Sergei Poljanski
dc0f732d0f
Checked against the Hetzner project: - Both servers have daily backups and delete and rebuild protection switched on, while the code said backups = false and set no protection. An apply would have turned all three off and discarded the existing backups. Record them as they are. - The firewalls had drifted both ways. Live, asxpio-ops also accepts XMPP ports and tcp/5000, and asxpio-services accepts 80, 443, XMPP, TURN, Valheim and Factorio ports; none of those services run. The code in turn missed tcp/25566, where the second Minecraft server listens. Describe the firewalls as they should be: internal networks, plus the public ports of services that run. Public SSH to asxpio-services goes too; sshd and iptables already refuse it from outside the VPN. This is not applied. The next plan will show the stale ports being closed and nothing else. Assisted-by: Claude:fable-5-2
91 lines
2.1 KiB
HCL
91 lines
2.1 KiB
HCL
# Ops Server (2 vCPU, 4GB RAM)
|
|
resource "hcloud_server" "ops" {
|
|
name = "asxpio-ops"
|
|
image = "debian-13"
|
|
location = "hel1"
|
|
server_type = "cx23"
|
|
|
|
ssh_keys = [
|
|
hcloud_ssh_key.asxpi.id,
|
|
hcloud_ssh_key.deploy.id
|
|
]
|
|
|
|
backups = true
|
|
delete_protection = true
|
|
rebuild_protection = true
|
|
|
|
public_net {
|
|
ipv4_enabled = true
|
|
ipv6_enabled = true
|
|
}
|
|
|
|
network {
|
|
network_id = hcloud_network.main.id
|
|
ip = "10.10.0.10"
|
|
}
|
|
|
|
firewall_ids = [hcloud_firewall.ops_fw.id]
|
|
|
|
labels = {
|
|
role = "ops"
|
|
env = "production"
|
|
managed_by = "terraform"
|
|
project = "asxpio"
|
|
}
|
|
|
|
# Cloud-init for automated server setup
|
|
user_data = file("${path.module}/cloud-init/ops.yaml")
|
|
# cloud-init only runs at first boot, and hcloud replaces the server
|
|
# when user_data, image or ssh_keys change. Never let an edit to those
|
|
# destroy a running machine: changes there apply to a rebuild only.
|
|
lifecycle {
|
|
ignore_changes = [user_data, image, ssh_keys]
|
|
prevent_destroy = true
|
|
}
|
|
}
|
|
|
|
# Services Server - CX43 (8 vCPU, 16GB RAM)
|
|
resource "hcloud_server" "services" {
|
|
name = "asxpio-services"
|
|
image = "debian-13"
|
|
location = "hel1"
|
|
server_type = "cx43"
|
|
|
|
ssh_keys = [
|
|
hcloud_ssh_key.asxpi.id,
|
|
hcloud_ssh_key.deploy.id
|
|
]
|
|
|
|
backups = true
|
|
delete_protection = true
|
|
rebuild_protection = true
|
|
|
|
public_net {
|
|
ipv4_enabled = true
|
|
ipv6_enabled = true
|
|
}
|
|
|
|
network {
|
|
network_id = hcloud_network.main.id
|
|
ip = "10.10.0.20"
|
|
}
|
|
|
|
firewall_ids = [hcloud_firewall.services_fw.id]
|
|
|
|
labels = {
|
|
role = "services"
|
|
env = "production"
|
|
managed_by = "terraform"
|
|
project = "asxpio"
|
|
}
|
|
|
|
# Cloud-init for automated server setup
|
|
user_data = file("${path.module}/cloud-init/services.yaml")
|
|
# cloud-init only runs at first boot, and hcloud replaces the server
|
|
# when user_data, image or ssh_keys change. Never let an edit to those
|
|
# destroy a running machine: changes there apply to a rebuild only.
|
|
lifecycle {
|
|
ignore_changes = [user_data, image, ssh_keys]
|
|
prevent_destroy = true
|
|
}
|
|
}
|