mirror of
https://github.com/2martens/cloud-configuration.git
synced 2026-10-17 16:46:51 +02:00
Added Hetzner resources
This commit is contained in:
Generated
+22
@@ -1,6 +1,28 @@
|
||||
# This file is maintained automatically by "terraform init".
|
||||
# Manual edits may be lost in future updates.
|
||||
|
||||
provider "registry.terraform.io/hetznercloud/hcloud" {
|
||||
version = "1.44.1"
|
||||
constraints = "1.44.1"
|
||||
hashes = [
|
||||
"h1:q2JvvbG+seeZ4A2ijxPi5Tis+NJVoB59cAt3KeQe0uA=",
|
||||
"zh:156df81d2c740608b9fb7f439defbb39b89585c55dc6e62e4af928808ff67f9e",
|
||||
"zh:32407f1df8b59afe5e35710c4acf2c8a8cbf5ea9a32126f34cb0c49ff142a047",
|
||||
"zh:456133e16e9ebfcd89534c968a8b2a3f931bf4acb76a8165acc2242b0b73ba78",
|
||||
"zh:6855c90399abc11e32fcdc0bf54bdedb50009c46183b926b3493fdcf48d5e39c",
|
||||
"zh:68fe1e7e9f692a29d75a3cc199b472e8bc00c9486b299bfaf816133797207804",
|
||||
"zh:6c62a9fe0a6de3cd4ea0591193baef00b65c838610feb369d14e36d15f9ea93e",
|
||||
"zh:6cb1db2287cc8baec8538d9df6a44f602f61580d8df4c484625295aa622f03d1",
|
||||
"zh:7fd577a8079da2f6e96066a8bf6bce6e36fdd36c67ac03044fd29f15eb718a6c",
|
||||
"zh:9f94d862b827c429bf6a3eea7a65b856475cdc6da7e0d8a8edfbc09de40bed3f",
|
||||
"zh:a6499d633a63668629a32628624137d2ef8e1ca5ef77766669470def7f4d5732",
|
||||
"zh:b46004de824350b1b9a44cc253608d25e7cdf77d628571ece2df2fe96aacb8d7",
|
||||
"zh:b9d8c401f8ddb829ee67bf429aac781bf5022605f4d18b041c417622746a37a1",
|
||||
"zh:cf182e8426d7bd555a46ea4c5d75ed431edb41aa162e57f07f13d235d0e74f0d",
|
||||
"zh:e1b777a95498489aa04231b7825cca445119f2b1988bfdcd8f0a35e0ba59d883",
|
||||
]
|
||||
}
|
||||
|
||||
provider "registry.terraform.io/inwx/inwx" {
|
||||
version = "1.3.2"
|
||||
constraints = "1.3.2"
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
output "ansible_inventory" {
|
||||
value = templatefile("${path.module}/inventory.tftpl", {
|
||||
devops = hcloud_server.server_devops, k8s_servers = [hcloud_server.server_k8s_test]
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
#cloud-config
|
||||
users:
|
||||
- name: 2martensAdmin
|
||||
groups: users, admin
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
shell: /bin/bash
|
||||
ssh_authorized_keys:
|
||||
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBjYkz73HbsFtRAOfS5QB9xDbOajU9C4gpDp+OjQkLir 2martens@Jims-Air.fritz.box"
|
||||
packages:
|
||||
- fail2ban
|
||||
- ufw
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
runcmd:
|
||||
- printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
|
||||
- systemctl enable fail2ban
|
||||
- ufw allow OpenSSH
|
||||
- ufw enable
|
||||
- sed -i -e '/^\(#\|\)PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
- sed -i -e '/^\(#\|\)PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
- sed -i -e '/^\(#\|\)X11Forwarding/s/^.*$/X11Forwarding no/' /etc/ssh/sshd_config
|
||||
- sed -i -e '/^\(#\|\)MaxAuthTries/s/^.*$/MaxAuthTries 2/' /etc/ssh/sshd_config
|
||||
- sed -i -e '/^\(#\|\)AllowTcpForwarding/s/^.*$/AllowTcpForwarding no/' /etc/ssh/sshd_config
|
||||
- sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
|
||||
- sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
|
||||
- sed -i '$a AllowUsers 2martensAdmin' /etc/ssh/sshd_config
|
||||
- reboot
|
||||
@@ -1,3 +1,217 @@
|
||||
// data sources
|
||||
|
||||
data "hcloud_location" "falkenstein" {
|
||||
name = "fsn1"
|
||||
}
|
||||
|
||||
data "hcloud_location" "nuremberg" {
|
||||
name = "nbg1"
|
||||
}
|
