Resource Reference & Definitions

Complete reference for the microsrv OpenTofu provider: virtual machines, containers, block volumes, VPC, edge gateways, load balancers, and WireGuard peers.

Resource Model

The microsrv provider provides declarative resources matching the platform’s control plane architecture. All resources support automated dependency graph resolution and graceful teardown on tofu destroy.

1. Projects and Access Keys

`microsrv_project`

Logical workspace boundary providing quota limits, billing aggregation, and resource isolation.

resource "microsrv_project" "prod" {
  name = "production-workloads"
}

name (string, required) — Unique project name. Modifying forces replacement (ForceNew).

`microsrv_ssh_key`

Public SSH key for host authentication across VMs and containers.

resource "microsrv_ssh_key" "deployer" {
  name       = "deployer-key"
  public_key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG... deployer@ci"
}

name (string, required) — User-friendly key name.
public_key (string, required) — RSA or ED25519 public key string. Modifying forces replacement (ForceNew).

2. Virtual Networking

`microsrv_vpc`

Isolated private network with high-performance eBPF routing and built-in Outbound NAT.

resource "microsrv_vpc" "app_net" {
  project_id = microsrv_project.prod.id
  region_id  = data.microsrv_region.central.id
  cidr       = "10.42.0.0/24"
}

project_id (string, required) — Parent project ID.
region_id (string, required) — Target deployment region ID.
cidr (string, required) — IPv4 network block with /24 prefix (e.g. 10.42.0.0/24).

`microsrv_network_interface`

Virtual NIC binding a compute instance or VPN peer to a VPC subnet.

resource "microsrv_network_interface" "eth0" {
  project_id = microsrv_project.prod.id
  vpc_id     = microsrv_vpc.app_net.id
  # ip_address = "10.42.0.15" # Optional: static IP reservation
}

project_id (string, required) — Parent project ID.
vpc_id (string, required) — Target VPC ID.
ip_address (string, optional) — Static IP within the VPC subnet. If omitted, the platform assigns the first available IP. Changing forces replacement.

3. Storage and Disks

`microsrv_volume`

Persistent block storage on replicated NVMe pools. Used for bootable OS disks (with clone_from) and blank data disks.

# Boot disk cloned from an official base image
resource "microsrv_volume" "boot_disk" {
  project_id = microsrv_project.prod.id
  region_id  = data.microsrv_region.central.id
  size_mib   = 20480 # 20 GiB
  clone_from = data.microsrv_image.ubuntu.code
}

# Persistent data volume for databases or logs
resource "microsrv_volume" "data_disk" {
  project_id = microsrv_project.prod.id
  region_id  = data.microsrv_region.central.id
  size_mib   = 51200 # 50 GiB
}

project_id, region_id (string, required) — Project and region associations.
size_mib (number, required) — Volume capacity in MiB (512 MiB allocation quantum).
clone_from (string, optional) — Base OS image identifier (e.g. ubuntu-noble). Turns the volume into an immutable boot disk.
attached_to (string, read-only) — ID of the instance currently attached to the disk.

4. Virtual Machines (Compute)

`microsrv_vm`

Full KVM guest instance with live migration support and scale-from-zero capabilities.

resource "microsrv_vm" "backend" {
  project_id            = microsrv_project.prod.id
  region_id             = data.microsrv_region.central.id
  flavor_id             = data.microsrv_flavor.std.id
  class                 = "shared" # or "guaranteed"
  name                  = "backend-api"
  boot_volume_id        = microsrv_volume.boot_disk.id
  network_interface_ids = [microsrv_network_interface.eth0.id]
  ssh_key_ids           = [microsrv_ssh_key.deployer.id]
  volume_ids            = [microsrv_volume.data_disk.id]
  serverless            = false
}

flavor_id (string, required) — Hardware profile. VMs require flavors with at least 1 vCPU and 2 GiB RAM (std.1c2g or larger).
class (string, required) — Scheduling tier ("shared" with overcommit or "guaranteed" with dedicated cores).
boot_volume_id (string, required) — An explicit microsrv_volume created with clone_from. In microsrv, boot disks are always managed as separate resources.
serverless (bool, optional) — Scale-from-zero mode (checkpoints state to disk during idle, restores on inbound network activity).
When destroyed, the VM cleanly detaches attached volumes so disk data is preserved until volume resources are explicitly removed.

5. Isolated Containers (gVisor)

`microsrv_container_image`

Pulls and verifies an OCI container image from a public or private container registry.

resource "microsrv_container_image" "nginx" {
  project_id = microsrv_project.prod.id
  region_id  = data.microsrv_region.central.id
  ref        = "nginx:1.27-alpine"
}

ref (string, required) — Image reference (Docker Hub, GHCR, etc.). Reaches READY when pulling finishes.

