From 2556bdbd4e6ba4862ac539f661b3221c3194bc31 Mon Sep 17 00:00:00 2001 From: Jim Martens Date: Tue, 31 Oct 2023 11:11:31 +0100 Subject: [PATCH] Added Hetzner resources --- terraform/.terraform.lock.hcl | 22 ++++ terraform/amsible.tf | 5 + terraform/cloud-init.yaml | 27 ++++ terraform/hetzner.tf | 214 +++++++++++++++++++++++++++++++ terraform/imports.tf | 230 ++++------------------------------ terraform/inventory.tftpl | 7 ++ terraform/main.tf | 4 + terraform/providers.tf | 5 +- terraform/variables.tf | 6 + 9 files changed, 313 insertions(+), 207 deletions(-) create mode 100644 terraform/amsible.tf create mode 100644 terraform/cloud-init.yaml create mode 100644 terraform/inventory.tftpl diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl index 8590961..1520517 100644 --- a/terraform/.terraform.lock.hcl +++ b/terraform/.terraform.lock.hcl @@ -1,6 +1,28 @@ # This file is maintained automatically by "terraform init". # Manual edits may be lost in future updates. +provider "registry.terraform.io/hetznercloud/hcloud" { + version = "1.44.1" + constraints = "1.44.1" + hashes = [ + "h1:q2JvvbG+seeZ4A2ijxPi5Tis+NJVoB59cAt3KeQe0uA=", + "zh:156df81d2c740608b9fb7f439defbb39b89585c55dc6e62e4af928808ff67f9e", + "zh:32407f1df8b59afe5e35710c4acf2c8a8cbf5ea9a32126f34cb0c49ff142a047", + "zh:456133e16e9ebfcd89534c968a8b2a3f931bf4acb76a8165acc2242b0b73ba78", + "zh:6855c90399abc11e32fcdc0bf54bdedb50009c46183b926b3493fdcf48d5e39c", + "zh:68fe1e7e9f692a29d75a3cc199b472e8bc00c9486b299bfaf816133797207804", + "zh:6c62a9fe0a6de3cd4ea0591193baef00b65c838610feb369d14e36d15f9ea93e", + "zh:6cb1db2287cc8baec8538d9df6a44f602f61580d8df4c484625295aa622f03d1", + "zh:7fd577a8079da2f6e96066a8bf6bce6e36fdd36c67ac03044fd29f15eb718a6c", + "zh:9f94d862b827c429bf6a3eea7a65b856475cdc6da7e0d8a8edfbc09de40bed3f", + "zh:a6499d633a63668629a32628624137d2ef8e1ca5ef77766669470def7f4d5732", + "zh:b46004de824350b1b9a44cc253608d25e7cdf77d628571ece2df2fe96aacb8d7", + "zh:b9d8c401f8ddb829ee67bf429aac781bf5022605f4d18b041c417622746a37a1", + "zh:cf182e8426d7bd555a46ea4c5d75ed431edb41aa162e57f07f13d235d0e74f0d", + "zh:e1b777a95498489aa04231b7825cca445119f2b1988bfdcd8f0a35e0ba59d883", + ] +} + provider "registry.terraform.io/inwx/inwx" { version = "1.3.2" constraints = "1.3.2" diff --git a/terraform/amsible.tf b/terraform/amsible.tf new file mode 100644 index 0000000..fbdb63d --- /dev/null +++ b/terraform/amsible.tf @@ -0,0 +1,5 @@ +output "ansible_inventory" { + value = templatefile("${path.module}/inventory.tftpl", { + devops = hcloud_server.server_devops, k8s_servers = [hcloud_server.server_k8s_test] + }) +} \ No newline at end of file diff --git a/terraform/cloud-init.yaml b/terraform/cloud-init.yaml new file mode 100644 index 0000000..4067798 --- /dev/null +++ b/terraform/cloud-init.yaml @@ -0,0 +1,27 @@ +#cloud-config +users: + - name: 2martensAdmin + groups: users, admin + sudo: ALL=(ALL) NOPASSWD:ALL + shell: /bin/bash + ssh_authorized_keys: + - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBjYkz73HbsFtRAOfS5QB9xDbOajU9C4gpDp+OjQkLir 2martens@Jims-Air.fritz.box" +packages: + - fail2ban + - ufw +package_update: true +package_upgrade: true +runcmd: + - printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local + - systemctl enable fail2ban + - ufw allow OpenSSH + - ufw enable + - sed -i -e '/^\(#\|\)PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config + - sed -i -e '/^\(#\|\)PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config + - sed -i -e '/^\(#\|\)X11Forwarding/s/^.