Run the whole IaaS platform as code.

Provisions a Cloud Service VM: the record is created synchronously, the OS deployed asynchronously via a task the provider waits on. Plan, location and network placement are immutable; hostname/display_name update in place.

resource "iaas_instance" "web" {
  location_id = data.iaas_location.nyc.id
  plan_id     = data.iaas_plan.small.id
  image_id    = data.iaas_image.ubuntu.id
  ssh_keys    = [iaas_ssh_key.deploy.id]
  timezone    = "UTC"
  hostname     = "web-01"
  display_name = "Web 01"
  timeouts { create = "30m"; delete = "30m" }
}

Registers an SSH public key in your account for injection into instances at provision time.

resource "iaas_ssh_key" "laptop" {
  name       = "laptop"
  public_key = "ssh-ed25519 AAAAC3Nza... you@example.com"
}

Manages a reusable, encrypted-at-rest cloud-init / startup script that can be attached to instances at provision time.

resource "iaas_user_script" "bootstrap" {
  name        = "bootstrap"
  type        = "bash"
  shebang     = "#!/bin/bash"
  content     = <<-EOT
    apt-get update
    apt-get upgrade -y
  EOT
}

Captures a custom image (snapshot) from a running instance. Creation converges asynchronously to "available"; every input forces a new resource (no update route).

resource "iaas_image" "web_snapshot" {
  instance_id = iaas_instance.web.id
  name        = "web-prod-2026-07"
}

A named backup schedule & retention policy; instances attach to it via the instance_ids set, in place.

Deploys a catalog Docker app or a custom Compose file onto an instance, installing the Docker engine automatically first if needed. No update route - every change replaces the deployment.

resource "iaas_docker_deployment" "wordpress" {
  instance_id = iaas_instance.app_host.id
  source = "app"
  slug   = "wordpress"
  env = { WORDPRESS_DB_PASSWORD = "change-me" }
  port_mappings = [{ container_port = 80, host_port = 8080 }]
}

A self-healing fleet kept between min_instances and max_instances. Launch placement is fixed at create; template, bounds and security groups update in place; deletion is async.

resource "iaas_autoscaling_group" "web" {
  name                = "web-asg"
  hypervisor_group_id = "aaaaaaaa-..."
  plan_id             = "bbbbbbbb-..."
  image_id            = "cccccccc-..."
  min_instances = 2
  max_instances = 8
  ssh_keys            = ["dddddddd-..."]
  security_group_ids  = ["eeeeeeee-..."]
}

A CPU or memory-driven scale-up/down policy attached to an autoscaling group. Child resource - the group_id is part of the API path.

An isolated layer-2 private network with a server-assigned VNI. No update endpoint - every attribute is immutable.

resource "iaas_vpc" "main" {
  name                = "prodnet01"
  cidr                = "10.0.0.0/24"
  hypervisor_group_id = "00000000-..."
}

resource "iaas_vpc_subnet" "web" {
  vpc_id = iaas_vpc.main.id
  cidr   = "10.0.0.0/24"
  type   = "public"
  name   = "web tier"
}

A subnet inside a VPC; gateway and netmask are server-derived from the CIDR. Only the name updates in place - changing CIDR or type replaces it.

Attaches an instance's single VPC network interface to a subnet. Auto-assigns the primary IP; additional_ips manages secondaries in place. Destroying releases the whole interface.

resource "iaas_instance_vpc_attachment" "example" {
  instance_id   = iaas_instance.example.id
  vpc_id        = iaas_vpc.example.id
  vpc_subnet_id = iaas_vpc_subnet.example.id
  additional_ips = ["10.0.0.10", "10.0.0.11"]
  primary_ip     = "10.0.0.10"
}

Reserves a long-lived public IPv4 address from a location's pool, attachable to / detachable from instances. Billing must be enabled; no update endpoint (replace on change).

resource "iaas_static_ip" "example" {
  ip_id               = "00000000-0000-0000-0000-000000000001"
  hypervisor_group_id = "00000000-0000-0000-0000-000000000000"
}

A named, version-scoped set of CIDR entries referenced from security group rules. Entries are an order-independent inline set.

resource "iaas_ip_set" "blocklist" {
  name       = "blocklist"
  ip_version = "ipv4"
  entries = [
    { cidr = "203.0.113.0/24", comment = "Abusive range" },
    { cidr = "198.51.100.7" },
  ]
}

The single egress gateway giving a VPC's private subnets outbound internet access. One per VPC; auto-assigned public IP; asynchronous provisioning.

resource "iaas_nat_gateway" "example" {
  vpc_id      = iaas_vpc.example.id
  nat_enabled = true
  subnet_ids  = [iaas_vpc_subnet.private.id]
}

