Automate immutable production deployments

infra/opentofu/main.tf

@@ -16,8 +16,12 @@ resource "hcloud_primary_ip" "main" {
   location          = var.location
   type              = "ipv4"
   auto_delete       = false
-  delete_protection = var.enable_resource_protection
+  delete_protection = var.enable_primary_ip_protection
   labels            = local.common_labels
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 resource "hcloud_firewall" "main" {
@@ -75,8 +79,10 @@ resource "hcloud_server" "main" {
   firewall_ids = [hcloud_firewall.main.id]
 
   user_data = templatefile("${path.module}/cloud-init.yaml.tftpl", {
-    deploy_user    = var.deploy_user
-    ssh_public_key = jsonencode(trimspace(var.ssh_public_key))
+    deploy_user                     = var.deploy_user
+    ssh_public_key                  = jsonencode(trimspace(var.ssh_public_key))
+    routing_volume_id               = hcloud_volume.routing_data.id
+    initialize_empty_routing_volume = var.initialize_empty_routing_volume
   })
 
   public_net {
@@ -85,8 +91,8 @@ resource "hcloud_server" "main" {
     ipv6_enabled = false
   }
 
-  delete_protection        = var.enable_resource_protection
-  rebuild_protection       = var.enable_resource_protection
+  delete_protection        = var.enable_server_protection
+  rebuild_protection       = var.enable_server_protection
   shutdown_before_deletion = true
 
   labels = local.common_labels
@@ -96,9 +102,12 @@ resource "hcloud_volume" "routing_data" {
   name              = "${var.server_name}-routing-data"
   location          = var.location
   size              = var.routing_volume_size_gb
-  format            = "ext4"
-  delete_protection = var.enable_resource_protection
+  delete_protection = var.enable_volume_protection
   labels            = local.common_labels
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 resource "hcloud_volume_attachment" "routing_data" {