thermograph/terraform/main.tf

locals {
  # Repo root (one level above this terraform/ dir). The module hashes the compose
  # files here so a compose change re-triggers the remote deploy, and this is the
  # tree the host's checkout mirrors over git.
  repo_root = abspath("${path.root}/..")

  # Reusable size presets — a host can reference one by name (hosts.<name>.size)
  # instead of hand-picking workers/app_cpus/db_cpus/db_memory separately. Mirrors
  # the target Proxmox sizing-tier model (architecture doc §6: nano/small/medium/
  # large -> {cores, mem}) ahead of actually provisioning VMs — Proxmox itself is
  # deferred; today these tiers just size the container caps on the existing
  # SSH-managed VPS hosts. "large" matches the current 48 GB prod box's numbers.
  sizes = {
    nano   = { workers = 1, app_cpus = 1, db_cpus = 1, db_memory = "1g" }
    small  = { workers = 4, app_cpus = 4, db_cpus = 2, db_memory = "8g" }
    medium = { workers = 6, app_cpus = 6, db_cpus = 3, db_memory = "12g" }
    large  = { workers = 8, app_cpus = 8, db_cpus = 4, db_memory = "16g" }
  }

  # Per-host resolved sizing: a named tier (host.size) wins when set; otherwise
  # the host's own workers/app_cpus/db_cpus/db_memory fields (each individually
  # defaulted in variables.tf) — so existing tfvars with explicit numbers are
  # unaffected, and a tier is purely an opt-in shortcut.
  host_sizing = {
    for name, h in var.hosts : name => h.size != null ? local.sizes[h.size] : {
      workers   = h.workers
      app_cpus  = h.app_cpus
      db_cpus   = h.db_cpus
      db_memory = h.db_memory
    }
  }
}

# One module instance per host. The module is entirely SSH-provisioner driven — it
# configures an already-existing VPS and hands the app off to docker compose.
module "host" {
  source   = "./modules/thermograph-host"
  for_each = var.hosts

  # Per-host config
  name                 = each.key
  host                 = each.value.host
  ssh_user             = each.value.ssh_user
  ssh_private_key_path = each.value.ssh_private_key_path
  role                 = each.value.role
  git_branch           = each.value.git_branch
  domain               = each.value.domain
  compose_files        = each.value.compose_files
  app_dir              = each.value.app_dir
  workers              = local.host_sizing[each.key].workers
  app_cpus             = local.host_sizing[each.key].app_cpus
  db_cpus              = local.host_sizing[each.key].db_cpus
  db_memory            = local.host_sizing[each.key].db_memory
  timescaledb_tag      = each.value.timescaledb_tag
  openmeteo            = each.value.openmeteo
  om_data_dir          = each.value.om_data_dir

  # Shared infra config
  repo_root = local.repo_root
  repo_url  = var.repo_url
  app_port  = var.app_port

  # Shared object-storage config (only used where openmeteo = true)
  om_bucket_remote = var.om_bucket_remote
  om_rclone_conf   = var.om_rclone_conf
  om_vfs_cache_max = var.om_vfs_cache_max

  # Shared secrets -> /etc/thermograph.env. postgres_password/auth_secret/
  # metrics_token/indexnow_key resolve through secrets.tf's locals (explicit
  # var wins if supplied, else Terraform-generated) rather than the raw vars.
  postgres_password     = local.postgres_password
  auth_secret           = local.auth_secret
  metrics_token         = local.metrics_token
  indexnow_key          = local.indexnow_key
  vapid_private_key     = var.vapid_private_key
  vapid_public_key      = var.vapid_public_key
  vapid_contact         = var.vapid_contact
  google_verify         = var.google_verify
  bing_verify           = var.bing_verify
  mail_backend          = var.mail_backend
  smtp_host             = var.smtp_host
  smtp_port             = var.smtp_port
  smtp_user             = var.smtp_user
  smtp_password         = var.smtp_password
  smtp_starttls         = var.smtp_starttls
  mail_from             = var.mail_from
  mail_reply_to         = var.mail_reply_to
  discord_webhook       = var.discord_webhook
  discord_public_key    = var.discord_public_key
  discord_app_id        = var.discord_app_id
  discord_bot_token     = var.discord_bot_token
  discord_client_secret = var.discord_client_secret
  registry_token        = var.registry_token
}