Module tf 

The terraform door — the same API 1.3, asked for by a different caller.

Everything else in this crate answers the calls monetize-cloud-impl’s upcloud plugin and gunnar/deploy/upcloud make. private-holger-ops reaches the SAME account through UpCloudLtd/upcloud 5.44 and terraform, and that caller asks for a handful of things the plugin never asks for: the plan table, the public template list, a server whose create body carries its network interfaces and its login block, and a firewall rule SET written in one call. Without them the estate this crate exists to exercise cannot be laid down at all — measured 2026-09-21, the first terraform plan against the mock died on GET /1.3/plan before it reached a single resource.

What is MEASURED here and what is INFERRED

The wire shapes below are INFERRED from the provider binary’s own behaviour (5.44.1, UPCLOUD_DEBUG_API_BASE_URL pointed at this mock) and from UpCloud’s published 1.3 surface — not from a capture of the live account, which this lane is forbidden to touch. They are marked here rather than presented as measurement, in the crate’s own house style: a mock stricter than the provider invents verdicts, and a mock that CLAIMS more than it measured lends its lies authority they have not earned.

The one thing that IS proven by construction: every field the provider reads back and this module does not send shows up as a terraform permadiff, which is loud. A field sent wrong is the dangerous one, so the shapes here are kept to what the provider demonstrably consumes.

Functions

interfaces_from_body

The interfaces a terraform create body asks for: server.networking.interfaces.interface[], each with an index and a type (public · utility · private).

plans

GET /1.3/plan. The provider fetches this before every server create and refuses a plan name that is not in it — which is a real check and the reason this endpoint is worth having rather than stubbing: a plan renamed in estate.toml is caught here, offline, in the same words the account would use.

render_rule

render_rules

rules_from_body

One firewall rule as the provider sends it and reads it back. Every field is a STRING on the wire, including position and the port numbers — the same stringification the rest of this crate reproduces, and the reason a client that expects numbers here fails at the provider and not in a test.