87 lines
2.1 KiB
Terraform
87 lines
2.1 KiB
Terraform
|
# Private Network Configuration
|
||
|
|
# Enables client servers to communicate without public IPs
|
||
|
|
|
||
|
|
# Private Network
|
||
|
|
resource "hcloud_network" "private" {
|
||
|
|
name = "client-private-network"
|
||
|
|
ip_range = "10.0.0.0/16"
|
||
|
|
|
||
|
|
labels = {
|
||
|
|
managed = "terraform"
|
||
|
|
purpose = "client-internal"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Subnet for client servers
|
||
|
|
resource "hcloud_network_subnet" "clients" {
|
||
|
|
network_id = hcloud_network.private.id
|
||
|
|
type = "cloud"
|
||
|
|
network_zone = "eu-central"
|
||
|
|
ip_range = "10.0.0.0/24"
|
||
|
|
}
|
||
|
|
|
||
|
|
# Note: Client servers attach to private network via main.tf dynamic block
|
||
|
|
|
||
|
|
# Edge Server Configuration
|
||
|
|
# Single public-facing reverse proxy for all clients
|
||
|
|
|
||
|
|
# SSH key for edge server
|
||
|
|
resource "hcloud_ssh_key" "edge" {
|
||
|
|
name = "edge-server-deploy-key"
|
||
|
|
public_key = file("${path.module}/../keys/ssh/edge.pub")
|
||
|
|
}
|
||
|
|
|
||
|
|
# Edge server (public IP + private network)
|
||
|
|
resource "hcloud_server" "edge" {
|
||
|
|
name = "edge"
|
||
|
|
server_type = var.edge_server_type
|
||
|
|
image = "ubuntu-24.04"
|
||
|
|
location = var.edge_location
|
||
|
|
ssh_keys = [hcloud_ssh_key.edge.id]
|
||
|
|
firewall_ids = [hcloud_firewall.client_firewall.id]
|
||
|
|
|
||
|
|
labels = {
|
||
|
|
role = "edge-proxy"
|
||
|
|
managed = "terraform"
|
||
|
|
}
|
||
|
|
|
||
|
|
# Enable backups
|
||
|
|
backups = var.enable_snapshots
|
||
|
|
|
||
|
|
# User data for initial setup
|
||
|
|
user_data = <<-EOF
|
||
|
|
#cloud-config
|
||
|
|
package_update: true
|
||
|
|
package_upgrade: true
|
||
|
|
packages:
|
||
|
|
- curl
|
||
|
|
- wget
|
||
|
|
- git
|
||
|
|
- python3
|
||
|
|
- python3-pip
|
||
|
|
runcmd:
|
||
|
|
- hostnamectl set-hostname edge
|
||
|
|
EOF
|
||
|
|
|
||
|
|
# Ensure public network is enabled
|
||
|
|
public_net {
|
||
|
|
ipv4_enabled = true
|
||
|
|
ipv6_enabled = true
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Attach edge server to private network
|
||
|
|
resource "hcloud_server_network" "edge" {
|
||
|
|
server_id = hcloud_server.edge.id
|
||
|
|
network_id = hcloud_network.private.id
|
||
|
|
ip = "10.0.0.2" # Fixed IP for edge server (10.0.0.1 is gateway)
|
||
|
|
}
|
||
|
|
|
||
|
|
# NAT Gateway Route
|
||
|
|
# Routes all internet-bound traffic from private network through edge server
|
||
|
|
resource "hcloud_network_route" "nat_gateway" {
|
||
|
|
network_id = hcloud_network.private.id
|
||
|
|
destination = "0.0.0.0/0"
|
||
|
|
gateway = "10.0.0.2" # Edge server acts as NAT gateway
|
||
|
|
}
|