diff --git a/azure/terraform/init.tf b/azure/terraform/init.tf
--- a/azure/terraform/init.tf
+++ b/azure/terraform/init.tf
@@ -31,6 +31,11 @@
   resource_group_name  = "swh-resource"
 }
 
+# same for resource group used by storage servers
+data "azurerm_resource_group" "euwest-servers" {
+  name = "euwest-servers"
+}
+
 variable "firstboot_script" {
   type = string
   default = "/root/firstboot.sh"
diff --git a/azure/terraform/storage.tf b/azure/terraform/storage.tf
new file mode 100644
--- /dev/null
+++ b/azure/terraform/storage.tf
@@ -0,0 +1,136 @@
+# storage0.euwest.azure exists already, keep it out of that declaration
+
+# will start from 1 storage01...
+variable "storage_servers" {
+  default = 1
+}
+
+variable "storage_disk_size" {
+  default = 30720
+}
+
+resource "azurerm_network_interface" "storage-interface" {
+  count = var.storage_servers
+
+  name                      = format("storage%02d-euwest-if", count.index + 1)
+  location                  = "westeurope"
+  resource_group_name       = "euwest-server"
+  network_security_group_id = data.azurerm_network_security_group.worker-nsg.id
+
+  ip_configuration {
+    name                          = "vaultNicConfiguration"
+    subnet_id                     = data.azurerm_subnet.default.id
+    public_ip_address_id          = ""
+    private_ip_address_allocation = "Dynamic"
+  }
+}
+
+resource "azurerm_virtual_machine" "storage-server" {
+  count = var.storage_servers
+
+  name                  = format("storage%02d", count.index + 1)
+  location              = "westeurope"
+  resource_group_name   = "euwest-servers"
+  network_interface_ids = [azurerm_network_interface.storage-interface[count.index].id]
+  vm_size               = "Standard_B2s"
+
+  boot_diagnostics {
+    enabled     = true
+    storage_uri = var.boot_diagnostics_uri
+  }
+
+  storage_os_disk {
+    name              = format("storage%02d-osdisk", count.index + 1)
+    caching           = "ReadWrite"
+    create_option     = "FromImage"
+    managed_disk_type = "Premium_LRS"
+  }
+
+  storage_data_disk {
+    name              = format("storage%02d-datadisk", count.index + 1)
+    caching           = "None"
+    create_option     = "Empty"
+    managed_disk_type = "Standard_LRS"
+    disk_size_gb      = var.storage_disk_size
+    lun               = 1
+  }
+
+  storage_image_reference {
+    publisher = "credativ"
+    offer     = "Debian"
+    sku       = "10"
+    version   = "latest"
+  }
+
+  os_profile {
+    computer_name  = format("storage%02d", count.index + 1)
+    admin_username = var.user_admin
+  }
+
+  os_profile_linux_config {
+    disable_password_authentication = true
+    ssh_keys {
+      path     = "/home/${var.user_admin}/.ssh/authorized_keys"
+      key_data = var.ssh_key_data_ardumont
+    }
+    ssh_keys {
+      path     = "/home/${var.user_admin}/.ssh/authorized_keys"
+      key_data = var.ssh_key_data_olasd
+    }
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "sudo mkdir /root/.ssh",
+      "echo ${var.ssh_key_data_ardumont} | sudo tee -a /root/.ssh/authorized_keys",
+      "echo ${var.ssh_key_data_olasd} | sudo tee -a /root/.ssh/authorized_keys",
+    ]
+
+    connection {
+      type = "ssh"
+      user = var.user_admin
+      host = azurerm_network_interface.storage-interface[count.index].private_ip_address
+    }
+  }
+
+  provisioner "file" {
+    content     = templatefile("templates/firstboot.sh.tpl", {
+      hostname   = format("storage%02d", count.index + 1),
+      fqdn       = format("storage%02d.euwest.azure.internal.softwareheritage.org", count.index + 1),
+      ip_address = azurerm_network_interface.storage-interface[count.index].private_ip_address,
+      facter_location = "azure_euwest",
+      disks = [{
+        base_disk = "/dev/sdc",
+        mountpoint = "/srv/storage",
+        filesystem = "ext4",
+        mount_options = "defaults",
+      }]
+      raids = []
+    })
+    destination = var.firstboot_script
+
+    connection {
+      type = "ssh"
+      user = "root"
+      host = azurerm_network_interface.storage-interface[count.index].private_ip_address
+    }
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "userdel -f ${var.user_admin}",
+      "chmod +x ${var.firstboot_script}",
+      "cat ${var.firstboot_script}",
+      "${var.firstboot_script}",
+    ]
+    connection {
+      type = "ssh"
+      user = "root"
+      host = azurerm_network_interface.storage-interface[count.index].private_ip_address
+    }
+  }
+
+  tags = {
+    environment = "Storage"
+  }
+}