Quickstart with OpenTofu

Step-by-step guide to installing the microsrv provider, obtaining a PAT token from the console, defining entities, and deploying infrastructure with OpenTofu.

Introduction

The microsrv provider for OpenTofu (and Terraform) allows you to declaratively define, provision, and version your entire cloud topology: projects, isolated VPC networks, virtual machines, containers, block volumes, load balancers, and access gateways.

In this guide, you will learn how to obtain an access token (PAT) in the console, declare your resources in HCL, and launch your first virtual machine with tofu apply.

Prerequisites

OpenTofu CLI (version >= 1.6, recommended 1.8+) or Terraform (>= 1.5). Verify your installation:
```
tofu version
```
An SSH public key on your local machine (usually ~/.ssh/id_ed25519.pub).
An active account in the microsrv Console.

Step 1. Generate a Personal Access Token (PAT)

The provider communicates with the platform control plane (https://api.microsrv.ru) using a Personal Access Token for authentication.

Open the microsrv Console.
In the navigation sidebar, go to Access -> Access Tokens.
Click Create Token (or navigate directly to /access-tokens/create).
Enter a descriptive token name (such as opentofu-quickstart) and specify the expiration period (0 for never expires).
Click Create Token.
Copy the generated token string (starts with prefix sel_).

[!WARNING] The secret token is shown only once. Be sure to copy and store it securely.

Export the token in your current terminal session:

export MICROSRV_TOKEN="sel_your_secret_token_string"

Optionally specify the API endpoint (defaults to production https://api.microsrv.ru):

export MICROSRV_ENDPOINT="https://api.microsrv.ru"

Step 2. Create the Project Directory and Configuration

Create a fresh directory and change into it:

mkdir microsrv-infra && cd microsrv-infra

Create main.tf:

terraform {
  required_version = ">= 1.6.0"

  required_providers {
    microsrv = {
      # Automatically retrieved from the official OpenTofu registry
      source = "microsrv-cloud/microsrv"
    }
  }
}

# The provider reads MICROSRV_TOKEN and MICROSRV_ENDPOINT from environment variables
provider "microsrv" {}

# 1. Lookup environment definitions via data sources
data "microsrv_region" "ru_central" {
  code = "ru-yndx-central"
}

data "microsrv_flavor" "std" {
  code = "std.1c2g"
}

data "microsrv_image" "ubuntu" {
  code = "ubuntu-noble"
}

# 2. Define the project workspace
resource "microsrv_project" "demo" {
  name = "demo-opentofu"
}

# 3. Register your SSH key
resource "microsrv_ssh_key" "admin" {
  name       = "admin-key"
  public_key = var.ssh_public_key
}

# 4. Provision a private VPC
resource "microsrv_vpc" "main" {
  project_id = microsrv_project.demo.id
  region_id  = data.microsrv_region.ru_central.id
  cidr       = "10.42.0.0/24"
}

# 5. Allocate a network interface within the VPC
resource "microsrv_network_interface" "eth0" {
  project_id = microsrv_project.demo.id
  vpc_id     = microsrv_vpc.main.id
}

# 6. Create an explicit boot disk cloned from the base OS image
resource "microsrv_volume" "boot" {
  project_id = microsrv_project.demo.id
  region_id  = data.microsrv_region.ru_central.id
  size_mib   = 20480
  clone_from = data.microsrv_image.ubuntu.code
}

# 7. Launch the virtual machine
resource "microsrv_vm" "web" {
  project_id            = microsrv_project.demo.id
  region_id             = data.microsrv_region.ru_central.id
  flavor_id             = data.microsrv_flavor.std.id
  class                 = "shared"
  name                  = "web-server"
  network_interface_ids = [microsrv_network_interface.eth0.id]
  ssh_key_ids           = [microsrv_ssh_key.admin.id]
  boot_volume_id        = microsrv_volume.boot.id
}

# 8. Create an SSH gateway route for secure shell access without public IPv4
resource "microsrv_gateway_route" "web_ssh" {
  project_id = microsrv_project.demo.id
  compute_id = microsrv_vm.web.id
  protocol   = "ssh"
}

# Variables & Outputs
variable "ssh_public_key" {
  type        = string
  description = "Contents of your public SSH key string"
}

output "vm_id" {
  description = "ID of the created virtual machine"
  value       = microsrv_vm.web.id
}

output "vm_ip" {
  description = "Internal VPC IP address"
  value       = microsrv_network_interface.eth0.ip_address
}

output "ssh_command" {
  description = "SSH connection command via the platform gateway"
  value       = "ssh web-server@msrv.space"
}

Create terraform.tfvars with your public SSH key:

ssh_public_key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@workstation"

[!TIP] You can populate your key with a one-liner:
echo "ssh_public_key = \"$(cat ~/.ssh/id_ed25519.pub)\"" > terraform.tfvars

Step 3. Initialize OpenTofu (`tofu init`)

Run initialization in your workspace directory:

tofu init

OpenTofu will:

Query registry.opentofu.org/microsrv-cloud/microsrv.
Verify cryptographic GPG signatures from Microsrv Releases (releases@microsrv.ru).
Download the provider binary for your OS and architecture.
Record content hashes into .terraform.lock.hcl.

Step 4. Review the Execution Plan (`tofu plan`)

Generate a dry-run execution plan:

tofu plan

OpenTofu indicates 7 resources to be created:

microsrv_project.demo
microsrv_ssh_key.admin
microsrv_vpc.main
microsrv_network_interface.eth0
microsrv_volume.boot
microsrv_vm.web
microsrv_gateway_route.web_ssh

Step 5. Apply the Configuration (`tofu apply`)

Apply the changes:

tofu apply

When prompted, type yes and press Enter.

The provisioning cycle completes in approximately 20–30 seconds:

The project and private VPC subnet are established.
The root disk is provisioned from the Ubuntu 24.04 image.
The virtual machine starts and reaches the READY state.
The SSH gateway route is registered on the edge network.

Upon completion, your outputs are printed:

Apply complete! Resources: 7 added, 0 changed, 0 destroyed.

Outputs:

ssh_command = "ssh web-server@msrv.space"
vm_id = "vm-01923..."
vm_ip = "10.42.0.2"

Step 6. Connect to Your Virtual Machine

Use the generated command to connect over the platform SSH gateway:

ssh web-server@msrv.space

[!NOTE] The edge gateway routes web-server to your VM’s private IP inside the VPC. No public IPv4 allocation or port forwarding is required.

Step 7. Cleanup Infrastructure (`tofu destroy`)

To tear down all resources when you are finished:

tofu destroy

Confirm with yes. OpenTofu will gracefully stop the VM, detach and destroy the volumes, network interfaces, and VPC in correct dependency order.

Next Steps

← Previousmicrosrv Overview Next →Networks (VPC) & Subnets