# Module: `probe`

Provisions **one overseas reference probe point** (doc/04 §1, §4.2).

Probes are low-frequency baseline resources, so they live in Terraform state —
unlike data-plane nodes, which are disposable cattle managed by the provision
service via vendor APIs (never in Terraform).

## What it creates

- `hcloud_server` running the probe agent (installed out-of-band; the probe
  holds **no** data-plane secrets and **no** user data).
- A firewall locking inbound to SSH (optionally CIDR-restricted).

## Role in the system

Overseas probes cross-check the in-China probe fleet so the scheduler can tell
**blocked** (in-China fails, overseas OK) from **machine down** (both fail),
avoiding false positives before triggering an automatic replacement (doc/04 §4.2).

> In-China probe points use serverless / third-party dialing services under a
> separate isolated identity and are **out of Terraform scope** — registered in
> [`../../identity-isolation.md`](../../identity-isolation.md).

## Inputs

| name | description |
|------|-------------|
| `name` | short id (e.g. `eu`, `us`) |
| `location` | vendor location |
| `server_type` | vendor size |
| `image` | OS image |
| `ssh_key_ids` | authorised SSH key IDs |
| `ssh_allowlist_cidrs` | inbound SSH allowlist |

## Outputs

`ipv4_address`, `server_id`.