Vultr Compute Stack

vultr-compute-stack

A Vultr compute stack: N identical instances on a private VPC behind a default-deny cloud firewall, with optional per-instance block storage and an optional reserved (static) IP that survives instance rebuilds.

Status: static-validated, live-test pending. Validated with tofu validate + tflint + checkov against the vultr/vultr provider. Not yet applied against a live Vultr account, so it ships under live-test quarantine.

Design & secure defaults

• SSH closed by default. Vultr firewall groups deny inbound traffic that matches no rule, so SSH stays shut until you list allowed_ssh_cidrs. Add arbitrary firewall_rules for everything else.
• Private networking. Instances join a dedicated VPC (created unless you pass an existing vpc_id); set disable_public_ipv4 = true for VPC-only or IPv6-only fleets.
• Backups on by default (backups_enabled = true) with a configurable schedule — turn off for ephemeral environments.
• Optional persistence: block_storage_size_gb attaches a live NVMe (or HDD) volume per instance; create_reserved_ip pins a static IPv4 to instance 1.

Usage

module "compute" {
  source = "github.com/ITfreak/iacbazaar//artifacts/terraform/vultr-compute-stack"

  name              = "app"
  region            = "ewr"
  instance_count    = 2
  allowed_ssh_cidrs = ["203.0.113.10/32"]
  ssh_key_ids       = ["<vultr-ssh-key-id>"]
}

See examples/basic for a complete configuration.

Key inputs

Variable	Description	Default
name	Resource name prefix	required
region	Vultr region id (e.g. ewr, ams)	required
instance_count	Number of instances (1-50)	1
plan	Vultr plan id	vc2-1c-1gb
os_id	OS id (2284 = Ubuntu 24.04)	2284
ssh_key_ids	SSH keys installed at boot	[]
allowed_ssh_cidrs	CIDRs allowed to reach tcp/22	[] (closed)
firewall_rules	Extra firewall rules map	{}
vpc_id / vpc_subnet / vpc_subnet_mask	Use existing VPC, or define the created one	null / 10.16.0.0 / 24
block_storage_size_gb / block_storage_type	Per-instance volume	null / high_perf
backups_enabled	Automatic backups	true
create_reserved_ip	Static IP on instance 1	false

Outputs

instance_ids, instance_labels, instance_main_ips, instance_internal_ips, vpc_id, firewall_group_id, block_storage_ids, reserved_ip, reserved_ip_id.

Provider

vultr/vultr >= 2.0, < 3.0. Requires Terraform/OpenTofu >= 1.6.

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.