Thomas Peterson
79e996ab03
- Caddy ersetzt den Hetzner-LB: terminiert TLS (Portal-Domain automatisch) und load-balanced per reverse_proxy über die App-Nodes. Für Custom-Domains (§11) On-Demand-TLS, autorisiert über GET /internal/tls-allowed. - TlsCheckController + DomainRepository::findVerifiedByHostname: erlaubt Zertifikate nur für Portal-Domain oder verifizierte Domains (Schutz vor Cert-Flooding). - Terraform: hcloud_load_balancer entfernt, Caddy-Server + Firewall (80/443) + cloud-init-caddy (Caddyfile templated mit Upstreams/Domain/ACME). - Optional Hetzner DNS via API (manage_dns): A-Record Portal + Wildcard → Caddy. - nginx.prod: /internal zu Symfony geroutet; APP_PORTAL_DOMAIN-Env. Validiert: Caddyfile (caddy validate), Terraform (validate), /internal/tls-allowed (200/403/400). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
157 lines
3.2 KiB
HCL
157 lines
3.2 KiB
HCL
variable "hcloud_token" {
|
|
description = "Hetzner Cloud API Token (Projekt → Security → API Tokens, Read&Write)"
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "location" {
|
|
description = "Hetzner Standort"
|
|
type = string
|
|
default = "nbg1"
|
|
}
|
|
|
|
variable "network_zone" {
|
|
description = "Netzwerk-Zone passend zum Standort (eu-central für nbg1/fsn1/hel1)"
|
|
type = string
|
|
default = "eu-central"
|
|
}
|
|
|
|
variable "ssh_public_key" {
|
|
description = "Öffentlicher SSH-Schlüssel für Server-Zugang"
|
|
type = string
|
|
}
|
|
|
|
variable "admin_cidr" {
|
|
description = "CIDR, das per SSH auf die Server darf (z. B. deine IP/32)"
|
|
type = string
|
|
}
|
|
|
|
variable "app_count" {
|
|
description = "Anzahl App-Nodes (für den Skalierungstest >= 2)"
|
|
type = number
|
|
default = 2
|
|
}
|
|
|
|
variable "app_server_type" {
|
|
description = "Servertyp App-Nodes"
|
|
type = string
|
|
default = "cx22"
|
|
}
|
|
|
|
variable "db_server_type" {
|
|
description = "Servertyp DB-Node"
|
|
type = string
|
|
default = "cx22"
|
|
}
|
|
|
|
# --- Anwendung / Deploy ---
|
|
variable "repo_url" {
|
|
description = "Git-URL des Repos (per cloud-init geklont; bei privat: Deploy-Token in der URL)"
|
|
type = string
|
|
}
|
|
|
|
variable "repo_branch" {
|
|
description = "Zu deployender Branch"
|
|
type = string
|
|
default = "main"
|
|
}
|
|
|
|
variable "domain" {
|
|
description = "Öffentliche Portal-Domain (CORS, Profil-URLs, TLS)"
|
|
type = string
|
|
}
|
|
|
|
variable "acme_email" {
|
|
description = "E-Mail für Let's Encrypt (Caddy ACME)"
|
|
type = string
|
|
}
|
|
|
|
# --- DNS (optional, Hetzner DNS API) ---
|
|
variable "manage_dns" {
|
|
description = "true = A-Records (Portal + Wildcard) per Hetzner DNS anlegen"
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
variable "hetzner_dns_token" {
|
|
description = "Hetzner DNS API Token (separat vom Cloud-Token; nur bei manage_dns)"
|
|
type = string
|
|
default = ""
|
|
sensitive = true
|
|
}
|
|
|
|
variable "dns_zone_name" {
|
|
description = "DNS-Zone bei Hetzner DNS (z. B. example.com), nur bei manage_dns"
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "app_secret" {
|
|
description = "Symfony APP_SECRET"
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "db_name" {
|
|
type = string
|
|
default = "vcard4reseller"
|
|
}
|
|
|
|
variable "db_user" {
|
|
type = string
|
|
default = "app"
|
|
}
|
|
|
|
variable "db_password" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "db_root_password" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "jwt_passphrase" {
|
|
description = "Passphrase der JWT-Schlüssel (identisch zu den erzeugten Keys)"
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "jwt_private_key" {
|
|
description = "Inhalt von config/jwt/private.pem (auf ALLEN Nodes identisch)"
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "jwt_public_key" {
|
|
description = "Inhalt von config/jwt/public.pem"
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
# --- Hetzner Object Storage (S3) ---
|
|
variable "s3_endpoint" {
|
|
description = "z. B. https://nbg1.your-objectstorage.com"
|
|
type = string
|
|
}
|
|
|
|
variable "s3_region" {
|
|
type = string
|
|
default = "nbg1"
|
|
}
|
|
|
|
variable "s3_bucket" {
|
|
type = string
|
|
}
|
|
|
|
variable "s3_key" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "s3_secret" {
|
|
type = string
|
|
sensitive = true
|
|
}
|