# Ops Server (2 vCPU, 4GB RAM)
resource "hcloud_server" "ops" {
  name        = "asxpio-ops"
  image       = "debian-13"
  location    = "hel1"
  server_type = "cx23"

  ssh_keys = [
    hcloud_ssh_key.asxpi.id,
    hcloud_ssh_key.deploy.id
  ]

  # Off: restic backs up both hosts to object storage (ansible role
  # restic_backup) for less than the 20% of the server price this costs
  backups            = false
  delete_protection  = true
  rebuild_protection = true

  public_net {
    ipv4_enabled = true
    ipv6_enabled = true
  }

  network {
    network_id = hcloud_network.main.id
    ip         = "10.10.0.10"
  }

  firewall_ids = [hcloud_firewall.ops_fw.id]

  labels = {
    role        = "ops"
    env         = "production"
    managed_by  = "terraform"
    project     = "asxpio"
  }

  # Cloud-init for automated server setup
  user_data = file("${path.module}/cloud-init/ops.yaml")
  # cloud-init only runs at first boot, and hcloud replaces the server
  # when user_data, image or ssh_keys change. Never let an edit to those
  # destroy a running machine: changes there apply to a rebuild only.
  lifecycle {
    ignore_changes  = [user_data, image, ssh_keys]
    prevent_destroy = true
  }
}

# Services Server - CX43 (8 vCPU, 16GB RAM)
resource "hcloud_server" "services" {
  name        = "asxpio-services"
  image       = "debian-13"
  location    = "hel1"
  server_type = "cx43"

  ssh_keys = [
    hcloud_ssh_key.asxpi.id,
    hcloud_ssh_key.deploy.id
  ]

  # Off: restic backs up both hosts to object storage (ansible role
  # restic_backup) for less than the 20% of the server price this costs
  backups            = false
  delete_protection  = true
  rebuild_protection = true

  public_net {
    ipv4_enabled = true
    ipv6_enabled = true
  }

  network {
    network_id = hcloud_network.main.id
    ip         = "10.10.0.20"
  }

  firewall_ids = [hcloud_firewall.services_fw.id]

  labels = {
    role        = "services"
    env         = "production"
    managed_by  = "terraform"
    project     = "asxpio"
  }

  # Cloud-init for automated server setup
  user_data = file("${path.module}/cloud-init/services.yaml")
  # cloud-init only runs at first boot, and hcloud replaces the server
  # when user_data, image or ssh_keys change. Never let an edit to those
  # destroy a running machine: changes there apply to a rebuild only.
  lifecycle {
    ignore_changes  = [user_data, image, ssh_keys]
    prevent_destroy = true
  }
}