||||
|
||||
data "hcloud_datacenter" "falkenstein" {
|
||||
name = "fsn1-dc14"
|
||||
}
|
||||
|
||||
data "hcloud_datacenter" "nuremberg" {
|
||||
name = "nbg1-dc3"
|
||||
}
|
||||
|
||||
data "hcloud_ssh_key" "macos" {
|
||||
name = "2martens@Jims-Air.fritz.box"
|
||||
}
|
||||
|
||||
data "hcloud_placement_group" "default" {
|
||||
name = "default"
|
||||
}
|
||||
|
||||
// common resources
|
||||
|
||||
resource "hcloud_network" "kubernetes-network" {
|
||||
name = "kubernetes"
|
||||
ip_range = "10.0.0.0/8"
|
||||
}
|
||||
|
||||
resource "hcloud_network_subnet" "k8s-network-subnet" {
|
||||
type = "cloud"
|
||||
network_id = hcloud_network.kubernetes-network.id
|
||||
network_zone = "eu-central"
|
||||
ip_range = "10.0.0.0/16"
|
||||
}
|
||||
|
||||
resource "hcloud_network_route" "k8s-route" {
|
||||
network_id = hcloud_network.kubernetes-network.id
|
||||
destination = "10.1.0.0/16"
|
||||
gateway = "10.0.0.2"
|
||||
}
|
||||
|
||||
resource "hcloud_firewall" "basic-firewall" {
|
||||
name = "basic-firewall"
|
||||
rule {
|
||||
direction = "in"
|
||||
protocol = "tcp"
|
||||
port = "22"
|
||||
description = "allow SSH"
|
||||
source_ips = [
|
||||
"0.0.0.0/0",
|
||||
"::/0",
|
||||
]
|
||||
}
|
||||
|
||||
rule {
|
||||
direction = "in"
|
||||
protocol = "tcp"
|
||||
port = "80"
|
||||
description = "allow HTTP"
|
||||
source_ips = [
|
||||
"0.0.0.0/0",
|
||||
"::/0",
|
||||
]
|
||||
}
|
||||
|
||||
rule {
|
||||
direction = "in"
|
||||
protocol = "tcp"
|
||||
port = "443"
|
||||
description = "allow HTTPS"
|
||||
source_ips = [
|
||||
"0.0.0.0/0",
|
||||
"::/0",
|
||||
]
|
||||
}
|
||||
|
||||
rule {
|
||||
direction = "in"
|
||||
protocol = "icmp"
|
||||
description = "allow ICMP"
|
||||
source_ips = [
|
||||
"0.0.0.0/0",
|
||||
"::/0",
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "hcloud_firewall_attachment" "basic-firewall_attachment" {
|
||||
firewall_id = hcloud_firewall.basic-firewall.id
|
||||
server_ids = [hcloud_server.server_devops.id, hcloud_server.server_k8s_test.id]
|
||||
}
|
||||
|
||||
resource "hcloud_firewall" "k8s-firewall" {
|
||||
name = "k8s-firewall"
|
||||
rule {
|
||||
direction = "in"
|
||||
protocol = "tcp"
|
||||
port = "16443"
|
||||
description = "Access Kubernetes"
|
||||
source_ips = [
|
||||
"0.0.0.0/0",
|
||||
"::/0",
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "hcloud_firewall_attachment" "k8s-firewall_attachment" {
|
||||
firewall_id = hcloud_firewall.k8s-firewall.id
|
||||
server_ids = [hcloud_server.server_k8s_test.id]
|
||||
}
|
||||
|
||||
// servers
|
||||
resource "hcloud_primary_ip" "primary_ipv4_devops" {
|
||||
name = "primary_ipv4_devops"
|
||||
datacenter = data.hcloud_datacenter.falkenstein.name
|
||||
type = "ipv4"
|
||||
assignee_type = "server"
|
||||
auto_delete = false
|
||||
}
|
||||
|
||||
resource "hcloud_primary_ip" "primary_ipv6_devops" {
|
||||
name = "primary_ipv6_devops"
|
||||
datacenter = data.hcloud_datacenter.falkenstein.name
|
||||
type = "ipv6"
|
||||
assignee_type = "server"
|
||||
auto_delete = false
|
||||
}
|
||||
|
||||
resource "hcloud_server" "server_devops" {
|
||||
name = "devops"
|
||||
image = "ubuntu-22.04"
|
||||
allow_deprecated_images = false
|
||||
server_type = "cax21"
|
||||
location = data.hcloud_location.falkenstein.name
|
||||
public_net {
|
||||
ipv4_enabled = true
|
||||
ipv4 = hcloud_primary_ip.primary_ipv4_devops.id
|
||||
ipv6_enabled = true
|
||||
