Add Vultr cloud module set (live-validated)

README.md

@@ -152,6 +152,55 @@ raptor import project-type --managed facets/azure --name "My Platform"
 
 ---
 
+### Vultr — Preview
+
+VKE (Vultr Kubernetes Engine) clusters with node pools, Vultr VPC networking, S3-compatible object storage, managed PostgreSQL, and a cloud-agnostic Kubernetes service — plus the shared K8s platform and KubeBlocks datastores.
+
+**First, create a Vultr API key** at https://my.vultr.com/settings/#settingsapi and add your control plane egress IP to the API access-control allow-list. Full walkthrough: [`project-type/vultr/ONBOARDING.md`](project-type/vultr/ONBOARDING.md).
+
+**Prompt for Praxis:**
+
+```
+Import the Vultr project type for me from the facets-modules-redesign repo
+(project-type/vultr/project-type.yml) along with its output types.
+```
+
+**Raptor CLI:** (imports the project type + modules + outputs; no base template — projects start empty)
+
+```bash
+raptor import project-type -f ./project-type/vultr/project-type.yml \
+  --modules-dir ./modules --outputs-dir ./outputs
+```
+
+With custom name:
+
+```bash
+raptor import project-type -f ./project-type/vultr/project-type.yml \
+  --modules-dir ./modules --outputs-dir ./outputs --name "Vultr Platform"
+```
+
+<details>
+<summary><strong>What's included</strong></summary>
+
+**Infrastructure**
+`Cloud Account (vultr_provider)` `Network/VPC (vultr_vpc)` `VKE Cluster (vke)` `Node Pool (vke)` `Object Storage (vultr)` `Service (k8s)`
+
+**Managed Datastores**
+`PostgreSQL (vultr)`
+
+**Self-hosted via KubeBlocks**
+`PostgreSQL` `MySQL` `MongoDB` `Redis`
+
+**K8s Platform**
+`Helm` `Ingress/NGINX` `cert-manager` `ConfigMap` `Secrets` `PVC` `Access Controls` `Callbacks` `K8s Resources` `Gateway API CRD` `Artifactories`
+
+**Operators & Monitoring**
+`KubeBlocks` `ECK` `Prometheus` `Grafana` `Alert Rules` `Monitoring`
+
+</details>
+
+---
+
 ### Linode (Akamai) — Preview
 
 LKE (Linode Kubernetes Engine) clusters with node pools, Linode VPC networking, S3-compatible object storage, managed PostgreSQL, and a cloud-agnostic Kubernetes service — plus the shared K8s platform and KubeBlocks datastores.

modules/cloud_account/vultr_provider/1.0/README.md

@@ -0,0 +1,31 @@
+# Vultr Provider Configuration
+
+Configures the Vultr Terraform provider with API key authentication for use by other Vultr modules.
+
+## Overview
+
+This module establishes the foundational Vultr provider configuration using a Vultr API key. It serves as the base provider configuration that other Vultr infrastructure modules (VPC, VKE, Object Storage, Managed Database) consume to access Vultr APIs and provision resources. It produces the `@facets/vultr_cloud_account` output type.
+
+## Environment as Dimension
+
+**Environment-specific provider configuration**: The API key is a secret reference and the default region is an override-only field, allowing different Vultr credentials and regions per environment.
+
+## Resources Created
+
+- **Vultr Provider Configuration**: Establishes an authenticated connection to the Vultr API
+- **Provider Output Interface**: Exposes the configured provider and default region for consumption by other modules
+
+## Security Considerations
+
+- The API key is supplied via a secret reference and is never stored in plain text within the module configuration
+- The key is declared in the `secrets` output attribute so the platform treats it as sensitive
+- Provider configuration is scoped per environment for security isolation
+
+## Required Configuration
+
+- **Vultr API Key**: A Vultr API key with access to the resources you intend to manage (secret reference)
+- **Vultr Region**: The default region for downstream resources, e.g. `ewr`, `lax`, `ord`, `fra`, `sgp` (override-only)
+
+## Usage Notes
+
+This module does not create any actual Vultr resources — it only configures the provider authentication. Other Vultr modules should consume this module's `@facets/vultr_cloud_account` output to access Vultr services with proper authentication.

