Server per Snapshot wegwerfen & neu aufbauen

    ddnsZone    = 'seb4u.com'          # leer = kein DDNS
    ddnsNames   = @('blog','vault','@')
    ddnsProxied = $false               # $true = Cloudflare-Proxy (orange Wolke)

#Requires -Version 5.1
<#
    snapshot.ps1  -  Hetzner-Server als Snapshot sichern, loeschen und spaeter
    identisch wieder aufbauen. Mehrere Server, feste (reservierte) IP optional.

      .\scripts\snapshot.ps1 status                 was laeuft, seit wann, ~Kosten, Snapshot-Inventar
      .\scripts\snapshot.ps1 down                   alle Server: Hook -> Snapshot -> alte pruzen -> loeschen
      .\scripts\snapshot.ps1 up                     alle Server: aus neuestem Snapshot neu, Hook danach
      .\scripts\snapshot.ps1 down -Only k3s-host    nur einzelne
      .\scripts\snapshot.ps1 up   -Only k3s-host
      .\scripts\snapshot.ps1 snapshots              alle Snapshots + geschaetzte monatliche Kosten
      .\scripts\snapshot.ps1 prune  -Keep 2         je Server nur die N neuesten Snapshots behalten

    Voraussetzungen:  hcloud CLI mit Kontext (hcloud context create ...), SSH-Key bei Hetzner,
    Firewall(s) existieren. Fuer feste IP: einmalig eine Primary-IP anlegen, z.B.
      hcloud primary-ip create --type ipv4 --name k3s-ip --datacenter nbg1-dc3
    und ihren Namen unten bei reservedIP eintragen (~0,50 EUR/Monat, IP bleibt stabil).
#>
param(
  [Parameter(Position = 0)]
  [ValidateSet('status', 'down', 'up', 'snapshots', 'prune')]
  [string]$Action = 'status',
  [string[]]$Only,
  [int]$Keep = 2
)

# Kein globales 'Stop': hcloud und ssh schreiben Hinweise ("Server not found",
# Fortschritt) nach stderr. PowerShell 5.1 wertet das unter 'Stop' faelschlich als
# abbrechenden Fehler. Wichtige Aufrufe pruefen $LASTEXITCODE selbst.
$ErrorActionPreference = 'Continue'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# ============================ KONFIGURATION ============================
# Ein Hashtable je Server. Optionale Felder leer lassen ('').
# preDown  : bash-Befehl auf dem Server, um Dienste sauber zu stoppen (vor dem Snapshot).
# postUp   : Scriptblock auf dem Laptop nach 'up'; bekommt die neue/feste IP als $args[0].
$SERVERS = @(
  @{
    name       = 'k3s-host'
    type       = 'cpx32'                                   # cpx22 | cpx32 | cax21 ...
    image      = 'ubuntu-24.04'                           # nur beim allerersten 'up' (kein Snapshot da)
    sshKey     = 'laptop'
    firewall   = 'k3s-fw'
    location   = 'nbg1'                                   # '' = Hetzner waehlt
    reservedIP = ''                                       # Name einer Primary-IP; '' = jedes Mal neue IP
    network    = ''                                       # Name eines privaten Netzes; '' = keins
    privateIP  = ''                                       # feste private IP (nur mit network)
    userData   = ''                                       # Pfad zu cloud-init.yaml (nur Erst-'up')
    ddnsZone   = ''                                       # z.B. 'seb4u.com' - leer = kein DDNS
    ddnsNames  = @()                                      # z.B. @('blog','vault','@')
    ddnsProxied = $false                                  # Cloudflare-Proxy fuer diese Records
    preDown    = 'systemctl stop k3s'
    postUp     = {
      param($ip)
      $kube = Join-Path $env:USERPROFILE '.kube\k3s-hetzner.yaml'
      scp -o StrictHostKeyChecking=accept-new "root@${ip}:/etc/rancher/k3s/k3s.yaml" $kube
      (Get-Content $kube) -replace '127\.0\.0\.1', $ip | Set-Content $kube
      [Environment]::SetEnvironmentVariable('KUBECONFIG', $kube, 'User')
      Write-Host "  KUBECONFIG -> $kube ($ip)"
    }
  }
  # Weitere Server als zusaetzliche @{ ... }-Bloecke hier einfuegen.
)

