# This file is pretty self-explanatory; it just creates a private network with a subnet.
resource "hcloud_network" "private" {
  name     = "private-network"
  ip_range = "10.0.0.0/16"
}
resource "hcloud_network_subnet" "private-subnet" {
  network_id   = hcloud_network.private.id
  type         = "server"
  network_zone = "eu-central"
  ip_range     = "10.0.1.0/24"
}

# This file contains the server information. Change it the way you'd like.
# The bastion server allows you to create a nice bastion host, but you might want to omit it.
resource "hcloud_server" "bastion" {
  name        = "bastion"
  server_type = var.bastion_server_type
  image       = "ubuntu-24.04"
  ssh_keys    = [hcloud_ssh_key.default.id]
  location    = var.location
  count = var.up ? 1 : 0
  public_net {
    ipv4_enabled = true
    ipv6_enabled = false
  }
  network {
    network_id = hcloud_network.private.id
    ip         = "10.0.1.2"
  }
}
# This is the main server
# Notice the var.image_id -- if it is default (empty string), I will use an ubuntu-24.04 image. However, I will soon discuss the ability to create a custom image.
resource "hcloud_server" "office-server" {
  name        = "office-server"
  server_type = var.office_server_type
  image       = var.image_id != "" ? var.image_id : "ubuntu-24.04"
  ssh_keys    = [hcloud_ssh_key.default.id]
  location    = var.location
  count = var.up ? 1 : 0
  public_net {
    ipv4_enabled = true
    ipv6_enabled = false
  }
  network {
    network_id = hcloud_network.private.id
    ip         = "10.0.1.10"
  }
}
resource "hcloud_firewall" "office_fw" {
  name = "office-firewall"
  rule {
    direction  = "in"
    protocol   = "tcp"
    port       = "22"
    source_ips = ["10.0.1.2/32"]  # only allow SSH from bastion
  }
  # optionally allow internal cluster traffic (e.g., all from private subnet)
  rule {
    direction  = "in"
    protocol   = "tcp"
    port       = "0-65535"
    source_ips = ["10.0.0.0/16"]  # internal network range
  }
  # default policy: deny everything else. Feel free to modify.
  # Especially if you want to open some ports to the outside world.
}
# This attached the firewall rule to the server
resource "hcloud_firewall_attachment" "office_fw_attach" {
  firewall_id = hcloud_firewall.office_fw.id
  server_ids  = [hcloud_server.office-server[0].id]
  count = var.up ? 1 : 0
}
# This is our "persistent" volume, which survives when servers are being destroyed. Notice that it does not have a "count" parameter -- it is always present. The count parameter is discussed further
resource "hcloud_volume" "office_data" {
  name = "office-data"
  size = 10               # in GB
  location = var.location
  automount = false       # important: we'll handle mount/encryption ourselves
}
# I attach the volume to the server
resource "hcloud_volume_attachment" "worker_data_attach" {
  volume_id = hcloud_volume.office_data.id
  server_id = hcloud_server.office-server[0].id
  count = var.up ? 1 : 0
  automount = false
}

# First, run init again, so that Terraform will download some extra plugins, since I have added some new resources
terraform init -var-file=office.tfvars
# Now you have these three commands to use: one would create your servers, another one would destroy them (but keep the volume)
# And third one would destroy everything
# Create the servers (and other necessary items):
terraform apply -var-file office.tfvars -var up=true
# Destroy the servers:
terraform apply -var-file office.tfvars -var up=false
# Destroy EVERYTHING, including your independent volume:
terraform destroy -var-file office.tfvars

# I will use the file out/ssh/config, which already contains all the necessary configuration for our servers
# Connect to bastion:
ssh -F out/ssh/config bastion
# Connect to the "office" server through bastion:
ssh -F out/ssh/config office

curl -s -X POST "https://api.hetzner.cloud/v1/servers/<your-server-id>/actions/create_image"
  -H "Authorization: Bearer <your-hcloud-token-here>"
  -H "Content-Type: application/json"
  -d '{"description": "My description", "type": "snapshot"}'
  | jq .image.id

output "office-server-id" {
  value = var.up ? hcloud_server.office-server[0].id : "-"
}