This repository contains my Pulumi IaC (in Python) and Ansible playbooks to automate setting up a VPS on any cloud provider.

### Core Components

- **Pulumi:** Infrastructure-as-Code tool used to provision the raw cloud resources (Virtual Network, Static IP, Virtual Machine).
- **Ansible:** Configuration Management tool used to SSH into the newly created server and automate software installation. It configures:
  - **Docker & Docker Compose v2:** Installed as the core container runtime to easily self-host applications.
  - **UFW (Uncomplicated Firewall):** Hardens the server by blocking all incoming traffic except for essential ports (22, 80, 443).
  - **Fail2ban:** Security daemon acting as an automated bot blocker, instantly banning IP addresses that attempt to brute-force or spam SSH logins.
  - **Restic + Backblaze B2:** An automated daily cron job that mathematically encrypts your Docker volumes and securely uploads them to the cloud.

### Prerequisites

Before deploying, you must install both Pulumi and Ansible on your local machine, and authenticate with your chosen cloud provider's CLI.

**Install Pulumi (Linux/macOS):**
```bash
curl -fsSL https://get.pulumi.com | sh
```

**Install Ansible:**
Follow the [official Ansible installation guide](https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html) to install it using your operating system's package manager (e.g., `brew install ansible`, `pacman -S ansible`, or `apt install ansible`).

### Setup

1. **Clone the Repository:** 
```bash
git clone https://github.com/YOUR_USERNAME/cloud-vps.git
cd cloud-vps
```

2. **Choose Your Cloud Provider:** This blueprint is natively written for **Microsoft Azure**, but the Ansible logic is completely cloud-agnostic. Ensure you have the Azure CLI installed and have run `az login` to authenticate.

3. **Configure the Blueprint:** Navigate into the `azure/` directory, copy the example configuration files, and modify `Pulumi.dev.yaml` with your preferred region, VM size, and local SSH key path:
```bash
cd azure
cp Pulumi.dev.example.yaml Pulumi.dev.yaml
cp ansible/inventory.example.yml ansible/inventory.yml
```

4. **Initialize the Environment:** Create a Python virtual environment and install the Pulumi dependencies:
```bash
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
```

### Backups (Backblaze B2 + Restic)

The Ansible playbook automatically configures a daily 3:00 AM cron job to encrypt and back up your data to the cloud using **Restic**.

Before deploying, you must create a free Backblaze B2 bucket, generate an Application Key, and add those credentials to your `ansible/inventory.yml` file:

```yaml
all:
  hosts:
    vps:
      ansible_host: <YOUR_VPS_IP>
      ansible_user: papyrus
      b2_account_id: 'YOUR_KEY_ID'
      b2_account_key: 'YOUR_APPLICATION_KEY'
      b2_bucket: 'YOUR_EXACT_BUCKET_NAME'
      restic_password: 'super_secret_encryption_password'
```

*Note: After your first deployment, you must SSH into the server and run `restic -r b2:YOUR_BUCKET:/backup init` to initialize the encrypted bucket.*

### Deployment

You can deploy the cloud infrastructure using the automated script or run the steps manually.

**Option A: Automated Deployment**
```bash
cd azure
chmod +x scripts/deploy.sh
./scripts/deploy.sh
```

**Option B: Manual Deployment**
```bash
cd azure

# 1. Provision cloud resources
pulumi up --stack dev

# 2. Get the new Public IP and add it to ansible/inventory.yml
pulumi stack output vm_public_ip

# 3. Configure the Ubuntu server
cd ansible
ansible-playbook playbook.yml
```

### Access

Once deployed, connect securely via SSH:
```bash
ssh papyrus@<YOUR_VPS_IP>
```

### Teardown

To destroy the cloud resources and stop billing:
```bash
pulumi destroy --stack dev
```