*$/X11Forwarding no/' /etc/ssh/sshd_config + - sed -i -e '/^\(#\|\)MaxAuthTries/s/^.*$/MaxAuthTries 2/' /etc/ssh/sshd_config + - sed -i -e '/^\(#\|\)AllowTcpForwarding/s/^.*$/AllowTcpForwarding no/' /etc/ssh/sshd_config + - sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config + - sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config + - sed -i '$a AllowUsers 2martensAdmin' /etc/ssh/sshd_config + - reboot \ No newline at end of file diff --git a/terraform/hetzner.tf b/terraform/hetzner.tf index 174cbdd..b100ffc 100644 --- a/terraform/hetzner.tf +++ b/terraform/hetzner.tf @@ -1,3 +1,217 @@ +// data sources + +data "hcloud_location" "falkenstein" { + name = "fsn1" +} + +data "hcloud_location" "nuremberg" { + name = "nbg1" +} + +data "hcloud_datacenter" "falkenstein" { + name = "fsn1-dc14" +} + +data "hcloud_datacenter" "nuremberg" { + name = "nbg1-dc3" +} + +data "hcloud_ssh_key" "macos" { + name = "2martens@Jims-Air.fritz.box" +} + +data "hcloud_placement_group" "default" { + name = "default" +} + +// common resources + +resource "hcloud_network" "kubernetes-network" { + name = "kubernetes" + ip_range = "10.0.0.0/8" +} + +resource "hcloud_network_subnet" "k8s-network-subnet" { + type = "cloud" + network_id = hcloud_network.kubernetes-network.id + network_zone = "eu-central" + ip_range = "10.0.0.0/16" +} + +resource "hcloud_network_route" "k8s-route" { + network_id = hcloud_network.kubernetes-network.id + destination = "10.1.0.0/16" + gateway = "10.0.0.2" +} + +resource "hcloud_firewall" "basic-firewall" { + name = "basic-firewall" + rule { + direction = "in" + protocol = "tcp" + port = "22" + description = "allow SSH" + source_ips = [ + "0.0.0.0/0", + "::/0", + ] + } + + rule { + direction = "in" + protocol = "tcp" + port = "80" + description = "allow HTTP" + source_ips = [ + "0.0.0.0/0", + "::/0", + ] + } + + rule { + direction = "in" + protocol = "tcp" + port = "443" + description = "allow HTTPS" + source_ips = [ + "0.0.0.0/0", + "::/0", + ] + } + + rule { + direction = "in" + protocol = "icmp" + description = "allow ICMP" + source_ips = [ + "0.0.0.0/0", + "::/0", + ] + } +} + +resource "hcloud_firewall_attachment" "basic-firewall_attachment" { + firewall_id = hcloud_firewall.basic-firewall.id + server_ids = [hcloud_server.server_devops.id, hcloud_server.server_k8s_test.id] +} + +resource "hcloud_firewall" "k8s-firewall" { + name = "k8s-firewall" + rule { + direction = "in" + protocol = "tcp" + port = "16443" + description = "Access Kubernetes" + source_ips = [ + "0.0.0.0/0", + "::/0", + ] + } +} + +resource "hcloud_firewall_attachment" "k8s-firewall_attachment" { + firewall_id = hcloud_firewall.k8s-firewall.id + server_ids = [hcloud_server.server_k8s_test.id] +} + +// servers +resource "hcloud_primary_ip" "primary_ipv4_devops" { + name = "primary_ipv4_devops" + datacenter = data.hcloud_datacenter.falkenstein.name + type = "ipv4" + assignee_type = "server" + auto_delete = false +} + +resource "hcloud_primary_ip" "primary_ipv6_devops" { + name = "primary_ipv6_devops" + datacenter = data.hcloud_datacenter.falkenstein.name + type = "ipv6" + assignee_type = "server" + auto_delete = false +} + +resource "hcloud_server" "server_devops" { + name = "devops" + image = "ubuntu-22.04" + allow_deprecated_images = false + server_type = "cax21" + location = data.hcloud_location.falkenstein.name + public_net { + ipv4_enabled = true + ipv4 = hcloud_primary_ip.primary_ipv4_devops.id + ipv6_enabled = true + ipv6 = hcloud_primary_ip.primary_ipv6_devops.id + } + ignore_remote_firewall_ids = false + keep_disk = false + placement_group_id = data.hcloud_placement_group.default.id + labels = { + "apache" : "yes", + "docker" : "yes", + "drone" : "yes" + } + firewall_ids = [hcloud_firewall.basic-firewall.id] + ssh_keys = [data.hcloud_ssh_key.macos.id] + user_data = file("cloud-init.yaml") + shutdown_before_deletion = true + + lifecycle { + ignore_changes = [ssh_keys, user_data] + } +} + +resource "hcloud_primary_ip" "primary_ipv4_k8s_test" { + name = "primary_ipv4_applications" + datacenter = data.hcloud_datacenter.falkenstein.name + type = "ipv4" + assignee_type = "server" + auto_delete = false +} + +resource "hcloud_primary_ip" "primary_ipv6_k8s_test" { + name = "primary_ipv6_applications" + datacenter = data.hcloud_datacenter.falkenstein.name + type = "ipv6" + assignee_type = "server" + auto_delete = false +} + +resource "hcloud_server" "server_k8s_test" { + name = "applications" + image = "ubuntu-22.04" + allow_deprecated_images = false + server_type = "cax21" + location = data.hcloud_location.falkenstein.name + public_net { + ipv4_enabled = true + ipv4 = hcloud_primary_ip.primary_ipv4_devops.id + ipv6_enabled = true + ipv6 = hcloud_primary_ip.primary_ipv6_devops.id + } + ignore_remote_firewall_ids = false + keep_disk = false + placement_group_id = data.hcloud_placement_group.default.id + labels = { + "kubernetes" : "yes" + } + firewall_ids = [hcloud_firewall.basic-firewall.id, hcloud_firewall.k8s-firewall.id] + ssh_keys = [data.hcloud_ssh_key.macos.id] + user_data = file("cloud-init.yaml") + shutdown_before_deletion = true + + network { + network_id = hcloud_network.kubernetes-network.id + ip = "10.0.0.2" + } + + lifecycle { + ignore_changes = [ssh_keys, user_data] + } + + depends_on = [hcloud_network_subnet.k8s-network-subnet] +} + module "drone_domain" { source = "./modules/domain" domain = "2martens.de" diff --git a/terraform/imports.tf b/terraform/imports.tf index 2455a1e..ee5e5b2 100644 --- a/terraform/imports.tf +++ b/terraform/imports.tf @@ -1,226 +1,44 @@ import { - to = inwx_domain.twomartens_de - id = "2martens.de" + to = hcloud_server.server_devops + id = "35455513" } import { - to = inwx_domain.twomartens_eu - id = "2martens.eu" + to = hcloud_primary_ip.primary_ipv4_devops + id = "36118827" } import { - to = inwx_domain_contact.admin - id = "73763" + to = hcloud_primary_ip.primary_ipv6_devops + id = "36118828" } + import { - to = inwx_nameserver_record.twomartens_eu_root_redirect - id = "2martens.eu:378503086" + to = hcloud_server.server_k8s_test + id = "36009341" } + import { - to = inwx_nameserver_record.twomartens_eu_www_redirect - id = "2martens.eu:378503087" + to = hcloud_primary_ip.primary_ipv4_k8s_test + id = "37226591" } + import { - to = inwx_nameserver_record.twomartens_eu_ns1 - id = "2martens.eu:378502917" + to = hcloud_primary_ip.primary_ipv6_k8s_test + id = "37226592" } + import { - to = inwx_nameserver_record.twomartens_eu_ns2 - id = "2martens.eu:378502918" + to = hcloud_firewall.k8s-firewall + id = "1104136" } + import { - to = inwx_nameserver_record.twomartens_eu_ns3 - id = "2martens.eu:378502919" + to = hcloud_firewall.basic-firewall + id = "994375" } + import { - to = inwx_nameserver_record.twomartens_eu_soa - id = "2martens.eu:378502916" -} -import { - to = module.personal_website_domain.inwx_nameserver_record.a - id = "2martens.de:239663989" -} -import { - to = inwx_nameserver_record.twomartens_de_allris_a - id = "2martens.de:340019353" -} -import { - to = module.api_domain.inwx_nameserver_record.a - id = "2martens.de:1092884501" -} -import { - to = module.argocd_domain.inwx_nameserver_record.a - id = "2martens.de:1212798670" -} -import { - to = inwx_nameserver_record.twomartens_de_autoconfig_a - id = "2martens.de:239663992" -} -import { - to = inwx_nameserver_record.twomartens_de_autodiscover_a - id = "2martens.de:239663993" -} -import { - to = module.drone_domain.inwx_nameserver_record.a - id = "2martens.de:239663999" -} -import { - to = module.nextcloud_domain.inwx_nameserver_record.a - id = "2martens.de:338442650" -} -import { - to = module.gitea_domain.inwx_nameserver_record.a - id = "2martens.de:268916567" -} -import { - to = module.keycloak_domain.inwx_nameserver_record.a - id = "2martens.de:1054579480" -} -import { - to = inwx_nameserver_record.twomartens_de_jim_a - id = "2martens.de:239664005" -} -import { - to = inwx_nameserver_record.twomartens_de_pad_a - id = "2martens.de:394456668" -} -import { - to = module.helm-repo_domain.inwx_nameserver_record.a - id = "2martens.de:1101805861" -} -import { - to = inwx_nameserver_record.twomartens_de_short_a - id = "2martens.de:406563107" -} -import { - to = module.statping_domain.inwx_nameserver_record.a - id = "2martens.de:725319152" -} -import { - to = module.wahlrecht_domain.inwx_nameserver_record.a - id = "2martens.de:1088066410" -} -import { - to = module.personal_website_domain.inwx_nameserver_record.aaaa - id = "2martens.de:239663996" -} -import { - to = inwx_nameserver_record.twomartens_de_allris_aaaa - id = "2martens.de:340019354" -} -import { - to = module.api_domain.inwx_nameserver_record.aaaa - id = "2martens.de:1092884499" -} -import { - to = module.argocd_domain.inwx_nameserver_record.aaaa - id = "2martens.de:1212798943" -} -import { - to = inwx_nameserver_record.twomartens_de_autoconfig_aaaa - id = "2martens.de:239664001" -} -import { - to = inwx_nameserver_record.twomartens_de_autodiscover_aaaa - id = "2martens.de:239664004" -} -import { - to = module.drone_domain.inwx_nameserver_record.aaaa - id = "2martens.de:239664000" -} -import { - to = module.nextcloud_domain.inwx_nameserver_record.aaaa - id = "2martens.de:338442816" -} -import { - to = module.gitea_domain.inwx_nameserver_record.aaaa - id = "2martens.de:268916568" -} -import { - to = module.keycloak_domain.inwx_nameserver_record.aaaa - id = "2martens.de:1054579481" -} -import { - to = inwx_nameserver_record.twomartens_de_jim_aaaa - id = "2martens.de:258187630" -} -import { - to = inwx_nameserver_record.twomartens_de_pad_aaaa - id = "2martens.de:394456669" -} -import { - to = module.helm-repo_domain.inwx_nameserver_record.aaaa - id = "2martens.de:1101808918" -} -import { - to = inwx_nameserver_record.twomartens_de_short_aaaa - id = "2martens.de:406563108" -} -import { - to = module.statping_domain.inwx_nameserver_record.aaaa - id = "2martens.de:725322833" -} -import { - to = module.wahlrecht_domain.inwx_nameserver_record.aaaa - id = "2martens.de:1088066412" -} -import { - to = inwx_nameserver_record.twomartens_de_cdn_cname - id = "2martens.de:258404695" -} -import { - to = inwx_nameserver_record.twomartens_de_aws-validations-cdn_cname - id = "2martens.de:258403560" -} -import { - to = module.nextcloud_domain.inwx_nameserver_record.mx[0] - id = "2martens.de:338450118" -} -import { - to = module.keycloak_domain.inwx_nameserver_record.mx[0] - id = "2martens.de:1055393884" -} -import { - to = module.personal_website_domain.inwx_nameserver_record.mx[0] - id = "2martens.de:239663995" -} -import { - to = inwx_nameserver_record.twomartens_de_ns1 - id = "2martens.de:239663978" -} -import { - to = inwx_nameserver_record.twomartens_de_ns2 - id = "2martens.de:239663979" -} -import { - to = inwx_nameserver_record.twomartens_de_ns3 - id = "2martens.de:239663980" -} -import { - to = inwx_nameserver_record.twomartens_de_soa - id = "2martens.de:239663977" -} -import { - to = inwx_nameserver_record.twomartens_de_google-verification_txt - id = "2martens.de:239663998" -} -import { - to = module.personal_website_domain.inwx_nameserver_record.mx-spf[0] - id = "2martens.de:338469503" -} -import { - to = module.nextcloud_domain.inwx_nameserver_record.mx-spf[0] - id = "2martens.de:338450182" -} -import { - to = module.keycloak_domain.inwx_nameserver_record.mx-spf[0] - id = "2martens.de:1055394105" -} -import { - to = inwx_nameserver_record.twomartens_de_ci-ownercheck_txt - id = "2martens.de:338759677" -} -import { - to = inwx_nameserver_record.twomartens_de_uberspace-domainkey_txt - id = "2martens.de:1055394106" + to = hcloud_network.kubernetes-network + id = "3498594" } \ No newline at end of file diff --git a/terraform/inventory.tftpl b/terraform/inventory.tftpl new file mode 100644 index 0000000..66474e1 --- /dev/null +++ b/terraform/inventory.tftpl @@ -0,0 +1,7 @@ +[kubernetes] +%{ for server in k8s_servers ~} +${server.name} ansible_host=${server.ipv4_address} ansible_python_interpreter=/usr/bin/python3 +%{ endfor ~} + +[ci] +${devops.name} ansible_host=${devops.ipv4_address} ansible_python_interpreter=/usr/bin/python3 diff --git a/terraform/main.tf b/terraform/main.tf index 78c84ed..9228b83 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -11,5 +11,9 @@ terraform { source = "inwx/inwx" version = "1.3.2" } + hcloud = { + source = "hetznercloud/hcloud" + version = "1.44.1" + } } } \ No newline at end of file diff --git a/terraform/providers.tf b/terraform/providers.tf index bc09c10..6a4ebc7 100644 --- a/terraform/providers.tf +++ b/terraform/providers.tf @@ -2,5 +2,8 @@ provider "inwx" { api_url = "https://api.domrobot.com/jsonrpc/" username = var.inwx_user password = var.inwx_password - # Configuration options +} + +provider "hcloud" { + token = var.hcloud_token } \ No newline at end of file diff --git a/terraform/variables.tf b/terraform/variables.tf index 5e069a1..791a3aa 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -31,3 +31,9 @@ variable "admin_email" { type = string sensitive = true } + + +variable "hcloud_token" { + type = string + sensitive = true +} \ No newline at end of file