From ef7405153766d1b0fe9b832fff984616b6da5939 Mon Sep 17 00:00:00 2001
From: Melchior Reimers <melchiorreimers@Melchiors-MacBook-Pro-8.local>
Date: Wed, 4 Feb 2026 19:59:55 +0100
Subject: [PATCH] added ssh in fw rule

---
 .gitea/workflows/deploy.yaml | 46 +++++++++++++++++++++++++++++++++++-
 data.tf                      |  1 +
 main.tf                      | 16 +++++++++----
 terraform.tfvars.example     |  1 +
 4 files changed, 59 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 44b32ac..8cc04f9 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -12,6 +12,12 @@ jobs:
         env:
           SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
           HETZNER_TOKEN: ${{ secrets.HETZNER_TOKEN }}
+          TF_BACKEND_BUCKET: ${{ secrets.TF_BACKEND_BUCKET }}
+          TF_BACKEND_KEY: ${{ secrets.TF_BACKEND_KEY }}
+          TF_BACKEND_REGION: ${{ secrets.TF_BACKEND_REGION }}
+          TF_BACKEND_ENDPOINT: ${{ secrets.TF_BACKEND_ENDPOINT }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         run: |
           set -e
           if [ -z "$SSH_PUBLIC_KEY" ]; then
@@ -22,6 +28,30 @@ jobs:
             echo "Missing HETZNER_TOKEN secret"
             exit 1
           fi
+          if [ -z "$TF_BACKEND_BUCKET" ]; then
+            echo "Missing TF_BACKEND_BUCKET secret"
+            exit 1
+          fi
+          if [ -z "$TF_BACKEND_KEY" ]; then
+            echo "Missing TF_BACKEND_KEY secret"
+            exit 1
+          fi
+          if [ -z "$TF_BACKEND_REGION" ]; then
+            echo "Missing TF_BACKEND_REGION secret"
+            exit 1
+          fi
+          if [ -z "$TF_BACKEND_ENDPOINT" ]; then
+            echo "Missing TF_BACKEND_ENDPOINT secret"
+            exit 1
+          fi
+          if [ -z "$AWS_ACCESS_KEY_ID" ]; then
+            echo "Missing AWS_ACCESS_KEY_ID secret"
+            exit 1
+          fi
+          if [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
+            echo "Missing AWS_SECRET_ACCESS_KEY secret"
+            exit 1
+          fi
           python - <<'PY'
           import os
           token = os.environ.get("HETZNER_TOKEN", "")
@@ -37,6 +67,12 @@ jobs:
         env:
           HETZNER_TOKEN: ${{ secrets.HETZNER_TOKEN }}
           SSH_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+          TF_BACKEND_BUCKET: ${{ secrets.TF_BACKEND_BUCKET }}
+          TF_BACKEND_KEY: ${{ secrets.TF_BACKEND_KEY }}
+          TF_BACKEND_REGION: ${{ secrets.TF_BACKEND_REGION }}
+          TF_BACKEND_ENDPOINT: ${{ secrets.TF_BACKEND_ENDPOINT }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         run: |
           set -e
           # Kopiere das Template und ersetze die Platzhalter mit sed
@@ -52,7 +88,15 @@ jobs:
           Path("terraform.tfvars").write_text(content)
           PY
 
-          terraform init
+          terraform init \
+            -backend-config="bucket=$TF_BACKEND_BUCKET" \
+            -backend-config="key=$TF_BACKEND_KEY" \
+            -backend-config="region=$TF_BACKEND_REGION" \
+            -backend-config="endpoint=$TF_BACKEND_ENDPOINT" \
+            -backend-config="force_path_style=true" \
+            -backend-config="skip_credentials_validation=true" \
+            -backend-config="skip_metadata_api_check=true" \
+            -backend-config="skip_region_validation=true"
           terraform apply -auto-approve
 
           echo "Deployment successful"
\ No newline at end of file
diff --git a/data.tf b/data.tf
index db29240..afabfa4 100644
--- a/data.tf
+++ b/data.tf
@@ -1,4 +1,5 @@
 terraform {
+  backend "s3" {}
   required_providers {
     hcloud = {
       source  = "hetznercloud/hcloud"
diff --git a/main.tf b/main.tf
index dd86419..d91cf1b 100644
--- a/main.tf
+++ b/main.tf
@@ -1,6 +1,7 @@
-# SSH Key (existing)
-data "hcloud_ssh_key" "default" {
-  name = local.ssh_key_name
+# SSH Key
+resource "hcloud_ssh_key" "default" {
+  name       = local.ssh_key_name
+  public_key = var.ssh_public_key
 }
 
 # Cloud-init script
@@ -21,7 +22,7 @@ resource "hcloud_server" "vps" {
   image       = var.image
   server_type = data.hcloud_server_type.selected.name
   location    = data.hcloud_location.selected.name
-  ssh_keys    = concat([data.hcloud_ssh_key.default.id])
+  ssh_keys    = concat([hcloud_ssh_key.default.id])
   user_data   = local.user_data
 
   labels = {
@@ -70,6 +71,13 @@ resource "hcloud_firewall" "vps" {
     destination_ips = ["0.0.0.0/0", "::/0"]
     description     = "ICMP outbound"
   }
+    rule {
+    direction       = "in"
+    protocol        = "tcp"
+    port            = "22"
+    destination_ips = ["0.0.0.0/0", "::/0"]
+    description     = "ssh outbound"
+  }
 }
 
 resource "hcloud_firewall_attachment" "vps" {
diff --git a/terraform.tfvars.example b/terraform.tfvars.example
index 3601e3c..a226121 100644
--- a/terraform.tfvars.example
+++ b/terraform.tfvars.example
@@ -5,4 +5,5 @@ image          = "ubuntu-24.04"
 location       = "nbg1"
 ssh_public_key = "__SSH_KEY__"
 ssh_key_name   = "mrmbp"
+existing_firewall_name = "my-existing-firewall"