removed more security bs

.gitea/workflows/deploy.yaml

@@ -8,32 +8,94 @@ jobs:
   deploy-docker:
     runs-on: ubuntu-latest
     steps:
-      - name: Deploy via SSH
-        uses: appleboy/ssh-action@v0.1.10
-        with:
-          host: 172.17.0.1
-          username: root
-          key: ${{ secrets.SSH_PRIVATE_KEY }}
-          # Wir übergeben die Secrets als Environment-Variablen an den SSH-Befehl
-          envs: DB_USER,DB_PASSWORD
-          script: |
-            mkdir -p /root/iac
-            cd /root/iac
-            
-            # Repository aktualisieren
-            if [ ! -d ".git" ]; then
-              git clone https://git.bana.space/krumbelfix/iac.git .
-            else
-              git pull origin main
-            fi
-            
-            echo "hcloud_token = "${hetzner_token}" >> ./hetzner/terraform.tfvars
-            
-            # Docker Container neu bauen und starten
-            terraform plan
-            terraform apply
-            
-            echo "Deployment sucessfull"
+      - name: Validate deployment secrets
         env:
-          DB_USER: ${{ secrets.DB_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          SSH_PUBLIC_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+          HETZNER_TOKEN: ${{ secrets.HETZNER_TOKEN }}
+          S3_BUCKET: ${{ secrets.S3_BUCKET }}
+          S3_REGION: ${{ secrets.S3_REGION }}
+          S3_ENDPOINT: ${{ secrets.S3_ENDPOINT }}
+          S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
+          S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
+        run: |
+          set -e
+          if [ -z "$SSH_PUBLIC_KEY" ]; then
+            echo "Missing SSH_PUBLIC_KEY secret"
+            exit 1
+          fi
+          if [ -z "$HETZNER_TOKEN" ]; then
+            echo "Missing HETZNER_TOKEN secret"
+            exit 1
+          fi
+          if [ -z "$S3_BUCKET" ]; then
+            echo "Missing S3_BUCKET secret"
+            exit 1
+          fi
+          if [ -z "$S3_REGION" ]; then
+            echo "Missing S3_REGION secret"
+            exit 1
+          fi
+          if [ -z "$S3_ENDPOINT" ]; then
+            echo "Missing S3_ENDPOINT secret"
+            exit 1
+          fi
+          if [ -z "$S3_ACCESS_KEY" ]; then
+            echo "Missing S3_ACCESS_KEY secret"
+            exit 1
+          fi
+          if [ -z "$S3_SECRET_KEY" ]; then
+            echo "Missing S3_SECRET_KEY secret"
+            exit 1
+          fi
+          python - <<'PY'
+          import os
+          token = os.environ.get("HETZNER_TOKEN", "")
+          print(f"HETZNER_TOKEN length: {len(token)}")
+          if len(token) != 64:
+              raise SystemExit("HETZNER_TOKEN must be exactly 64 characters")
+          PY
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+      - name: Deploy with Terraform
+        env:
+          HETZNER_TOKEN: ${{ secrets.HETZNER_TOKEN }}
+          SSH_KEY: ${{ secrets.SSH_PUBLIC_KEY }}
+          S3_BUCKET: ${{ secrets.S3_BUCKET }}
+          S3_REGION: ${{ secrets.S3_REGION }}
+          S3_ENDPOINT: ${{ secrets.S3_ENDPOINT }}
+          S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
+          S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
+          S3_KEY: ${{ secrets.S3_KEY }}
+        run: |
+          set -e
+          # Kopiere das Template und ersetze die Platzhalter mit sed
+          python - <<'PY'
+          from pathlib import Path
+          import os
+
+          content = Path("terraform.tfvars.example").read_text()
+          content = content.replace("__HCLOUD_TOKEN__", os.environ["HETZNER_TOKEN"])
+          raw_key = os.environ.get("SSH_KEY", "")
+          key_line = next((line for line in raw_key.splitlines() if line.strip()), "")
+          content = content.replace("__SSH_KEY__", key_line)
+          Path("terraform.tfvars").write_text(content)
+          PY
+
+          terraform init -reconfigure \
+            -backend-config="bucket=$S3_BUCKET" \
+            -backend-config="key=${S3_KEY:-hetzner/terraform.tfstate}" \
+            -backend-config="region=$S3_REGION" \
+            -backend-config="endpoint=$S3_ENDPOINT" \
+            -backend-config="access_key=$S3_ACCESS_KEY" \
+            -backend-config="secret_key=$S3_SECRET_KEY" \
+            -backend-config="workspace_key_prefix=" \
+            -backend-config="skip_credentials_validation=true" \
+            -backend-config="skip_region_validation=true" \
+            -backend-config="skip_requesting_account_id=true" \
+            -backend-config="skip_metadata_api_check=true" \
+            -backend-config="force_path_style=true"
+          terraform apply -auto-approve
+
+          echo "Deployment successful"