A named, stateful firewall rule set attachable to instances. Rules (CIDR, IP-set, or remote-group based) are managed as an inline order-independent set; instance attachments update in place.

resource "iaas_security_group" "web" {
  name         = "web-sg"
  instance_ids = [iaas_instance.web1.id, iaas_instance.web2.id]
  rules = [
    { direction = "ingress", protocol = "tcp", port_range_min = 443, port_range_max = 443, ip_version = "ipv4", cidr = "0.0.0.0/0" },
    { direction = "ingress", protocol = "tcp", port_range_min = 22,  port_range_max = 22,  ip_version = "ipv4", ip_set_id = iaas_ip_set.office.id },
  ]
}

An HAProxy load balancer backed by a dedicated instance, deployed in public mode (location) or VPC mode (subnet). Asynchronous; every input is immutable - frontends/backends/targets are separate resources.

resource "iaas_load_balancer" "public" {
  name                = "web-lb"
  lb_plan_id          = "44444444-..."
  hypervisor_group_id = "33333333-..."
  timeouts { create = "20m" }
}
resource "iaas_lb_backend" "web" {
  load_balancer_id = iaas_load_balancer.public.id
  name = "web-servers"; algorithm = "roundrobin"; mode = "http"
}
resource "iaas_lb_frontend" "http" {
  load_balancer_id   = iaas_load_balancer.public.id
  port = 80; protocol = "http"; default_backend_id = iaas_lb_backend.web.id
}

A backend pool of a load balancer, selecting the balancing algorithm and mode. Child of the load balancer; import as <lb_id>/<backend_id>.

A backend member - target_ip:target_port, optionally linked to an instance - with weight and enabled toggle. Import as a 3-part composite id.

A listener (port + protocol) that accepts traffic and routes to a default backend; attach a certificate here for HTTPS.

An L7 routing rule on a frontend that directs matching traffic to a specific backend. Import as a 3-part composite id.

A manually-uploaded PEM certificate + private key attached to an HTTPS frontend. Immutable - any change rotates (replaces) it.

A WireGuard endpoint VM deployed into a VPC's public subnet, giving remote clients and sites encrypted access to the VPC. One per VPC; asynchronous; entirely immutable.

resource "iaas_vpn_gateway" "example" {
  vpc_id        = iaas_vpc.example.id
  vpngw_plan_id = "11111111-..."
  vpc_subnet_id = iaas_vpc_subnet.public.id  # write-only, must be a PUBLIC subnet
  name          = "vpngw-prod"
}

A WireGuard peer on a gateway: a road-warrior client or a third-party site-to-site connection you configure yourself (public_key/endpoint/allowed_ips).

A server-derived WireGuard peering between two of your own VPN gateways in different VPCs. The server generates a symmetric pair of peer rows; model each side with its own resource.

resource "iaas_vpn_peering" "a_to_b" {
  vpn_gateway_id    = var.vpc_a_gateway_id
  remote_gateway_id = var.vpc_b_gateway_id
}
# Model the mirror side too, to own both rows in Terraform:
resource "iaas_vpn_peering" "b_to_a" {
  vpn_gateway_id    = var.vpc_b_gateway_id
  remote_gateway_id = var.vpc_a_gateway_id
}

An internal, per-VPC CoreDNS zone attachable to one or more VPCs, where its records become resolvable. Name is immutable; description and attached VPCs update in place.

resource "iaas_dns_zone" "example" {
  name    = "corp.internal"
  vpc_ids = [iaas_vpc.example.id]
}
resource "iaas_dns_record_set" "www" {
  zone_id = iaas_dns_zone.example.id
  name = "www"; type = "A"; routing_policy = "weighted"; ttl = 300
}
resource "iaas_dns_record" "www_a1" {
  zone_id = iaas_dns_zone.example.id; record_set_id = iaas_dns_record_set.www.id
  value = "10.0.0.10"; weight = 60
}

A named group of same-type records inside a zone, sharing a routing policy (simple / weighted / multivalue / failover) and TTL.

A single validated record value within a set (A/AAAA/CNAME/SRV), with an optional active health check that withholds unhealthy records from resolution.

A managed MySQL/MariaDB/PostgreSQL instance deployed into a VPC subnet. Asynchronous; plan resizes and engine_version upgrades happen in place; a billed add-on.

resource "iaas_managed_database" "primary" {
  name           = "app-prod-db"
  engine         = "mysql"
  engine_version = "8.0"
  db_plan_id     = "00000000-..."
  vpc_id         = "11111111-..."
  vpc_subnet_id  = "22222222-..."
  timeouts { create = "30m"; update = "15m"; delete = "30m" }
}

A read replica of a managed database, inheriting engine and version from its primary. Plan can be resized in place; everything else forces replacement.

A named, engine-scoped map of database configuration parameters (suffix-free keys only, e.g. max_connections).

