Migrate bastion, monitor to Hetzner

.github/workflows/hosts.yml

@@ -41,8 +41,6 @@ jobs:
     strategy:
       matrix:
         host:
-        - bastion
-        - monitor
         - nut-homelab
         - nut-network
   buildQEMUImage:
@@ -130,8 +128,10 @@ jobs:
         - controller
         - dill
         - fabricator
+        - gateway
         - htpc
         - matrix
+        - monitor
         - omnibus
         - whirlwind
 name: Build hosts

.sops.yaml

@@ -1,6 +1,5 @@
 keys:
   - &user_ethnt age10539mc6shf02hpa8huyjktdw3nfyavxdg8pt247wwvq4xrv8h5zs8nc0k0
-  - &host_bastion age1x708x83pjj7urp26pncx67fqz8a3htrf0umw7c00pvmxhl6y95lszjgd6r
   - &host_monitor age1g22ghnrdg858yv6w2ux8hgntj8gkdyjn28axdkmzyx38d4vx6geqj4px9a
   - &host_omnibus age1k5nzxq4ej2u9ls97c2dhlz96j2vghv0assz5g0p4npzyc8c8fqlqld72hg
   - &host_htpc age1gkzp905yqkla54l52m4xkqtxpn0sndkx0vh6qqa8d2tu29x8f35q354gpe
@@ -12,6 +11,7 @@ keys:
   - &host_nut_network age10q5gqw4gwts228ayanvalq7c93peqjdsfqcgevd7qr43u5rhnczs9u2ysj
   - &host_nut_homelab age1hxynjkmtgcu9lwejchkjfqjp484at589sznqkxk6weucp37p4p7qaj440h
   - &host_whirlwind age1dtf3ahstj5mhzcqf4d2zc54d5dds69ka32dqpmpsskyaz04dtshq9ryxat
+  - &host_gateway age1px3aq87zcjgts5guc59fqn64zjkqzukdwce4a0ggza83n3atkcws4h5aww
 
 creation_rules:
   - path_regex: '^.*secrets\.(json|yml)'
@@ -24,9 +24,9 @@ creation_rules:
           - *host_matrix
           - *host_controller
           - *host_builder
-          - *host_bastion
           - *host_dill
           - *host_fabricator
           - *host_nut_network
           - *host_nut_homelab
           - *host_whirlwind
+          - *host_gateway

deploy/terraform/configuration.tf

@@ -70,3 +70,7 @@ provider "porkbun" {
   api_key        = data.sops_file.secrets.data["PORKBUN_API_KEY"]
   secret_api_key = data.sops_file.secrets.data["PORKBUN_API_SECRET"]
 }
+
+provider "hcloud" {
+  token = data.sops_file.secrets.data["HETZNER_API_TOKEN"]
+}

deploy/terraform/dns.tf

@@ -18,23 +18,23 @@ resource "aws_route53_record" "root_e10_video" {
   name    = "e10.video"
   type    = "A"
   ttl     = 300
-  records = [aws_eip.bastion.public_ip]
+  records = [hcloud_server.gateway.ipv4_address]
 }
 
 resource "aws_route53_record" "status_e10_video" {
   zone_id = aws_route53_zone.e10_video.zone_id
   name    = "status.e10.video"
   type    = "A"
   ttl     = 300
-  records = [aws_eip.monitor.public_ip]
+  records = [hcloud_server.monitor.ipv4_address]
 }
 
 resource "aws_route53_record" "wildcard_e10_video" {
   zone_id = aws_route53_zone.e10_video.zone_id
   name    = "*.e10.video"
   type    = "A"
   ttl     = 300
-  records = [aws_eip.bastion.public_ip]
+  records = [hcloud_server.gateway.ipv4_address]
 }
 
 resource "aws_route53_record" "em824837_e10_video" {
@@ -81,15 +81,15 @@ resource "aws_route53_record" "root_e10_land" {
   name    = "e10.land"
   type    = "A"
   ttl     = 300
-  records = [aws_eip.bastion.public_ip]
+  records = [hcloud_server.gateway.ipv4_address]
 }
 
 resource "aws_route53_record" "wildcard_e10_land" {
   zone_id = aws_route53_zone.e10_land.zone_id
   name    = "*.e10.land"
   type    = "A"
   ttl     = 300
-  records = [aws_eip.bastion.public_ip]
+  records = [hcloud_server.gateway.ipv4_address]
 }
 
 # e10.camp
@@ -111,96 +111,96 @@ resource "aws_route53_record" "root_e10_camp" {
   zone_id = aws_route53_zone.e10_camp.zone_id
   name    = "e10.camp"
   type    = "A"
-  ttl     = 300
-  records = [aws_eip.bastion.public_ip]
+  ttl     = 60
+  records = [hcloud_server.gateway.ipv4_address]
 }
 