.terraform.lock.hcl

@@ -0,0 +1,23 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hetznercloud/hcloud" {
+  version     = "1.60.0"
+  constraints = "~> 1.45"
+  hashes = [
+    "h1:a+0jnJt73mpSsncc36Idxy5ziS7N4Iim4otcW11XkXo=",
+    "zh:13d729f4859bdcf9e6c2e706bdb010d1e770d8e06834335a1ef7f982fffd0c99",
+    "zh:3b36a77cf1869a9abce3a45e2c796cb4f3e5e819497919a8a837badbb9576a1d",
+    "zh:4ec1f0d4e7fe4dffd7a4a2c5846d45243b1ade669c234a772631824c1d4faa10",
+    "zh:5042482e86618efd1122e398faf09ccdf2ba849b0aefa589b6da656b847402d5",
+    "zh:52d4524bdde5424cf2a8b130ab085c1236c694da16adae9d31c925c26bbde02d",
+    "zh:54af898bdbbb0e342b9a2bf39725114cff52713a03ee966bd734a6a2fef953b9",
+    "zh:59979a5377245ffd5c962123547703bca9201a7019c6ef5ba9cf2e6119b4911d",
+    "zh:6006e47336182ab68c18980d620d9dc4aab8bdb250744e4c9117d694bf01192a",
+    "zh:8061ace3e91510afde141d3556be50b1b23b2578ec0626843641fea8dad3bcaf",
+    "zh:c24f6fcf0ddbe5395c71ccbda2588196b00c0090017a84d7ae4b0132197dfcd2",
+    "zh:ca9143d179a3815d49e61f70cc8a3340abac44e8f75259f1107520e407252923",
+    "zh:d5ea79ba8b22db4cb6404334316a2c58a9b7b44e8eb2ddf7d62350d99c1831d5",
+    "zh:eb15f600011e7822b526b137fc5e88db15a7ef7c826ebaa16fa6486cf1f1ce2a",
+  ]
+}

.terraform/providers/registry.terraform.io/hetznercloud/hcloud/1.60.0/darwin_arm64/LICENSE

