Fix network assignment and add firewalls

terraform/.terraform.lock.hcl

@@ -2,20 +2,21 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/hetznercloud/hcloud" {
-  version     = "1.24.0"
-  constraints = "1.24.0"
+  version     = "1.26.0"
+  constraints = "1.26.0"
   hashes = [
-    "h1:vvqGYZelldPCpFeaelRQ1Eif0Gv/Si1S5h9gKPlHhAU=",
-    "zh:167864a19937ec8cb8a5c76ddbb0171dcc349b956783bad54868e334b5fdfce5",
-    "zh:1ded8cd94cd70fd29385610bd6d7c8cbf4f5c24f41e343bb522f0f4e5c4a46d2",
-    "zh:4b2dcab6c32d903c0a52354cd41062b83ccf29ae776c28425399b1d7033a8bc3",
-    "zh:6602fffa0b5ea12bebef2cd9f362a51cc103f50aa0a1c2bd9913a08131d705b8",
-    "zh:a3b365f71fbd9d45751f5caa13b5053d7e16ab6eee664fc5048199abfa57317a",
-    "zh:b374b12a9cd7971983008b99567da888101e89085ccee35eced51494fd6764ca",
-    "zh:bfb5e5ab097d412d74cdfe72fab509ef29f2fb651f2e80440e1f74c393eb3914",
-    "zh:c23febaf02ad46a528adfa98011e8fa66dbd55b75971a31eeb2a54d797ffd2e0",
-    "zh:cc608d2a967383cb951e8796f844321a80d7cae3797c455d4b9f3a9f585f51e0",
-    "zh:d3922631a3ef57c130471dad91fc868b961460d6a7a193398e9ed646712a92f7",
-    "zh:e68342eea16b34a69d3f615fdd27176c59430f93a65e9f9eb52b27827549ffba",
+    "h1:2LLe4UKLS7R+t+tQL1oOFLA8c8/rs3iCfT26LyiQcsk=",
+    "zh:03d7eb722a4ee25774949baace0125392060d0369d4cb9257d7d298ab6ece3ff",
+    "zh:0fed2e63ac4cb6fe6b2a5b6891abf973cb7c1716e487fbabc09216e0ec05e866",
+    "zh:1a84c8c1c8e2d6607de5aa09aa3f9254183cde75a5acc666cca5f4b02a1d290e",
+    "zh:23ac426aa3a0001fb20045dc35569978864f139732f45ab671c64e80123c91a1",
+    "zh:23b78348b24ae3e4679bd90989c999346efd71ee228d17368d5f556f63e5fd06",
+    "zh:2503fe28ac87661af96e7755a7404307000822104ac1abc571271eee46c95ab5",
+    "zh:3fe859b2611d20ed5cd65cc2ec812acf73c7dfb39f2fee45ef99a3896c2662a8",
+    "zh:51ef869ed35d0d8aada35f587c4a64802f1140dc93c40a4e7c9800560143bb1a",
+    "zh:69b93cf4adca465b89da08e4e3b4aaf831821f1fbae68e526c0a292b3cfa463d",
+    "zh:6a4e23c6aa86e3d30240e6e4c97daef3af9ad217be2c6f35300fe1839fdbf8b2",
+    "zh:97a513459692a981a62b4a566c1d736c4a67622d2fbbee3771ec3ea8d576d484",
+    "zh:fec6c07731e23d1dd45015b44747b89c4fee58b5b2560f96d24c7da5a8ecb2ad",
   ]
 }

terraform/main.tf

@@ -35,12 +35,7 @@ resource "hcloud_server" "server" {
     "everyonecancontribute.com/server" = "true",
     "everyonecancontribute.com/agent"  = "false"
   }
-  network {
-    network_id = hcloud_network.k3s.id
-  }
-  depends_on = [
-    hcloud_network_subnet.k3s
-  ]
+  firewall_ids = [hcloud_firewall.base.id, hcloud_firewall.k3s-server.id]
 }
 
 resource "hcloud_server" "agent-cx21" {
@@ -54,12 +49,7 @@ resource "hcloud_server" "agent-cx21" {
     "everyonecancontribute.com/server" = "false",
     "everyonecancontribute.com/agent"  = "true"
   }
-  network {
-    network_id = hcloud_network.k3s.id
-  }
-  depends_on = [
-    hcloud_network_subnet.k3s
-  ]
+  firewall_ids = [hcloud_firewall.base.id]
 }
 
 resource "hcloud_network" "k3s" {
@@ -73,3 +63,40 @@ resource "hcloud_network_subnet" "k3s" {
   network_zone = "eu-central"
   ip_range     = "10.29.0.0/24"
 }
+
+resource "hcloud_server_network" "server" {
+  count      = length(hcloud_server.server)
+  server_id  = hcloud_server.server[count.index].id
+  network_id = hcloud_network.k3s.id
+}
+
+resource "hcloud_server_network" "agent-cx21" {
+  count      = length(hcloud_server.agent-cx21)
+  server_id  = hcloud_server.agent-cx21[count.index].id
+  network_id = hcloud_network.k3s.id
+}
+
+resource "hcloud_firewall" "base" {
+  name = "base"
+  rule {
+    direction  = "in"
+    protocol   = "icmp"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "22"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+}
+
+resource "hcloud_firewall" "k3s-server" {
+  name = "k3s-server"
+  rule {
+    direction  = "in"
+    protocol   = "tcp"
+    port       = "6443"
+    source_ips = ["0.0.0.0/0", "::/0"]
+  }
+}

terraform/version.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     hcloud = {
       source  = "hetznercloud/hcloud"
-      version = "1.24.0"
+      version = "1.26.0"
     }
   }
 }