Civo Compute Stack

civo-compute-stack

Status: static-validated, live-test pending. This module ships under live-test quarantine — it passes tofu fmt, tofu validate, and tflint, but the real apply → verify → destroy gate is deferred until a Civo cloud sandbox account is wired into the live-test lane. Treat the secure defaults as reviewed, the cloud behavior as not yet proven end-to-end.

Civo compute stack: one or more instances on a dedicated private network behind a deny-by-default firewall, with optional per-instance block storage and an optional reserved (static) public IP. Works with Terraform and OpenTofu (>= 1.6), Civo provider >= 1.0, < 2.0.

Design / secure defaults

• Dedicated private network (civo_network) per stack instead of the Civo default network — clean isolation.
• Deny-by-default firewall. The civo_firewall is created with create_default_rules = false, so nothing inbound is permitted until you list CIDRs. SSH (tcp/22) opens only for allowed_ssh_cidrs; the default empty list leaves SSH closed. Add app ports via extra_ingress_rules. Egress is allowed so instances can reach package mirrors.
• Key-based access by default. write_password = false, so Civo does not generate/email a root password — supply sshkey_id. If you do enable write_password, the generated value is a sensitive output.
• Per-instance data volume (civo_volume + civo_volume_attachment), attached at boot by default so cloud-init can format and mount it.
• Reserved IP guard. create_reserved_ip is gated by a precondition requiring instance_count = 1, since the static IP binds to one instance — this fails fast at plan time rather than silently mis-wiring.

Usage

provider "civo" {
  region = "LON1" # token via CIVO_TOKEN
}

module "compute" {
  source = "./civo-compute-stack"

  name           = "app"
  region         = "LON1"
  instance_count = 2
  size           = "g3.small"
  disk_image     = "ubuntu-noble"

  allowed_ssh_cidrs = ["203.0.113.10/32"]
  sshkey_id         = "<your-civo-ssh-key-id>"

  volume_size_gb = 40
  tags           = ["app", "demo"]
}

Inputs

Name	Type	Default	Description
name	string	—	Resource name prefix (required)
region	string	—	Civo region, e.g. LON1, NYC1 (required)
instance_count	number	1	Number of instances (1-50)
size	string	"g3.small"	Civo instance size code
disk_image	string	"ubuntu-noble"	Boot disk image / template
sshkey_id	string	null	Civo SSH key id installed at boot
initial_user	string	"civo"	Initial sudo user
write_password	bool	false	Generate + email a root password (off; prefer SSH keys)
public_ip	string	"create"	create, none, or move_ip_from:<id>
script	string	null	Cloud-init / bootstrap script
network_cidr	string	"10.30.0.0/24"	IPv4 CIDR for the private network
network_nameservers	list(string)	[]	Custom nameservers (empty = Civo defaults)
allowed_ssh_cidrs	list(string)	[]	CIDRs allowed to SSH (tcp/22); empty = closed
extra_ingress_rules	map(object)	{}	Extra firewall ingress rules { protocol, port_range, cidr, action, label }
volume_size_gb	number	null	Per-instance data volume size; null disables
volume_attach_at_boot	bool	true	Attach the volume at boot
create_reserved_ip	bool	false	Create + bind a reserved static IP (needs instance_count = 1)
tags	set(string)	[]	Instance tags

Outputs

Name	Description
instance_ids	Instance IDs
instance_hostnames	Instance hostnames
instance_public_ips	Public IPv4 addresses (empty when public_ip = "none")
instance_private_ips	Private network IPv4 addresses
instance_initial_passwords	Civo-generated passwords (sensitive, only with write_password)
network_id	Private network ID
firewall_id	Firewall ID
volume_ids	Data volume IDs (empty when disabled)
reserved_ip	Reserved static IP, or null
reserved_ip_id	Reserved IP ID, or null

Requirements

• Terraform or OpenTofu >= 1.6
• civo/civo provider >= 1.0, < 2.0
• create_reserved_ip = true requires instance_count = 1 (enforced by a precondition).

Verification

Static-validated (tofu fmt, tofu validate, tflint). Live apply/destroy testing pending Civo sandbox availability — see catalog status.

License

Commercial — LicenseRef-IaCBazaar-Commercial.