Add GCP deployment examples: create Terraform configurations for GCP, including network setup, instance definitions, and routing, along with a README for usage instructions.

2026-08-27 21:23:47 +02:00
parent 245d0dfd96
commit c8f54ca865
12 changed files with 465 additions and 2 deletions
@@ -72,7 +72,8 @@ Alternatively write `/etc/vpn-router/vpn-router.conf` directly before or after i
 A configuration-management tool should do that and then restart `vpn-router-setup`.

 See [examples/](examples/) for a cloud-init template and a shell installer, and
-[examples/azure/](examples/azure/) for a full Terraform example that deploys a router on Azure.
+[examples/azure/](examples/azure/) / [examples/gcp/](examples/gcp/) for full Terraform examples
+that deploy a router on Azure or GCP.

 ## Configuration

@@ -3,7 +3,7 @@
 # TF_VAR_psk or in a git-ignored *.auto.tfvars instead.

 subscription_id       = "00000000-0000-0000-0000-000000000000"
-location              = "westeurope"
+location              = "polandcentral"
 name                  = "vpn-router-example"
 admin_ssh_public_key  = "ssh-ed25519 AAAA... you@example.com"

@@ -0,0 +1,48 @@
+# GCP example
+
+Deploys `vpn-router` on a GCE instance: a two-NIC router (external/WAN and internal/protected,
+each its own VPC network), a demo protected `workload` subnet in the internal network routed
+through it, and cloud-init that installs and configures the package on first boot. See the
+repository's top-level [README](../../README.md) for what the package itself does, and
+[../azure/](../azure/) for the equivalent Azure example - the two share the same design.
+
+## Prerequisites
+
+- A GCP project and credentials Terraform can pick up (`gcloud auth application-default login`
+  or a service account).
+- An SSH key pair for `admin_ssh_public_key`.
+- A build of the `vpn-router` package published to the repository at `repo_url` (default: the
+  project's Gitea Debian registry). See [../../debian-package](../../debian-package) for
+  `build.sh`/`publish.sh`. That repository must allow anonymous reads, since the router pulls
+  the package with no credentials configured.
+
+## Usage
+
+```sh
+cp terraform.tfvars.example terraform.tfvars
+$EDITOR terraform.tfvars
+export TF_VAR_psk='change-me'   # keep secrets out of tracked files
+```
+
+`platform = gcp` and `mode = auto` are hard-coded into the cloud-init template call in
+`router.tf`: the router has exactly two NICs, and on GCP the system default route always goes
+out NIC0 (the external one here) while a secondary NIC only reaches its own subnet unless
+policy-routed - exactly the case `mode = auto` is designed to detect reliably. See the
+top-level README's "What mode decides" section.
+
+Unlike the Azure example, `ext` and `internal` are two separate VPC networks (GCP instances
+attach one NIC per network), with `int` and `workload` as two subnets inside the same
+`internal` network. GCP routes apply network-wide rather than per-subnet, so `routes.tf`
+needs no separate subnet association - the route in `internal` already covers both subnets.
+
+## Verifying
+
+```sh
+ssh <admin_username>@$(terraform output -raw router_public_ip)
+systemctl status vpn-router-setup
+swanctl --list-sas
+```
+
+Set `deploy_workload_vm = true` and re-apply to add a VM on the `workload` subnet (no public
+IP - reach it via the router or IAP) for confirming that its traffic to `remote_cidrs` actually
+flows through the router.
@@ -0,0 +1,78 @@
+resource "google_dns_record_set" "router_ext" {
+  count = var.dns_managed_zone != "" ? 1 : 0
+
+  name         = "${var.local_fqdn}."
