From 461aebd3f16de2d92f06ec9dad1310a334403cdc Mon Sep 17 00:00:00 2001 From: Ethan Turkeltaub Date: Sat, 12 Sep 2026 11:44:47 -0400 Subject: [PATCH 1/2] Remove dead Terraform code --- deploy/terraform/configuration.tf | 2 +- deploy/terraform/keys.tf | 5 ----- deploy/terraform/nixos.tf | 6 ------ deploy/terraform/servers.tf | 4 ++-- deploy/terraform/state.tf | 12 ------------ deploy/terraform/variables.tf | 8 ++++---- 6 files changed, 7 insertions(+), 30 deletions(-) delete mode 100644 deploy/terraform/nixos.tf diff --git a/deploy/terraform/configuration.tf b/deploy/terraform/configuration.tf index 6fc78961..0b20bd31 100644 --- a/deploy/terraform/configuration.tf +++ b/deploy/terraform/configuration.tf @@ -7,7 +7,7 @@ provider "tailscale" { provider "aws" { access_key = data.sops_file.secrets.data["AWS_ACCESS_KEY_ID"] secret_key = data.sops_file.secrets.data["AWS_SECRET_ACCESS_KEY"] - region = var.region + region = "us-east-2" } provider "proxmox" { diff --git a/deploy/terraform/keys.tf b/deploy/terraform/keys.tf index c796aed8..f5ee9341 100644 --- a/deploy/terraform/keys.tf +++ b/deploy/terraform/keys.tf @@ -14,11 +14,6 @@ resource "local_sensitive_file" "deploy_public_key" { file_permission = "0600" } -resource "aws_key_pair" "deploy_key" { - key_name = "generated-key-${sha256(tls_private_key.deploy_key.public_key_openssh)}" - public_key = tls_private_key.deploy_key.public_key_openssh -} - resource "tls_private_key" "builder_key" { algorithm = "RSA" } diff --git a/deploy/terraform/nixos.tf b/deploy/terraform/nixos.tf deleted file mode 100644 index b5400387..00000000 --- a/deploy/terraform/nixos.tf +++ /dev/null @@ -1,6 +0,0 @@ -# https://nixos.github.io/amis/ - -variable "aws_ami_nixos_arm64" { - default = "ami-0da2240a68445a0f9" - type = string -} diff --git a/deploy/terraform/servers.tf b/deploy/terraform/servers.tf index 1759a852..d7e58cea 100644 --- a/deploy/terraform/servers.tf +++ b/deploy/terraform/servers.tf @@ -5,7 +5,7 @@ resource "hcloud_server" "gateway" { server_type = "cpx11" - location = "ash" + location = var.hcloud_primary_location image = "debian-12" @@ -53,7 +53,7 @@ resource "hcloud_server" "monitor" { server_type = "cpx21" - location = "hil" + location = var.hcloud_secondary_location image = "debian-12" diff --git a/deploy/terraform/state.tf b/deploy/terraform/state.tf index f4c2a00b..8717feeb 100644 --- a/deploy/terraform/state.tf +++ b/deploy/terraform/state.tf @@ -10,18 +10,6 @@ resource "aws_s3_bucket_versioning" "deploy" { } } -resource "aws_dynamodb_table" "terraform_state_lock" { - name = "terraform_lock" - read_capacity = 5 - write_capacity = 5 - hash_key = "LockID" - - attribute { - name = "LockID" - type = "S" - } -} - terraform { backend "s3" { bucket = "deploy.e10.camp" diff --git a/deploy/terraform/variables.tf b/deploy/terraform/variables.tf index 605018fa..caec730a 100644 --- a/deploy/terraform/variables.tf +++ b/deploy/terraform/variables.tf @@ -1,9 +1,9 @@ -variable "region" { - default = "us-east-2" +variable "hcloud_primary_location" { + default = "ash" type = string } -variable "availability_zone" { - default = "us-east-2a" +variable "hcloud_secondary_location" { + default = "hil" type = string } From 6e40e9046c8dfba3ebf4329956d1c885322ef5aa Mon Sep 17 00:00:00 2001 From: Ethan Turkeltaub Date: Sun, 13 Sep 2026 20:15:56 -0400 Subject: [PATCH 2/2] Finish cleaning up Terraform --- deploy/terraform/certificates.tf | 63 +++++++++------ deploy/terraform/configuration.tf | 76 ------------------- deploy/terraform/email.tf | 9 --- deploy/terraform/networking.tf | 11 --- deploy/terraform/providers.tf | 122 ++++++++++++++++++------------ deploy/terraform/secrets.tf | 2 +- deploy/terraform/servers.tf | 7 -- deploy/terraform/variables.tf | 5 ++ deploy/terraform/versions.tf | 50 ++++++++++++ 9 files changed, 169 insertions(+), 176 deletions(-) delete mode 100644 deploy/terraform/configuration.tf delete mode 100644 deploy/terraform/networking.tf create mode 100644 