ipv6 = hcloud_primary_ip.primary_ipv6_devops.id
|
||||
}
|
||||
ignore_remote_firewall_ids = false
|
||||
keep_disk = false
|
||||
placement_group_id = data.hcloud_placement_group.default.id
|
||||
labels = {
|
||||
"apache" : "yes",
|
||||
"docker" : "yes",
|
||||
"drone" : "yes"
|
||||
}
|
||||
firewall_ids = [hcloud_firewall.basic-firewall.id]
|
||||
ssh_keys = [data.hcloud_ssh_key.macos.id]
|
||||
user_data = file("cloud-init.yaml")
|
||||
shutdown_before_deletion = true
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [ssh_keys, user_data]
|
||||
}
|
||||
}
|
||||
|
||||
resource "hcloud_primary_ip" "primary_ipv4_k8s_test" {
|
||||
name = "primary_ipv4_applications"
|
||||
datacenter = data.hcloud_datacenter.falkenstein.name
|
||||
type = "ipv4"
|
||||
assignee_type = "server"
|
||||
auto_delete = false
|
||||
}
|
||||
|
||||
resource "hcloud_primary_ip" "primary_ipv6_k8s_test" {
|
||||
name = "primary_ipv6_applications"
|
||||
datacenter = data.hcloud_datacenter.falkenstein.name
|
||||
type = "ipv6"
|
||||
assignee_type = "server"
|
||||
auto_delete = false
|
||||
}
|
||||
|
||||
resource "hcloud_server" "server_k8s_test" {
|
||||
name = "applications"
|
||||
image = "ubuntu-22.04"
|
||||
allow_deprecated_images = false
|
||||
server_type = "cax21"
|
||||
location = data.hcloud_location.falkenstein.name
|
||||
public_net {
|
||||
ipv4_enabled = true
|
||||
ipv4 = hcloud_primary_ip.primary_ipv4_devops.id
|
||||
ipv6_enabled = true
|
||||
ipv6 = hcloud_primary_ip.primary_ipv6_devops.id
|
||||
}
|
||||
ignore_remote_firewall_ids = false
|
||||
keep_disk = false
|
||||
placement_group_id = data.hcloud_placement_group.default.id
|
||||
labels = {
|
||||
"kubernetes" : "yes"
|
||||
}
|
||||
firewall_ids = [hcloud_firewall.basic-firewall.id, hcloud_firewall.k8s-firewall.id]
|
||||
ssh_keys = [data.hcloud_ssh_key.macos.id]
|
||||
user_data = file("cloud-init.yaml")
|
||||
shutdown_before_deletion = true
|
||||
|
||||
network {
|
||||
network_id = hcloud_network.kubernetes-network.id
|
||||
ip = "10.0.0.2"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [ssh_keys, user_data]
|
||||
}
|
||||
|
||||
depends_on = [hcloud_network_subnet.k8s-network-subnet]
|
||||
}
|
||||
|
||||
module "drone_domain" {
|
||||
source = "./modules/domain"
|
||||
domain = "2martens.de"
|
||||
|
||||
+24
-206
@@ -1,226 +1,44 @@
|
||||
import {
|
||||
to = inwx_domain.twomartens_de
|
||||
id = "2martens.de"
|
||||
to = hcloud_server.server_devops
|
||||
id = "35455513"
|
||||
}
|
||||
|
||||
import {
|
||||
to = inwx_domain.twomartens_eu
|
||||
id = "2martens.eu"
|
||||
to = hcloud_primary_ip.primary_ipv4_devops
|
||||
id = "36118827"
|
||||
}
|
||||
|
||||
import {
|
||||
to = inwx_domain_contact.admin
|
||||
id = "73763"
|
||||
to = hcloud_primary_ip.primary_ipv6_devops
|
||||
id = "36118828"
|
||||
}
|
||||
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_eu_root_redirect
|
||||
id = "2martens.eu:378503086"
|
||||
to = hcloud_server.server_k8s_test
|
||||
id = "36009341"
|
||||
}
|
||||
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_eu_www_redirect
|
||||
id = "2martens.eu:378503087"
|
||||
to = hcloud_primary_ip.primary_ipv4_k8s_test
|
||||
id = "37226591"
|
||||
}
|
||||
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_eu_ns1
|
||||
id = "2martens.eu:378502917"
|
||||
to = hcloud_primary_ip.primary_ipv6_k8s_test
|
||||
id = "37226592"
|
||||
}
|
||||
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_eu_ns2
