From 97eaa8cf513228f80d29a4afc014f1a4b4cd743e Mon Sep 17 00:00:00 2001 From: alessandrovitali Date: Tue, 18 Aug 2026 16:33:28 +0200 Subject: [PATCH] feat(terraform): add firewall configuration --- terraform/main.tf | 43 +++++++++++++++++++++++++++++++++++-------- 1 file changed, 35 insertions(+), 8 deletions(-) diff --git a/terraform/main.tf b/terraform/main.tf index 3b5e092..8850638 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -1,22 +1,49 @@ -# SSH key shared with the VPS +# Setup the SSH key in the Hetzner Cloud Console resource "hcloud_ssh_key" "ansible" { name = var.project_name public_key = var.ssh_public_key } -# Provision a small Hetzner Cloud VPS +# Provision the Hetzner Cloud VPS resource "hcloud_server" "dokploy" { - name = var.project_name - image = var.hcloud_image - server_type = var.hcloud_server_type - location = var.hcloud_location - ssh_keys = [hcloud_ssh_key.ansible.id] + name = var.project_name + image = var.hcloud_image + server_type = var.hcloud_server_type + location = var.hcloud_location + ssh_keys = [hcloud_ssh_key.ansible.id] + firewall_ids = [hcloud_firewall.host.id] public_net { ipv4_enabled = true } } +# Configure Hetzner Cloud Firewall +resource "hcloud_firewall" "host" { + name = var.project_name + + rule { + direction = "in" + protocol = "tcp" + port = "80" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { + direction = "in" + protocol = "tcp" + port = "443" + source_ips = ["0.0.0.0/0", "::/0"] + } + + rule { + direction = "in" + protocol = "tcp" + port = "22" + source_ips = ["0.0.0.0/0", "::/0"] + } +} + # Resolve the Cloudflare zone from its apex domain name data "cloudflare_zone" "zone" { filter = { @@ -28,7 +55,7 @@ locals { public_ip = hcloud_server.dokploy.ipv4_address } -# Automatically publish the VPS IP as a Cloudflare A record +# Publish the VPS IP as a Cloudflare A record resource "cloudflare_dns_record" "a" { zone_id = data.cloudflare_zone.zone.id name = var.record_name