asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

terraform: XMPP and Xray ports on services, no Hetzner backups

Browse source 
Open the ports of the XMPP server and Xray, which move to
asxpio-services, and close 25566 with Minecraft Fossils gone.

Turn off Hetzner's server backups on both hosts: restic now backs up
the data to object storage in two regions, and the server backups cost
20% of each server's price. Disabling them deletes the existing backup
images, so apply that part only after restic has a verified snapshot.

Assisted-by: Claude:opus-5-5
This commit is contained in:
Sergei Poljanski 2026-11-12 20:57:52 +04:00
commit bc8cc75a19
2 changed files with 17 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
terraform/firewall.tf
View file

@ -13,8 +13,18 @@ locals {
] ]
services_public = [ services_public = [
{ protocol = "tcp", port = "25565-25566" }, # Minecraft (Paper, Fossils) { protocol = "tcp", port = "25565" }, # Minecraft (Paper)
{ protocol = "udp", port = "19132" }, # Minecraft Bedrock (Geyser) { protocol = "udp", port = "19132" }, # Minecraft Bedrock (Geyser)
{ protocol = "tcp", port = "443" }, # Xray VLESS Reality
{ protocol = "tcp", port = "5222-5223" }, # XMPP clients (STARTTLS, TLS)
{ protocol = "tcp", port = "5269" }, # XMPP servers
{ protocol = "tcp", port = "5443" }, # XMPP WebSocket, host-meta
{ protocol = "tcp", port = "7777" }, # XMPP file transfer proxy
{ protocol = "tcp", port = "8448" }, # Matrix federation (ejabberd)
{ protocol = "tcp", port = "3478" }, # STUN/TURN
{ protocol = "udp", port = "3478" }, # STUN/TURN
{ protocol = "udp", port = "49160-49199" }, # TURN relay
{ protocol = "udp", port = "50000-50099" }, # Telegram gateway calls
] ]
} }

8
terraform/servers.tf
View file

@ -10,7 +10,9 @@ resource "hcloud_server" "ops" {
hcloud_ssh_key.deploy.id hcloud_ssh_key.deploy.id
] ]
backups = true # Off: restic backs up both hosts to object storage (ansible role
# restic_backup) for less than the 20% of the server price this costs
backups = false
delete_protection = true delete_protection = true
rebuild_protection = true rebuild_protection = true
@ -56,7 +58,9 @@ resource "hcloud_server" "services" {
hcloud_ssh_key.deploy.id hcloud_ssh_key.deploy.id
] ]
backups = true # Off: restic backs up both hosts to object storage (ansible role
# restic_backup) for less than the 20% of the server price this costs
backups = false
delete_protection = true delete_protection = true
rebuild_protection = true rebuild_protection = true