@@ -0,0 +1,373 @@
+Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+    means each individual or legal entity that creates, contributes to
+    the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+    means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code
+    Form, and Modifications of such Source Code Form, in each case
+    including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+    means
+
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+    means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+    means a work that combines Covered Software with other material, in
+    a separate file or files, that is not Covered Software.
+
+1.8. "License"
+    means this document.
+
+1.9. "Licensable"
+    means having the right to grant, to the maximum extent possible,
+    whether at the time of the initial grant or subsequently, any and
+    all of the rights conveyed by this License.
+
+1.10. "Modifications"
+    means any of the following:
+
+    (a) any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered
+        Software; or
+
+    (b) any new file in Source Code Form that contains any Covered
+        Software.
+
+1.11. "Patent Claims" of a Contributor
+    means any patent claim(s), including without limitation, method,
+    process, and apparatus claims, in any patent Licensable by such
+    Contributor that would be infringed, but for the grant of the
+    License, by the making, using, selling, offering for sale, having
+    made, import, or transfer of either its Contributions or its
+    Contributor Version.
+
+1.12. "Secondary License"
+    means either the GNU General Public License, Version 2.0, the GNU
+    Lesser General Public License, Version 2.1, the GNU Affero General
+    Public License, Version 3.0, or any later versions of those
+    licenses.
+
+1.13. "Source Code Form"
+    means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that
+    controls, is controlled by, or is under common control with You. For
+    purposes of this definition, "control" means (a) the power, direct
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
+    ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+    Licensable by such Contributor to use, reproduce, make available,
+    modify, display, perform, distribute, and otherwise exploit its
+    Contributions, either on an unmodified basis, with Modifications, or
+    as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+    for sale, have made, import, and otherwise transfer either its
+    Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+    or
+
+(b) for infringements caused by: (i) Your and any other third party's
+    modifications of Covered Software, or (ii) the combination of its
+    Contributions with other software (except as part of its Contributor
+    Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+    its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+    License, or sublicense it under different terms, provided that the
+    license for the Executable Form does not attempt to limit or alter
+    the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+*                                                                      *
+*  6. Disclaimer of Warranty                                           *
+*  -------------------------                                           *
+*                                                                      *
+*  Covered Software is provided under this License on an "as is"       *
+*  basis, without warranty of any kind, either expressed, implied, or  *
+*  statutory, including, without limitation, warranties that the       *
+*  Covered Software is free of defects, merchantable, fit for a        *
+*  particular purpose or non-infringing. The entire risk as to the     *
+*  quality and performance of the Covered Software is with You.        *
+*  Should any Covered Software prove defective in any respect, You     *
+*  (not any Contributor) assume the cost of any necessary servicing,   *
+*  repair, or correction. This disclaimer of warranty constitutes an   *
+*  essential part of this License. No use of any Covered Software is   *
+*  authorized under this License except under this disclaimer.         *
+*                                                                      *
+************************************************************************
+
+************************************************************************
+*                                                                      *
+*  7. Limitation of Liability                                          *
+*  --------------------------                                          *
+*                                                                      *
+*  Under no circumstances and under no legal theory, whether tort      *
+*  (including negligence), contract, or otherwise, shall any           *
+*  Contributor, or anyone who distributes Covered Software as          *
+*  permitted above, be liable to You for any direct, indirect,         *
+*  special, incidental, or consequential damages of any character      *
+*  including, without limitation, damages for lost profits, loss of    *
+*  goodwill, work stoppage, computer failure or malfunction, or any    *
+*  and all other commercial damages or losses, even if such party      *
+*  shall have been informed of the possibility of such damages. This   *
+*  limitation of liability shall not apply to liability for death or   *
+*  personal injury resulting from such party's negligence to the       *
+*  extent applicable law prohibits such limitation. Some               *
+*  jurisdictions do not allow the exclusion or limitation of           *
+*  incidental or consequential damages, so this exclusion and          *
+*  limitation may not apply to You.                                    *
+*                                                                      *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+---------------------------------------------------------
+
+  This Source Code Form is "Incompatible With Secondary Licenses", as
+  defined by the Mozilla Public License, v. 2.0.

.terraform/providers/registry.terraform.io/hetznercloud/hcloud/1.60.0/darwin_arm64/README.md

