asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

terraform: match the servers; open only ports in use

Browse source 
Checked against the Hetzner project:

 - Both servers have daily backups and delete and rebuild protection
   switched on, while the code said backups = false and set no
   protection. An apply would have turned all three off and discarded
   the existing backups. Record them as they are.

 - The firewalls had drifted both ways. Live, asxpio-ops also accepts
   XMPP ports and tcp/5000, and asxpio-services accepts 80, 443, XMPP,
   TURN, Valheim and Factorio ports; none of those services run. The
   code in turn missed tcp/25566, where the second Minecraft server
   listens.

Describe the firewalls as they should be: internal networks, plus the
public ports of services that run. Public SSH to asxpio-services goes
too; sshd and iptables already refuse it from outside the VPN.

This is not applied. The next plan will show the stale ports being
closed and nothing else.

Assisted-by: Claude:fable-5-2
This commit is contained in:
Sergei Poljanski 2026-11-12 15:52:29 +04:00
commit dc0f732d0f
3 changed files with 68 additions and 261 deletions
Download patch file Download diff file Expand all files Collapse all files

6
terraform/README.md
View file

@ -4,9 +4,11 @@ Hetzner Cloud infrastructure managed via Terraform.
## Servers
- **asxpio-ops** (2 vCPU, 4GB) - Traefik, Forgejo, app stacks
- **asxpio-ops** (CX23: 2 vCPU, 4GB) - Traefik, Forgejo, app stacks
- **asxpio-services** (CX43: 8 vCPU, 16GB) - CI runner, game servers, SillyTavern
Both have Hetzner daily backups plus delete and rebuild protection.
Both servers carry `prevent_destroy` and ignore changes to `user_data`,
`image` and `ssh_keys`: cloud-init only runs at first boot, and hcloud
would otherwise replace a running server when those change. Edits to
@ -37,7 +39,7 @@ day-to-day configuration is in `../ansible`.
| Item | Monthly |
|------|---------|
| ops | €3.71 |
| ops CX23 | €3.71 |
| services CX43 | €11.15 |
| IPv4 (2x) | €1.24 |
| S3 (1TB) | €6.19 |