Sergei Poljanski
bc8cc75a19
Open the ports of the XMPP server and Xray, which move to asxpio-services, and close 25566 with Minecraft Fossils gone. Turn off Hetzner's server backups on both hosts: restic now backs up the data to object storage in two regions, and the server backups cost 20% of each server's price. Disabling them deletes the existing backup images, so apply that part only after restic has a verified snapshot. Assisted-by: Claude:opus-5-5
95 lines
2.4 KiB
HCL
95 lines
2.4 KiB
HCL
# Ops Server (2 vCPU, 4GB RAM)
|
|
resource "hcloud_server" "ops" {
|
|
name = "asxpio-ops"
|
|
image = "debian-13"
|
|
location = "hel1"
|
|
server_type = "cx23"
|
|
|
|
ssh_keys = [
|
|
hcloud_ssh_key.asxpi.id,
|
|
hcloud_ssh_key.deploy.id
|
|
]
|
|
|
|
# Off: restic backs up both hosts to object storage (ansible role
|
|
# restic_backup) for less than the 20% of the server price this costs
|
|
backups = false
|
|
delete_protection = true
|
|
rebuild_protection = true
|
|
|
|
public_net {
|
|
ipv4_enabled = true
|
|
ipv6_enabled = true
|
|
}
|
|
|
|
network {
|
|
network_id = hcloud_network.main.id
|
|
ip = "10.10.0.10"
|
|
}
|
|
|
|
firewall_ids = [hcloud_firewall.ops_fw.id]
|
|
|
|
labels = {
|
|
role = "ops"
|
|
env = "production"
|
|
managed_by = "terraform"
|
|
project = "asxpio"
|
|
}
|
|
|
|
# Cloud-init for automated server setup
|
|
user_data = file("${path.module}/cloud-init/ops.yaml")
|
|
# cloud-init only runs at first boot, and hcloud replaces the server
|
|
# when user_data, image or ssh_keys change. Never let an edit to those
|
|
# destroy a running machine: changes there apply to a rebuild only.
|
|
lifecycle {
|
|
ignore_changes = [user_data, image, ssh_keys]
|
|
prevent_destroy = true
|
|
}
|
|
}
|
|
|
|
# Services Server - CX43 (8 vCPU, 16GB RAM)
|
|
resource "hcloud_server" "services" {
|
|
name = "asxpio-services"
|
|
image = "debian-13"
|
|
location = "hel1"
|
|
server_type = "cx43"
|
|
|
|
ssh_keys = [
|
|
hcloud_ssh_key.asxpi.id,
|
|
hcloud_ssh_key.deploy.id
|
|
]
|
|
|
|
# Off: restic backs up both hosts to object storage (ansible role
|
|
# restic_backup) for less than the 20% of the server price this costs
|
|
backups = false
|
|
delete_protection = true
|
|
rebuild_protection = true
|
|
|
|
public_net {
|
|
ipv4_enabled = true
|
|
ipv6_enabled = true
|
|
}
|
|
|
|
network {
|
|
network_id = hcloud_network.main.id
|
|
ip = "10.10.0.20"
|
|
}
|
|
|
|
firewall_ids = [hcloud_firewall.services_fw.id]
|
|
|
|
labels = {
|
|
role = "services"
|
|
env = "production"
|
|
managed_by = "terraform"
|
|
project = "asxpio"
|
|
}
|
|
|
|
# Cloud-init for automated server setup
|
|
user_data = file("${path.module}/cloud-init/services.yaml")
|
|
# cloud-init only runs at first boot, and hcloud replaces the server
|
|
# when user_data, image or ssh_keys change. Never let an edit to those
|
|
# destroy a running machine: changes there apply to a rebuild only.
|
|
lifecycle {
|
|
ignore_changes = [user_data, image, ssh_keys]
|
|
prevent_destroy = true
|
|
}
|
|
}
|