@@ -0,0 +1,202 @@
+# Terraform Provider for the Hetzner Cloud
+
+[![GitHub release](https://img.shields.io/github/tag/hetznercloud/terraform-provider-hcloud.svg?label=release)](https://github.com/hetznercloud/terraform-provider-hcloud/releases/latest) [![Actions Status](https://github.com/hetznercloud/terraform-provider-hcloud/workflows/test/badge.svg)](https://github.com/hetznercloud/terraform-provider-hcloud/actions)[![Actions Status](https://github.com/hetznercloud/terraform-provider-hcloud/workflows/release/badge.svg)](https://github.com/hetznercloud/terraform-provider-hcloud/actions)
+[![Codecov](https://codecov.io/gh/hetznercloud/terraform-provider-hcloud/graph/badge.svg?token=og7OhpoV5W)](https://codecov.io/gh/hetznercloud/terraform-provider-hcloud/tree/main)
+
+- Documentation: https://registry.terraform.io/providers/hetznercloud/hcloud/latest/docs
+
+## Requirements
+
+- [Terraform](https://developer.hashicorp.com/terraform/install) or [OpenTofu](https://opentofu.org/docs/intro/install/)
+  - Our provider tests run with Terraform or OpenTofu releases that are supported upstream.
+  - Our provider should work with any tool that supports the [terraform plugin protocol version 6](https://developer.hashicorp.com/terraform/plugin/terraform-plugin-protocol#protocol-version-6).
+- [Go](https://go.dev/doc/install) (to build the provider plugin)
+
+## Development
+
+### API Stability
+
+This Go module implements a Terraform Provider for Hetzner Cloud
+Services. We thus guarantee backwards compatibility only for use through
+Terraform HCL. The actual _Go code_ in this repository _may change
+without a major version increase_.
+
+Currently, the code is mostly located in the `hcloud` package. In the
+long term we want to move most of the `hcloud` package into individual
+sub-packages located in the `internal` directory. The goal is a
+structure similar to HashiCorp's [Terraform Provider
+Scaffolding](https://github.com/hashicorp/terraform-provider-scaffolding)
+
+### Using the provider
+
+If you are building the provider, follow the instructions to [install it as a plugin](https://www.terraform.io/docs/plugins/basics.html#installing-a-plugin). After placing it into your plugins directory, run `terraform init` to initialize it.
+
+### Building the provider
+
+Clone repository to: `$GOPATH/src/github.com/hetznercloud/terraform-provider-hcloud`
+
+```sh
+$ mkdir -p $GOPATH/src/github.com/hetznercloud; cd $GOPATH/src/github.com/hetznercloud
+$ git clone https://github.com/hetznercloud/terraform-provider-hcloud.git
+```
+
+Enter the provider directory and build the provider
+
+```sh
+$ cd $GOPATH/src/github.com/hetznercloud/terraform-provider-hcloud
+$ make build
+```
+
+### Developing the provider
+
+If you wish to work on the provider, you'll first need [Go](http://www.golang.org) installed on your machine (version 1.14+ is _required_). You'll also need to correctly setup a [GOPATH](http://golang.org/doc/code.html#GOPATH), as well as adding `$GOPATH/bin` to your `$PATH`.
+
+To compile the provider, run `make build`. This will build the provider and put the provider binary in the `$GOPATH/bin` directory.
+
+```sh
+$ make build
+...
+$ ./bin/terraform-provider-hcloud
+...
+```
+
+In order to test the provider, you can simply run `make test`.
+
+```sh
+$ make test
+```
+
+In order to run the full suite of Acceptance tests run `make testacc`.
+
+_Note:_ Acceptance tests create real resources, and often cost money to run.
+
+```
+$ make testacc
+```
+
+You may save your acceptance tests environment variables in the `.env` file, for example:
+
+```sh
+$ cat .env
+HCLOUD_TOKEN=YOUR_API_TEST_TOKEN
+#TF_ACC=1
+TF_LOG=DEBUG
+TF_LOG_PATH_MASK=test-%s.log
+
+$ go test -v -timeout=30m -parallel=8 ./internal/server
+=== RUN   TestAccHcloudDataSourceServerTest
+# ...
+```
+
+### Running a local build
+
+Choose a terraform cli config file path:
+
+```sh
+export TF_CLI_CONFIG_FILE="terraform.tfrc"
+```
+
+In the terraform cli config file, override the lookup path for the `hetznercloud/hcloud` provider to use the local build:
+
+```sh
+cat <<EOF >"$TF_CLI_CONFIG_FILE"
+provider_installation {
+  dev_overrides {
+    "hetznercloud/hcloud" = "$PWD"
+  }
+
+  direct {}
+}
+EOF
+```
+
+Build the provider, resulting in a `terraform-provider-hcloud` binary:
+
+```sh
+make build
+```
+
+Finally, run your terraform plan to see if it works:
+
+```sh
+tofu plan
+```
+
+You should see the following warning:
+
+```
+╷
+│ Warning: Provider development overrides are in effect
+│
+│ The following provider development overrides are set in the CLI configuration:
+│  - hetznercloud/hcloud in /home/user/code/github.com/hetznercloud/terraform-provider-hcloud
+│
+│ The behavior may therefore not match any released version of the provider and applying changes may cause the state to become incompatible with published releases.
+╵
+```
+
+### Releasing experimental features
+
+To publish experimental features as part of regular releases:
+
+- an announcement, including a link to a changelog entry, must be added to the release notes.
+
+- an `Experimental` notice, must be added to the experimental resource, datasource, and functions descriptions:
+
+  ```go
+  func (r *Resource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+    resp.Schema.MarkdownDescription = `
+  Manage a Hetzner Cloud Product.
+
+  See https://docs.hetzner.cloud/reference/cloud#product for more details.
+  `
+    experimental.Product.AppendNotice(&resp.Schema.MarkdownDescription)
+  }
+  ```
+
+- a `Experimental` warning must be logged when experimental resource, datasource, or functions are being used:
+
+  ```go
+  func (r *Resource) Configure(_ context.Context, _ resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+    experimental.Product.AppendDiagnostic(&resp.Diagnostics)
+  }
+  ```
+
+### Deprecating attributes
+
+When deprecating an attributes:
+
+1. Mark the attribute in the schema as deprecated (for SDKv2, the docs template may also need updating), in the message explain the deprecation and link to changelog, for example:
+
+   ```go
+   func Resource() *schema.Resource {
+       return &schema.Resource{
+           // ...
+           Schema: map[string]*schema.Schema{
+               "datacenter": {
+                   // ...
+                   Deprecated: "The datacenter attribute is deprecated and will be removed after 1 July 2026. Please use the location attribute instead. See https://docs.hetzner.cloud/changelog#2025-12-16-phasing-out-datacenters.",
+                   // ...
+               },
+           },
+       }
+   }
+   ```
+
+2. - For inputs: Implement backwards-compatible behaviour if possible
+   - For output: Keep writing the attribute for as long as it is returned from the API. Once it is no longer
+     returned the code should return the user config/previous state if available, or `""` (SDKv2) / `null` (Plugin Framework).
+
+3. In the resource and datasource docs, add a `## Deprecations` section with a subsection for this field, explaining the behaviour and urging users to upgrade to a compatible version, for example:
+
+   ```md
+   ### `datacenter` attribute
+
+   The `datacenter` attribute is deprecated, use the `ABC` attribute instead.
+
+   See our the [API changelog](https://docs.hetzner.cloud/changelog#2025-12-16-phasing-out-datacenters) for more details.
+
+   -> Please upgrade to `v1.W.0+` of the provider to avoid issues once the Hetzner Cloud API no longer returns the `XYZ` attribute.
+   ```
+
+4. Highlight the deprecation in the Release Notes.

