The infrastructure from before 2026 (before it was managed as code) is kept for reference in Archive → Infrastructure (Legacy).
Infrastructure Overview
ABAIR's servers are managed as code in the infrastructure-automation repository (mirrored to GitHub). To change a server, you edit the repository and run a make target. You don't click through the Proxmox UI or install packages by hand over SSH.
How the pieces fit together
| Tool | Location in the repo | What it does |
|---|---|---|
| Terraform | terraform/hetzner-main/ | Creates the virtual machines on the Proxmox host: CPU, memory, disk, IP address and cloud-init settings. See Provisioning with Terraform. |
| Ansible | ansible/ | Configures the software on every server: Docker, application stacks, firewalls, monitoring agents and CI runners. See Configuring with Ansible. |
| Make | Makefile | Wraps Terraform and Ansible. Each target runs one playbook (or Terraform) with the right secrets from Vaultwarden. See Makefile Reference. |
| nginx config | networking/nginx-config/ | One file per public hostname, deployed to the webserver. See Networking and Ingress. |
| Grafana dashboards | grafana-dashboards/ | Dashboard JSON, loaded into Grafana automatically. See Monitoring and Security. |
Every make target runs inside a pinned Docker container, so the only tools you need on your own machine are Docker and make. See Getting Started.
The servers
The estate is spread across several machines, each in a separate place for a reason:
- hetzner-main is a Hetzner dedicated server running Proxmox VE. It hosts the production virtual machines on a private network,
10.0.0.0/24:- webserver is the only public entry point for web traffic.
- api-gateway runs the public ABAIR API.
- services-user runs the user-facing apps.
- services-staff runs internal tools.
- docker-build runs the CI runners and the image registry.
- synthesis-legacy runs the older speech-synthesis stack.
- Amergin is a separate Hetzner server with a GPU. It runs speech recognition, speech synthesis and predictive text. It connects to hetzner-main over a private Hetzner vSwitch.
- Secops is a separate Hetzner server for security and operations tools: Wazuh (SIEM), Gitea, Rocket.Chat and the monitoring stack. It is kept apart from production on purpose, so a compromise of production doesn't also hand over the tools used to detect and recover from it.
- Vaultwarden is a small Hetzner Cloud server, in its own account, that hosts the team's password vault. Most secrets used by the
maketargets come from here. - Puca is a Raspberry Pi in the lab that records Irish-language radio and TV.
The Server List has addresses and specs for all of them. The Diagrams show the same layout visually.
Not managed by this repo
A few machines still run outside Terraform and Ansible:
- scealai (
10.0.0.6, VMID 106) is a VM on hetzner-main that hosts An Scéalaí,lara.abair.ieand the publicgramadoir.abair.ie. It is configured by hand. The only thing the repo does to it is enroll a Wazuh agent. - services (
10.0.0.2) is the legacy monolithic VM whose apps moved to services-user and services-staff. The webserver still sendsmail.abair.ieandold.abair.ieto it. - A few nginx routes still point at other older machines (
10.0.0.5,10.0.0.8). See Networking and Ingress.
Where to go next
- New here? Start with Getting Started.
- Looking for a server? See the Server List.
- Want to change something? See Making Changes, or Adding an App if you're deploying a new web app.
- Want to know how something is backed up? See Backups and Recovery.