Add Azure deployment examples and enhance configuration management

- Update .gitignore to exclude Terraform files - Enhance README with Azure deployment instructions - Refactor publish.sh to use a container for changelog parsing - Add Azure example files including Terraform configurations - Create cloud-init templates for PKI and default configurations - Implement workload VM setup for testing routing
2026-08-23 22:10:29 +02:00
parent 7cb2f1b8dd
commit dac5cea5ee
16 changed files with 651 additions and 24 deletions
@@ -0,0 +1,104 @@
+resource "azurerm_resource_group" "this" {
+  name     = "rg-${var.name}"
+  location = var.location
+}
+
+resource "azurerm_virtual_network" "this" {
+  name                = "vnet-${var.name}"
+  resource_group_name = azurerm_resource_group.this.name
+  location            = azurerm_resource_group.this.location
+  address_space       = [var.vnet_address_space]
+}
+
+resource "azurerm_subnet" "ext" {
+  name                 = "ext"
+  resource_group_name  = azurerm_resource_group.this.name
+  virtual_network_name = azurerm_virtual_network.this.name
+  address_prefixes     = [var.ext_subnet_cidr]
+}
+
+resource "azurerm_subnet" "int" {
+  name                 = "int"
+  resource_group_name  = azurerm_resource_group.this.name
+  virtual_network_name = azurerm_virtual_network.this.name
+  address_prefixes     = [var.int_subnet_cidr]
+}
+
+resource "azurerm_subnet" "workload" {
+  name                 = "workload"
+  resource_group_name  = azurerm_resource_group.this.name
+  virtual_network_name = azurerm_virtual_network.this.name
+  address_prefixes     = [var.workload_subnet_cidr]
+}
+
+resource "azurerm_dns_a_record" "router_ext" {
+  count = var.dns_zone_id != null ? 1 : 0
+
+  name                = trimsuffix(var.local_fqdn, ".${split("/", var.dns_zone_id)[length(split("/", var.dns_zone_id)) - 1]}")
+  zone_name           = split("/", var.dns_zone_id)[length(split("/", var.dns_zone_id)) - 1]
+  resource_group_name = split("/", var.dns_zone_id)[4]
+  ttl                 = 300
+  records             = [azurerm_public_ip.ext.ip_address]
+}
+
+resource "azurerm_network_security_group" "router_ext" {
+  name                = "nsg-${var.name}-ext"
+  resource_group_name = azurerm_resource_group.this.name
+  location            = azurerm_resource_group.this.location
+
+  security_rule {
+    name                       = "Allow-SSH-TCP-22"
+    priority                   = 100
+    direction                  = "Inbound"
+    access                     = "Allow"
+    protocol                   = "Tcp"
+    source_port_range          = "*"
+    destination_port_range     = "22"
+    source_address_prefix      = "*"
+    destination_address_prefix = "*"
+  }
+
+  security_rule {
+    name                       = "Allow-IKE-UDP-500"
+    priority                   = 110
+    direction                  = "Inbound"
+    access                     = "Allow"
+    protocol                   = "Udp"
+    source_port_range          = "*"
+    destination_port_range     = "500"
+    source_address_prefix      = "*"
+    destination_address_prefix = "*"
+  }
+
+  security_rule {
+    name                       = "Allow-IPsec-NAT-T-UDP-4500"
+    priority                   = 120
+    direction                  = "Inbound"
+    access                     = "Allow"
+    protocol                   = "Udp"
+    source_port_range          = "*"
+    destination_port_range     = "4500"
+    source_address_prefix      = "*"
+    destination_address_prefix = "*"
+  }
+
+  dynamic "security_rule" {
+    for_each = var.wireguard_enabled ? [1] : []
+    content {
+      name                       = "Allow-WireGuard-UDP"
+      priority                   = 130
+      direction                  = "Inbound"
+      access                     = "Allow"
+      protocol                   = "Udp"
+      source_port_range          = "*"
+      destination_port_range     = tostring(var.wireguard_listen_port)
+      source_address_prefix      = "*"
+      destination_address_prefix = "*"
+    }
+  }
+}
+
+resource "azurerm_network_interface_security_group_association" "router_ext" {
+  network_interface_id     = azurerm_network_interface.ext.id
+  network_security_group_id = azurerm_network_security_group.router_ext.id
+}