sjat/boma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
boma/terraform
History
sjat b0511179cb feat(tf/offsite): retire askari's WAN :22 (mesh-only SSH) 
The Hetzner Cloud Firewall SSH rule is now conditional on a non-empty
ssh_admin_cidrs (default []); askari sets it empty so the WAN :22 rule is
removed on the next apply. SSH is reached over wt0; break-glass is the Hetzner
console. Apply is the live cutover (Task 5). Mesh-hardening 1/3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-17 20:51:24 +02:00
..
environments feat(tf/offsite): retire askari's WAN :22 (mesh-only SSH) 2026-06-17 20:51:24 +02:00
modules feat(tf/offsite): retire askari's WAN :22 (mesh-only SSH) 2026-06-17 20:51:24 +02:00
README.md docs(review): 2026-06-14 repo audit — M4a doc drift + Traefik→Caddy lag 2026-06-14 18:37:54 +02:00

README.md

terraform/

Infrastructure provisioning. Terraform owns VM existence only — creating and destroying Proxmox VMs. It writes no DNS records and configures nothing inside a VM; Ansible owns all of that.

  • modules/proxmox_vm/ — reusable VM module (Proxmox only).
  • modules/hetzner_vm/ — reusable VM module (Hetzner Cloud: server + firewall + SSH key + cloud-init).
  • environments/{staging,production}/ — separate state per environment (Proxmox). Add a VM by editing local.vms in that env's main.tf, then make tf-plan → tf-apply → tf-inventory. Not yet terraform inited.
  • environments/offsite/ — the off-site Hetzner host (askari); the one applied environment. Use make tf-* TF_ENV=offsite and tf-inventory-offsite.

Rationale: ADR-006. Handoff to Ansible: ADR-009. Secrets via TF_VAR_* only — never in .tfvars. See STATUS.md for what is provisioned.