.terraform/terraform.tfstate

@@ -0,0 +1,52 @@
+{
+    "version": 3,
+    "serial": 1,
+    "lineage": "0290e863-8866-b524-28c7-502a72ae5e86",
+    "backend": {
+        "type": "s3",
+        "config": {
+            "access_key": "SCWFZWV16A7VNQH9EWH7",
+            "acl": null,
+            "assume_role_duration_seconds": null,
+            "assume_role_policy": null,
+            "assume_role_policy_arns": null,
+            "assume_role_tags": null,
+            "assume_role_transitive_tag_keys": null,
+            "bucket": "hetzner-terraform-state",
+            "dynamodb_endpoint": null,
+            "dynamodb_table": null,
+            "encrypt": null,
+            "endpoint": "https://s3.fr-par.scw.cloud",
+            "external_id": null,
+            "force_path_style": true,
+            "iam_endpoint": null,
+            "key": "hetzner/terraform.tfstate",
+            "kms_key_id": null,
+            "max_retries": null,
+            "profile": null,
+            "region": "fr-par",
+            "role_arn": null,
+            "secret_key": "d77f9fae-be4f-421f-a417-1bf8acc5af91",
+            "session_name": null,
+            "shared_credentials_file": null,
+            "skip_credentials_validation": true,
+            "skip_metadata_api_check": true,
+            "skip_region_validation": true,
+            "sse_customer_key": null,
+            "sts_endpoint": null,
+            "token": null,
+            "workspace_key_prefix": ""
+        },
+        "hash": 893988343
+    },
+    "modules": [
+        {
+            "path": [
+                "root"
+            ],
+            "outputs": {},
+            "resources": {},
+            "depends_on": []
+        }
+    ]
+}

data.tf

@@ -5,6 +5,7 @@ terraform {
       version = "~> 1.45"
     }
   }
+  backend "s3" {}
 }
 
 provider "hcloud" {

main.tf

@@ -1,15 +1,18 @@
 # SSH Key
 resource "hcloud_ssh_key" "default" {
-  name       = "${var.server_name}-ssh-key"
+  name       = local.ssh_key_name
   public_key = var.ssh_public_key
 }
 
 # Cloud-init script
 locals {
+  ssh_key_name = length(trimspace(var.ssh_key_name)) > 0 ? var.ssh_key_name : "${var.server_name}-ssh-key"
   user_data = templatefile("${path.module}/scripts/cloud-init.sh", {
-    tailscale_auth_key = var.tailscale_auth_key
     username           = var.username
     ssh_public_key     = var.ssh_public_key
+    distro_id          = var.distro_id
+    distro_codename    = var.distro_codename
+
   })
 }
 
