Examples

Ready-to-copy root configurations under terraform/examples/, one per substrate/scenario. Each is a complete tofu apply — infra + bootstrap (+ platform where applicable). Copy the one that matches your substrate, fill in terraform.tfvars (where provided), and follow Getting started.

Two patterns appear across the set:

• <cloud>-shc — one module "shc" call (a substrate front door) folds infra + bootstrap into a single root; the platform (DNS / ACME / apps) is wired either through the module’s topology block (Hetzner) or with root-level shc_connection / shc_config / shc_deployment resources (the cloudflare-parent-mix estates).
• scenario variants (hetzner-lan, hetzner-wan-nebula, hetzner-lan-lb, mixed-proxmox-hetzner, proxmox-lan) — demonstrate a specific topology or a multi-substrate composition.

Notes:

• “off (root shc_*)” means the module’s topology block is deliberately omitted and the platform is wired with root-level shc_connection / shc_config / shc_deployment resources — the cloudflare-parent-mix shape, the default across live estates (the module’s single-connection topology block can’t express a cloudflare DNS provider split from a cloud-native volume/proxy provider).
• Examples that ship a registry.tfrc (gcp, digitalocean, scaleway) include a ready provider_installation block — use it via export TF_CLI_CONFIG_FILE="$PWD/registry.tfrc".
• “Unverified-live” means the substrate module is built + unit-tested but has not been applied against a live account yet.

The canonical single-root example. It wires infra + bootstrap + the lb platform in one tofu apply with no bearer token and no driver.sh.

versions.tf — declares both providers; the shc provider resolves from the network mirror (see Getting started):

terraform {
  required_version = ">= 1.6.0"
  required_providers {
    hcloud = { source = "hetznercloud/hcloud", version = "~> 1.45" }
    shc    = { source = "selfhosted-cloud/shc" }
  }
}

main.tf — one module "shc" call folding all three layers:

provider "hcloud" {
  # Token from the HCLOUD_TOKEN environment variable — never in tfvars/state.
}

module "shc" {
  source = "../../modules/shc/hetzner"

  cluster_name   = var.cluster_name
  region         = var.region
  image          = var.image
  ssh_public_key = var.ssh_public_key

  # Default SSH — both node groups resolve to this. Drives the install+join
  # transport AND, for the bootstrap node, the platform-resource SSH transport.
  ssh = {
    user             = "admin"
    private_key_path = var.ssh_private_key_path
  }

  # LAYER 1: infra (always applies) — two pools, mixed runtime + region.
  node_groups = {
    control = { count = 3, server_type = "cx33", runtime = "compose" }
    workers = {
      count = 2, server_type = "cx43", runtime = "swarm", region = var.workers_region
      firewall = {                       # PER-GROUP firewall (only workers)
        public_ports = [
          { port = "30000-32767", protocol = "tcp" },
          { port = "30000-32767", protocol = "udp" },
        ]
      }
    }
  }

  networking = { private = true, ip_range = var.network_cidr, subnet = var.subnet_cidr }
  firewall   = { public_ports = [] } # inter_node unset → derives "none" from this private plane

  # LAYER 2: bootstrap — installs the .deb + runs shc init / shc node join
  # over SSH. Public Let's Encrypt via a named ACME provider.
  bootstrap = {
    package        = { deb_url = var.deb_url }
    vault_password = var.vault_pw
    nebula         = false
    host           = var.shc_host
    acme = {
      providers = { prod = { email = var.acme_email } }
      default   = "prod"
    }
  }

  # LAYER 3: topology / platform — DNS + ACME + traefik LB port attach, over
  # the same SSH transport (requires bootstrap, enforced by a check block).
  topology = {
    kind = "lb"
    dns = {
      name        = "hetzner"
      type        = "hetzner"
      zones       = [var.dns_zone]
      credentials = { token = var.hcloud_token }
    }
  }
}

What each layer maps to:

• Layer 1 (infra) → hcloud_server, hcloud_network, hcloud_network_subnet, hcloud_firewall (per group), hcloud_ssh_key, hcloud_placement_group. Plain hcloud resources, authed from HCLOUD_TOKEN.
• Layer 2 (bootstrap) → inside module.core: one pure-config shc_cluster, one shc_node.bootstrap (shc init on control node 1), and shc_node.workers (shc node join on the other 4). See shc_node.
• Layer 3 (topology lb) → a proxy-capable shc_connection (named hetzner), a shc_config setting dns.provider, and a shc_stack_ports attaching 80/443 to the system traefik stack.

The bootstrap node’s runtime is DERIVED from node_groups.control.runtime (the alphabetically-first group), not a standalone field.

Outputs (outputs.tf) surface the cluster endpoint and node facts:

tofu output cluster_endpoint
tofu output node_public_ipv4s

To manage more of the cluster declaratively, add root-level shc_deployment blocks (with a cluster { ssh { hosts = module.shc.cluster_ssh_hosts, user = "admin", private_key = file(var.ssh_private_key_path) } } override so they reach the cluster — hosts names every node, so the operation still lands when the leader moves), or SSH in and use the CLI.

See The module library for the full shc/hetzner and core input/output reference, and the cloud guides for per-cloud account prerequisites.