Sergei Poljanski
dc0f732d0f
Checked against the Hetzner project: - Both servers have daily backups and delete and rebuild protection switched on, while the code said backups = false and set no protection. An apply would have turned all three off and discarded the existing backups. Record them as they are. - The firewalls had drifted both ways. Live, asxpio-ops also accepts XMPP ports and tcp/5000, and asxpio-services accepts 80, 443, XMPP, TURN, Valheim and Factorio ports; none of those services run. The code in turn missed tcp/25566, where the second Minecraft server listens. Describe the firewalls as they should be: internal networks, plus the public ports of services that run. Public SSH to asxpio-services goes too; sshd and iptables already refuse it from outside the VPN. This is not applied. The next plan will show the stale ports being closed and nothing else. Assisted-by: Claude:fable-5-2
141 lines
3.1 KiB
Markdown
141 lines
3.1 KiB
Markdown
# ASXP.IO Infrastructure
|
|
|
|
Hetzner Cloud infrastructure managed via Terraform.
|
|
|
|
## Servers
|
|
|
|
- **asxpio-ops** (CX23: 2 vCPU, 4GB) - Traefik, Forgejo, app stacks
|
|
- **asxpio-services** (CX43: 8 vCPU, 16GB) - CI runner, game servers, SillyTavern
|
|
|
|
Both have Hetzner daily backups plus delete and rebuild protection.
|
|
|
|
Both servers carry `prevent_destroy` and ignore changes to `user_data`,
|
|
`image` and `ssh_keys`: cloud-init only runs at first boot, and hcloud
|
|
would otherwise replace a running server when those change. Edits to
|
|
`cloud-init/*.yaml` therefore describe a rebuild, not the live machine;
|
|
day-to-day configuration is in `../ansible`.
|
|
|
|
## Storage (S3-compatible)
|
|
|
|
**Terraform State:**
|
|
- asxpio-terraform-main (hel1)
|
|
- asxpio-terraform-repl (fsn1)
|
|
|
|
**Backups:**
|
|
- asxpio-backups-main (hel1)
|
|
- asxpio-backups-repl (fsn1)
|
|
|
|
**Immich (buckets kept, service not running):**
|
|
- asxpio-immich-main (hel1)
|
|
- asxpio-immich-repl (fsn1)
|
|
|
|
## Network
|
|
|
|
- VPC: 10.10.0.0/20
|
|
- WireGuard VPN: 10.20.0.0/24
|
|
- IPv4 + IPv6 enabled
|
|
|
|
## Cost
|
|
|
|
| Item | Monthly |
|
|
|------|---------|
|
|
| ops CX23 | €3.71 |
|
|
| services CX43 | €11.15 |
|
|
| IPv4 (2x) | €1.24 |
|
|
| S3 (1TB) | €6.19 |
|
|
| S3 1TB Traffic | €1.24 |
|
|
| **Total** | **€22.29** |
|
|
|
|
## Setup
|
|
|
|
### 1. Initialize
|
|
```bash
|
|
terraform init
|
|
```
|
|
|
|
### 2. Configure secrets
|
|
Edit `terraform.tfvars`:
|
|
```hcl
|
|
hcloud_token = "your-token"
|
|
s3_access_key = "your-key"
|
|
s3_secret_key = "your-secret"
|
|
s3_endpoint_hel1 = "hel1.your-objectstorage.com"
|
|
s3_endpoint_fsn1 = "fsn1.your-objectstorage.com"
|
|
```
|
|
|
|
### 3. Deploy
|
|
```bash
|
|
terraform plan
|
|
terraform apply
|
|
```
|
|
|
|
### 4. Enable S3 backend (optional)
|
|
After buckets are created:
|
|
|
|
```bash
|
|
# Set credentials
|
|
export AWS_ACCESS_KEY_ID="your-key"
|
|
export AWS_SECRET_ACCESS_KEY="your-secret"
|
|
|
|
# Or use ~/.aws/credentials file
|
|
mkdir -p ~/.aws
|
|
cat > ~/.aws/credentials <<EOF
|
|
[default]
|
|
aws_access_key_id = your-key
|
|
aws_secret_access_key = your-secret
|
|
EOF
|
|
|
|
# Uncomment backend in providers.tf
|
|
# Then migrate state
|
|
terraform init -migrate-state
|
|
```
|
|
|
|
## DNS Management
|
|
|
|
**Current:** Managed manually via `hcloud` CLI
|
|
|
|
Zones: asxp.io (61604), czsk.it (61606), childfr.ee (61605)
|
|
|
|
**TODO:** Migrate to Terraform-managed DNS when provider v1.54.0+ is available:
|
|
```hcl
|
|
# Upgrade provider in providers.tf
|
|
hcloud = {
|
|
source = "hetznercloud/hcloud"
|
|
version = "~> 1.54"
|
|
}
|
|
|
|
# Import existing zones
|
|
terraform import hcloud_zone.asxp_io 61604
|
|
terraform import hcloud_zone.czsk_it 61606
|
|
terraform import hcloud_zone.childfr_ee 61605
|
|
|
|
# Example DNS resource
|
|
resource "hcloud_zone" "asxp_io" {
|
|
name = "asxp.io"
|
|
mode = "primary"
|
|
labels = {
|
|
managed_by = "terraform"
|
|
}
|
|
}
|
|
|
|
resource "hcloud_zone_rrset" "apex_a" {
|
|
zone = hcloud_zone.asxp_io.name
|
|
name = "@"
|
|
type = "A"
|
|
records = [
|
|
{ value = "95.217.19.240", comment = "ops-server" },
|
|
]
|
|
}
|
|
```
|
|
|
|
See: https://github.com/hetznercloud/terraform-provider-hcloud/releases/tag/v1.54.0
|
|
|
|
## Files
|
|
|
|
- `servers.tf` - Server definitions + cloud-init
|
|
- `s3.tf` - S3 buckets (6 total)
|
|
- `vpc.tf` - Private network
|
|
- `firewall.tf` - Security rules
|
|
- `dns.tf` - DNS docs (manual management)
|
|
- `keys.tf` - SSH keys
|
|
- `cloud-init/*.yaml` - Server provisioning
|