From c8f54ca865462b5c00f198596d5d4bfdc42493a7 Mon Sep 17 00:00:00 2001 From: Slawomir Koszewski Date: Thu, 27 Aug 2026 21:23:47 +0200 Subject: [PATCH] Add GCP deployment examples: create Terraform configurations for GCP, including network setup, instance definitions, and routing, along with a README for usage instructions. --- README.md | 3 +- examples/azure/terraform.tfvars.example | 2 +- examples/gcp/README.md | 48 +++++++ examples/gcp/network.tf | 78 +++++++++++ examples/gcp/outputs.tf | 9 ++ examples/gcp/providers.tf | 5 + examples/gcp/router.tf | 79 +++++++++++ examples/gcp/routes.tf | 13 ++ examples/gcp/terraform.tfvars.example | 20 +++ examples/gcp/variables.tf | 171 ++++++++++++++++++++++++ examples/gcp/versions.tf | 14 ++ examples/gcp/workload.tf | 25 ++++ 12 files changed, 465 insertions(+), 2 deletions(-) create mode 100644 examples/gcp/README.md create mode 100644 examples/gcp/network.tf create mode 100644 examples/gcp/outputs.tf create mode 100644 examples/gcp/providers.tf create mode 100644 examples/gcp/router.tf create mode 100644 examples/gcp/routes.tf create mode 100644 examples/gcp/terraform.tfvars.example create mode 100644 examples/gcp/variables.tf create mode 100644 examples/gcp/versions.tf create mode 100644 examples/gcp/workload.tf diff --git a/README.md b/README.md index e651fbf..1f6c5be 100644 --- a/README.md +++ b/README.md @@ -72,7 +72,8 @@ Alternatively write `/etc/vpn-router/vpn-router.conf` directly before or after i A configuration-management tool should do that and then restart `vpn-router-setup`. See [examples/](examples/) for a cloud-init template and a shell installer, and -[examples/azure/](examples/azure/) for a full Terraform example that deploys a router on Azure. +[examples/azure/](examples/azure/) / [examples/gcp/](examples/gcp/) for full Terraform examples +that deploy a router on Azure or GCP. ## Configuration diff --git a/examples/azure/terraform.tfvars.example b/examples/azure/terraform.tfvars.example index 2371855..6c43128 100644 --- a/examples/azure/terraform.tfvars.example +++ b/examples/azure/terraform.tfvars.example @@ -3,7 +3,7 @@ # TF_VAR_psk or in a git-ignored *.auto.tfvars instead. subscription_id = "00000000-0000-0000-0000-000000000000" -location = "westeurope" +location = "polandcentral" name = "vpn-router-example" admin_ssh_public_key = "ssh-ed25519 AAAA... you@example.com" diff --git a/examples/gcp/README.md b/examples/gcp/README.md new file mode 100644 index 0000000..caad736 --- /dev/null +++ b/examples/gcp/README.md @@ -0,0 +1,48 @@ +# GCP example + +Deploys `vpn-router` on a GCE instance: a two-NIC router (external/WAN and internal/protected, +each its own VPC network), a demo protected `workload` subnet in the internal network routed +through it, and cloud-init that installs and configures the package on first boot. See the +repository's top-level [README](../../README.md) for what the package itself does, and +[../azure/](../azure/) for the equivalent Azure example - the two share the same design. + +## Prerequisites + +- A GCP project and credentials Terraform can pick up (`gcloud auth application-default login` + or a service account). +- An SSH key pair for `admin_ssh_public_key`. +- A build of the `vpn-router` package published to the repository at `repo_url` (default: the + project's Gitea Debian registry). See [../../debian-package](../../debian-package) for + `build.sh`/`publish.sh`. That repository must allow anonymous reads, since the router pulls + the package with no credentials configured. + +## Usage + +```sh +cp terraform.tfvars.example terraform.tfvars +$EDITOR terraform.tfvars +export TF_VAR_psk='change-me' # keep secrets out of tracked files +``` + +`platform = gcp` and `mode = auto` are hard-coded into the cloud-init template call in +`router.tf`: the router has exactly two NICs, and on GCP the system default route always goes +out NIC0 (the external one here) while a secondary NIC only reaches its own subnet unless +policy-routed - exactly the case `mode = auto` is designed to detect reliably. See the +top-level README's "What mode decides" section. + +Unlike the Azure example, `ext` and `internal` are two separate VPC networks (GCP instances +attach one NIC per network), with `int` and `workload` as two subnets inside the same +`internal` network. GCP routes apply network-wide rather