Skip to content

Terraform & Infrastructure

Purpose

Understand and safely inspect the Terraform that provisions AkshayaBazaar's cloud infrastructure (Hetzner Cloud compute + Cloudflare DNS/security/R2) - without ever running apply/destroy against shared infrastructure from this documentation portal.

Module map

terraform/
├── bootstrap/          # ONE-TIME, local state - creates the R2 bucket remote state itself lives in
├── modules/
│   ├── hetzner-network/     # private network + subnet
│   ├── hetzner-firewall/    # generic firewall (SSH always allowlisted; web/extra rules opt-in)
│   ├── hetzner-server/      # generic "one VM" - the shared K3s node, every environment's data VM, and the optional Jenkins VM all use this one module
│   ├── cloudflare-dns/      # A/AAAA records
│   ├── cloudflare-security/ # zone-wide SSL/TLS settings (production owns this)
│   └── cloudflare-r2/       # one R2 bucket
├── environments/
│   ├── platform/    # own state - the ONE shared K3s VM + private network
│   ├── staging/     # own state - staging's own data VM/DNS/R2, reads platform's state for the node IP
│   ├── production/  # own state - production's own data VM/DNS/R2/zone settings
│   ├── dev/         # structural scaffold, modeled on staging - never applied
│   └── shared/      # optional Jenkins VM - independent of platform and both app environments
└── cloud-init/
    ├── k3s-node-shared.yaml.tpl  # the shared K3s node's boot script
    └── data-vm.yaml.tpl          # MySQL + Redis, one per environment

Pages in this section

  • Environments - the four environment roots, single-VM topology, why not one root with a workspace toggle.
  • Hetzner - compute/network/firewall resources.
  • Cloudflare - DNS, security settings, R2.
  • Execution - init/fmt/validate/plan/apply/destroy, state and secret handling, and exactly what this portal will and will not run.

Safe commands only, from this portal

# Linux/Bash - containerized, no local terraform binary required
docker run --rm -v "$(pwd)/terraform:/tf" -w /tf hashicorp/terraform:1.9 fmt -recursive -check -diff
docker run --rm -v "$(pwd)/terraform:/tf" -w "/tf/environments/staging" hashicorp/terraform:1.9 init -backend=false -input=false
docker run --rm -v "$(pwd)/terraform:/tf" -w "/tf/environments/staging" hashicorp/terraform:1.9 validate

fmt -check and validate -backend=false need no credentials and touch no remote state - safe to run anytime, against any environment, including staging/production, from any machine. plan, apply, and destroy are never run as part of building or maintaining this documentation - see Execution for exactly where the line is drawn and why.

Never commit

*.tfstate
*.tfstate.*
.terraform/
*.tfplan
Already enforced by terraform/.gitignore - see Execution → State handling.