CivoStatic-verified

Civo Compute Stack

Name: Civo Compute Stack
Brand: IaC Bazaar
SKU: civo-compute-stack
Availability: InStock

Instances with network, firewall, volume, and reserved IP.

terraformAlt & Specialty Cloudscivo

Compare Virtual Machines across clouds →

civo-compute-stackvizier v1.2.0

Verification

Static-verified

Passed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).

Conformance

Static validation (fmt · validate · tflint)
No applicable security policies for this provider
Plan tests (mocked: validation rules · outputs)

Provenance

SHA-256 checksum
Cosign signature

Functional

Live test pending (no cloud run yet)

Last verified 2026-06-28 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o civo-compute-stack-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/civo-compute-stack/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle civo-compute-stack-1.0.0.sigstore.json \
  civo-compute-stack-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "aa532ced120f42e8323bb4a36639d429633652e521440670c3c5f883342413bf  civo-compute-stack-1.0.0.tar.gz" | sha256sum -c

Signature bundle Public key Machine-readable receipt How we verify

Use it from the registry

terraform · opentofu

module "compute_stack" {
  source  = "www.iac-bazaar.com/iac-bazaar/civo-compute-stack/civo"
  version = "1.0.0"
}

Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.

Cite it in your README

badge · attribution

Paste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.

README.md, GitLab, Gitea

[![IaC Bazaar: static-verified](https://www.iac-bazaar.com/api/artifacts/civo-compute-stack/badge)](https://www.iac-bazaar.com/catalog/civo-compute-stack?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

Terraform module 1.0.0, static-verified on IaC Bazaar: [Civo Compute Stack](https://www.iac-bazaar.com/catalog/civo-compute-stack?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

```hcl
module "compute_stack" {
  source  = "www.iac-bazaar.com/iac-bazaar/civo-compute-stack/civo"
  version = "1.0.0"
}
```

Preview:

Inputs & outputs

Create a free account to read this module's contract

The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.

Create a free account →Sign in

Documentation

civo-compute-stack

Status: static-validated, live-test pending. This module ships under live-test quarantine — it passes tofu fmt, tofu validate, and tflint, but the real apply → verify → destroy gate is deferred until a Civo cloud sandbox account is wired into the live-test lane. Treat the secure defaults as reviewed, the cloud behavior as not yet proven end-to-end.

Civo compute stack: one or more instances on a dedicated private network behind a deny-by-default firewall, with optional per-instance block storage and an optional reserved (static) public IP. Works with Terraform and OpenTofu (>= 1.6), Civo provider >= 1.0, < 2.0.

Design / secure defaults

Dedicated private network (civo_network) per stack instead of the Civo default network — clean isolation.
Deny-by-default firewall. The civo_firewall is created with create_default_rules = false, so nothing inbound is permitted until you list CIDRs. SSH (tcp/22) opens only for allowed_ssh_cidrs; the default empty list leaves SSH closed. Add app ports via extra_ingress_rules. Egress is allowed so instances can reach package mirrors.
Key-based access by default. write_password = false, so Civo does not generate/email a root password — supply sshkey_id. If you do enable write_password, the generated value is a sensitive output.
Per-instance data volume (civo_volume + civo_volume_attachment), attached at boot by default so cloud-init can format and mount it.
Reserved IP guard. create_reserved_ip is gated by a precondition requiring instance_count = 1, since the static IP binds to one instance — this fails fast at plan time rather than silently mis-wiring.

Requirements

Terraform or OpenTofu >= 1.6
civo/civo provider >= 1.0, < 2.0
create_reserved_ip = true requires instance_count = 1 (enforced by a precondition).

License

Commercial — LicenseRef-IaCBazaar-Commercial.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

Usage
Inputs
Outputs

Create a free account Sign in

Related modules

Static validatedLive test pending

tencent-cvm-instance

A CVM instance in your subnet with login by key pair and no password, ordered security groups, no public address (one by name), the system disk encrypted with your KMS key (the service key by name), the Cloud Workload Protection and Cloud Monitor agents left on, a CAM role when you name one, and API termination refused. Pay-as-you-go by the hour.

View module

Static validatedLive test pending

aws-lightsail-instance

A Lightsail instance is created with 22 and 80 open to every address; its public address changes when it stops unless a static IP is attached, and every DNS record pointing at it is then wrong; and automatic snapshots are off. The port list replaced by your rules with SSH from anywhere accepted by name, a static IP attached, and the daily AutoSnapshot add-on on at the hour you choose.

View module

Static validatedLive test pending

scaleway-instance

A Scaleway instance on a Private Network with a required security group (the project default allows everything inbound), no public address unless a flexible IP is accepted by name, the project's SSH keys and no password, a Block Storage root volume deleted with the instance, cloud-init, and protection from deletion (off by name).

View module

Static validatedLive test pending

ibm-vsi-instance

A VPC virtual server in your subnet with the SSH keys you name and no password, security groups on the primary interface, no floating IP, the boot volume encrypted with a Key Protect key (IBM's key by name), secure boot on, and the metadata service on so a trusted profile can be the instance identity instead of a stored API key.

View module

Static validatedLive test pending

alicloud-ecs-instance

An ECS instance in your vSwitch with login by key pair and no password, no public address unless bandwidth above zero is accepted by name, the system disk encrypted with your KMS key (the service key by name), the metadata service on IMDSv2 only with a hop limit of one, the Security Center agent on, and deletion protection. Pay-as-you-go.

View module

Static validatedLive test pending

huawei-ecs-instance

An ECS instance in your subnet with login by key pair and no password, no elastic IP unless one is accepted by name, the system disk encrypted with your KMS key (the platform key by name), an IAM agency as its identity so code on it needs no stored access key (none by name), the Cloud Eye agent on, and the instance stopped before destroy with its disks. Pay-per-use.

View module