Terraform on serverplus: infrastructure as code

What Terraform on serverplus is

serverplus is built on OpenStack, so you can manage its infrastructure as code with the official terraform-provider-openstack provider. You describe servers, networks and rules in .tf files, and Terraform (or the compatible OpenTofu) brings the cloud to the desired state: repeatable, reviewable in git and reversible.

What you need

• Terraform or OpenTofu installed locally (or in CI).
• Application credentials (id + secret) from the panel — the "Access management" section. Safer than your account password.
• A ~/.config/openstack/clouds.yaml file with your access block (same as for the CLI).

clouds:
  serverplus:
    auth_type: v3applicationcredential
    auth:
      auth_url: https://identity.serverplus.uz/v3
      application_credential_id: <ID>
      application_credential_secret: <SECRET>
    region_name: RegionOne
    interface: public
    identity_api_version: 3

Configuring the provider

A minimal versions.tf and a provider that takes access straight from clouds.yaml:

terraform {
  required_providers {
    openstack = {
      source  = "terraform-provider-openstack/openstack"
      version = "~> 3.0"
    }
  }
}

provider "openstack" {
  cloud = "serverplus"
}

Your first server

An example main.tf: an SSH key, a security group with port 22 open, a VM on a private network and an external (floating) IP.

resource "openstack_compute_keypair_v2" "kp" {
  name       = "tf-key"
  public_key = file("~/.ssh/id_rsa.pub")
}

resource "openstack_networking_secgroup_v2" "web" {
  name = "tf-web"
}

resource "openstack_networking_secgroup_rule_v2" "ssh" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.web.id
}

resource "openstack_compute_instance_v2" "vm" {
  name            = "tf-vm-1"
  image_name      = "Ubuntu 22.04"
  flavor_name     = "m1.small"
  key_pair        = openstack_compute_keypair_v2.kp.name
  security_groups = [openstack_networking_secgroup_v2.web.name]
  network { name = "private" }
}

About networking. The server must be on a network with a router and external gateway, otherwise it will have no internet. Take the exact image, flavor and network names from the panel or via openstack image list, openstack flavor list, openstack network list.

Running it

export OS_CLOUD=serverplus
terraform init
terraform plan
terraform apply

terraform destroy   # удалить всё, что создано

Security

• The state file is a secret. terraform.tfstate contains passwords and keys. Do not commit it to git; keep it in a secured backend (for example serverplus S3 storage) with encryption.
• Use application credentials, not your account password — they can be revoked in one click.
• Pass secrets via variables and the environment (TF_VAR_...), not hardcoded in .tf.

FAQ

The provider does not authenticate. Check OS_CLOUD=serverplus and that clouds.yaml is correct (identity_api_version: 3).

Terraform cannot find the image or flavor. Names must match exactly — compare with openstack image list and openstack flavor list.

No floating IP is assigned. Check the external network (pool) name: openstack network list --external.