b6c9fa666d
This commit captures the infrastructure state immediately following the "Post-Tyranny Tech" workshop on January 23rd, 2026. Infrastructure Status: - 13 client servers deployed (white, valk, zwaan, specht, das, uil, vos, haas, wolf, ree, mees, mus, mol, kikker) - Services: Authentik SSO, Nextcloud, Collabora Office, Traefik - Private network architecture with edge NAT gateway - OIDC integration between Authentik and Nextcloud - Automated recovery flows and invitation system - Container update monitoring with Diun - Uptime monitoring with Uptime Kuma Changes include: - Multiple new client host configurations - Network architecture improvements (private IPs + NAT) - DNS management automation - Container update notifications - Email configuration via Mailgun - SSH key generation for all clients - Encrypted secrets for all deployments - Health check and diagnostic scripts Known Issues to Address: - Nextcloud version pinned to v30 (should use 'latest' or v32) - Zitadel references in templates (migrated to Authentik but templates not updated) - Traefik dynamic config has obsolete static routes 🤖 Generated with Claude Code (https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
58 lines
1.5 KiB
HCL
58 lines
1.5 KiB
HCL
# DNS Configuration for vrije.cloud using hcloud provider
|
|
# The zone already exists in Hetzner Console, so we reference it as a data source
|
|
|
|
# Reference the existing DNS zone
|
|
data "hcloud_zone" "main" {
|
|
name = var.base_domain
|
|
}
|
|
|
|
# A Records for client servers - all now have direct public IPs
|
|
resource "hcloud_zone_rrset" "client_a" {
|
|
for_each = var.clients
|
|
|
|
zone = data.hcloud_zone.main.name
|
|
name = each.value.subdomain
|
|
type = "A"
|
|
ttl = 300
|
|
records = [
|
|
{
|
|
value = hcloud_server.client[each.key].ipv4_address
|
|
comment = "Client ${each.key} server"
|
|
}
|
|
]
|
|
}
|
|
|
|
# Wildcard A record for each client (e.g., *.test.vrije.cloud for zitadel.test.vrije.cloud)
|
|
resource "hcloud_zone_rrset" "client_wildcard" {
|
|
for_each = var.clients
|
|
|
|
zone = data.hcloud_zone.main.name
|
|
name = "*.${each.value.subdomain}"
|
|
type = "A"
|
|
ttl = 300
|
|
records = [
|
|
{
|
|
value = hcloud_server.client[each.key].ipv4_address
|
|
comment = "Wildcard for ${each.key} subdomains"
|
|
}
|
|
]
|
|
}
|
|
|
|
# AAAA Records for IPv6 - all clients now have IPv6
|
|
resource "hcloud_zone_rrset" "client_aaaa" {
|
|
for_each = var.clients
|
|
|
|
zone = data.hcloud_zone.main.name
|
|
name = each.value.subdomain
|
|
type = "AAAA"
|
|
ttl = 300
|
|
records = [
|
|
{
|
|
value = hcloud_server.client[each.key].ipv6_address
|
|
comment = "Client ${each.key} server IPv6"
|
|
}
|
|
]
|
|
}
|
|
|
|
# Static A record for monitoring server removed - managed manually
|
|
# (status.vrije.cloud -> external monitoring server)
|