The cost table was a year old. Use the amounts billed now.
Both servers still cost less than the list price for their type
(3.99 against 5.49, 11.99 against 15.99). That price belongs to the
existing server, so say plainly that a reinstall has to happen in
place.
Assisted-by: Claude:fable-5-2
Checked against the Hetzner project:
- Both servers have daily backups and delete and rebuild protection
switched on, while the code said backups = false and set no
protection. An apply would have turned all three off and discarded
the existing backups. Record them as they are.
- The firewalls had drifted both ways. Live, asxpio-ops also accepts
XMPP ports and tcp/5000, and asxpio-services accepts 80, 443, XMPP,
TURN, Valheim and Factorio ports; none of those services run. The
code in turn missed tcp/25566, where the second Minecraft server
listens.
Describe the firewalls as they should be: internal networks, plus the
public ports of services that run. Public SSH to asxpio-services goes
too; sshd and iptables already refuse it from outside the VPN.
This is not applied. The next plan will show the stale ports being
closed and nothing else.
Assisted-by: Claude:fable-5-2
hcloud replaces a server when user_data, image or ssh_keys change, and
cloud-init only runs at first boot anyway. An edit to cloud-init, like
adding a user, would therefore plan the destruction of a production
machine. Ignore changes to those three attributes and set
prevent_destroy on both servers, so cloud-init describes a rebuild and
nothing else.
Add user zerrtika to cloud-init to match the servers; the user was
created on them by playbook 04.
Assisted-by: Claude:fable-5-2