+  type         = "A"
+  ttl          = 300
+  managed_zone = var.dns_managed_zone
+  project      = var.dns_project != "" ? var.dns_project : var.project_id
+  rrdatas      = [google_compute_address.ext.address]
+}
+
+resource "google_compute_network" "ext" {
+  name                    = "${var.name}-ext"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "ext" {
+  name          = "${var.name}-ext"
+  network       = google_compute_network.ext.id
+  region        = var.region
+  ip_cidr_range = var.ext_subnet_cidr
+}
+
+resource "google_compute_network" "internal" {
+  name                    = "${var.name}-int"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "int" {
+  name          = "${var.name}-int"
+  network       = google_compute_network.internal.id
+  region        = var.region
+  ip_cidr_range = var.int_subnet_cidr
+}
+
+resource "google_compute_subnetwork" "workload" {
+  name          = "${var.name}-workload"
+  network       = google_compute_network.internal.id
+  region        = var.region
+  ip_cidr_range = var.workload_subnet_cidr
+}
+
+resource "google_compute_firewall" "router_ext" {
+  name    = "${var.name}-ext-allow-router"
+  network = google_compute_network.ext.name
+
+  allow {
+    protocol = "tcp"
+    ports    = ["22"]
+  }
+
+  allow {
+    protocol = "udp"
+    ports    = ["500", "4500"]
+  }
+
+  dynamic "allow" {
+    for_each = var.wireguard_enabled ? [1] : []
+    content {
+      protocol = "udp"
+      ports    = [tostring(var.wireguard_listen_port)]
+    }
+  }
+
+  source_ranges = ["0.0.0.0/0"]
+  target_tags   = ["${var.name}-router"]
+}
+
+resource "google_compute_firewall" "internal_allow_all" {
+  name    = "${var.name}-int-allow-internal"
+  network = google_compute_network.internal.name
+
+  allow {
+    protocol = "all"
+  }
+
+  source_ranges = [var.int_subnet_cidr, var.workload_subnet_cidr]
+}
@@ -0,0 +1,9 @@
+output "router_public_ip" {
+  description = "Public IP address of the router VM."
+  value       = google_compute_address.ext.address
+}
+
+output "router_internal_ip" {
+  description = "Private IP address of the router's internal NIC - the next hop to use in routes configured outside this Terraform run (another route, or an on-prem device) that need to reach remote_cidrs through this router."
+  value       = google_compute_instance.router.network_interface[1].network_ip
+}
@@ -0,0 +1,5 @@
+provider "google" {
+  project = var.project_id
+  region  = var.region
+  zone    = var.zone
+}
@@ -0,0 +1,79 @@
+data "http" "repo_gpg_key" {
+  url = "${var.repo_url}/repository.key"
+}
+
+locals {
+  supply_pki = var.ca_cert_file != ""
+
+  cloud_init_vars = {
+    hostname            = var.name
+    fqdn                = var.local_fqdn
+    repo_url            = var.repo_url
+    repo_gpg_key        = data.http.repo_gpg_key.response_body
+    ubuntu_codename     = var.ubuntu_codename
+    platform            = "gcp"
+    mode                = "auto"
+    external_interface  = ""
+    internal_interface  = ""
+    local_id_mode       = var.local_id_mode
+    local_cidrs         = var.local_cidrs
+    int_addr            = ""
+    int_gateway_ip      = ""
+    remote_addrs        = var.remote_addrs
+    remote_id           = var.remote_id
+    remote_cidrs        = var.remote_cidrs
+    psk_b64             = base64encode(var.psk)
+    p2s_enabled         = var.p2s_enabled
+    p2s_address_pool    = var.p2s_address_pool
+    p2s_ca_name         = "VPN Router CA"
+    wg_enabled          = var.wireguard_enabled
+    wg_address          = var.wireguard_address
+    wg_listen_port      = var.wireguard_listen_port
+  }
+
+  cloud_init_rendered = local.supply_pki ? templatefile("${path.module}/../cloud-init-with-pki.yaml.tpl", merge(local.cloud_init_vars, {
+    label       = split(".", var.local_fqdn)[0]
+    ca_cert     = file(var.ca_cert_file)
+    server_cert = file(var.server_cert_file)
+    server_key  = file(var.server_key_file)
+  })) : templatefile("${path.module}/../cloud-init.yaml.tpl", local.cloud_init_vars)
+}
+
