From bc8cc75a192acbff270c07fad3b28fa2f9f80b6f Mon Sep 17 00:00:00 2001 From: Sergei Poljanski Date: Thu, 12 Nov 2026 20:57:52 +0400 Subject: [PATCH] terraform: XMPP and Xray ports on services, no Hetzner backups Open the ports of the XMPP server and Xray, which move to asxpio-services, and close 25566 with Minecraft Fossils gone. Turn off Hetzner's server backups on both hosts: restic now backs up the data to object storage in two regions, and the server backups cost 20% of each server's price. Disabling them deletes the existing backup images, so apply that part only after restic has a verified snapshot. Assisted-by: Claude:opus-5-5 --- terraform/firewall.tf | 12 +++++++++++- terraform/servers.tf | 8 ++++++-- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/terraform/firewall.tf b/terraform/firewall.tf index 8f87f8b..58c1718 100644 --- a/terraform/firewall.tf +++ b/terraform/firewall.tf @@ -13,8 +13,18 @@ locals { ] services_public = [ - { protocol = "tcp", port = "25565-25566" }, # Minecraft (Paper, Fossils) + { protocol = "tcp", port = "25565" }, # Minecraft (Paper) { protocol = "udp", port = "19132" }, # Minecraft Bedrock (Geyser) + { protocol = "tcp", port = "443" }, # Xray VLESS Reality + { protocol = "tcp", port = "5222-5223" }, # XMPP clients (STARTTLS, TLS) + { protocol = "tcp", port = "5269" }, # XMPP servers + { protocol = "tcp", port = "5443" }, # XMPP WebSocket, host-meta + { protocol = "tcp", port = "7777" }, # XMPP file transfer proxy + { protocol = "tcp", port = "8448" }, # Matrix federation (ejabberd) + { protocol = "tcp", port = "3478" }, # STUN/TURN + { protocol = "udp", port = "3478" }, # STUN/TURN + { protocol = "udp", port = "49160-49199" }, # TURN relay + { protocol = "udp", port = "50000-50099" }, # Telegram gateway calls ] } diff --git a/terraform/servers.tf b/terraform/servers.tf index 286d320..f908ac7 100644 --- a/terraform/servers.tf +++ b/terraform/servers.tf @@ -10,7 +10,9 @@ resource "hcloud_server" "ops" { hcloud_ssh_key.deploy.id ] - backups = true + # Off: restic backs up both hosts to object storage (ansible role + # restic_backup) for less than the 20% of the server price this costs + backups = false delete_protection = true rebuild_protection = true @@ -56,7 +58,9 @@ resource "hcloud_server" "services" { hcloud_ssh_key.deploy.id ] - backups = true + # Off: restic backs up both hosts to object storage (ansible role + # restic_backup) for less than the 20% of the server price this costs + backups = false delete_protection = true rebuild_protection = true