-resource "aws_route53_record" "bastion_e10_camp" {
+resource "aws_route53_record" "gateway_e10_camp" {
   zone_id = aws_route53_zone.e10_camp.zone_id
-  name    = "bastion.e10.camp"
+  name    = "gateway.e10.camp"
   type    = "A"
   ttl     = 300
-  records = [aws_eip.bastion.public_ip]
+  records = [hcloud_server.gateway.ipv4_address]
 }
 
 resource "aws_route53_record" "monitor_e10_camp" {
   zone_id = aws_route53_zone.e10_camp.zone_id
   name    = "monitor.e10.camp"
   type    = "A"
-  ttl     = 300
-  records = [aws_eip.monitor.public_ip]
+  ttl     = 60
+  records = [hcloud_server.monitor.ipv4_address]
 }
 
 resource "aws_route53_record" "grafana_e10_camp" {
   zone_id = aws_route53_zone.e10_camp.zone_id
   name    = "grafana.e10.camp"
   type    = "A"
-  ttl     = 300
-  records = [aws_eip.monitor.public_ip]
+  ttl     = 60
+  records = [hcloud_server.monitor.ipv4_address]
 }
 
 resource "aws_route53_record" "status_e10_camp" {
   zone_id = aws_route53_zone.e10_camp.zone_id
   name    = "status.e10.camp"
   type    = "A"
-  ttl     = 300
-  records = [aws_eip.monitor.public_ip]
+  ttl     = 60
+  records = [hcloud_server.monitor.ipv4_address]
 }
 
 resource "aws_route53_record" "ntfy_e10_camp" {
   zone_id = aws_route53_zone.e10_camp.zone_id
   name    = "ntfy.e10.camp"
   type    = "A"
-  ttl     = 300
-  records = [aws_eip.monitor.public_ip]
+  ttl     = 60
+  records = [hcloud_server.monitor.ipv4_address]
 }
 
 resource "aws_route53_record" "healthchecks_e10_camp" {
   zone_id = aws_route53_zone.e10_camp.zone_id
   name    = "healthchecks.e10.camp"
   type    = "A"
-  ttl     = 300
-  records = [aws_eip.monitor.public_ip]
+  ttl     = 60
+  records = [hcloud_server.monitor.ipv4_address]
 }
 
 resource "aws_route53_record" "wildcard_e10_camp" {
   zone_id = aws_route53_zone.e10_camp.zone_id
   name    = "*.e10.camp"
   type    = "A"
-  ttl     = 300
-  records = [aws_eip.bastion.public_ip]
+  ttl     = 60
+  records = [hcloud_server.gateway.ipv4_address]
 }
 
 resource "aws_route53_record" "em824837_e10_camp" {
   zone_id = aws_route53_zone.e10_camp.zone_id
   name    = "em824837.e10.camp"
   type    = "CNAME"
   records = ["return.smtp2go.net"]
-  ttl     = 300
+  ttl     = 60
 }
 
 resource "aws_route53_record" "s824837_domainkey_e10_camp" {
   zone_id = aws_route53_zone.e10_camp.zone_id
   name    = "s824837._domainkey.e10.camp"
   type    = "CNAME"
   records = ["dkim.smtp2go.net"]
-  ttl     = 300
+  ttl     = 60
 }
 
 resource "aws_route53_record" "link_email_e10_camp" {
   zone_id = aws_route53_zone.e10_camp.zone_id
   name    = "link.email.e10.camp"
   type    = "CNAME"
   records = ["track.smtp2go.net"]
-  ttl     = 300
+  ttl     = 60
 }
 
 resource "aws_route53_record" "auth_monitor_e10_camp" {
   zone_id = aws_route53_zone.e10_camp.zone_id
   name    = "auth.monitor.e10.camp"
   type    = "A"
-  records = [aws_eip.monitor.public_ip]
-  ttl     = 300
+  records = [hcloud_server.monitor.ipv4_address]
+  ttl     = 60
 }
 
 # satan.network
@@ -223,7 +223,7 @@ resource "aws_route53_record" "unifi_satan_network" {
   name    = "unifi.satan.network"
   type    = "A"
   ttl     = 300
-  records = [aws_eip.bastion.public_ip]
+  records = [hcloud_server.gateway.ipv4_address]
 }
 
 # e10.network
@@ -246,15 +246,15 @@ resource "aws_route53_record" "root_e10_network" {
   name    = "e10.network"
   type    = "A"
   ttl     = 300
-  records = [aws_eip.bastion.public_ip]
+  records = [hcloud_server.gateway.ipv4_address]
 }
 
 resource "aws_route53_record" "wildcard_e10_network" {
   zone_id = aws_route53_zone.e10_network.zone_id
   name    = "*.e10.network"
   type    = "A"
   ttl     = 300
-  records = [aws_eip.bastion.public_ip]
+  records = [hcloud_server.gateway.ipv4_address]
 }
 
 # turkeltaub.me
@@ -413,6 +413,22 @@ resource "aws_route53_zone" "e10_computer" {
   name = "e10.computer"
 }
 
+resource "aws_route53_record" "root_e10_computer" {
+  zone_id = aws_route53_zone.e10_computer.zone_id
+  name    = "e10.computer"
+  type    = "A"
+  ttl     = 300
+  records = [hcloud_server.gateway.ipv4_address]
+}
+
+resource "aws_route53_record" "wildcard_e10_computer" {
+  zone_id = aws_route53_zone.e10_computer.zone_id
+  name    = "*.e10.computer"
+  type    = "A"
+  ttl     = 300
+  records = [hcloud_server.gateway.ipv4_address]
+}
+
 resource "porkbun_nameservers" "e10_computer" {
   domain      = "e10.computer"
   nameservers = sort(aws_route53_zone.e10_computer.name_servers)

deploy/terraform/keys.tf

@@ -50,3 +50,8 @@ resource "local_sensitive_file" "rsync_net_public_key" {
   filename        = "${path.module}/../../keys/rsync_net_rsa.pub"
   file_permission = "0600"
 }
+
+resource "hcloud_ssh_key" "deploy" {
+  name       = "deploy"
+  public_key = file("${path.module}/../../keys/id_rsa.pub")
+}