feat: initial import of RailianceHosts starter

terraform/hetzner/cloud_init.yaml

@@ -0,0 +1,44 @@
+#cloud-config
+package_update: true
+package_upgrade: true
+packages:
+  - git
+  - curl
+  - unzip
+  - python3
+  - python3-venv
+  - ufw
+  - vim
+
+users:
+  - name: admin
+    groups: [sudo]
+    shell: /bin/bash
+    sudo: "ALL=(ALL) NOPASSWD:ALL"
+ssh_pwauth: false
+disable_root: true
+
+write_files:
+  - path: /etc/ssh/sshd_config.d/10-hardening.conf
+    permissions: "0644"
+    content: |
+      PasswordAuthentication no
+      PermitRootLogin no
+      PubkeyAuthentication yes
+
+  - path: /usr/local/bin/railliance-bootstrap.sh
+    permissions: "0755"
+    content: |
+      #!/usr/bin/env bash
+      set -euo pipefail
+
+      # Basic firewall
+      ufw default deny incoming
+      ufw default allow outgoing
+      ufw allow OpenSSH
+      ufw --force enable
+
+      systemctl restart ssh
+
+runcmd:
+  - [ bash, -c, "/usr/local/bin/railliance-bootstrap.sh > /var/log/railliance-bootstrap.log 2>&1" ]

terraform/hetzner/main.tf

@@ -0,0 +1,47 @@
+terraform {
+  required_version = ">= 1.7.0"
+  required_providers {
+    hcloud = {
+      source  = "hetznercloud/hcloud"
+      version = "~> 1.49"
+    }
+    template = {
+      source  = "hashicorp/template"
+      version = "~> 2.2"
+    }
+  }
+}
+
+provider "hcloud" {
+  token = var.hcloud_token
+}
+
+locals {
+  servers    = yamldecode(file("${path.module}/../../inventory/servers.yaml")).servers
+  cloud_init = file("${path.module}/cloud_init.yaml")
+}
+
+resource "hcloud_ssh_key" "admin" {
+  name       = "railliance-admin"
+  public_key = file("${path.module}/../../keys/admin_ssh.pub")
+}
+
+resource "hcloud_server" "srv" {
+  for_each    = { for s in local.servers : s.name => s }
+  name        = each.value.name
+  image       = coalesce(each.value.image, "ubuntu-24.04")
+  server_type = each.value.type
+  location    = each.value.region
+  ssh_keys    = [hcloud_ssh_key.admin.id]
+  user_data   = local.cloud_init
+
+  labels = {
+    role   = each.value.role
+    labels = join(",", try(each.value.labels, []))
+    env    = "default"
+  }
+}
+
+output "servers" {
+  value = { for k, v in hcloud_server.srv : k => v.ipv4_address }
+}

terraform/hetzner/variables.tf

@@ -0,0 +1,5 @@
+variable "hcloud_token" {
+  description = "Hetzner Cloud API token"
+  type        = string
+  sensitive   = true
+}