UpCloudPlan-validated

UpCloud Server Stack

Name: UpCloud Server Stack
Brand: IaC Bazaar
SKU: upcloud-server-stack
Availability: InStock

Servers on SDN private network with storage, router, and firewall rules.

terraformAlt & Specialty Cloudsupcloud

Compare Virtual Machines across clouds →

upcloud-server-stackvizier v1.2.0

Verification

Plan-validated

Passed: module logic verified on a mocked plan - inputs, validation rules, conditional creation and outputs resolve (no real provider, no cloud).

Conformance

Static validation (fmt · validate · tflint)
No applicable security policies for this provider
Plan tests (mocked: validation rules · outputs)

Provenance

SHA-256 checksum
Cosign signature

Functional

Live test pending (no cloud run yet)

Last verified 2026-06-28 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o upcloud-server-stack-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/upcloud-server-stack/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle upcloud-server-stack-1.0.0.sigstore.json \
  upcloud-server-stack-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "9b593a709ce45bac2280a8d3fd0214afab42c35febfe2622e3e792666a9ebd48  upcloud-server-stack-1.0.0.tar.gz" | sha256sum -c

Signature bundle Public key Machine-readable receipt How we verify

Use it from the registry

terraform · opentofu

module "server_stack" {
  source  = "www.iac-bazaar.com/iac-bazaar/upcloud-server-stack/upcloud"
  version = "1.0.0"
}

Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.

Cite it in your README

badge · attribution

Paste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads plan-validated because the record says so, and the link lands on this page.

README.md, GitLab, Gitea

[![IaC Bazaar: plan-validated](https://www.iac-bazaar.com/api/artifacts/upcloud-server-stack/badge)](https://www.iac-bazaar.com/catalog/upcloud-server-stack?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

Terraform module 1.0.0, plan-validated on IaC Bazaar: [UpCloud Server Stack](https://www.iac-bazaar.com/catalog/upcloud-server-stack?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

```hcl
module "server_stack" {
  source  = "www.iac-bazaar.com/iac-bazaar/upcloud-server-stack/upcloud"
  version = "1.0.0"
}
```

Preview:

Inputs & outputs

Create a free account to read this module's contract

The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.

Create a free account →Sign in

Documentation

upcloud-server-stack

N identical UpCloud cloud servers on a dedicated SDN private network (with router), encrypted boot + data storage, SSH-key-only login, and a deny-by-default per-server firewall. One module call gives you a private east-west plane your servers share, with public exposure strictly opt-in. Works with Terraform and OpenTofu (>= 1.6), UpCloud provider >= 5.0, < 6.0. EU/Nordic-sovereign infrastructure, MIT-licensed provider.

Status: static-validated, live-test pending. Validated with tofu validate + tflint + checkov against the UpCloudLtd/upcloud provider. Not yet applied against a live UpCloud account (no cloud sandbox yet), so it ships under live-test quarantine.

Design & secure defaults

Private by default. Every server gets an SDN private NIC; the public IPv4 interface is opt-in (public_interface = false). Private-only servers are reached through a bastion or load balancer.
Deny-by-default firewall. The per-server firewall (firewall = true) carries explicit allow rules first, then a catch-all drop for all remaining inbound IPv4 and IPv6. SSH (22/tcp) opens only to the CIDRs in ssh_source_ranges — empty means SSH is closed.
Encryption at rest on (encrypt_storage = true) for the boot disk and any data disks.
SSH-key-only login. ssh_keys is required; create_password = false, so no password logins are provisioned.
Source IP filtering on every interface (anti-spoofing).
Dedicated router + SDN network per stack, with the DHCP default route left off so private-only servers do not silently gain an unexpected egress path.
plan xor cpu+mem is enforced by a precondition; a custom-sized server requires both cpu and mem.

Requirements

Requirement	Version
Terraform / OpenTofu	`>= 1.6`
`UpCloudLtd/upcloud`	`>= 5.0, < 6.0`

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

Usage
Inputs
Outputs

Create a free account Sign in

Related modules

Static validatedLive test pending

upcloud-storage-template

An UpCloud storage template made from a server's storage, which is UpCloud's custom image, labelled by role and build (unlabelled has to be accepted by name). The template lives in the zone of its source and is the storage at that moment, secrets and all: build the source clean and stop the server first.

View module

Static validatedLive test pending

tencent-cvm-instance

A CVM instance in your subnet with login by key pair and no password, ordered security groups, no public address (one by name), the system disk encrypted with your KMS key (the service key by name), the Cloud Workload Protection and Cloud Monitor agents left on, a CAM role when you name one, and API termination refused. Pay-as-you-go by the hour.

View module

Static validatedLive test pending

aws-lightsail-instance

A Lightsail instance is created with 22 and 80 open to every address; its public address changes when it stops unless a static IP is attached, and every DNS record pointing at it is then wrong; and automatic snapshots are off. The port list replaced by your rules with SSH from anywhere accepted by name, a static IP attached, and the daily AutoSnapshot add-on on at the hour you choose.

View module

Static validatedLive test pending

scaleway-instance

A Scaleway instance on a Private Network with a required security group (the project default allows everything inbound), no public address unless a flexible IP is accepted by name, the project's SSH keys and no password, a Block Storage root volume deleted with the instance, cloud-init, and protection from deletion (off by name).

View module

Static validatedLive test pending

ibm-vsi-instance

A VPC virtual server in your subnet with the SSH keys you name and no password, security groups on the primary interface, no floating IP, the boot volume encrypted with a Key Protect key (IBM's key by name), secure boot on, and the metadata service on so a trusted profile can be the instance identity instead of a stored API key.

View module

Static validatedLive test pending

alicloud-ecs-instance

An ECS instance in your vSwitch with login by key pair and no password, no public address unless bandwidth above zero is accepted by name, the system disk encrypted with your KMS key (the service key by name), the metadata service on IMDSv2 only with a hop limit of one, the Security Center agent on, and deletion protection. Pay-as-you-go.

View module