than per-subnet, so `routes.tf` +needs no separate subnet association - the route in `internal` already covers both subnets. + +## Verifying + +```sh +ssh @$(terraform output -raw router_public_ip) +systemctl status vpn-router-setup +swanctl --list-sas +``` + +Set `deploy_workload_vm = true` and re-apply to add a VM on the `workload` subnet (no public +IP - reach it via the router or IAP) for confirming that its traffic to `remote_cidrs` actually +flows through the router. diff --git a/examples/gcp/network.tf b/examples/gcp/network.tf new file mode 100644 index 0000000..a1167e7 --- /dev/null +++ b/examples/gcp/network.tf @@ -0,0 +1,78 @@ +resource "google_dns_record_set" "router_ext" { + count = var.dns_managed_zone != "" ? 1 : 0 + + name = "${var.local_fqdn}." + type = "A" + ttl = 300 + managed_zone = var.dns_managed_zone + project = var.dns_project != "" ? var.dns_project : var.project_id + rrdatas = [google_compute_address.ext.address] +} + +resource "google_compute_network" "ext" { + name = "${var.name}-ext" + auto_create_subnetworks = false +} + +resource "google_compute_subnetwork" "ext" { + name = "${var.name}-ext" + network = google_compute_network.ext.id + region = var.region + ip_cidr_range = var.ext_subnet_cidr +} + +resource "google_compute_network" "internal" { + name = "${var.name}-int" + auto_create_subnetworks = false +} + +resource "google_compute_subnetwork" "int" { + name = "${var.name}-int" + network = google_compute_network.internal.id + region = var.region + ip_cidr_range = var.int_subnet_cidr +} + +resource "google_compute_subnetwork" "workload" { + name = "${var.name}-workload" + network = google_compute_network.internal.id + region = var.region + ip_cidr_range = var.workload_subnet_cidr +} + +resource "google_compute_firewall" "router_ext" { + name = "${var.name}-ext-allow-router" + network = google_compute_network.ext.name + + allow { + protocol = "tcp" + ports = ["22"] + } + + allow { + protocol = "udp" + ports = ["500", "4500"] + } + + dynamic "allow" { + for_each = var.wireguard_enabled ? [1] : [] + content { + protocol = "udp" + ports = [tostring(var.wireguard_listen_port)] + } + } + + source_ranges = ["0.0.0.0/0"] + target_tags = ["${var.name}-router"] +} + +resource "google_compute_firewall" "internal_allow_all" { + name = "${var.name}-int-allow-internal" + network = google_compute_network.internal.name + + allow { + protocol = "all" + } + + source_ranges = [var.int_subnet_cidr, var.workload_subnet_cidr] +} diff --git a/examples/gcp/outputs.tf b/examples/gcp/outputs.tf new file mode 100644 index 0000000..26c6aa4 --- /dev/null +++ b/examples/gcp/outputs.tf @@ -0,0 +1,9 @@ +output "router_public_ip" { + description = "Public IP address of the router VM." + value = google_compute_address.ext.address +} + +output "router_internal_ip" { + description = "Private IP address of the router's internal NIC - the next hop to use in routes configured outside this Terraform run (another route, or an on-prem device) that need to reach remote_cidrs through this router." + value = google_compute_instance.router.network_interface[1].network_ip +} diff --git a/examples/gcp/providers.tf b/examples/gcp/providers.tf new file mode 100644 index 0000000..9ff0ef1 --- /dev/null +++ b/examples/gcp/providers.tf @@ -0,0 +1,5 @@ +provider "google" { + project = var.project_id + region = var.region + zone = var.zone +} diff --git a/examples/gcp/router.tf b/examples/gcp/router.tf new file mode 100644 index 0000000..6cd738d --- /dev/null +++ b/examples/gcp/router.tf @@ -0,0 +1,79 @@ +data "http" "repo_gpg_key" { + url = "${var.repo_url}/repository.key" +} + +locals { + supply_pki = var.ca_cert_file != "" + + cloud_init_vars = { + hostname = var.name + fqdn = var.local_fqdn + repo_url = var.repo_url + repo_gpg_key = data.http.repo_gpg_key.response_body + ubuntu_codename = var.ubuntu_codename + platform = "gcp" + mode = "auto" + external_interface = "" + internal_interface = "" + local_id_mode = var.local_id_mode + local_cidrs = var.local_cidrs + int_addr = "" + int_gateway_ip = "" + remote_addrs = var.remote_addrs + remote_id = var.remote_id + remote_cidrs = var.remote_cidrs + psk_b64 = base64encode(var.psk) + p2s_enabled = var.p2s_enabled + p2s_address_pool = var.p2s_address_pool + p2s_ca_name = "VPN Router CA" + wg_enabled = var.wireguard_enabled + wg_address = var.wireguard_address + wg_listen_port = var.wireguard_listen_port + } + + cloud_init_rendered = local.supply_pki ? templatefile("${path.module}/../cloud-init-with-pki.yaml.tpl", merge(local.cloud_init_vars, { + label = split(".", var.local_fqdn)[0] + ca_cert = file(var.ca_cert_file) + server_cert = file(var.server_cert_file) + server_key = file(var.server_key_file) + })) : templatefile("${path.module}/../cloud-init.yaml.tpl", local.cloud_init_vars) +} + +resource "google_compute_address" "ext" { + name = "${var.name}-ext" + region = var.region +} + +resource "google_compute_instance" "router" { + name = var.name + machine_type = var.machine_type + zone = var.zone + tags = ["${var.name}-router"] + + can_ip_forward = true + + boot_disk { + initialize_params { + image = "ubuntu-os-cloud/ubuntu-2404-lts-amd64" + } + } + + network_interface { + network = google_compute_network.ext.id + subnetwork = google_compute_subnetwork.ext.id + + access_config { + nat_ip = google_compute_address.ext.address + } + } + + network_interface { + network = google_compute_network.internal.id + subnetwork = google_compute_subnetwork.int.id + } + + metadata = { + ssh-keys = "${var.admin_username}:${var.admin_ssh_public_key}" + user-data = local.cloud_init_rendered + } +} diff --git a/examples/gcp/routes.tf b/examples/gcp/routes.tf new file mode 100644 index 0000000..905688f --- /dev/null +++ b/examples/gcp/routes.tf @@ -0,0 +1,13 @@ +locals { + remote_cidr_list = [for c in split(",", var.remote_cidrs) : trimspace(c) if trimspace(c) != ""] +} + +resource "google_compute_route" "to_remote" { + for_each = toset(local.remote_cidr_list) + + name = "${var.name}-to-${replace(replace(each.value, "/", "-"), ".", "-")}" + network = google_compute_network.internal.name + dest_range = each.value + next_hop_instance = google_compute_instance.router.self_link + priority = 100 +} diff --git a/examples/gcp/terraform.tfvars.example b/examples/gcp/terraform.tfvars.example new file mode 100644 index 0000000..3f6eb4c --- /dev/null +++ b/examples/gcp/terraform.tfvars.example @@ -0,0 +1,20 @@ +# Copy to terraform.tfvars (or a git-ignored *.auto.tfvars) and adjust. +# Keep secrets - psk here - out of any tracked file: set them with +# TF_VAR_psk or in a git-ignored *.auto.tfvars instead. + +project_id = "my-gcp-project" +region = "europe-central2" +zone = "europe-central2-a" +name = "vpn-router-example" +admin_ssh_public_key = "ssh-ed25519 AAAA... you@example.com" + +local_fqdn = "router.example.com" +local_cidrs = "10.0.3.0/24" + +remote_addrs = "peer.example.net" +remote_id = "peer.example.net" +remote_cidrs = "192.168.0.0/24" + +p2s_enabled = false +wireguard_enabled = false +deploy_workload_vm = false diff --git a/examples/gcp/variables.tf b/examples/gcp/variables.tf new file mode 100644 index 0000000..fa00723 --- /dev/null +++ b/examples/gcp/variables.tf @@ -0,0 +1,171 @@ +variable "project_id" { + description = "GCP project to deploy into." + type = string +} + +variable "region" { + description = "GCP region to deploy into." + type = string +} + +variable "zone" { + description = "GCP zone to deploy the VMs into." + type = string +} + +variable "name" { + description = "Base name used to derive resource names." + type = string + default = "vpn-router-example" +} + +variable "admin_username" { + description = "Admin username created on both VMs via SSH key metadata." + type = string + default = "vpnrouter" +} + +variable "admin_ssh_public_key" { + description = "SSH public key installed for admin_username on both VMs." + type = string +} + +variable "machine_type" { + description = "Machine type for the router." + type = string + default = "e2-small" +} + +variable "local_fqdn" { + description = "FQDN of the router, used as the road-warrior/IKE identity and, when dns_managed_zone is set, as the name of the A record created for it." + type = string +} + +variable "dns_managed_zone" { + description = "Name of an existing Cloud DNS managed zone to create local_fqdn's A record in, pointing at the router's public IP. local_fqdn must be a name within that zone's DNS name. Leave empty to skip - local_fqdn is then just a label with nothing making it resolve." + type = string + default = "" +} + +variable "dns_project" { + description = "Project that owns dns_managed_zone. Leave empty to use project_id." + type = string + default = "" +} + +variable "local_id_mode" { + description = "IKE local identity source: fqdn, public_ip or internal_ip." + type = string + default = "fqdn" +} + +variable "local_cidrs" { + description = "Local subnet CIDR(s) advertised into the site-to-site tunnel. Should include the workload subnet CIDR." + type = string +} + +variable "remote_addrs" { + description = "Remote gateway address(es) or FQDN for the site-to-site tunnel." + type = string +} + +variable "remote_id" { + description = "Remote peer's IKE identity, without a leading @." + type = string +} + +variable "remote_cidrs" { + description = "Remote subnet CIDR(s) reachable through the site-to-site tunnel." + type = string +} + +variable "psk" { + description = "Pre-shared key for the site-to-site IKEv2 tunnel." + type = string + sensitive = true +} + +variable "p2s_enabled" { + description = "Enable road-warrior (P2S) access." + type = bool + default = false +} + +variable "p2s_address_pool" { + description = "CIDR block assigned to road-warrior clients." + type = string + default = "" +} + +variable "ca_cert_file" { + description = "Path to an existing CA certificate PEM to supply instead of letting the package generate one. Leave empty to auto-generate." + type = string + default = "" +} + +variable "server_cert_file" { + description = "Path to an existing server certificate PEM, paired with ca_cert_file." + type = string + default = "" +} + +variable "server_key_file" { + description = "Path to an existing server private key PEM, paired with ca_cert_file." + type = string + default = "" + sensitive = true +} + +variable "wireguard_enabled" { + description = "Enable the WireGuard endpoint." + type = bool + default = false +} + +variable "wireguard_address" { + description = "Address and prefix length for the wg0 interface." + type = string + default = "" +} + +variable "wireguard_listen_port" { + description = "UDP port WireGuard listens on." + type = number + default = 51820 +} + +variable "deploy_workload_vm" { + description = "Deploy a bare VM on the workload subnet, for manually verifying routing through the router." + type = bool + default = false +} + +variable "repo_url" { + description = "Base URL of the Debian package repository the router pulls vpn-router from." + type = string + default = "https://gitea.koszewscy.waw.pl/api/packages/slawek/debian" +} + +variable "ubuntu_codename" { + description = "Ubuntu release codename of the router VM's image, used to select the apt repo component." + type = string + default = "noble" +} + +variable "ext_subnet_cidr" { + description = "CIDR of the router's external (WAN-facing) subnet, in its own VPC network." + type = string + default = "10.0.1.0/24" +} + +variable "int_subnet_cidr" { + description = "CIDR of the router's internal (protected-network-facing) subnet, in its own VPC network." + type = string + default = "10.0.2.0/24" +} + +variable "workload_subnet_cidr" { + description = "CIDR of the demo protected workload subnet, in the same VPC network as int_subnet_cidr and routed through the router." + type = string + default = "10.0.3.0/24" +} diff --git a/examples/gcp/versions.tf b/examples/gcp/versions.tf new file mode 100644 index 0000000..5b96cbb --- /dev/null +++ b/examples/gcp/versions.tf @@ -0,0 +1,14 @@ +terraform { + required_version = ">= 1.9" + + required_providers { + google = { + source = "hashicorp/google" + version = ">= 7.0, < 8.0" + } + http = { + source = "hashicorp/http" + version = ">= 3.4, < 4.0" + } + } +} diff --git a/examples/gcp/workload.tf b/examples/gcp/workload.tf new file mode 100644 index 0000000..73bcf05 --- /dev/null +++ b/examples/gcp/workload.tf @@ -0,0 +1,25 @@ +# Bare VM on the workload subnet, for manually verifying that its traffic to +# remote_cidrs flows through the router. Off by default so a plain apply +# stays to just the router. + +resource "google_compute_instance" "workload" { + count = var.deploy_workload_vm ? 1 : 0 + name = "${var.name}-workload" + machine_type = var.machine_type + zone = var.zone + + boot_disk { + initialize_params { + image = "ubuntu-os-cloud/ubuntu-2404-lts-amd64" + } + } + + network_interface { + network = google_compute_network.internal.id + subnetwork = google_compute_subnetwork.workload.id + } + + metadata = { + ssh-keys = "${var.admin_username}:${var.admin_ssh_public_key}" + } +}