|
||||
id = "2martens.eu:378502918"
|
||||
to = hcloud_firewall.k8s-firewall
|
||||
id = "1104136"
|
||||
}
|
||||
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_eu_ns3
|
||||
id = "2martens.eu:378502919"
|
||||
to = hcloud_firewall.basic-firewall
|
||||
id = "994375"
|
||||
}
|
||||
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_eu_soa
|
||||
id = "2martens.eu:378502916"
|
||||
}
|
||||
import {
|
||||
to = module.personal_website_domain.inwx_nameserver_record.a
|
||||
id = "2martens.de:239663989"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_allris_a
|
||||
id = "2martens.de:340019353"
|
||||
}
|
||||
import {
|
||||
to = module.api_domain.inwx_nameserver_record.a
|
||||
id = "2martens.de:1092884501"
|
||||
}
|
||||
import {
|
||||
to = module.argocd_domain.inwx_nameserver_record.a
|
||||
id = "2martens.de:1212798670"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_autoconfig_a
|
||||
id = "2martens.de:239663992"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_autodiscover_a
|
||||
id = "2martens.de:239663993"
|
||||
}
|
||||
import {
|
||||
to = module.drone_domain.inwx_nameserver_record.a
|
||||
id = "2martens.de:239663999"
|
||||
}
|
||||
import {
|
||||
to = module.nextcloud_domain.inwx_nameserver_record.a
|
||||
id = "2martens.de:338442650"
|
||||
}
|
||||
import {
|
||||
to = module.gitea_domain.inwx_nameserver_record.a
|
||||
id = "2martens.de:268916567"
|
||||
}
|
||||
import {
|
||||
to = module.keycloak_domain.inwx_nameserver_record.a
|
||||
id = "2martens.de:1054579480"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_jim_a
|
||||
id = "2martens.de:239664005"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_pad_a
|
||||
id = "2martens.de:394456668"
|
||||
}
|
||||
import {
|
||||
to = module.helm-repo_domain.inwx_nameserver_record.a
|
||||
id = "2martens.de:1101805861"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_short_a
|
||||
id = "2martens.de:406563107"
|
||||
}
|
||||
import {
|
||||
to = module.statping_domain.inwx_nameserver_record.a
|
||||
id = "2martens.de:725319152"
|
||||
}
|
||||
import {
|
||||
to = module.wahlrecht_domain.inwx_nameserver_record.a
|
||||
id = "2martens.de:1088066410"
|
||||
}
|
||||
import {
|
||||
to = module.personal_website_domain.inwx_nameserver_record.aaaa
|
||||
id = "2martens.de:239663996"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_allris_aaaa
|
||||
id = "2martens.de:340019354"
|
||||
}
|
||||
import {
|
||||
to = module.api_domain.inwx_nameserver_record.aaaa
|
||||
id = "2martens.de:1092884499"
|
||||
}
|
||||
import {
|
||||
to = module.argocd_domain.inwx_nameserver_record.aaaa
|
||||
id = "2martens.de:1212798943"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_autoconfig_aaaa
|
||||
id = "2martens.de:239664001"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_autodiscover_aaaa
|
||||
id = "2martens.de:239664004"
|
||||
}
|
||||
import {
|
||||
to = module.drone_domain.inwx_nameserver_record.aaaa
|
||||
id = "2martens.de:239664000"
|
||||
}
|
||||
import {
|
||||
to = module.nextcloud_domain.inwx_nameserver_record.aaaa
|
||||
id = "2martens.de:338442816"
|
||||
}
|
||||
import {
|
||||
to = module.gitea_domain.inwx_nameserver_record.aaaa
|
||||
id = "2martens.de:268916568"
|
||||
}
|
||||
import {
|
||||
to = module.keycloak_domain.inwx_nameserver_record.aaaa
|
||||
id = "2martens.de:1054579481"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_jim_aaaa
|
||||
