sjat
1ee343dfca
hetzner_vm gains a public_web bool (default false); offsite sets it true. Firewall adds 80/443 tcp + 3478 udp from anywhere (SSH-from-ubongo preserved). For M4 Caddy + NetBird. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
21 lines
794 B
HCL
21 lines
794 B
HCL
# offsite/main.tf — off-site Hetzner hosts. Terraform owns VM existence (ADR-006,
|
|
# generalized to Hetzner). ALWAYS `make tf-plan TF_ENV=offsite` and review before
|
|
# `make tf-apply TF_ENV=offsite`.
|
|
|
|
module "askari" {
|
|
source = "../../modules/hetzner_vm"
|
|
|
|
name = "askari"
|
|
server_type = "cx23" # x86, 2 vCPU / 4 GB / 40 GB (CAX11/ARM was out of stock in
|
|
# every EU location 2026-06-14; cx23 is same-spec + cheaper)
|
|
location = "hel1" # Helsinki
|
|
image = "debian-13"
|
|
ansible_ssh_pubkey = var.ansible_ssh_pubkey
|
|
ssh_admin_cidrs = var.ssh_admin_cidrs
|
|
public_web = true # Caddy 80/443 + NetBird 3478 (M4)
|
|
labels = {
|
|
env = "offsite"
|
|
group = "offsite_hosts"
|
|
managed-by = "terraform"
|
|
}
|
|
}
|