+resource "google_compute_address" "ext" {
+  name   = "${var.name}-ext"
+  region = var.region
+}
+
+resource "google_compute_instance" "router" {
+  name         = var.name
+  machine_type = var.machine_type
+  zone         = var.zone
+  tags         = ["${var.name}-router"]
+
+  can_ip_forward = true
+
+  boot_disk {
+    initialize_params {
+      image = "ubuntu-os-cloud/ubuntu-2404-lts-amd64"
+    }
+  }
+
+  network_interface {
+    network    = google_compute_network.ext.id
+    subnetwork = google_compute_subnetwork.ext.id
+
+    access_config {
+      nat_ip = google_compute_address.ext.address
+    }
+  }
+
+  network_interface {
+    network    = google_compute_network.internal.id
+    subnetwork = google_compute_subnetwork.int.id
+  }
+
+  metadata = {
+    ssh-keys  = "${var.admin_username}:${var.admin_ssh_public_key}"
+    user-data = local.cloud_init_rendered
+  }
+}
@@ -0,0 +1,13 @@
+locals {
+  remote_cidr_list = [for c in split(",", var.remote_cidrs) : trimspace(c) if trimspace(c) != ""]
+}
+
+resource "google_compute_route" "to_remote" {
+  for_each = toset(local.remote_cidr_list)
+
+  name              = "${var.name}-to-${replace(replace(each.value, "/", "-"), ".", "-")}"
+  network           = google_compute_network.internal.name
+  dest_range        = each.value
+  next_hop_instance = google_compute_instance.router.self_link
+  priority          = 100
+}
@@ -0,0 +1,20 @@
+# Copy to terraform.tfvars (or a git-ignored *.auto.tfvars) and adjust.
+# Keep secrets - psk here - out of any tracked file: set them with
+# TF_VAR_psk or in a git-ignored *.auto.tfvars instead.
+
+project_id            = "my-gcp-project"
+region                = "europe-central2"
+zone                  = "europe-central2-a"
+name                  = "vpn-router-example"
+admin_ssh_public_key  = "ssh-ed25519 AAAA... you@example.com"
+
+local_fqdn   = "router.example.com"
+local_cidrs  = "10.0.3.0/24"
+
+remote_addrs  = "peer.example.net"
+remote_id     = "peer.example.net"
+remote_cidrs  = "192.168.0.0/24"
+
+p2s_enabled       = false
+wireguard_enabled = false
+deploy_workload_vm = false
@@ -0,0 +1,171 @@
+variable "project_id" {
+  description = "GCP project to deploy into."
+  type        = string
+}
+
+variable "region" {
+  description = "GCP region to deploy into."
+  type        = string
+}
+
+variable "zone" {
+  description = "GCP zone to deploy the VMs into."
+  type        = string
+}
+
+variable "name" {
+  description = "Base name used to derive resource names."
+  type        = string
+  default     = "vpn-router-example"
+}
+
+variable "admin_username" {
+  description = "Admin username created on both VMs via SSH key metadata."
+  type        = string
+  default     = "vpnrouter"
+}
+
+variable "admin_ssh_public_key" {
+  description = "SSH public key installed for admin_username on both VMs."
+  type        = string
+}
+
+variable "machine_type" {
+  description = "Machine type for the router."
+  type        = string
+  default     = "e2-small"
+}
+
+variable "local_fqdn" {
+  description = "FQDN of the router, used as the road-warrior/IKE identity and, when dns_managed_zone is set, as the name of the A record created for it."
+  type        = string
+}
+
+variable "dns_managed_zone" {
+  description = "Name of an existing Cloud DNS managed zone to create local_fqdn's A record in, pointing at the router's public IP. local_fqdn must be a name within that zone's DNS name. Leave empty to skip - local_fqdn is then just a label with nothing making it resolve."
+  type        = string
+  default     = ""
+}
+
+variable "dns_project" {
+  description = "Project that owns dns_managed_zone. Leave empty to use project_id."
+  type        = string
+  default     = ""
+}
+
+variable "local_id_mode" {
+  description = "IKE local identity source: fqdn, public_ip or internal_ip."
+  type        = string
+  default     = "fqdn"
+}
+
+variable "local_cidrs" {
+  description = "Local subnet CIDR(s) advertised into the site-to-site tunnel. Should include the workload subnet CIDR."
