78 lines
2.9 KiB
Terraform
78 lines
2.9 KiB
Terraform
|
# Creates a GCE VM (+ the minimal networking it needs) for the thermograph-host
|
||
|
|
# module to then provision over SSH — this module contributes NOTHING to
|
||
|
|
# provisioning logic (no Docker install, no compose, no secrets rendering); it
|
||
|
|
# only stands the box up and hands its IP back. See ../../main.tf's module.gcp_vm
|
||
|
|
# / module.host composition. Scaffold only: nothing here is applied until a
|
||
|
|
# caller populates var.gcp_hosts (root variables.tf) with a real entry.
|
||
|
|
|
||
|
|
# A dedicated VPC rather than the project's "default" network, so this doesn't
|
||
|
|
# depend on (or clutter) whatever else may already exist in the project.
|
||
|
|
resource "google_compute_network" "this" {
|
||
|
|
project = var.project
|
||
|
|
name = "thermograph-${var.name}"
|
||
|
|
auto_create_subnetworks = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "google_compute_subnetwork" "this" {
|
||
|
|
project = var.project
|
||
|
|
name = "thermograph-${var.name}"
|
||
|
|
network = google_compute_network.this.id
|
||
|
|
region = join("-", slice(split("-", var.zone), 0, 2))
|
||
|
|
ip_cidr_range = "10.20.0.0/24"
|
||
|
|
}
|
||
|
|
|
||
|
|
# 22/80/443 only -- matches the SSH-managed hosts' own ufw rules (thermograph-host
|
||
|
|
# module's setup step). The app port itself is opened by that same module's ufw
|
||
|
|
# step when the host has no domain, same as any other host it provisions.
|
||
|
|
resource "google_compute_firewall" "allow_ingress" {
|
||
|
|
project = var.project
|
||
|
|
name = "thermograph-${var.name}-allow-ingress"
|
||
|
|
network = google_compute_network.this.id
|
||
|
|
source_ranges = ["0.0.0.0/0"]
|
||
|
|
|
||
|
|
allow {
|
||
|
|
protocol = "tcp"
|
||
|
|
ports = ["22", "80", "443"]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "google_compute_instance" "this" {
|
||
|
|
project = var.project
|
||
|
|
name = "thermograph-${var.name}"
|
||
|
|
zone = var.zone
|
||
|
|
machine_type = var.machine_type
|
||
|
|
|
||
|
|
boot_disk {
|
||
|
|
initialize_params {
|
||
|
|
# Debian: matches the apt-based setup script thermograph-host's
|
||
|
|
# provisioner runs (Docker's get.docker.com installer, ufw, Caddy's apt repo).
|
||
|
|
image = "debian-cloud/debian-12"
|
||
|
|
size = 30
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
network_interface {
|
||
|
|
subnetwork = google_compute_subnetwork.this.id
|
||
|
|
access_config {} # ephemeral public IP
|
||
|
|
}
|
||
|
|
|
||
|
|
metadata = {
|
||
|
|
ssh-keys = "${var.ssh_user}:${file(pathexpand(var.ssh_public_key_path))}"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# A brief pause before the caller's thermograph-host module opens an SSH
|
||
|
|
# connection: a fresh GCE instance's sshd is not always immediately reachable
|
||
|
|
# the instant the API reports the instance RUNNING (cloud-init/sshd startup is a
|
||
|
|
# known race here, distinct from the null_resource provisioner's own timeout).
|
||
|
|
resource "time_sleep" "wait_for_ssh" {
|
||
|
|
create_duration = "30s"
|
||
|
|
depends_on = [google_compute_instance.this]
|
||
|
|
}
|
||
|
|
|
||
|
|
output "external_ip" {
|
||
|
|
description = "Public IP of the created instance, once it (and a short settle delay) exist."
|
||
|
|
value = google_compute_instance.this.network_interface[0].access_config[0].nat_ip
|
||
|
|
depends_on = [time_sleep.wait_for_ssh]
|
||
|
|
}
|