`microsrv_container`

Isolated workload running inside a hardened Google gVisor sandbox with Stateful OverlayFS support.

resource "microsrv_container" "web" {
  project_id            = microsrv_project.prod.id
  region_id             = data.microsrv_region.central.id
  flavor_id             = data.microsrv_flavor.micro.id # Micro flavors (512 MiB) supported
  class                 = "shared"
  image_id              = microsrv_container_image.nginx.id
  name                  = "nginx-proxy"
  command               = ["nginx", "-g"]
  args                  = ["daemon off;"]
  env                   = { "ENV" = "production" }
  restart_policy        = "always"
  user                  = "root"
  volume_ids            = [microsrv_volume.data_disk.id]
  network_interface_ids = [microsrv_network_interface.eth0.id]
  ssh_key_ids           = [microsrv_ssh_key.deployer.id]
  serverless            = true
}

command, args (list of string, optional) — Entrypoint overrides. When omitted, inherits default ENTRYPOINT/CMD from the image.
volume_ids (list of string, optional) — Attached block volumes providing persistence via Stateful OverlayFS.
serverless (bool, optional) — Automatic scale-to-zero when idle.

6. Access Gateways

`microsrv_gateway_route`

Configures ingress rules on the platform edge network without assigning public IPv4 addresses to workloads.

# SSH gateway route for shell access via msrv.space
resource "microsrv_gateway_route" "vm_ssh" {
  project_id = microsrv_project.prod.id
  compute_id = microsrv_vm.backend.id
  protocol   = "ssh"
}

# HTTP gateway route for web applications
resource "microsrv_gateway_route" "web_http" {
  project_id  = microsrv_project.prod.id
  compute_id  = microsrv_container.web.id
  protocol    = "http"
  target_port = 80 # backend container listen port
  comment     = "Public web entrypoint"
}

# Direct TLS SNI passthrough with PROXY Protocol support
resource "microsrv_gateway_route" "custom_tls" {
  project_id     = microsrv_project.prod.id
  compute_id     = microsrv_vm.backend.id
  protocol       = "tls"
  sni_domain     = "api.mycompany.com"
  proxy_protocol = "v2"
}

compute_id (string, required) — ID of the target VM or Container.
protocol (string, required) — "ssh", "http", or "tls".
target_port (number, optional) — Destination port for http routing.
sni_domain (string, optional) — Custom domain for SNI routing under tls.
proxy_protocol (string, optional) — "v1" or "v2" to relay real client IPs.

7. Load Balancing

`microsrv_load_balancer`

L4 TCP load balancer with an allocated Virtual IP (VIP) inside your VPC.

resource "microsrv_load_balancer" "lb" {
  project_id = microsrv_project.prod.id
  vpc_id     = microsrv_vpc.app_net.id
  vip        = "10.42.0.100"

  listeners = [
    {
      protocol    = "tcp"
      listen_port = 80
      target_port = 80
      algorithm   = "round_robin"
    },
    {
      protocol    = "tcp"
      listen_port = 443
      target_port = 443
      algorithm   = "source_ip"
    }
  ]

  backends = [
    microsrv_vm.backend.id,
    microsrv_vm.backend_replica.id,
  ]

  health_check = {
    protocol    = "tcp"
    port        = 80
    interval_ms = 1000
    timeout_ms  = 500
  }
}

vip (string, required) — Reserved internal IP within the VPC CIDR.
listeners (list of objects) — Forwarding rules and balancing algorithms ("round_robin", "source_ip").
backends (list of string) — Target VM instance IDs.
health_check (object) — TCP readiness check parameters.

8. WireGuard VPN Peering

`microsrv_wireguard_peer`

Connects an external workstation, CI node, or on-premises server to the VPC over an encrypted WireGuard tunnel.

resource "microsrv_wireguard_peer" "dev_laptop" {
  project_id           = microsrv_project.prod.id
  network_interface_id = microsrv_network_interface.eth0.id
  public_key           = var.wireguard_public_key
  comment              = "MacBook Pro Dmitrii"
}

output "wireguard_connection_info" {
  value = {
    peer_id    = microsrv_wireguard_peer.dev_laptop.id
    status     = microsrv_wireguard_peer.dev_laptop.status
  }
}

network_interface_id (string, required) — VPC network interface.
public_key (string, required) — 32-byte base64-encoded X25519 public key.

Console “Copy as Code” Integration

Whenever you configure instances, networks, or volumes in the web UI:

Open the resource detail view in the Console.
Select the IaC tab (or click Copy as Code on any create form).
Copy the production-ready HCL snippet formatted to terraform fmt standards.

Next Steps

← PreviouseBPF & Live Migration Architecture Next →eBPF Outbound NAT Architecture