# Stundensaetze (EUR): im Repo aus scripts/rates.psd1 geladen (eine Quelle fuer
# beide Skripte + kosten.html). Hier inline als Fallback - Stand nach 15.06.2026.
$RatePerHour       = @{ cpx22  = 0.0075; cpx32  = 0.0116; cpx42  = 0.0219; cpx52 = 0.0404
                        cax11 = 0.0082; cax21 = 0.0144; cax31 = 0.0288; cax41 = 0.0562
                        cpx22 = 0.0267; cpx32 = 0.0486; cpx42 = 0.0952; cpx52 = 0.1377; cpx62 = 0.1781
                        ccx13 = 0.0589; ccx23 = 0.1178; ccx33 = 0.1897 }
$SnapRatePerGBMonth = 0.0143     # Stand nach 15.06.2026 (unveraendert)
$WarnHours         = 12
# =====================================================================

function Require-Hcloud {
  if (-not (Get-Command hcloud -ErrorAction SilentlyContinue)) {
    throw "hcloud CLI fehlt. Installieren: winget install HetznerCloud.CLI"
  }
}
function Targets {
  if ($Only) { return $SERVERS | Where-Object { $Only -contains $_.name } }
  return $SERVERS
}
function Server-Info([string]$name) {
  $raw = hcloud server describe $name -o json 2>$null
  if ($LASTEXITCODE -ne 0 -or -not $raw) { return $null }
  try { return (($raw -join "`n") | ConvertFrom-Json) } catch { return $null }
}
function Snapshots-For([string]$name) {
  $raw = hcloud image list --type snapshot -o json
  if ($LASTEXITCODE -ne 0 -or -not $raw) { return @() }
  try { $list = ($raw -join "`n") | ConvertFrom-Json } catch { return @() }
  $list | Where-Object { $_.description -eq $name } |
    Sort-Object { [datetime]$_.created } -Descending
}
function Forget-HostKey([string]$hostOrIp) {
  if ($hostOrIp) { ssh-keygen -R $hostOrIp *> $null }
}
function Wait-Ssh([string]$ip) {
  Forget-HostKey $ip
  for ($i = 0; $i -lt 60; $i++) {
    ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 -o BatchMode=yes `
        "root@$ip" 'true' 2>$null | Out-Null
    if ($LASTEXITCODE -eq 0) { return $true }
    Start-Sleep 5
  }
  return $false
}

function Invoke-Down([hashtable]$s) {
  $info = Server-Info $s.name
  if (-not $info) { Write-Host "  $($s.name): schon weg."; return }
  $ip = $info.public_net.ipv4.ip

  if ($s.preDown) {
    Write-Host "  $($s.name): stoppe Dienste ..."
    ssh -o StrictHostKeyChecking=accept-new "root@$ip" "$($s.preDown)" 2>$null | Out-Null
    ssh -o StrictHostKeyChecking=accept-new "root@$ip" 'sync' 2>$null | Out-Null
  }

  Write-Host "  $($s.name): Snapshot wird erstellt (1-4 Min) ..."
  hcloud server create-image --type snapshot --description $s.name `
    --label 'managed-by=snapshot-ps1' $s.name | Out-Null
  if ($LASTEXITCODE -ne 0) {
    Write-Warning "  $($s.name): Snapshot fehlgeschlagen - Server wird NICHT geloescht."
    return
  }

