mirror of
https://github.com/acaloiaro/sfos
synced 2026-07-21 10:12:24 +00:00
126 lines
3.3 KiB
HCL
126 lines
3.3 KiB
HCL
terraform {
|
|
required_providers {
|
|
hcloud = {
|
|
source = "hetznercloud/hcloud"
|
|
version = "1.49.1"
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
provider "hcloud" {
|
|
token = var.compute_provider_access_token
|
|
}
|
|
|
|
resource "hcloud_ssh_key" "admin" {
|
|
name = "sfos admin user"
|
|
public_key = var.admin_ssh_public_key
|
|
}
|
|
|
|
#####################################################################################################################
|
|
# Instances
|
|
#####################################################################################################################
|
|
|
|
locals {
|
|
# These are the private IP addresses that are assigned to each node
|
|
# We start at the buttom of the cidr block + 2 because 0 is not routable and 1 is reserved; hence "i + 2" below
|
|
node_private_ips = {
|
|
value = [for i in range(var.node_count) : "${cidrhost(var.internal_cidr_block, i + 2)}"]
|
|
}
|
|
}
|
|
|
|
resource "hcloud_server" "nodes" {
|
|
count = var.node_count
|
|
name = "sfos-${count.index}"
|
|
image = "ubuntu-22.04" # This is the _initial_ OS installed on the nodes. NixOS is installed over this later
|
|
server_type = var.compute_provider_node_type
|
|
location = var.compute_provider_location
|
|
ssh_keys = [hcloud_ssh_key.admin.id]
|
|
labels = {
|
|
"sfos" : true
|
|
}
|
|
user_data = data.template_file.cloud_config.rendered
|
|
firewall_ids = [hcloud_firewall.allow_ssh.id]
|
|
}
|
|
|
|
|
|
data "template_file" "cloud_config" {
|
|
template = file("config/cloud-config.tpl")
|
|
vars = {
|
|
tailscale_auth_key = var.tailscale_auth_key
|
|
admin_ssh_public_key = var.admin_ssh_public_key
|
|
}
|
|
}
|
|
|
|
#####################################################################################################################
|
|
# Network
|
|
#####################################################################################################################
|
|
|
|
# This network is used solely for load balancing support, since HZ load balancers need to operate on a private subnet
|
|
resource "hcloud_network" "sfos_private" {
|
|
name = "cluster-private"
|
|
ip_range = var.internal_cidr_block
|
|
}
|
|
|
|
resource "hcloud_network_subnet" "private_subnet" {
|
|
network_id = hcloud_network.sfos_private.id
|
|
type = "cloud"
|
|
network_zone = var.compute_provider_region
|
|
ip_range = var.internal_cidr_block
|
|
}
|
|
|
|
resource "hcloud_firewall" "allow_ssh" {
|
|
name = "incus allow ssh/incus admin"
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "22"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "80"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "443"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "8443"
|
|
source_ips = [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
}
|
|
|
|
#####################################################################################################################
|
|
# Storage
|
|
#####################################################################################################################
|
|
|
|
# This volume is reserved for the general purpose storage for any application
|
|
resource "hcloud_volume" "gp-storage" {
|
|
name = "gp-storage"
|
|
size = 10
|
|
location = var.compute_provider_location
|
|
format = "xfs"
|
|
delete_protection = true
|
|
}
|
|
|
|
|