terraform-hetzner-docker/server.tf at master · internetztube/terraform-hetzner-docker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
resource "hcloud_server" "default" {
  name         = var.name
  server_type  = var.server_type
  image        = "ubuntu-24.04"
  location     = var.location
  firewall_ids = concat(var.firewall_ids, [hcloud_firewall.ssh.id])
  keep_disk    = var.keep_disk
  backups      = var.backups

  # ipv4 needs to be enabled in order to make ipv4 floating ip work.
  public_net {
    ipv6_enabled = true
    ipv4_enabled = true
  }

  labels = {
    tf_create_final_snapshot = var.create_final_snapshot
  }

  ssh_keys = [var.ssh_key_id]

  # Final Snapshot
  provisioner "local-exec" {
    when        = destroy
    interpreter = ["/bin/bash", "-c"]
    environment = {
      SERVER_ID             = self.id
      SERVER_NAME           = self.name
      SERVER_LOCATION       = self.location
      CREATE_FINAL_SNAPSHOT = lookup(self.labels, "tf_create_final_snapshot", "false")
    }
    command = "sh ${path.module}/scripts/server-final-snapshot.sh"
  }
}

# We're using remote scripts in favor of cloud-init.yml, since with every cloud-init.yml change the server gets recreated.
# With remote scripts, we're more flexible.
resource "null_resource" "host_dependency_basic" {
  triggers = {
    last_update = "2025-05-09"
  }

  depends_on = [
    hcloud_server.default
  ]

  provisioner "remote-exec" {
    inline = [
      <<EOF
        apt-get update
        apt-get install -y ca-certificates unattended-upgrades curl gnupg unzip yq htop
      EOF
    ]

    connection {
      type        = "ssh"
      user        = "root"
      private_key = var.ssh_private_key
      host        = hcloud_server.default.ipv4_address
      timeout     = "5m"
    }
  }
}

resource "null_resource" "host_dependency_aws_cli" {
  triggers = {
    last_update = "2025-03-15"
  }

  depends_on = [
    null_resource.host_dependency_basic
  ]

  provisioner "remote-exec" {
    inline = [
      <<EOF
        curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
        unzip awscliv2.zip
        ./aws/install
        rm -f awscliv2.zip
      EOF
    ]

    connection {
      type        = "ssh"
      user        = "root"
      private_key = var.ssh_private_key
      host        = hcloud_server.default.ipv4_address
      timeout     = "5m"
    }
  }
}

resource "null_resource" "host_dependency_docker" {
  triggers = {
    last_update = "2025-05-11"
  }

  depends_on = [
    null_resource.host_dependency_aws_cli
  ]

  provisioner "remote-exec" {
    inline = [
      <<EOF
        # Clean install
        apt-get remove -y docker-ce                || true
        apt-get remove -y docker-ce-cli            || true
        apt-get remove -y containerd.io            || true
        apt-get remove -y docker-buildx-plugin     || true
        apt-get remove -y docker-compose-plugin    || true

        # Allow internet access
        echo "net.ipv4.ip_forward=1" >> /etc/sysctl.d/enable-ip-forward.conf

        # Add Docker's official GPG key
        install -m 0755 -d /etc/apt/keyrings
        curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
        chmod a+r /etc/apt/keyrings/docker.gpg

        # Set up Docker repository
        echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null

        # Install Docker Engine, CLI, Containerd, Docker Compose
        apt-get update
        apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
      EOF
    ]

    connection {
      type        = "ssh"
      user        = "root"
      private_key = var.ssh_private_key
      host        = hcloud_server.default.ipv4_address
      timeout     = "5m"
    }
  }
}

resource "null_resource" "server_ready" {
  triggers = {
    always = timestamp()
  }

  depends_on = [
    null_resource.host_dependency_basic,
    null_resource.host_dependency_aws_cli,
    null_resource.host_dependency_docker
  ]
}