id = "2martens.de:258187630"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_pad_aaaa
|
||||
id = "2martens.de:394456669"
|
||||
}
|
||||
import {
|
||||
to = module.helm-repo_domain.inwx_nameserver_record.aaaa
|
||||
id = "2martens.de:1101808918"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_short_aaaa
|
||||
id = "2martens.de:406563108"
|
||||
}
|
||||
import {
|
||||
to = module.statping_domain.inwx_nameserver_record.aaaa
|
||||
id = "2martens.de:725322833"
|
||||
}
|
||||
import {
|
||||
to = module.wahlrecht_domain.inwx_nameserver_record.aaaa
|
||||
id = "2martens.de:1088066412"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_cdn_cname
|
||||
id = "2martens.de:258404695"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_aws-validations-cdn_cname
|
||||
id = "2martens.de:258403560"
|
||||
}
|
||||
import {
|
||||
to = module.nextcloud_domain.inwx_nameserver_record.mx[0]
|
||||
id = "2martens.de:338450118"
|
||||
}
|
||||
import {
|
||||
to = module.keycloak_domain.inwx_nameserver_record.mx[0]
|
||||
id = "2martens.de:1055393884"
|
||||
}
|
||||
import {
|
||||
to = module.personal_website_domain.inwx_nameserver_record.mx[0]
|
||||
id = "2martens.de:239663995"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_ns1
|
||||
id = "2martens.de:239663978"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_ns2
|
||||
id = "2martens.de:239663979"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_ns3
|
||||
id = "2martens.de:239663980"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_soa
|
||||
id = "2martens.de:239663977"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_google-verification_txt
|
||||
id = "2martens.de:239663998"
|
||||
}
|
||||
import {
|
||||
to = module.personal_website_domain.inwx_nameserver_record.mx-spf[0]
|
||||
id = "2martens.de:338469503"
|
||||
}
|
||||
import {
|
||||
to = module.nextcloud_domain.inwx_nameserver_record.mx-spf[0]
|
||||
id = "2martens.de:338450182"
|
||||
}
|
||||
import {
|
||||
to = module.keycloak_domain.inwx_nameserver_record.mx-spf[0]
|
||||
id = "2martens.de:1055394105"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_ci-ownercheck_txt
|
||||
id = "2martens.de:338759677"
|
||||
}
|
||||
import {
|
||||
to = inwx_nameserver_record.twomartens_de_uberspace-domainkey_txt
|
||||
id = "2martens.de:1055394106"
|
||||
to = hcloud_network.kubernetes-network
|
||||
id = "3498594"
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
[kubernetes]
|
||||
%{ for server in k8s_servers ~}
|
||||
${server.name} ansible_host=${server.ipv4_address} ansible_python_interpreter=/usr/bin/python3
|
||||
%{ endfor ~}
|
||||
|
||||
[ci]
|
||||
${devops.name} ansible_host=${devops.ipv4_address} ansible_python_interpreter=/usr/bin/python3
|
||||
@@ -11,5 +11,9 @@ terraform {
|
||||
source = "inwx/inwx"
|
||||
version = "1.3.2"
|
||||
}
|
||||
hcloud = {
|
||||
source = "hetznercloud/hcloud"
|
||||
version = "1.44.1"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -2,5 +2,8 @@ provider "inwx" {
|
||||
api_url = "https://api.domrobot.com/jsonrpc/"
|
||||
username = var.inwx_user
|
||||
password = var.inwx_password
|
||||
# Configuration options
|
||||
}
|
||||
|
||||
provider "hcloud" {
|
||||
token = var.hcloud_token
|
||||
}
|
||||
@@ -31,3 +31,9 @@ variable "admin_email" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
||||
variable "hcloud_token" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
Reference in New Issue
Block a user