- Make sure login credentials are in `clouds.yaml`
	- OpenStack password in environment variable `OS_PASSWORD`
- Put webdb groups in `webdb-groups.tf`
- Maybe update image in `instances.tf`? 1002 should be latest Ubuntu LTS, 2GB RAM

If all is well, there is already an ansible controller. Given that there are host variables, the ansible plays
should all be ran from the same computer -- that computer is the ansible controller.

The ansible controller should already be set up with
- Ansible
- Terraform
- The Azure CLI

Security groups: `allow-users` allows some specific IPs, makes set-up easier in that it doesn't require UvAvpn. Otherwise, all servers can only be accessed from within UvAvpn

Terraform sets up a keypair for VM login but doesn't export it; it can be extracted using `tools/get_ssh_key.sh`.
Similarly, there is a keypair for the Ansible controller; it can be extracted using `tools/get_ansible_ssh_key.sh`.

- On first run, you may have to run `terraform init` to get the openstack plugin etc.

- Run `terraform refresh`

Validate and plan changes
- `terraform validate` and `terraform plan`

For some reason Terraform wants to change egress rules for allow-uva-internal even though they are already set that way; this will error out when applying but doesn't matter.

Edit (15/11/2024): this should be fixed! assuming you have the up-to-date tfstate file.

Finally, apply the changes: `terraform apply`.

Once applied, the .tfstate file should be updated with the information about the new servers.

You can run `tools/get_groupnames.sh` to get a JSON of group name-IP pairs (requires `jq`).
Similarly, `tools/get_ansible_inventory.sh` generates a JSON in Ansible inventory format with the host IPs.
These two tools are also used by `ansible/generate_inventory.sh` to generate the Ansible inventory.