deploy/terraform/versions.tf diff --git a/deploy/terraform/certificates.tf b/deploy/terraform/certificates.tf index ec557a24..6bf83699 100644 --- a/deploy/terraform/certificates.tf +++ b/deploy/terraform/certificates.tf @@ -1,19 +1,34 @@ +variable "acme_staging_directory" { + default = "https://acme-staging-v02.api.letsencrypt.org/directory" + type = string +} + +variable "acme_production_directory" { + default = "https://acme-v02.api.letsencrypt.org/directory" + type = string +} + +variable "acme_tos" { + default = "https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf" + type = string +} + resource "proxmox_virtual_environment_acme_account" "anise_staging" { provider = proxmox.anise name = "staging" - contact = "admin@e10.camp" - directory = "https://acme-staging-v02.api.letsencrypt.org/directory" - tos = "https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf" + contact = var.admin_email_address + directory = var.acme_staging_directory + tos = var.acme_tos } resource "proxmox_virtual_environment_acme_account" "anise_production" { provider = proxmox.anise name = "production" - contact = "admin@e10.camp" - directory = "https://acme-v02.api.letsencrypt.org/directory" - tos = "https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf" + contact = var.admin_email_address + directory = var.acme_production_directory + tos = var.acme_tos } resource "proxmox_virtual_environment_acme_dns_plugin" "anise_dns_plugin" { @@ -32,18 +47,18 @@ resource "proxmox_virtual_environment_acme_account" "basil_staging" { provider = proxmox.basil name = "staging" - contact = "admin@e10.camp" - directory = "https://acme-staging-v02.api.letsencrypt.org/directory" - tos = "https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf" + contact = var.admin_email_address + directory = var.acme_staging_directory + tos = var.acme_tos } resource "proxmox_virtual_environment_acme_account" "basil_production" { provider = proxmox.basil name = "production" - contact = "admin@e10.camp" - directory = "https://acme-v02.api.letsencrypt.org/directory" - tos = "https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf" + contact = var.admin_email_address + directory = var.acme_production_directory + tos = var.acme_tos } resource "proxmox_virtual_environment_acme_dns_plugin" "basil_dns_plugin" { @@ -62,18 +77,18 @@ resource "proxmox_virtual_environment_acme_account" "cardamom_staging" { provider = proxmox.cardamom name = "staging" - contact = "admin@e10.camp" - directory = "https://acme-staging-v02.api.letsencrypt.org/directory" - tos = "https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf" + contact = var.admin_email_address + directory = var.acme_staging_directory + tos = var.acme_tos } resource "proxmox_virtual_environment_acme_account" "cardamom_production" { provider = proxmox.cardamom name = "production" - contact = "admin@e10.camp" - directory = "https://acme-v02.api.letsencrypt.org/directory" - tos = "https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf" + contact = var.admin_email_address + directory = var.acme_production_directory + tos = var.acme_tos } resource "proxmox_virtual_environment_acme_dns_plugin" "cardamom_dns_plugin" { @@ -92,18 +107,18 @@ resource "proxmox_virtual_environment_acme_account" "elderflower_staging" { provider = proxmox.elderflower name = "staging" - contact = "admin@e10.camp" - directory = "https://acme-staging-v02.api.letsencrypt.org/directory" - tos = "https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf" + contact = var.admin_email_address + directory = var.acme_staging_directory + tos = var.acme_tos } resource "proxmox_virtual_environment_acme_account" "elderflower_production" { provider = proxmox.elderflower name = "production" - contact = "admin@e10.camp" - directory = "https://acme-v02.api.letsencrypt.org/directory" - tos = "https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf" + contact = var.admin_email_address + directory = var.acme_production_directory + tos = var.acme_tos } resource "proxmox_virtual_environment_acme_dns_plugin" "elderflower_dns_plugin" { diff --git a/deploy/terraform/configuration.tf b/deploy/terraform/configuration.tf deleted file mode 100644 index 0b20bd31..00000000 --- a/deploy/terraform/configuration.tf +++ /dev/null @@ -1,76 +0,0 @@ -provider "tailscale" { - oauth_client_id = data.sops_file.secrets.data["TAILSCALE_OAUTH_CLIENT_ID"] - oauth_client_secret = data.sops_file.secrets.data["TAILSCALE_OAUTH_CLIENT_SECRET"] - tailnet = data.sops_file.secrets.data["TAILSCALE_TAILNET"] -} - -provider "aws" { - access_key = data.sops_file.secrets.data["AWS_ACCESS_KEY_ID"] - secret_key = data.sops_file.secrets.data["AWS_SECRET_ACCESS_KEY"] - region = "us-east-2" -} - -provider "proxmox" { - alias = "anise" - endpoint = "https://anise:8006/" - username = data.sops_file.secrets.data["ANISE_PM_USERNAME"] - password = data.sops_file.secrets.data["ANISE_PM_PASSWORD"] - insecure = true - - ssh { - agent = true - username = "deploy" - } -} - -provider "proxmox" { - alias = "basil" - endpoint = "https://basil:8006/" - username = data.sops_file.secrets.data["BASIL_PM_USERNAME"] - password = data.sops_file.secrets.data["BASIL_PM_PASSWORD"] - insecure = true - - ssh { - agent = true - username = "deploy" - } -} - -provider "proxmox" { - alias = "cardamom" - endpoint = "https://cardamom:8006/" - username = data.sops_file.secrets.data["CARDAMOM_PM_USERNAME"] - password = data.sops_file.secrets.data["CARDAMOM_PM_PASSWORD"] - insecure = true - - ssh { - agent = true - username = "deploy" - } -} - -provider "proxmox" { - alias = "elderflower" - endpoint = "https://elderflower:8006/" - username = data.sops_file.secrets.data["ELDERFLOWER_PM_USERNAME"] - password = data.sops_file.secrets.data["ELDERFLOWER_PM_PASSWORD"] - insecure = true - - ssh { - agent = true - username = "deploy" - } -} - -provider "improvmx" { - token = data.sops_file.secrets.data["IMPROVMX_API_TOKEN"] -} - -provider "porkbun" { - api_key = data.sops_file.secrets.data["PORKBUN_API_KEY"] - secret_api_key = data.sops_file.secrets.data["PORKBUN_API_SECRET"] -} - -provider "hcloud" { - token = data.sops_file.secrets.data["HETZNER_API_TOKEN"] -} diff --git a/deploy/terraform/email.tf b/deploy/terraform/email.tf index e40eb5c1..7a33dd84 100644 --- a/deploy/terraform/email.tf +++ b/deploy/terraform/email.tf @@ -81,12 +81,3 @@ resource "aws_iam_user_policy_attachment" "mailer_ses_sender" { user = aws_iam_user.mailer.name policy_arn = aws_iam_policy.ses_sender.arn } - -# output "smtp_username" { -# value = aws_iam_access_key.mailer.id -# } - -# output "smtp_password" { -# value = aws_iam_access_key.mailer.ses_smtp_password_v4 -# sensitive = true -# } diff --git a/deploy/terraform/networking.tf b/deploy/terraform/networking.tf deleted file mode 100644 index 5c8006b7..00000000 --- a/deploy/terraform/networking.tf +++ /dev/null @@ -1,11 +0,0 @@ -resource "hcloud_network" "private_network" { - name = "private-network" - ip_range = "172.16.0.0/16" -} - -resource "hcloud_network_subnet" "default_private_network_subnet" { - type = "cloud" - network_id = hcloud_network.private_network.id - network_zone = "us-east" - ip_range = "172.16.1.0/24" -} diff --git a/deploy/terraform/providers.tf b/deploy/terraform/providers.tf index ad8d9f87..0b20bd31 100644 --- a/deploy/terraform/providers.tf +++ b/deploy/terraform/providers.tf @@ -1,50 +1,76 @@ -terraform { - required_version = ">= 1.0" - - required_providers { - aws = { - source = "hashicorp/aws" - version = "5.35.0" - } - - local = { - source = "hashicorp/local" - version = "2.9.0" - } - - tls = { - source = "hashicorp/tls" - version = "4.3.0" - } - - tailscale = { - source = "tailscale/tailscale" - version = "0.24.0" - } - - sops = { - source = "carlpett/sops" - version = "1.0.0" - } - - proxmox = { - source = "bpg/proxmox" - version = "0.66.3" - } - - improvmx = { - source = "issyl0/improvmx" - version = "0.7.1" - } - - porkbun = { - source = "kyswtn/porkbun" - version = "0.1.3" - } - - hcloud = { - source = "hetznercloud/hcloud" - version = "1.68.0" - } +provider "tailscale" { + oauth_client_id = data.sops_file.secrets.data["TAILSCALE_OAUTH_CLIENT_ID"] + oauth_client_secret = data.sops_file.secrets.data["TAILSCALE_OAUTH_CLIENT_SECRET"] + tailnet = data.sops_file.secrets.data["TAILSCALE_TAILNET"] +} + +provider "aws" { + access_key = data.sops_file.secrets.data["AWS_ACCESS_KEY_ID"] + secret_key = data.sops_file.secrets.data["AWS_SECRET_ACCESS_KEY"] + region = "us-east-2" +} + +provider "proxmox" { + alias = "anise" + endpoint = "https://anise:8006/" + username = data.sops_file.secrets.data["ANISE_PM_USERNAME"] + password = data.sops_file.secrets.data["ANISE_PM_PASSWORD"] + insecure = true + + ssh { + agent = true + username = "deploy" + } +} + +provider "proxmox" { + alias = "basil" + endpoint = "https://basil:8006/" + username = data.sops_file.secrets.data["BASIL_PM_USERNAME"] + password = data.sops_file.secrets.data["BASIL_PM_PASSWORD"] + insecure = true + + ssh { + agent = true + username = "deploy" } } + +provider "proxmox" { + alias = "cardamom" + endpoint = "https://cardamom:8006/" + username = data.sops_file.secrets.data["CARDAMOM_PM_USERNAME"] + password = data.sops_file.secrets.data["CARDAMOM_PM_PASSWORD"] + insecure = true + + ssh { + agent = true + username = "deploy" + } +} + +provider "proxmox" { + alias = "elderflower" + endpoint = "https://elderflower:8006/" + username = data.sops_file.secrets.data["ELDERFLOWER_PM_USERNAME"] + password = data.sops_file.secrets.data["ELDERFLOWER_PM_PASSWORD"] + insecure = true + + ssh { + agent = true + username = "deploy" + } +} + +provider "improvmx" { + token = data.sops_file.secrets.data["IMPROVMX_API_TOKEN"] +} + +provider "porkbun" { + api_key = data.sops_file.secrets.data["PORKBUN_API_KEY"] + secret_api_key = data.sops_file.secrets.data["PORKBUN_API_SECRET"] +} + +provider "hcloud" { + token = data.sops_file.secrets.data["HETZNER_API_TOKEN"] +} diff --git a/deploy/terraform/secrets.tf b/deploy/terraform/secrets.tf index d3b47c14..0b59d6d9 100644 --- a/deploy/terraform/secrets.tf +++ b/deploy/terraform/secrets.tf @@ -1,3 +1,3 @@ data "sops_file" "secrets" { - source_file = "../../secrets.json" + source_file = "${path.module}/../../secrets.json" } diff --git a/deploy/terraform/servers.tf b/deploy/terraform/servers.tf index d7e58cea..0e5d4ec7 100644 --- a/deploy/terraform/servers.tf +++ b/deploy/terraform/servers.tf @@ -17,16 +17,9 @@ resource "hcloud_server" "gateway" { ipv6_enabled = true } - network { - network_id = hcloud_network.private_network.id - ip = "172.16.1.10" - } - lifecycle { ignore_changes = [ssh_keys, image] } - - depends_on = [hcloud_network_subnet.default_private_network_subnet] } module "gateway_install" { diff --git a/deploy/terraform/variables.tf b/deploy/terraform/variables.tf index caec730a..d99fc963 100644 --- a/deploy/terraform/variables.tf +++ b/deploy/terraform/variables.tf @@ -7,3 +7,8 @@ variable "hcloud_secondary_location" { default = "hil" type = string } + +variable "admin_email_address" { + default = "admin@e10.camp" + type = string +} diff --git a/deploy/terraform/versions.tf b/deploy/terraform/versions.tf new file mode 100644 index 00000000..ad8d9f87 --- /dev/null +++ b/deploy/terraform/versions.tf @@ -0,0 +1,50 @@ +terraform { + required_version = ">= 1.0" + + required_providers { + aws = { + source = "hashicorp/aws" + version = "5.35.0" + } + + local = { + source = "hashicorp/local" + version = "2.9.0" + } + + tls = { + source = "hashicorp/tls" + version = "4.3.0" + } + + tailscale = { + source = "tailscale/tailscale" + version = "0.24.0" + } + + sops = { + source = "carlpett/sops" + version = "1.0.0" + } + + proxmox = { + source = "bpg/proxmox" + version = "0.66.3" + } + + improvmx = { + source = "issyl0/improvmx" + version = "0.7.1" + } + + porkbun = { + source = "kyswtn/porkbun" + version = "0.1.3" + } + + hcloud = { + source = "hetznercloud/hcloud" + version = "1.68.0" + } + } +}