Add GCP deployment examples: create Terraform configurations for GCP, including network setup, instance definitions, and routing, along with a README for usage instructions.

2026-08-27 21:23:47 +02:00
parent 245d0dfd96
commit c8f54ca865
12 changed files with 465 additions and 2 deletions
@@ -0,0 +1,78 @@
+resource "google_dns_record_set" "router_ext" {
+  count = var.dns_managed_zone != "" ? 1 : 0
+
+  name         = "${var.local_fqdn}."
+  type         = "A"
+  ttl          = 300
+  managed_zone = var.dns_managed_zone
+  project      = var.dns_project != "" ? var.dns_project : var.project_id
+  rrdatas      = [google_compute_address.ext.address]
+}
+
+resource "google_compute_network" "ext" {
+  name                    = "${var.name}-ext"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "ext" {
+  name          = "${var.name}-ext"
+  network       = google_compute_network.ext.id
+  region        = var.region
+  ip_cidr_range = var.ext_subnet_cidr
+}
+
+resource "google_compute_network" "internal" {
+  name                    = "${var.name}-int"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "int" {
+  name          = "${var.name}-int"
+  network       = google_compute_network.internal.id
+  region        = var.region
+  ip_cidr_range = var.int_subnet_cidr
+}
+
+resource "google_compute_subnetwork" "workload" {
+  name          = "${var.name}-workload"
+  network       = google_compute_network.internal.id
+  region        = var.region
+  ip_cidr_range = var.workload_subnet_cidr
+}
+
+resource "google_compute_firewall" "router_ext" {
+  name    = "${var.name}-ext-allow-router"
+  network = google_compute_network.ext.name
+
+  allow {
+    protocol = "tcp"
+    ports    = ["22"]
+  }
+
+  allow {
+    protocol = "udp"
+    ports    = ["500", "4500"]
+  }
+
+  dynamic "allow" {
+    for_each = var.wireguard_enabled ? [1] : []
+    content {
+      protocol = "udp"
+      ports    = [tostring(var.wireguard_listen_port)]
+    }
+  }
+
+  source_ranges = ["0.0.0.0/0"]
+  target_tags   = ["${var.name}-router"]
+}
+
+resource "google_compute_firewall" "internal_allow_all" {
+  name    = "${var.name}-int-allow-internal"
+  network = google_compute_network.internal.name
+
+  allow {
+    protocol = "all"
+  }
+
+  source_ranges = [var.int_subnet_cidr, var.workload_subnet_cidr]
+}