With provider 1.54 the plan replaces both servers. Hetzner stopped
returning a server's datacenter, the old provider derived the location
from it, and a location that reads back empty differs from "hel1",
which forces replacement. Only prevent_destroy stood in the way.
Provider 1.70.2 reads the location properly: the same plan then shows
the two firewall updates and nothing else. The lock file is not
tracked, so raise the version constraint to keep the old provider out.
Run terraform init -upgrade once in existing checkouts.
Assisted-by: Claude:fable-5-2
Checked against the Hetzner project:
- Both servers have daily backups and delete and rebuild protection
switched on, while the code said backups = false and set no
protection. An apply would have turned all three off and discarded
the existing backups. Record them as they are.
- The firewalls had drifted both ways. Live, asxpio-ops also accepts
XMPP ports and tcp/5000, and asxpio-services accepts 80, 443, XMPP,
TURN, Valheim and Factorio ports; none of those services run. The
code in turn missed tcp/25566, where the second Minecraft server
listens.
Describe the firewalls as they should be: internal networks, plus the
public ports of services that run. Public SSH to asxpio-services goes
too; sshd and iptables already refuse it from outside the VPN.
This is not applied. The next plan will show the stale ports being
closed and nothing else.
Assisted-by: Claude:fable-5-2
hcloud replaces a server when user_data, image or ssh_keys change, and
cloud-init only runs at first boot anyway. An edit to cloud-init, like
adding a user, would therefore plan the destruction of a production
machine. Ignore changes to those three attributes and set
prevent_destroy on both servers, so cloud-init describes a rebuild and
nothing else.
Add user zerrtika to cloud-init to match the servers; the user was
created on them by playbook 04.
Assisted-by: Claude:fable-5-2