  # alte Snapshots dieses Servers aufraeumen, die N neuesten behalten
  Snapshots-For $s.name | Select-Object -Skip $Keep | ForEach-Object {
    hcloud image delete $_.id | Out-Null
  }

  hcloud server delete $s.name | Out-Null
  Forget-HostKey $ip

  # DDNS: A-Records entfernen (nur ohne reservierte IP)
  if ($s.ddnsZone -and $s.ddnsNames -and -not $s.reservedIP) {
    $cf = Join-Path $PSScriptRoot 'cf-dns.ps1'
    if (Test-Path $cf) {
      try { & $cf -Zone $s.ddnsZone -Name $s.ddnsNames -Delete } catch { Write-Warning "  DDNS: $($_.Exception.Message)" }
    }
  }

  $keptIp = if ($s.reservedIP) { "  Reservierte IP '$($s.reservedIP)' bleibt (~0,50 EUR/Monat)." } else { '' }
  Write-Host "  $($s.name): geloescht.$keptIp" -ForegroundColor Green
}

function Invoke-Up([hashtable]$s) {
  if (Server-Info $s.name) { Write-Host "  $($s.name): laeuft bereits."; return }

  $snap  = Snapshots-For $s.name | Select-Object -First 1
  $image = if ($snap) { "$($snap.id)" } else { $s.image }
  Write-Host "  $($s.name): erstelle aus $(if($snap){"Snapshot $($snap.id)"}else{"Basis-Image $image"}) ..."

  $a = @('server', 'create', '--name', $s.name, '--type', $s.type, '--image', $image, '--ssh-key', $s.sshKey)
  if ($s.firewall)   { $a += @('--firewall', $s.firewall) }
  if ($s.location)   { $a += @('--location', $s.location) }
  if ($s.reservedIP) { $a += @('--primary-ipv4', $s.reservedIP) }
  if ($s.network)    { $a += @('--network', $s.network) }
  if (-not $snap -and $s.userData) { $a += @('--user-data-from-file', $s.userData) }
  hcloud @a | Out-Null
  if ($LASTEXITCODE -ne 0) { Write-Warning "  $($s.name): Server-Erstellung fehlgeschlagen."; return }

  # feste private IP (falls gewuenscht): neu anhaengen
  if ($s.network -and $s.privateIP) {
    hcloud server detach-from-network $s.name --network $s.network 2>$null | Out-Null
    hcloud server attach-to-network   $s.name --network $s.network --ip $s.privateIP | Out-Null
  }

  $ip = if ($s.reservedIP) {
    (hcloud primary-ip describe $s.reservedIP -o 'format={{.IP}}').Trim()
  } else {
    (hcloud server ip $s.name).Trim()
  }

  if (Wait-Ssh $ip) {
    if ($s.ddnsZone -and $s.ddnsNames) {          # DNS-A-Record auf die neue IP (cf-dns.ps1)
      $cf = Join-Path $PSScriptRoot 'cf-dns.ps1'
      if (Test-Path $cf) {
        try { & $cf -Zone $s.ddnsZone -Name $s.ddnsNames -IP $ip -Proxied:([bool]$s.ddnsProxied) }
        catch { Write-Warning "  DDNS: $($_.Exception.Message)" }
      }
    }
    if ($s.postUp) {
      Write-Host "  $($s.name): postUp-Hook ..."
      & $s.postUp $ip
    }
    Write-Host "  $($s.name): bereit ($ip)." -ForegroundColor Green
  } else {
    Write-Warning "  $($s.name): Server $ip da, aber SSH noch nicht erreichbar. Spaeter: .\scripts\snapshot.ps1 status"
  }
}

function Show-Status {
  $sumRun = 0.0
  foreach ($s in (Targets)) {
    $info = Server-Info $s.name
    if (-not $info) { Write-Host ("  {0,-16} AUS" -f $s.name) -ForegroundColor Green; continue }
    $age  = (Get-Date).ToUniversalTime() - ([datetime]$info.created).ToUniversalTime()
    $rt   = $info.server_type.name                        # echter Typ, nicht die Config
    $rate = $RatePerHour[$rt]
    if ($rate) { $sumRun += $age.TotalHours * $rate }
    $flag = if ($age.TotalHours -gt $WarnHours) { ' (!)' } else { '' }
    Write-Host ("  {0,-16} AN {1,-7} seit {2}d {3:00}h  {4,-15} {5}" -f `
      $s.name, $rt, $age.Days, $age.Hours, $info.public_net.ipv4.ip, $flag) -ForegroundColor Yellow
  }
  Write-Host ""
  Show-Snapshots
  Write-Host ("`nLaufende Server: ~{0:N2} EUR bisher." -f $sumRun) -ForegroundColor Yellow
}

