96 lines
2.1 KiB
Terraform
96 lines
2.1 KiB
Terraform
resource "hcloud_ssh_key" "admin" {
|
|
name = "${var.server_name}-admin"
|
|
public_key = var.ssh_public_key
|
|
}
|
|
|
|
resource "hcloud_firewall" "watchtower" {
|
|
name = "${var.server_name}-fw"
|
|
|
|
# SSH
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "22"
|
|
source_ips = concat(var.admin_allow_ipv4, var.admin_allow_ipv6)
|
|
}
|
|
|
|
# WireGuard
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "51820"
|
|
source_ips = concat(var.admin_allow_ipv4, var.admin_allow_ipv6)
|
|
}
|
|
|
|
# ICMP (ping) — useful for ops, optional
|
|
rule {
|
|
direction = "in"
|
|
protocol = "icmp"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
}
|
|
|
|
resource "hcloud_primary_ip" "ipv4" {
|
|
name = "${var.server_name}-ipv4"
|
|
type = "ipv4"
|
|
location = var.location
|
|
auto_delete = false
|
|
}
|
|
|
|
resource "hcloud_primary_ip" "ipv6" {
|
|
name = "${var.server_name}-ipv6"
|
|
type = "ipv6"
|
|
location = var.location
|
|
auto_delete = false
|
|
}
|
|
|
|
resource "hcloud_volume" "observability" {
|
|
name = "${var.server_name}-observability"
|
|
size = var.observability_volume_size_gb
|
|
location = var.location
|
|
|
|
labels = {
|
|
role = "observability-data"
|
|
managed_by = "opentofu"
|
|
environment = "prod"
|
|
}
|
|
|
|
lifecycle {
|
|
prevent_destroy = true
|
|
}
|
|
}
|
|
|
|
resource "hcloud_volume_attachment" "observability" {
|
|
volume_id = hcloud_volume.observability.id
|
|
server_id = hcloud_server.watchtower.id
|
|
automount = false
|
|
}
|
|
|
|
resource "hcloud_server" "watchtower" {
|
|
name = var.server_name
|
|
server_type = var.server_type
|
|
image = var.server_image
|
|
location = var.location
|
|
ssh_keys = [hcloud_ssh_key.admin.id]
|
|
firewall_ids = [hcloud_firewall.watchtower.id]
|
|
|
|
public_net {
|
|
ipv4_enabled = true
|
|
ipv4 = hcloud_primary_ip.ipv4.id
|
|
ipv6_enabled = true
|
|
ipv6 = hcloud_primary_ip.ipv6.id
|
|
}
|
|
|
|
user_data = file("${path.module}/cloud-init.yaml")
|
|
|
|
labels = {
|
|
role = "observability"
|
|
managed_by = "opentofu"
|
|
environment = "prod"
|
|
}
|
|
|
|
lifecycle {
|
|
ignore_changes = [user_data, ssh_keys]
|
|
}
|
|
}
|