modules/cloud_account/vultr_provider/1.0/facets.yaml

@@ -0,0 +1,54 @@
+intent: cloud_account
+flavor: vultr_provider
+version: "1.0"
+description: Module to configure and provision resources within a Vultr cloud account
+intentDetails:
+  type: Cloud & Infrastructure
+  description: Configure and provision resources within a Vultr cloud account
+  displayName: Cloud Account
+  iconUrl: https://raw.githubusercontent.com/Facets-cloud/facets-modules-redesign/main/icons/cloud_account.svg
+clouds:
+  - kubernetes
+spec:
+  title: Vultr Provider Configuration
+  description: Configure Vultr API access credentials and the default region
+  type: object
+  properties:
+    api_key:
+      type: string
+      title: Vultr API Key
+      description: Vultr API key with access to the resources you intend to manage
+      x-ui-secret-ref: true
+    region:
+      type: string
+      title: Vultr Region
+      description: Default Vultr region for downstream resources (e.g. ewr, lax, ord, fra, sgp)
+      x-ui-placeholder: ewr
+      x-ui-overrides-only: true
+  required:
+    - api_key
+    - region
+  x-ui-order:
+    - api_key
+    - region
+outputs:
+  default:
+    type: "@facets/vultr_cloud_account"
+    providers:
+      vultr:
+        source: vultr/vultr
+        version: 2.31.2
+        attributes:
+          api_key: attributes.api_key
+sample:
+  kind: cloud_account
+  flavor: vultr_provider
+  version: "1.0"
+  disabled: true
+  spec:
+    api_key: ""
+    region: ewr
+iac:
+  validated_files:
+    - main.tf
+    - variables.tf

modules/cloud_account/vultr_provider/1.0/main.tf

@@ -0,0 +1,4 @@
+# Vultr Provider Configuration Module
+# This module configures the Vultr provider credentials and exposes them for other modules.
+#
+# Note: output_attributes and output_interfaces locals are defined in outputs.tf

modules/cloud_account/vultr_provider/1.0/outputs.tf

@@ -0,0 +1,9 @@
+locals {
+  output_attributes = {
+    api_key = var.instance.spec.api_key
+    region  = var.instance.spec.region
+    secrets = "[\"api_key\"]"
+  }
+  output_interfaces = {
+  }
+}

modules/cloud_account/vultr_provider/1.0/variables.tf

@@ -0,0 +1,31 @@
+variable "instance" {
+  description = "Configures the Vultr Terraform provider with API key authentication"
+  type = object({
+    kind    = string
+    flavor  = string
+    version = string
+    spec = object({
+      api_key = string
+      region  = string
+    })
+  })
+}
+
+variable "instance_name" {
+  description = "The architectural name for the resource as added in the Facets blueprint designer."
+  type        = string
+}
+
+variable "environment" {
+  description = "An object containing details about the environment."
+  type = object({
+    name        = string
+    unique_name = string
+  })
+}
+
+variable "inputs" {
+  description = "A map of inputs requested by the module developer."
+  type = object({
+  })
+}

modules/datastore/postgres/vultr/1.0/README.md

@@ -0,0 +1,30 @@
+# Vultr Managed PostgreSQL
+
+Creates a Vultr managed PostgreSQL database with SSL/TLS and trusted-IP allow-listing. Produces `@facets/postgres`.
+
+## Overview
+
+Provisions a Vultr Managed Database running the PostgreSQL engine. The module exposes `writer` and `reader` connection interfaces (both pointing at the primary host; Vultr handles read scaling via separate read replicas). The database is protected from accidental deletion with `prevent_destroy`.
+
+## Resources Created
+
+- **vultr_database**: A managed PostgreSQL cluster (`database_engine = "pg"`)
+
+## Required Configuration
+
+- **PostgreSQL Version**: one of `13`, `14`, `15`, `16`, `17`
+- **Database Plan** (`sizing.plan`): a Vultr managed-database plan slug encoding vCPU/RAM/disk and node count, e.g. `vultr-dbaas-hobbyist-cc-1-25-1` (list via `GET /v2/databases/plans`)
+- **Trusted IPs** (optional): CIDRs permitted to connect; empty denies all external access
+
+## Inputs
+
+- **Vultr Cloud Account** (`@facets/vultr_cloud_account`): provides the Vultr provider and region
+
+## Outputs
+
+- `@facets/postgres` (default): `writer` and `reader` interfaces with `host`, `port`, `username`, `password`, `connection_string`
+
+## Notes & Gotchas
+
+- **Trusted IPs**: the database is reachable only from CIDRs in `network_access.trusted_ips`. Add your VKE node egress CIDRs to allow the cluster to connect.
+- **SSL required**: connection strings include `sslmode=require`.

