From c6d43af68b93a7ae7ebc2aea257cb3b44e8dc563 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Fri, 16 Oct 2026 22:45:09 +1100
Subject: [PATCH] Build only the syd servers until mel has stock

---
 modules/binarylane/main.tf    | 17 +++++++++++------
 modules/binarylane/outputs.tf |  2 +-
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/modules/binarylane/main.tf b/modules/binarylane/main.tf
index ce083e1..3f7c0bd 100644
--- a/modules/binarylane/main.tf
+++ b/modules/binarylane/main.tf
@@ -27,6 +27,11 @@ locals {
     ausyd2nxvm2130 = { region = "syd", vpc_ip = "172.18.30.10", vpn = "ausyd2nxvm2131", ptr = "mta1.edge.unkin.net" }
     aumel1nxvm2132 = { region = "mel", vpc_ip = "172.18.31.10", vpn = "aumel1nxvm2133", ptr = "mta2.edge.unkin.net" }
   }
+
+  # regions whose servers are built; mel is out of stock at BinaryLane
+  enabled_regions = ["syd"]
+  enabled_vpns    = { for k, v in local.vpns : k => v if contains(local.enabled_regions, v.region) }
+  enabled_edges   = { for k, v in local.edges : k => v if contains(local.enabled_regions, v.region) }
 }
 
 resource "binarylane_vpc" "dmz" {
@@ -37,7 +42,7 @@ resource "binarylane_vpc" "dmz" {
 }
 
 resource "binarylane_vpc_route_entries" "dmz" {
-  for_each = local.vpns
+  for_each = local.enabled_vpns
 
   vpc_id = binarylane_vpc.dmz[each.value.region].id
   route_entries = [for dst in local.lab_routes : {
@@ -82,7 +87,7 @@ resource "vault_kv_secret_v2" "vpn" {
 }
 
 resource "binarylane_server" "vpn" {
-  for_each = local.vpns
+  for_each = local.enabled_vpns
 
   name                         = "${each.key}.${local.domain}"
   region                       = each.value.region
@@ -120,7 +125,7 @@ resource "binarylane_server" "vpn" {
 }
 
 resource "binarylane_server" "edge" {
-  for_each = local.edges
+  for_each = local.enabled_edges
 
   name              = "${each.key}.${local.domain}"
   region            = each.value.region
@@ -153,7 +158,7 @@ resource "binarylane_server" "edge" {
 }
 
 resource "binarylane_server_reverse_name" "edge" {
-  for_each = local.edges
+  for_each = local.enabled_edges
 
   server_id    = binarylane_server.edge[each.key].id
   ipv4_address = binarylane_server.edge[each.key].public_ipv4_addresses[0]
@@ -161,7 +166,7 @@ resource "binarylane_server_reverse_name" "edge" {
 }
 
 resource "binarylane_server_firewall_rules" "edge" {
-  for_each = local.edges
+  for_each = local.enabled_edges
 
   server_id = binarylane_server.edge[each.key].id
   firewall_rules = [
@@ -200,7 +205,7 @@ resource "binarylane_server_firewall_rules" "edge" {
 
 # SSH has no rule: management reaches sshd through wg0, which this firewall never sees.
 resource "binarylane_server_firewall_rules" "vpn" {
-  for_each = local.vpns
+  for_each = local.enabled_vpns
 
   server_id = binarylane_server.vpn[each.key].id
   firewall_rules = [
diff --git a/modules/binarylane/outputs.tf b/modules/binarylane/outputs.tf
index 0bf347d..bd55617 100644
--- a/modules/binarylane/outputs.tf
+++ b/modules/binarylane/outputs.tf
@@ -19,7 +19,7 @@ output "hosts" {
 
 output "router_links" {
   description = "Per-region p2p wg/ospf link as prodnxsr0020 sees it; vpc_cidr arrives via ospf. Consumed by its Puppet config."
-  value = { for k, v in local.vpns : v.region => {
+  value = { for k, v in local.enabled_vpns : v.region => {
     interface              = "wg-${v.region}"
     listen_port            = v.router_port
     router_address         = "${v.router_address}/31"