add hetzner server module

modules/hetzner_server/main.tf

@@ -0,0 +1,40 @@
+terraform {
+  required_version = ">= 1.0.0"
+  required_providers {
+    hcloud = { source = "hetznercloud/hcloud", version = "~> 1.68.0" }
+  }
+}
+
+locals {
+  # single naming scheme - propagates everywhere
+  key_name      = "${var.name}-key"
+  firewall_name = "${var.name}-fw"
+}
+
+resource "hcloud_ssh_key" "this" {
+  name       = local.key_name
+  public_key = var.ssh_public_key
+}
+
+resource "hcloud_firewall" "this" {
+  name = local.firewall_name
+
+  dynamic "rule" {
+    for_each = var.firewall_rules
+    content {
+      direction  = rule.value.direction
+      protocol   = rule.value.protocol
+      port       = rule.value.port
+      source_ips = rule.value.source_ips
+    }
+  }
+}
+
+resource "hcloud_server" "this" {
+  name         = var.name
+  image        = var.image
+  server_type  = var.server_type
+  location     = var.location
+  user_data    = var.user_data
+  firewall_ids = [hcloud_firewall.this.id]
+}

modules/hetzner_server/outputs.tf

@@ -0,0 +1,24 @@
+output "ipv4_address" {
+  description = "Primary public IPv4 address of the host"
+  value       = hcloud_server.this.ipv4_address
+}
+
+output "ipv6_address" {
+  description = "Primary public IPv6 address of the host"
+  value       = hcloud_server.this.ipv6_address
+}
+
+output "server_id" {
+  description = "Hetzner server ID"
+  value       = hcloud_server.this.id
+}
+
+output "ssh_key_name" {
+  description = "Name of the registered Hetzner SSH key"
+  value       = hcloud_ssh_key.this.name
+}
+
+output "firewall_name" {
+  description = "Name of the firewall attached to the host"
+  value       = hcloud_firewall.this.name
+}

modules/hetzner_server/variables.tf

@@ -0,0 +1,46 @@
+variable "name" {
+  type        = string
+  description = "Host name (used as prefix for the SSH key and firewall)"
+}
+
+variable "ssh_public_key" {
+  type        = string
+  description = "Public SSH key to manage the host"
+}
+
+variable "server_type" {
+  type        = string
+  description = "Hetzner server type (e.g. cx22)"
+}
+
+variable "image" {
+  type        = string
+  description = "OS image to boot (e.g. debian-13)"
+}
+
+variable "location" {
+  type        = string
+  description = "Hetzner location (fsn1, nbg1, hel1, ash1)"
+  default     = "nbg1"
+  validation {
+    condition     = contains(["fsn1", "nbg1", "hel1", "ash1"], var.location)
+    error_message = "location must be one of fsn1, nbg1, hel1, ash1."
+  }
+}
+
+variable "user_data" {
+  type        = string
+  description = "Pre-rendered cloud-init user data (optional). Caller renders it from a template."
+  default     = null
+}
+
+variable "firewall_rules" {
+  type = list(object({
+    direction  = string
+    protocol   = string
+    port       = string
+    source_ips = list(string)
+  }))
+  description = "Firewall rules applied to the host"
+  default = []
+}