colem/todo-hetzner
1
0
Fork 0
mirror of https://github.com/cole-maxwell1/todo-hetzner.git synced 2026-10-27 19:02:49 -05:00
Code Issues Packages Projects Releases Wiki Activity

docs: clarify Hetzner and Ansible configuration

Browse Source 
Add concrete SSH key and bucket examples.

Update group variable paths to match the inventory layout.
This commit is contained in:
cole-maxwell1
2026-08-07 09:53:55 -05:00
parent dd60bd4a3e
commit 74dff70b16
1 changed files with 23 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+23 -14
View File
@@ -79,13 +79,13 @@ Generate an Ed25519 key if one does not already exist:
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519
``` ```
Install the Hetzner CLI on macOS, expose the Cloud token to it, and upload the public key: Install the [Hetzner CLI](https://github.com/hetznercloud/cli/blob/main/docs/tutorials/setup-hcloud-cli.md) and expose the Cloud token to it, and upload the public key:
```sh ```sh
brew install hcloud brew install hcloud
export HCLOUD_TOKEN="$TF_VAR_hcloud_token" export HCLOUD_TOKEN="$TF_VAR_hcloud_token"
hcloud ssh-key create \ hcloud ssh-key create \
--name home-mac \ --name yourkey \
--public-key-from-file ~/.ssh/id_ed25519.pub --public-key-from-file ~/.ssh/id_ed25519.pub
``` ```
@@ -95,10 +95,19 @@ List the project keys and copy the numeric ID from the `ID` column:
hcloud ssh-key list hcloud ssh-key list
``` ```
Ex:
```sh
❯ hcloud ssh-key list
ID NAME FINGERPRINT AGE
116588791 yourkey 44:36:cf:03:cd:6c:bb:24:84:4c:38:d5:83:ca:99:74 12h
```
Configure that value in `prod.tfvars`: Configure that value in `prod.tfvars`:
```hcl ```hcl
ssh_key_ids = [123456] ssh_key_ids = [116588791]
``` ```
The key can also be uploaded in the Hetzner Console under **Security > SSH Keys**. `hcloud ssh-key list` is the reliable way to obtain its numeric ID. The key can also be uploaded in the Hetzner Console under **Security > SSH Keys**. `hcloud ssh-key list` is the reliable way to obtain its numeric ID.
@@ -154,7 +163,7 @@ openssl rand -hex 6
Use the result in a descriptive bucket name: Use the result in a descriptive bucket name:
```hcl ```hcl
bucket_name = "cole-todo-prod-backups-a83d109cf241" bucket_name = "todo-test-prod-backups-a83d109cf241"
``` ```
Bucket names must be 3-63 characters, use lowercase letters, numbers, and hyphens, and start and end with a letter or number. If the provider reports that the name is taken, generate a new suffix. Never include credentials or other secrets in a bucket name. Bucket names must be 3-63 characters, use lowercase letters, numbers, and hyphens, and start and end with a letter or number. If the provider reports that the name is taken, generate a new suffix. Never include credentials or other secrets in a bucket name.
@@ -179,13 +188,13 @@ project_name = "todo"
network_zone = "eu-central" network_zone = "eu-central"
server_location = "nbg1" server_location = "nbg1"
server_type = "cx22" server_type = "cx22"
ssh_key_ids = [123456] ssh_key_ids = [116588791]
ssh_source_cidrs = ["198.51.100.25/32"] ssh_source_cidrs = ["198.51.100.25/32"]
prod_private_ip = "10.0.1.10" prod_private_ip = "10.0.1.10"
s3_endpoint = "https://nbg1.your-objectstorage.com" s3_endpoint = "https://nbg1.your-objectstorage.com"
s3_region = "nbg1" s3_region = "nbg1"
bucket_name = "cole-todo-prod-backups-a83d109cf241" bucket_name = "todo-test-prod-backups-a83d109cf241"
``` ```
Keep the default staging private address in `infra/environments/staging/staging.tfvars` unless it conflicts with another resource: Keep the default staging private address in `infra/environments/staging/staging.tfvars` unless it conflicts with another resource:
@@ -228,37 +237,37 @@ ansible-inventory -i ansible/inventory/hosts.yml --graph
Create the shared non-secret Ansible configuration from its example. The destination is ignored by Git: Create the shared non-secret Ansible configuration from its example. The destination is ignored by Git:
```sh ```sh
cp ansible/group_vars/all/main.yml.example ansible/group_vars/all/main.yml cp ansible/inventory/group_vars/all/main.yml.example ansible/inventory/group_vars/all/main.yml
``` ```
Create one shared Vault for Object Storage credentials and separate environment Vaults for database passwords: Create one shared Vault for Object Storage credentials and separate environment Vaults for database passwords:
```sh ```sh
ansible-vault create ansible/group_vars/all/vault.yml ansible-vault create ansible/inventory/group_vars/all/vault.yml
ansible-vault create ansible/group_vars/prod/vault.yml ansible-vault create ansible/inventory/group_vars/prod/vault.yml
ansible-vault create ansible/group_vars/staging/vault.yml ansible-vault create ansible/inventory/group_vars/staging/vault.yml
``` ```
Store the Object Storage credentials needed by WAL-G in `ansible/group_vars/all/vault.yml`: Store the Object Storage credentials needed by WAL-G in `ansible/inventory/group_vars/all/vault.yml`:
```yaml ```yaml
wal_g_access_key: "replace-with-object-storage-access-key" wal_g_access_key: "replace-with-object-storage-access-key"
wal_g_secret_key: "replace-with-object-storage-secret-key" wal_g_secret_key: "replace-with-object-storage-secret-key"
``` ```
Store only the production database password in `ansible/group_vars/prod/vault.yml`: Store only the production database password in `ansible/inventory/group_vars/prod/vault.yml`:
```yaml ```yaml
app_db_password: "replace-with-production-database-password" app_db_password: "replace-with-production-database-password"
``` ```
Store a distinct staging password in `ansible/group_vars/staging/vault.yml`: Store a distinct staging password in `ansible/inventory/group_vars/staging/vault.yml`:
```yaml ```yaml
app_db_password: "replace-with-distinct-staging-database-password" app_db_password: "replace-with-distinct-staging-database-password"
``` ```
Configure the matching non-secret values in `ansible/group_vars/all/main.yml`: Configure the matching non-secret values in `ansible/inventory/group_vars/all/main.yml`:
```yaml ```yaml
wal_g_s3_prefix: s3://cole-todo-prod-backups-a83d109cf241/prod wal_g_s3_prefix: s3://cole-todo-prod-backups-a83d109cf241/prod