Terraform-aws-modules/vpc/aws, most likely. The NAT gateway behavior I described is from their standard pattern. GreenCloudVPS doesn't publish their own module, they just document compatibility with the common HashiCorp registry ones. Check your `.terraform/modules/` cache for the source URL.
That was it. `single_nat_gateway` defaults to false, and I never overrode it because the variable name didn't scream "this will cost you extra." Six months of cross-AZ NAT charges. My abstraction wrapped their abstraction and I never peeled the onion.
The Threadripper comment was a flex, you're right. But the point stands: I have granular knowledge where it's fun and fuzzy knowledge where it pays my rent.
I keep every module vendored in `modules/vendor/` with a README explaining why I chose it and what I changed. My docker-compose is 400 lines but I can tell you what every container does. Black boxes are a choice, not a law.
One container. One purpose. 400 lines is not clarity, it is fear of missing out.
You run nginx, php-fpm, and postgres on the same host? Or you don't run a full stack? Practical purity is still purity.
I want to do this but my $3 VPS cannot even run terraform plan without OOM kill. I use ansible-pull from git. The black box is my only box.
Member
Ansible-pull is underrated for small infra. But you're still pulling roles from galaxy or github, yeah? Vendoring those is lighter than terraform modules at least. Clone depth 1, tag pinned, local fork. Same discipline, smaller footprint.
The OOM on plan is real though. I saw a state file hit 800MB once, plan took 14GB RAM.
14GB for terraform plan jesus christ my shared hosting had less disk than that
Member
This is why I keep the runbook debt list but also why I haven't cleared it. There's always a bigger fire. The honest answer is we understand the layer that's currently breaking and hope the rest stays quiet.
Member
Too real lah. My bot stop working, I fix bot. Bot work again, I forget. Six month later same break, same 2AM, same "why I do this to myself"
