diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..cdac6f7
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,10 @@
+.terraform/
+*.tfstate
+*.tfstate.backup
+*.tfvars
+!*.tfvars.example
+kubeconfig
+talosconfig
+.terraform.lock.hcl
+backend.conf
+.claude
diff --git a/main.tf b/main.tf
new file mode 100644
index 0000000..04eef6d
--- /dev/null
+++ b/main.tf
@@ -0,0 +1,32 @@
+module "kubernetes" {
+  source  = "hcloud-k8s/kubernetes/hcloud"
+  version = "3.27.2"
+
+  cluster_name  = var.cluster_name
+  hcloud_token  = var.hcloud_token
+
+  cluster_kubeconfig_path  = "kubeconfig"
+  cluster_talosconfig_path = "talosconfig"
+
+  firewall_use_current_ipv4 = true
+
+  cert_manager_enabled = true
+
+  control_plane_nodepools = [
+    {
+      name     = "control"
+      type     = "cx23" # 2 vCPU, 4 GB RAM
+      location = "hel1"
+      count    = 1
+    }
+  ]
+
+  worker_nodepools = [
+    {
+      name     = "worker"
+      type     = "cx23" # 2 vCPU, 4 GB RAM
+      location = "hel1"
+      count    = 2
+    }
+  ]
+}
diff --git a/outputs.tf b/outputs.tf
new file mode 100644
index 0000000..8210108
--- /dev/null
+++ b/outputs.tf
@@ -0,0 +1,7 @@
+output "control_plane_public_ipv4_list" {
+  value = module.kubernetes.control_plane_public_ipv4_list
+}
+
+output "worker_public_ipv4_list" {
+  value = module.kubernetes.worker_public_ipv4_list
+}
diff --git a/providers.tf b/providers.tf
new file mode 100644
index 0000000..6af3309
--- /dev/null
+++ b/providers.tf
@@ -0,0 +1,29 @@
+terraform {
+  backend "s3" {
+    bucket                      = "k8s-asxpio-main"
+    key                         = "terraform/state/terraform.tfstate"
+    region                      = "hel1"
+    endpoint                    = "https://hel1.your-objectstorage.com"
+    skip_credentials_validation = true
+    skip_metadata_api_check     = true
+    skip_region_validation      = true
+    skip_requesting_account_id  = true
+    force_path_style            = true
+  }
+
+  required_providers {
+    helm = {
+      source  = "hashicorp/helm"
+      version = ">= 2.0"
+    }
+  }
+}
+
+provider "helm" {
+  kubernetes = {
+    host                   = module.kubernetes.kubeconfig_data.server
+    cluster_ca_certificate = module.kubernetes.kubeconfig_data.ca
+    client_certificate     = module.kubernetes.kubeconfig_data.cert
+    client_key             = module.kubernetes.kubeconfig_data.key
+  }
+}
diff --git a/terraform.tfvars.example b/terraform.tfvars.example
new file mode 100644
index 0000000..d7ce6a3
--- /dev/null
+++ b/terraform.tfvars.example
@@ -0,0 +1,2 @@
+hcloud_token = "your-hetzner-cloud-api-token"
+cluster_name = "k8s"
diff --git a/traefik.tf b/traefik.tf
new file mode 100644
index 0000000..b08fa2f
--- /dev/null
+++ b/traefik.tf
@@ -0,0 +1,21 @@
+resource "helm_release" "traefik" {
+  name             = "traefik"
+  namespace        = "traefik"
+  create_namespace = true
+  repository       = "https://traefik.github.io/charts"
+  chart            = "traefik"
+  version          = "35.0.1"
+
+  set = [
+    {
+      name  = "providers.kubernetesCRD.enabled"
+      value = "true"
+    },
+    {
+      name  = "providers.kubernetesIngress.enabled"
+      value = "true"
+    }
+  ]
+
+  depends_on = [module.kubernetes]
+}
diff --git a/variables.tf b/variables.tf
new file mode 100644
index 0000000..cc54fdb
--- /dev/null
+++ b/variables.tf
@@ -0,0 +1,9 @@
+variable "cluster_name" {
+  type    = string
+  default = "k8s-asxpio"
+}
+
+variable "hcloud_token" {
+  type      = string
+  sensitive = true
+}