An off-host S3-based backup policy (schedule, optional point-in-time recovery, retention) attached to managed databases via database_ids.

A plan-sized block storage volume. Async-provisioned; resize by switching to a larger plan; attach/detach an instance in place.

resource "iaas_volume" "data" {
  name                = "app-data"
  volume_plan_id      = "00000000-...0010"
  hypervisor_group_id = "00000000-...0000"
  instance_id         = "00000000-...0020"
  timeouts { create = "30m" }
}

A point-in-time, immutable snapshot of a volume. Async; import as <volume_id>/<snapshot_id>.

An S3-compatible object storage bucket with its own auto-generated, re-readable credentials; standalone access keys can be attached with a permission.

resource "iaas_s3_bucket" "assets" {
  name         = "my-app-assets"
  s3_plan_id   = "00000000-..."
  s3_server_id = "11111111-..."
  default_access = "private"
}

A standalone S3 access key whose secret is returned only once, at creation. No delete endpoint - destroying only removes it from state.

A managed cluster: a 1- or 3-node control plane behind a dedicated CP load balancer, plus a default worker pool. Async multi-stage provisioning; version bumps drive a staged in-place upgrade.

resource "iaas_kubernetes_cluster" "prod" {
  name = "prod"; slug = "prod"
  hypervisor_group_id  = "22222222-..."
  vpc_id               = "33333333-..."
  cp_vpc_subnet_id     = "44444444-..." # must be private
  worker_vpc_subnet_id = "55555555-..."
  kubernetes_version_id   = "66666666-..." # bump in place to upgrade
  control_node_count      = 3
  cp_instance_plan_id     = "77777777-..."
  cp_lb_plan_id           = "88888888-..."
  worker_instance_plan_id = "99999999-..."
  worker_count = 3
  timeouts { create = "45m"; update = "45m"; delete = "30m" }
}

A worker node pool with its own plan, min/max size, labels, taints and autoscaling toggle. Also manages a cluster's default pool via import.

A custom PEM or Let's Encrypt TLS certificate on a cluster's control-plane load balancer. No update route - any change rotates the certificate.

resource "iaas_kubernetes_ssl_certificate" "prod" {
  cluster_id = iaas_kubernetes_cluster.prod.id
  source     = "letsencrypt"
  domain     = "k8s.example.com"
}

A single firewall rule on one of a cluster's auto-provisioned groups (lb / cp / worker). No update - changing a field replaces the rule. Import as a 3-part composite id.

A Slack, Discord, Telegram or generic webhook delivery target that alert rules dispatch through. Config is sensitive and round-trips encrypted.

A metric-threshold alert that fires through attached notification channels when a resource metric crosses a threshold for a configured duration.

A logical grouping label for organizing instances, VPCs, load balancers, buckets and databases. Fully updatable in place.

Assigns one resource (instance / vpc / load_balancer / s3_bucket / managed_database) to a project as a standalone tagging action - not an attribute on the resource itself.

resource "iaas_project_assignment" "web_in_production" {
  project_id    = iaas_project.production.id
  resource_type = "instance"
  resource_id   = iaas_instance.web.id
}

Resolves a deploy location (hypervisor group) by slug or display name.

Resolves an instance plan by name within a location (optionally disambiguated by plan group).

Resolves an OS image by exact name, falling back to a unique case-insensitive substring match. Distinct from the iaas_image resource.

Resolves a mountable ISO by exact name.

Resolves an active Kubernetes version by semantic version string, e.g. 1.31.4.

Resolves a region eligible to host a cluster - only regions with Kubernetes + VPC + Load Balancer enabled are returned.

Resolves a cluster-create plan by name and kind (worker / cp / lb).

Resolves a VPC eligible to host a cluster by name; exposes has_nat_gateway since a private control plane needs NAT egress.

data "iaas_kubernetes_vpc" "prod" { name = "prod-vpc" }

data "iaas_kubernetes_subnet" "cp" {
  vpc_id = data.iaas_kubernetes_vpc.prod.id
  name   = "cp-subnet"
  type   = "private"
}

Resolves a subnet within a VPC by name (and optional type) for use as cp_vpc_subnet_id / worker_vpc_subnet_id.

Downloads a fresh admin kubeconfig for a running cluster. Sensitive - every read mints a new client certificate.

Renders the self-contained cluster-autoscaler manifest, embedding a freshly-minted controller JWT. Sensitive - every read rotates the active token.

Returns the caller's own account (whoami) - a singleton with no input filter. Referencing it validates the token & IP-lock during plan/apply.

data "iaas_account" "current" {}

output "is_admin" { value = data.iaas_account.current.is_admin }

Downloads the rendered WireGuard client .conf for a road-warrior peer. Sensitive; only valid for road_warrior peers.