M.V. Hutz
04ca230bee
## Summary - Adds a private runner server on the Hetzner private network (no public IP) - NAT through the gitea server for outbound internet access via `hcloud_network_route` and iptables forwarding rules - Runner connects to gitea over HTTPS on the private network with TLS verification disabled - Includes Taskfile commands for runner deployment and SSH access ## Test plan - [x] Runner registers with gitea instance - [x] Private network connectivity verified - [ ] Run a test workflow to confirm end-to-end CI 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #6 Co-authored-by: M.V. Hutz <git@maximhutz.me> Co-committed-by: M.V. Hutz <git@maximhutz.me>
25 lines
659 B
HCL
25 lines
659 B
HCL
resource "hcloud_network" "private_network" {
|
|
name = "repository-network"
|
|
ip_range = local.network_cidr
|
|
}
|
|
|
|
resource "hcloud_network_subnet" "private_subnet" {
|
|
network_id = hcloud_network.private_network.id
|
|
type = "cloud"
|
|
network_zone = local.network_zone
|
|
ip_range = local.subnet_cidr
|
|
}
|
|
|
|
resource "hcloud_server_network" "server_network" {
|
|
server_id = hcloud_server.server_instance.id
|
|
network_id = hcloud_network.private_network.id
|
|
ip = local.server_ip
|
|
}
|
|
|
|
resource "hcloud_network_route" "nat_route" {
|
|
network_id = hcloud_network.private_network.id
|
|
destination = "0.0.0.0/0"
|
|
gateway = local.server_ip
|
|
}
|
|
|