feat(terraform): add firewall configuration

terraform/main.tf

@@ -1,22 +1,49 @@
-# SSH key shared with the VPS
+# Setup the SSH key in the Hetzner Cloud Console
 resource "hcloud_ssh_key" "ansible" {
   name       = var.project_name
   public_key = var.ssh_public_key
 }
 
-# Provision a small Hetzner Cloud VPS
+# Provision the Hetzner Cloud VPS
 resource "hcloud_server" "dokploy" {
-  name        = var.project_name
+  name         = var.project_name
-  image       = var.hcloud_image
+  image        = var.hcloud_image
-  server_type = var.hcloud_server_type
+  server_type  = var.hcloud_server_type
-  location    = var.hcloud_location
+  location     = var.hcloud_location
-  ssh_keys    = [hcloud_ssh_key.ansible.id]
+  ssh_keys     = [hcloud_ssh_key.ansible.id]
+  firewall_ids = [hcloud_firewall.host.id]
 
   public_net {
     ipv4_enabled = true
   }
 }
 
+# Configure Hetzner Cloud Firewall
+resource "hcloud_firewall" "host" {
+  name = var.project_name
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "80"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "443"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+}
+
 # Resolve the Cloudflare zone from its apex domain name
 data "cloudflare_zone" "zone" {
   filter = {
@@ -28,7 +55,7 @@ locals {
   public_ip = hcloud_server.dokploy.ipv4_address
 }
 
-# Automatically publish the VPS IP as a Cloudflare A record
+# Publish the VPS IP as a Cloudflare A record
 resource "cloudflare_dns_record" "a" {
   zone_id = data.cloudflare_zone.zone.id
   name    = var.record_name