Add GCP deployment examples: create Terraform configurations for GCP, including network setup, instance definitions, and routing, along with a README for usage instructions.

2026-08-27 21:23:47 +02:00
parent 245d0dfd96
commit c8f54ca865
12 changed files with 465 additions and 2 deletions
@@ -0,0 +1,171 @@
+variable "project_id" {
+  description = "GCP project to deploy into."
+  type        = string
+}
+
+variable "region" {
+  description = "GCP region to deploy into."
+  type        = string
+}
+
+variable "zone" {
+  description = "GCP zone to deploy the VMs into."
+  type        = string
+}
+
+variable "name" {
+  description = "Base name used to derive resource names."
+  type        = string
+  default     = "vpn-router-example"
+}
+
+variable "admin_username" {
+  description = "Admin username created on both VMs via SSH key metadata."
+  type        = string
+  default     = "vpnrouter"
+}
+
+variable "admin_ssh_public_key" {
+  description = "SSH public key installed for admin_username on both VMs."
+  type        = string
+}
+
+variable "machine_type" {
+  description = "Machine type for the router."
+  type        = string
+  default     = "e2-small"
+}
+
+variable "local_fqdn" {
+  description = "FQDN of the router, used as the road-warrior/IKE identity and, when dns_managed_zone is set, as the name of the A record created for it."
+  type        = string
+}
+
+variable "dns_managed_zone" {
+  description = "Name of an existing Cloud DNS managed zone to create local_fqdn's A record in, pointing at the router's public IP. local_fqdn must be a name within that zone's DNS name. Leave empty to skip - local_fqdn is then just a label with nothing making it resolve."
+  type        = string
+  default     = ""
+}
+
+variable "dns_project" {
+  description = "Project that owns dns_managed_zone. Leave empty to use project_id."
+  type        = string
+  default     = ""
+}
+
+variable "local_id_mode" {
+  description = "IKE local identity source: fqdn, public_ip or internal_ip."
+  type        = string
+  default     = "fqdn"
+}
+
+variable "local_cidrs" {
+  description = "Local subnet CIDR(s) advertised into the site-to-site tunnel. Should include the workload subnet CIDR."
+  type        = string
+}
+
+variable "remote_addrs" {
+  description = "Remote gateway address(es) or FQDN for the site-to-site tunnel."
+  type        = string
+}
+
+variable "remote_id" {
+  description = "Remote peer's IKE identity, without a leading @."
+  type        = string
+}
+
+variable "remote_cidrs" {
+  description = "Remote subnet CIDR(s) reachable through the site-to-site tunnel."
+  type        = string
+}
+
+variable "psk" {
+  description = "Pre-shared key for the site-to-site IKEv2 tunnel."
+  type        = string
+  sensitive   = true
+}
+
+variable "p2s_enabled" {
+  description = "Enable road-warrior (P2S) access."
+  type        = bool
+  default     = false
+}
+
+variable "p2s_address_pool" {
+  description = "CIDR block assigned to road-warrior clients."
+  type        = string
+  default     = ""
+}
+
+variable "ca_cert_file" {
+  description = "Path to an existing CA certificate PEM to supply instead of letting the package generate one. Leave empty to auto-generate."
+  type        = string
+  default     = ""
+}
+
+variable "server_cert_file" {
+  description = "Path to an existing server certificate PEM, paired with ca_cert_file."
+  type        = string
+  default     = ""
+}
+
+variable "server_key_file" {
+  description = "Path to an existing server private key PEM, paired with ca_cert_file."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "wireguard_enabled" {
+  description = "Enable the WireGuard endpoint."
+  type        = bool
+  default     = false
+}
+
+variable "wireguard_address" {
+  description = "Address and prefix length for the wg0 interface."
+  type        = string
+  default     = ""
+}
+
+variable "wireguard_listen_port" {
+  description = "UDP port WireGuard listens on."
+  type        = number
+  default     = 51820
+}
+
+variable "deploy_workload_vm" {
+  description = "Deploy a bare VM on the workload subnet, for manually verifying routing through the router."
+  type        = bool
+  default     = false
+}
+
+variable "repo_url" {
+  description = "Base URL of the Debian package repository the router pulls vpn-router from."
+  type        = string
+  default     = "https://gitea.koszewscy.waw.pl/api/packages/slawek/debian"
+}
+
+variable "ubuntu_codename" {
+  description = "Ubuntu release codename of the router VM's image, used to select the apt repo component."
+  type        = string
+  default     = "noble"
+}
+
+variable "ext_subnet_cidr" {
+  description = "CIDR of the router's external (WAN-facing) subnet, in its own VPC network."
+  type        = string
+  default     = "10.0.1.0/24"
+}
+
+variable "int_subnet_cidr" {
+  description = "CIDR of the router's internal (protected-network-facing) subnet, in its own VPC network."
+  type        = string
+  default     = "10.0.2.0/24"
+}
+
+variable "workload_subnet_cidr" {
+  description = "CIDR of the demo protected workload subnet, in the same VPC network as int_subnet_cidr and routed through the router."
+  type        = string
+  default     = "10.0.3.0/24"
+}