From 74dff70b16c9f0cb96dd84d9c0068529e1955cff Mon Sep 17 00:00:00 2001 From: cole-maxwell1 Date: Fri, 7 Aug 2026 09:53:55 -0500 Subject: [PATCH] docs: clarify Hetzner and Ansible configuration Add concrete SSH key and bucket examples. Update group variable paths to match the inventory layout. --- README.md | 37 +++++++++++++++++++++++-------------- 1 file changed, 23 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index c93d3b3..c76d330 100644 --- a/README.md +++ b/README.md @@ -79,13 +79,13 @@ Generate an Ed25519 key if one does not already exist: ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 ``` -Install the Hetzner CLI on macOS, expose the Cloud token to it, and upload the public key: +Install the [Hetzner CLI](https://github.com/hetznercloud/cli/blob/main/docs/tutorials/setup-hcloud-cli.md) and expose the Cloud token to it, and upload the public key: ```sh brew install hcloud export HCLOUD_TOKEN="$TF_VAR_hcloud_token" hcloud ssh-key create \ - --name home-mac \ + --name yourkey \ --public-key-from-file ~/.ssh/id_ed25519.pub ``` @@ -95,10 +95,19 @@ List the project keys and copy the numeric ID from the `ID` column: hcloud ssh-key list ``` +Ex: + +```sh +❯ hcloud ssh-key list + +ID NAME FINGERPRINT AGE +116588791 yourkey 44:36:cf:03:cd:6c:bb:24:84:4c:38:d5:83:ca:99:74 12h +``` + Configure that value in `prod.tfvars`: ```hcl -ssh_key_ids = [123456] +ssh_key_ids = [116588791] ``` The key can also be uploaded in the Hetzner Console under **Security > SSH Keys**. `hcloud ssh-key list` is the reliable way to obtain its numeric ID. @@ -154,7 +163,7 @@ openssl rand -hex 6 Use the result in a descriptive bucket name: ```hcl -bucket_name = "cole-todo-prod-backups-a83d109cf241" +bucket_name = "todo-test-prod-backups-a83d109cf241" ``` Bucket names must be 3-63 characters, use lowercase letters, numbers, and hyphens, and start and end with a letter or number. If the provider reports that the name is taken, generate a new suffix. Never include credentials or other secrets in a bucket name. @@ -179,13 +188,13 @@ project_name = "todo" network_zone = "eu-central" server_location = "nbg1" server_type = "cx22" -ssh_key_ids = [123456] +ssh_key_ids = [116588791] ssh_source_cidrs = ["198.51.100.25/32"] prod_private_ip = "10.0.1.10" s3_endpoint = "https://nbg1.your-objectstorage.com" s3_region = "nbg1" -bucket_name = "cole-todo-prod-backups-a83d109cf241" +bucket_name = "todo-test-prod-backups-a83d109cf241" ``` Keep the default staging private address in `infra/environments/staging/staging.tfvars` unless it conflicts with another resource: @@ -228,37 +237,37 @@ ansible-inventory -i ansible/inventory/hosts.yml --graph Create the shared non-secret Ansible configuration from its example. The destination is ignored by Git: ```sh -cp ansible/group_vars/all/main.yml.example ansible/group_vars/all/main.yml +cp ansible/inventory/group_vars/all/main.yml.example ansible/inventory/group_vars/all/main.yml ``` Create one shared Vault for Object Storage credentials and separate environment Vaults for database passwords: ```sh -ansible-vault create ansible/group_vars/all/vault.yml -ansible-vault create ansible/group_vars/prod/vault.yml -ansible-vault create ansible/group_vars/staging/vault.yml +ansible-vault create ansible/inventory/group_vars/all/vault.yml +ansible-vault create ansible/inventory/group_vars/prod/vault.yml +ansible-vault create ansible/inventory/group_vars/staging/vault.yml ``` -Store the Object Storage credentials needed by WAL-G in `ansible/group_vars/all/vault.yml`: +Store the Object Storage credentials needed by WAL-G in `ansible/inventory/group_vars/all/vault.yml`: ```yaml wal_g_access_key: "replace-with-object-storage-access-key" wal_g_secret_key: "replace-with-object-storage-secret-key" ``` -Store only the production database password in `ansible/group_vars/prod/vault.yml`: +Store only the production database password in `ansible/inventory/group_vars/prod/vault.yml`: ```yaml app_db_password: "replace-with-production-database-password" ``` -Store a distinct staging password in `ansible/group_vars/staging/vault.yml`: +Store a distinct staging password in `ansible/inventory/group_vars/staging/vault.yml`: ```yaml app_db_password: "replace-with-distinct-staging-database-password" ``` -Configure the matching non-secret values in `ansible/group_vars/all/main.yml`: +Configure the matching non-secret values in `ansible/inventory/group_vars/all/main.yml`: ```yaml wal_g_s3_prefix: s3://cole-todo-prod-backups-a83d109cf241/prod