function Show-Snapshots {
  $raw = hcloud image list --type snapshot -o json
  if ($LASTEXITCODE -ne 0 -or -not $raw) { Write-Warning "  hcloud image list fehlgeschlagen."; return }
  try { $all = ($raw -join "`n") | ConvertFrom-Json } catch { Write-Warning "  Snapshot-Liste nicht lesbar."; return }
  $mine = $all | Where-Object { ($SERVERS.name) -contains $_.description } |
          Sort-Object description, { [datetime]$_.created }
  if (-not $mine) { Write-Host "  Keine Snapshots."; return }
  $totalGb = 0.0
  Write-Host ("  {0,-16} {1,-12} {2,8}   {3}" -f 'SERVER', 'SNAPSHOT-ID', 'GROESSE', 'ERSTELLT')
  foreach ($i in $mine) {
    $gb = [double]$i.image_size
    $totalGb += $gb
    Write-Host ("  {0,-16} {1,-12} {2,6:N2} GB   {3}" -f $i.description, $i.id, $gb, ([datetime]$i.created).ToString('yyyy-MM-dd HH:mm'))
  }
  Write-Host ("  = {0:N1} GB  ->  ~{1:N2} EUR/Monat Snapshot-Speicher" -f $totalGb, ($totalGb * $SnapRatePerGBMonth))
}

function Invoke-Prune {
  foreach ($s in (Targets)) {
    $old = Snapshots-For $s.name | Select-Object -Skip $Keep
    foreach ($i in $old) {
      Write-Host "  loesche $($s.name) / $($i.id) ($([datetime]$i.created))"
      hcloud image delete $i.id | Out-Null
    }
  }
  Write-Host "Fertig. Je Server bleiben die $Keep neuesten." -ForegroundColor Green
}

Require-Hcloud
switch ($Action) {
  'status'    { Show-Status }
  'snapshots' { Show-Snapshots }
  'prune'     { Invoke-Prune }
  'down'      { Targets | ForEach-Object { Invoke-Down $_ } }
  'up'        { Targets | ForEach-Object { Invoke-Up   $_ } }
}

write_files:
  - path: /etc/selfdestruct.env
    permissions: '0600'
    content: |
      HCLOUD_TOKEN=TOKEN_NUR_FUER_DIESES_PROJEKT
  - path: /usr/local/bin/selfdestruct
    permissions: '0755'
    content: |
      #!/bin/bash
      LEASE=/etc/selfdestruct.lease
      now=$(date +%s)
      [ -f "$LEASE" ] || echo $((now + 43200)) > "$LEASE"      # 12 h ab Boot
      deadline=$(cat "$LEASE")
      if who | grep -q . ; then w=$((now + 7200)); [ "$w" -gt "$deadline" ] && echo "$w" > "$LEASE"; exit 0; fi
      [ "$now" -lt "$deadline" ] && exit 0
      . /etc/selfdestruct.env
      id=$(curl -s http://169.254.169.254/hetzner/v1/metadata/instance-id)
      curl -s -X DELETE -H "Authorization: Bearer $HCLOUD_TOKEN" \
        "https://api.hetzner.cloud/v1/servers/$id"
  - path: /etc/systemd/system/selfdestruct.timer
    content: |
      [Timer]
      OnBootSec=10min
      OnUnitActiveSec=10min
      [Install]
      WantedBy=timers.target
  - path: /etc/systemd/system/selfdestruct.service
    content: |
      [Service]
      Type=oneshot
      ExecStart=/usr/local/bin/selfdestruct
runcmd:
  - systemctl enable --now selfdestruct.timer