+  type        = string
+}
+
+variable "remote_addrs" {
+  description = "Remote gateway address(es) or FQDN for the site-to-site tunnel."
+  type        = string
+}
+
+variable "remote_id" {
+  description = "Remote peer's IKE identity, without a leading @."
+  type        = string
+}
+
+variable "remote_cidrs" {
+  description = "Remote subnet CIDR(s) reachable through the site-to-site tunnel."
+  type        = string
+}
+
+variable "psk" {
+  description = "Pre-shared key for the site-to-site IKEv2 tunnel."
+  type        = string
+  sensitive   = true
+}
+
+variable "p2s_enabled" {
+  description = "Enable road-warrior (P2S) access."
+  type        = bool
+  default     = false
+}
+
+variable "p2s_address_pool" {
+  description = "CIDR block assigned to road-warrior clients."
+  type        = string
+  default     = ""
+}
+
+variable "ca_cert_file" {
+  description = "Path to an existing CA certificate PEM to supply instead of letting the package generate one. Leave empty to auto-generate."
+  type        = string
+  default     = ""
+}
+
+variable "server_cert_file" {
+  description = "Path to an existing server certificate PEM, paired with ca_cert_file."
+  type        = string
+  default     = ""
+}
+
+variable "server_key_file" {
+  description = "Path to an existing server private key PEM, paired with ca_cert_file."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "wireguard_enabled" {
+  description = "Enable the WireGuard endpoint."
+  type        = bool
+  default     = false
+}
+
+variable "wireguard_address" {
+  description = "Address and prefix length for the wg0 interface."
+  type        = string
+  default     = ""
+}
+
+variable "wireguard_listen_port" {
+  description = "UDP port WireGuard listens on."
+  type        = number
+  default     = 51820
+}
+
+variable "deploy_workload_vm" {
+  description = "Deploy a bare VM on the workload subnet, for manually verifying routing through the router."
+  type        = bool
+  default     = false
+}
+
+variable "repo_url" {
+  description = "Base URL of the Debian package repository the router pulls vpn-router from."
+  type        = string
+  default     = "https://gitea.koszewscy.waw.pl/api/packages/slawek/debian"
+}
+
+variable "ubuntu_codename" {
+  description = "Ubuntu release codename of the router VM's image, used to select the apt repo component."
+  type        = string
+  default     = "noble"
+}
+
+variable "ext_subnet_cidr" {
+  description = "CIDR of the router's external (WAN-facing) subnet, in its own VPC network."
+  type        = string
+  default     = "10.0.1.0/24"
+}
+
+variable "int_subnet_cidr" {
+  description = "CIDR of the router's internal (protected-network-facing) subnet, in its own VPC network."
+  type        = string
+  default     = "10.0.2.0/24"
+}
+
+variable "workload_subnet_cidr" {
+  description = "CIDR of the demo protected workload subnet, in the same VPC network as int_subnet_cidr and routed through the router."
+  type        = string
+  default     = "10.0.3.0/24"
+}
@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.9"
+
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = ">= 7.0, < 8.0"
+    }
+    http = {
+      source  = "hashicorp/http"
+      version = ">= 3.4, < 4.0"
+    }
+  }
+}
@@ -0,0 +1,25 @@
+# Bare VM on the workload subnet, for manually verifying that its traffic to
+# remote_cidrs flows through the router. Off by default so a plain apply
+# stays to just the router.
+
+resource "google_compute_instance" "workload" {
+  count        = var.deploy_workload_vm ? 1 : 0
+  name         = "${var.name}-workload"
+  machine_type = var.machine_type
+  zone         = var.zone
+
+  boot_disk {
+    initialize_params {
+      image = "ubuntu-os-cloud/ubuntu-2404-lts-amd64"
+    }
+  }
+
+  network_interface {
+    network    = google_compute_network.internal.id
+    subnetwork = google_compute_subnetwork.workload.id
+  }
+
+  metadata = {
+    ssh-keys = "${var.admin_username}:${var.admin_ssh_public_key}"
+  }
+}