modules/datastore/postgres/vultr/1.0/facets.yaml

@@ -0,0 +1,99 @@
+intent: postgres
+flavor: vultr
+version: "1.0"
+clouds:
+  - kubernetes
+description: Managed PostgreSQL database on Vultr with SSL/TLS and trusted-IP allow-listing
+intentDetails:
+  type: Datastores
+  description: Vultr managed PostgreSQL database service
+  displayName: PostgreSQL
+  iconUrl: https://raw.githubusercontent.com/Facets-cloud/facets-modules-redesign/main/icons/postgres.svg
+spec:
+  title: Vultr Managed PostgreSQL Database
+  description: Managed PostgreSQL database on Vultr
+  type: object
+  x-ui-order:
+    - version_config
+    - sizing
+    - network_access
+  properties:
+    version_config:
+      type: object
+      title: Version Configuration
+      x-ui-order:
+        - version
+      properties:
+        version:
+          type: string
+          title: PostgreSQL Version
+          description: PostgreSQL engine major version
+          enum:
+            - "13"
+            - "14"
+            - "15"
+            - "16"
+            - "17"
+          default: "16"
+      required:
+        - version
+    sizing:
+      type: object
+      title: Sizing & Performance
+      x-ui-order:
+        - plan
+      properties:
+        plan:
+          type: string
+          title: Database Plan
+          description: "Vultr managed database plan slug (encodes vCPU/RAM/disk and node count, e.g. vultr-dbaas-hobbyist-cc-1-25-1). List plans via the Vultr API (GET /v2/databases/plans)."
+          default: vultr-dbaas-hobbyist-cc-1-25-1
+          x-ui-placeholder: vultr-dbaas-hobbyist-cc-1-25-1
+      required:
+        - plan
+    network_access:
+      type: object
+      title: Network Access
+      properties:
+        trusted_ips:
+          type: array
+          title: Trusted IPs
+          description: List of CIDRs permitted to connect (empty denies all external access)
+          default: []
+          items:
+            type: string
+            pattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$
+      required: []
+  required:
+    - version_config
+    - sizing
+inputs:
+  vultr_cloud_account:
+    type: "@facets/vultr_cloud_account"
+    optional: false
+    displayName: Vultr Cloud Account
+    description: Vultr provider configuration and default region
+    providers:
+      - vultr
+outputs:
+  default:
+    type: "@facets/postgres"
+    title: Vultr PostgreSQL Database
+sample:
+  kind: postgres
+  flavor: vultr
+  version: "1.0"
+  disabled: true
+  spec:
+    version_config:
+      version: "16"
+    sizing:
+      plan: vultr-dbaas-hobbyist-cc-1-25-1
+    network_access:
+      trusted_ips: []
+iac:
+  validated_files:
+    - main.tf
+    - variables.tf
+    - outputs.tf
+    - versions.tf

modules/datastore/postgres/vultr/1.0/main.tf

@@ -0,0 +1,27 @@
+# Vultr Managed PostgreSQL Module
+# Creates a Vultr managed PostgreSQL database.
+
+module "name" {
+  source        = "github.com/Facets-cloud/facets-utility-modules//name"
+  environment   = var.environment
+  limit         = 32
+  resource_name = var.instance_name
+  resource_type = "postgres"
+}
+
+locals {
+  region = var.inputs.vultr_cloud_account.attributes.region
+}
+
+resource "vultr_database" "db" {
+  label                   = module.name.name
+  database_engine         = "pg"
+  database_engine_version = var.instance.spec.version_config.version
+  region                  = local.region
+  plan                    = var.instance.spec.sizing.plan
+  trusted_ips             = var.instance.spec.network_access.trusted_ips
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}

modules/datastore/postgres/vultr/1.0/outputs.tf

@@ -0,0 +1,26 @@
+locals {
+  # Vultr managed PostgreSQL exposes a single primary host; read scaling is handled via
+  # separate read replicas, so reader and writer share the primary endpoint here.
+  # Connection strings use format() rather than "${...}" interpolation so the contract
+  # validator's brace-counting HCL parser can discover the writer/reader interface keys.
+  output_attributes = {}
+
+  output_interfaces = {
+    writer = {
+      host              = vultr_database.db.host
+      port              = tostring(vultr_database.db.port)
+      username          = vultr_database.db.user
+      password          = vultr_database.db.password
+      connection_string = format("postgresql://%s:%s@%s:%s/%s?sslmode=require", vultr_database.db.user, vultr_database.db.password, vultr_database.db.host, tostring(vultr_database.db.port), vultr_database.db.dbname)
+      secrets           = ["password", "connection_string"]
+    }
+    reader = {
+      host              = vultr_database.db.host
+      port              = tostring(vultr_database.db.port)
+      username          = vultr_database.db.user
+      password          = vultr_database.db.password
+      connection_string = format("postgresql://%s:%s@%s:%s/%s?sslmode=require", vultr_database.db.user, vultr_database.db.password, vultr_database.db.host, tostring(vultr_database.db.port), vultr_database.db.dbname)
+      secrets           = ["password", "connection_string"]
+    }
+  }
+}