@@ -19,7 +22,7 @@ resource "hcloud_server" "vps" {
   image       = var.image
   server_type = data.hcloud_server_type.selected.name
   location    = data.hcloud_location.selected.name
-  ssh_keys    = concat([hcloud_ssh_key.default.id], var.ssh_keys)
+  ssh_keys    = concat([hcloud_ssh_key.default.id])
   user_data   = local.user_data
 
   labels = {
@@ -54,6 +57,7 @@ resource "hcloud_firewall" "vps" {
     description     = "All TCP outbound"
   }
 
+
   rule {
     direction       = "out"
     protocol        = "udp"
@@ -68,9 +72,26 @@ resource "hcloud_firewall" "vps" {
     destination_ips = ["0.0.0.0/0", "::/0"]
     description     = "ICMP outbound"
   }
+  rule {
+    direction   = "in"
+    protocol    = "tcp"
+    port        = "22"
+    source_ips  = length(var.allowed_ssh_ips) > 0 ? var.allowed_ssh_ips : ["0.0.0.0/0", "::/0"]
+    description = "SSH inbound"
+  }
 }
 
 resource "hcloud_firewall_attachment" "vps" {
   firewall_id = hcloud_firewall.vps.id
   server_ids  = [hcloud_server.vps.id]
 }
+
+variable "distro_id" {
+  type    = string
+  default = "ubuntu"
+}
+
+variable "distro_codename" {
+  type    = string
+  default = "noble" # Das wäre der Codename für Ubuntu 24.04
+}

scripts/cloud-init.sh

@@ -18,20 +18,6 @@ DEBIAN_FRONTEND=noninteractive apt install -y \
   unattended-upgrades \
   apt-listchanges
 
-# Create non-root user
-#if ! id "$USERNAME" &>/dev/null; then
-#  useradd -m -s /bin/bash -G sudo "$USERNAME"
-#  echo "$USERNAME ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/$USERNAME
-#  chmod 0440 /etc/sudoers.d/$USERNAME
-#fi
-
-## SSH key for user
-#USER_HOME="/home/$USERNAME"
-#mkdir -p "$USER_HOME/.ssh"
-#echo "$SSH_PUBLIC_KEY" > "$USER_HOME/.ssh/authorized_keys"
-#chmod 700 "$USER_HOME/.ssh"
-#chmod 600 "$USER_HOME/.ssh/authorized_keys"
-#chown -R "$USERNAME:$USERNAME" "$USER_HOME/.ssh"
 
 # SSH hardening
 cat > /etc/ssh/sshd_config.d/hardening.conf << 'EOF'
@@ -40,20 +26,11 @@ PasswordAuthentication no
 ChallengeResponseAuthentication no
 UsePAM yes
 
-## Disable root login
-#PermitRootLogin no
 
 # Key-based auth only
 PubkeyAuthentication yes
 AuthorizedKeysFile .ssh/authorized_keys
 
-# Timeouts and limits
-ClientAliveInterval 300
-ClientAliveCountMax 2
-MaxAuthTries 3
-MaxSessions 3
-LoginGraceTime 30
-
 # Disable unused auth methods
 HostbasedAuthentication no
 PermitEmptyPasswords no
@@ -139,11 +116,4 @@ EOF
 
 sysctl -p /etc/sysctl.d/99-security.conf
 
-## Tailscale (optional)
-#if [ -n "$TAILSCALE_AUTH_KEY" ]; then
-#  curl -fsSL https://tailscale.com/install.sh | sh
-#  tailscale up --authkey="$TAILSCALE_AUTH_KEY" --ssh
-#  echo "Tailscale installed and connected"
-#fi
-
 echo "=== Cloud-init completed at $(date) ==="

