feat: Terraform production infrastructure (vRack, hub cluster, private LB)

[t0gun]

Overview

Codify production infrastructure with Terraform. Provisions the private network, NATS hub cluster, load balancer, and compute node placement on OVH Public Cloud.

Resources to manage

Networking

• vRack private network (e.g., 10.0.0.0/16)
• No public IPs for NATS hub nodes or LB
• Firewall rules: only compute nodes can reach LB on :7422

NATS Hub Cluster

• public cloud instances
• Private IPs on vRack
• Running nats-server in cluster mode with JetStream

Private Load Balancer

• Attached to vRack with private IP only (e.g., 10.0.0.10)
• Backends: 3 hub nodes on :7422 (leaf port) and :4222 (client port for controlp)
• Health checks on NATS monitoring port (:8222)

Compute Nodes

• Bare-metal instances on vRack
• Packer golden image (issue Bake immutable Packer golden host image #12) with nats-server + leaf.conf baked in
• NATS_HUB_HOST set to LB private IP at boot (cloud-init)

Topology

vRack (private, no internet exposure)
│
├── LB: 10.0.0.10 (private only)
│     ├── hub-1: 10.0.0.11
│     ├── hub-2: 10.0.0.12
│     └── hub-3: 10.0.0.13
│
├── compute-1 (leaf) → 10.0.0.10:7422
├── compute-2 (leaf) → 10.0.0.10:7422
└── compute-N (leaf) → 10.0.0.10:7422

Repo structure

terraform/
  main.tf
  variables.tf
  outputs.tf
  modules/
    network/       (vRack, subnets, firewall)
    nats-hub/      (hub instances, cluster config)
    load-balancer/ (private LB, backends, health checks)
    compute/       (bare-metal nodes, cloud-init)

Prerequisites

• Packer golden image (issue Bake immutable Packer golden host image #12)
• NATS hub and leaf topology working (issue Transition NATS to Hub and Leaf Topology #18)
• OVH API credentials for Terraform provider

Not in scope

• Multi-region (handled by duplicating the module per region later)
• DNS (use LB private IP directly for now)
• mTLS on leaf connections (separate issue)