# SSH Key
resource "hcloud_ssh_key" "default" {
  name       = "${var.server_name}-ssh-key"
  public_key = var.ssh_public_key
}

# Cloud-init script
locals {
  user_data = templatefile("${path.module}/scripts/cloud-init.sh", {
    username           = var.username
    ssh_public_key     = var.ssh_public_key
    distro_id          = vars.distro_id

  })
}

# Server
resource "hcloud_server" "vps" {
  name        = var.server_name
  image       = var.image
  server_type = data.hcloud_server_type.selected.name
  location    = data.hcloud_location.selected.name
  ssh_keys    = concat([hcloud_ssh_key.default.id], var.ssh_keys)
  user_data   = local.user_data

  labels = {
    app = "openclaw"
    os = "ubuntu24"
    virt = "docker"
    managed-by  = "terraform"
    environment = var.environment

  }
}

# Firewall – locked down by default
resource "hcloud_firewall" "vps" {
  name = "${var.server_name}-firewall"


  # ICMP for diagnostics
  rule {
    direction   = "in"
    protocol    = "icmp"
    source_ips  = ["0.0.0.0/0", "::/0"]
    description = "ICMP (ping)"
  }

  # Egress – allow all (Hetzner default, but explicit is better)
  rule {
    direction       = "out"
    protocol        = "tcp"
    port            = "1-65535"
    destination_ips = ["0.0.0.0/0", "::/0"]
    description     = "All TCP outbound"
  }

  rule {
    direction       = "out"
    protocol        = "udp"
    port            = "1-65535"
    destination_ips = ["0.0.0.0/0", "::/0"]
    description     = "All UDP outbound"
  }

  rule {
    direction       = "out"
    protocol        = "icmp"
    destination_ips = ["0.0.0.0/0", "::/0"]
    description     = "ICMP outbound"
  }
}

resource "hcloud_firewall_attachment" "vps" {
  firewall_id = hcloud_firewall.vps.id
  server_ids  = [hcloud_server.vps.id]
}
variable "distro_id" {
  type    = string
  default = "ubuntu"
}

variable "hcloud_token" {
  description = "Hetzner Cloud API token"
  type        = string
  sensitive   = true
}