terraform.tfvars

@@ -1,7 +1,7 @@
-hcloud_token   = "your-hetzner-api-token"
-server_name    = "clawdbot-prod"
+server_name    = "openclaw-prod"
 server_type    = "cax21"
 image          = "ubuntu-24.04"
-location       = "nbg1-dc3"
-ssh_public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCkKMAoaJiEWf5ruXnI1KOcwq3IRA2nShwPGaubklTVrCkTaXE8gSwpUtqnCJZvGxufUNVBLO/n/3KQNm8aFsEHX+c90F5FknrDro1S5szGRGlJz39YaMJeI0RSyHXNlOxIMl3zV1TpkvJGkdVCzTgafwSLfXws3/o/9fskNs5+jnTP03P8J4u1yEDbjmDNDRQRfBMHBbWOQ/+4Ci9japLSJrbUbmIpP78I8w2qCGPLBd/ksK3VTmn88sQ274m7nfjFMCIVondPz0u+oHg/5q0eiK1mbquTe9rdpx07BzNSLJbIHoEw+nqqf4L3mfoTNW7D67AgLZAztdrEj/GOzSL+tmgtO/lRQumZVCjWtyMtlL0D8F0O8lODngJhDbQHOOaoJz1kCBlJZOg2QqDsHQEO4FrNZ6gzlfj+q4LpYgEYMstJ2u/XFf5dEBWIA8JukYQeT/RLrMQJom0SmrEZ4kyzWWc7Rp9wF1QXk0Apgl2aKpqO6UTUP92P+hAPKmAArDgsSNZgiC/6ARYGi6igGObuGHW2pfB/5tK8mw55yiyH25XjP91BAaUDQfCab1yRU09nQenPzWQQ2bg87ZA6GQYi3xfzZoERCxmgfvhbvd7kEqBMHyOzD8WyFuNeBP8T06yKg0Qeo5jjQkrJySp8smnDqIkYcmhVAOYeZV/WfXtEzQ=="
-
+location       = "nbg1"
+distro_id      = "ubuntu"
+hcloud_token   = "__HCLOUD_TOKEN__"
+ssh_public_key = "__SSH_KEY__"

terraform.tfvars.example

@@ -1,7 +1,8 @@
-hcloud_token   = "your-hetzner-api-token"
+hcloud_token   = "__HCLOUD_TOKEN__"
 server_name    = "clawdbot-prod"
 server_type    = "cax21"
 image          = "ubuntu-24.04"
-location       = "nbg1-dc3"
-ssh_public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCkKMAoaJiEWf5ruXnI1KOcwq3IRA2nShwPGaubklTVrCkTaXE8gSwpUtqnCJZvGxufUNVBLO/n/3KQNm8aFsEHX+c90F5FknrDro1S5szGRGlJz39YaMJeI0RSyHXNlOxIMl3zV1TpkvJGkdVCzTgafwSLfXws3/o/9fskNs5+jnTP03P8J4u1yEDbjmDNDRQRfBMHBbWOQ/+4Ci9japLSJrbUbmIpP78I8w2qCGPLBd/ksK3VTmn88sQ274m7nfjFMCIVondPz0u+oHg/5q0eiK1mbquTe9rdpx07BzNSLJbIHoEw+nqqf4L3mfoTNW7D67AgLZAztdrEj/GOzSL+tmgtO/lRQumZVCjWtyMtlL0D8F0O8lODngJhDbQHOOaoJz1kCBlJZOg2QqDsHQEO4FrNZ6gzlfj+q4LpYgEYMstJ2u/XFf5dEBWIA8JukYQeT/RLrMQJom0SmrEZ4kyzWWc7Rp9wF1QXk0Apgl2aKpqO6UTUP92P+hAPKmAArDgsSNZgiC/6ARYGi6igGObuGHW2pfB/5tK8mw55yiyH25XjP91BAaUDQfCab1yRU09nQenPzWQQ2bg87ZA6GQYi3xfzZoERCxmgfvhbvd7kEqBMHyOzD8WyFuNeBP8T06yKg0Qeo5jjQkrJySp8smnDqIkYcmhVAOYeZV/WfXtEzQ=="
+location       = "nbg1"
+ssh_public_key = "__SSH_KEY__"
+ssh_key_name   = "mrmbp"
 

variables.tf

@@ -33,10 +33,10 @@ variable "ssh_public_key" {
   type        = string
 }
 
-variable "ssh_keys" {
-  description = "Additional SSH key IDs"
-  type        = list(string)
-  default     = []
+variable "ssh_key_name" {
+  description = "Existing Hetzner SSH key name (must already exist)"
+  type        = string
+  default     = ""
 }
 
 variable "username" {
@@ -45,13 +45,6 @@ variable "username" {
   default     = "clawdbot"
 }
 
-variable "tailscale_auth_key" {
-  description = "Tailscale auth key (optional)"
-  type        = string
-  default     = ""
-  sensitive   = true
-}
-
 variable "allowed_ssh_ips" {
   description = "IPs allowed to SSH (use your static IP or VPN range)"
   type        = list(string)