This repository contains my Pulumi IaC (in Python) and Ansible playbooks to automate setting up a VPS on any cloud provider.

Core Components

• Pulumi: Infrastructure-as-Code tool used to provision the raw cloud resources (Virtual Network, Static IP, Virtual Machine).
• Ansible: Configuration Management tool used to SSH into the newly created server and automate software installation. It configures:
  • Docker & Docker Compose v2: Installed as the core container runtime to easily self-host applications.
  • UFW (Uncomplicated Firewall): Hardens the server by blocking all incoming traffic except for essential ports (22, 80, 443).
  • Fail2ban: Security daemon acting as an automated bot blocker, instantly banning IP addresses that attempt to brute-force or spam SSH logins.
  • Restic + Backblaze B2: An automated daily cron job that mathematically encrypts your Docker volumes and securely uploads them to the cloud.

Prerequisites

Before deploying, you must install both Pulumi and Ansible on your local machine, and authenticate with your chosen cloud provider's CLI.

Install Pulumi (Linux/macOS):

curl -fsSL https://get.pulumi.com | sh

Install Ansible: Follow the official Ansible installation guide to install it using your operating system's package manager (e.g., brew install ansible, pacman -S ansible, or apt install ansible).

Setup

1. Clone the Repository:

git clone https://github.com/YOUR_USERNAME/cloud-vps.git
cd cloud-vps

2. Choose Your Cloud Provider: This blueprint is natively written for Microsoft Azure, but the Ansible logic is completely cloud-agnostic. Ensure you have the Azure CLI installed and have run az login to authenticate.

3. Configure the Blueprint: Copy the example configuration files and modify Pulumi.dev.yaml with your preferred region, VM size, and local SSH key path:

cp Pulumi.dev.example.yaml Pulumi.dev.yaml
cp ansible/inventory.example.yml ansible/inventory.yml

4. Initialize the Environment: Create a Python virtual environment and install the Pulumi dependencies:

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Backups (Backblaze B2 + Restic)

The Ansible playbook automatically configures a daily 3:00 AM cron job to encrypt and back up your data to the cloud using Restic.

Before deploying, you must create a free Backblaze B2 bucket, generate an Application Key, and add those credentials to your ansible/inventory.yml file:

all:
  hosts:
    vps:
      ansible_host: <YOUR_VPS_IP>
      ansible_user: papyrus
      b2_account_id: 'YOUR_KEY_ID'
      b2_account_key: 'YOUR_APPLICATION_KEY'
      b2_bucket: 'YOUR_EXACT_BUCKET_NAME'
      restic_password: 'super_secret_encryption_password'

Note: After your first deployment, you must SSH into the server and run restic -r b2:YOUR_BUCKET:/backup init to initialize the encrypted bucket.

Deployment

You can deploy the cloud infrastructure using the automated script or run the steps manually.

Option A: Automated Deployment

chmod +x scripts/deploy.sh
./scripts/deploy.sh

Option B: Manual Deployment

# 1. Provision cloud resources
pulumi up --stack dev

# 2. Get the new Public IP and add it to ansible/inventory.yml
pulumi stack output vm_public_ip

# 3. Configure the Ubuntu server
cd ansible
ansible-playbook playbook.yml

Access

Once deployed, connect securely via SSH:

ssh papyrus@<YOUR_VPS_IP>

Teardown

To destroy the cloud resources and stop billing:

pulumi destroy --stack dev