feat: add Docker/OpenTofu deployment and DE/NL routing

2026-07-24 23:10:17 +02:00
parent 57f7b4dedb
commit 12eee8d211
59 changed files with 4452 additions and 148 deletions
@@ -0,0 +1,108 @@
+locals {
+  common_labels = {
+    application = "watermaps"
+    managed_by  = "opentofu"
+  }
+}
+
+resource "hcloud_ssh_key" "deploy" {
+  name       = "${var.server_name}-deploy"
+  public_key = trimspace(var.ssh_public_key)
+  labels     = local.common_labels
+}
+
+resource "hcloud_primary_ip" "main" {
+  name              = "${var.server_name}-ipv4"
+  location          = var.location
+  type              = "ipv4"
+  auto_delete       = false
+  delete_protection = var.enable_resource_protection
+  labels            = local.common_labels
+}
+
+resource "hcloud_firewall" "main" {
+  name   = "${var.server_name}-firewall"
+  labels = local.common_labels
+
+  rule {
+    description = "SSH from configured administrator networks"
+    direction   = "in"
+    protocol    = "tcp"
+    port        = "22"
+    source_ips  = var.admin_cidrs
+  }
+
+  rule {
+    description = "HTTP for ACME challenge and HTTPS redirect"
+    direction   = "in"
+    protocol    = "tcp"
+    port        = "80"
+    source_ips = [
+      "0.0.0.0/0",
+      "::/0",
+    ]
+  }
+
+  rule {
+    description = "HTTPS"
+    direction   = "in"
+    protocol    = "tcp"
+    port        = "443"
+    source_ips = [
+      "0.0.0.0/0",
+      "::/0",
+    ]
+  }
+
+  rule {
+    description = "ICMP diagnostics"
+    direction   = "in"
+    protocol    = "icmp"
+    source_ips = [
+      "0.0.0.0/0",
+      "::/0",
+    ]
+  }
+}
+
+resource "hcloud_server" "main" {
+  name        = var.server_name
+  image       = "ubuntu-24.04"
+  server_type = var.server_type
+  location    = var.location
+
+  ssh_keys     = [hcloud_ssh_key.deploy.id]
+  firewall_ids = [hcloud_firewall.main.id]
+
+  user_data = templatefile("${path.module}/cloud-init.yaml.tftpl", {
+    deploy_user    = var.deploy_user
+    ssh_public_key = jsonencode(trimspace(var.ssh_public_key))
+  })
+
+  public_net {
+    ipv4_enabled = true
+    ipv4         = hcloud_primary_ip.main.id
+    ipv6_enabled = false
+  }
+
+  delete_protection        = var.enable_resource_protection
+  rebuild_protection       = var.enable_resource_protection
+  shutdown_before_deletion = true
+
+  labels = local.common_labels
+}
+
+resource "hcloud_volume" "routing_data" {
+  name              = "${var.server_name}-routing-data"
+  location          = var.location
+  size              = var.routing_volume_size_gb
+  format            = "ext4"
+  delete_protection = var.enable_resource_protection
+  labels            = local.common_labels
+}
+
+resource "hcloud_volume_attachment" "routing_data" {
+  volume_id = hcloud_volume.routing_data.id
+  server_id = hcloud_server.main.id
+  automount = false
+}