Add Azure deployment examples and enhance configuration management

- Update .gitignore to exclude Terraform files - Enhance README with Azure deployment instructions - Refactor publish.sh to use a container for changelog parsing - Add Azure example files including Terraform configurations - Create cloud-init templates for PKI and default configurations - Implement workload VM setup for testing routing
2026-08-23 22:10:29 +02:00
parent 7cb2f1b8dd
commit dac5cea5ee
16 changed files with 651 additions and 24 deletions
@@ -0,0 +1,111 @@
+data "http" "repo_gpg_key" {
+  url = "${var.repo_url}/repository.key"
+}
+
+locals {
+  supply_pki = var.ca_cert_file != ""
+
+  cloud_init_vars = {
+    hostname            = var.name
+    fqdn                = var.local_fqdn
+    repo_url            = var.repo_url
+    repo_gpg_key        = data.http.repo_gpg_key.response_body
+    ubuntu_codename     = var.ubuntu_codename
+    platform            = "azure"
+    mode                = "auto"
+    external_interface  = ""
+    internal_interface  = ""
+    local_id_mode       = var.local_id_mode
+    local_cidrs         = var.local_cidrs
+    int_addr            = ""
+    int_gateway_ip      = ""
+    remote_addrs        = var.remote_addrs
+    remote_id           = var.remote_id
+    remote_cidrs        = var.remote_cidrs
+    psk_b64             = base64encode(var.psk)
+    p2s_enabled         = var.p2s_enabled
+    p2s_address_pool    = var.p2s_address_pool
+    p2s_ca_name         = "VPN Router CA"
+    wg_enabled          = var.wireguard_enabled
+    wg_address          = var.wireguard_address
+    wg_listen_port      = var.wireguard_listen_port
+  }
+}
+
+resource "azurerm_public_ip" "ext" {
+  name                = "pip-${var.name}-ext"
+  resource_group_name = azurerm_resource_group.this.name
+  location            = azurerm_resource_group.this.location
+  allocation_method   = "Static"
+  sku                 = "Standard"
+}
+
+resource "azurerm_network_interface" "ext" {
+  name                  = "${var.name}-ext-nic"
+  resource_group_name  = azurerm_resource_group.this.name
+  location              = azurerm_resource_group.this.location
+  ip_forwarding_enabled = true
+
+  ip_configuration {
+    name                          = "ext"
+    subnet_id                     = azurerm_subnet.ext.id
+    private_ip_address_allocation = "Dynamic"
+    public_ip_address_id          = azurerm_public_ip.ext.id
+  }
+}
+
+resource "azurerm_network_interface" "int" {
+  name                  = "${var.name}-int-nic"
+  resource_group_name  = azurerm_resource_group.this.name
+  location              = azurerm_resource_group.this.location
+  ip_forwarding_enabled = true
+
+  ip_configuration {
+    name                          = "int"
+    subnet_id                     = azurerm_subnet.int.id
+    private_ip_address_allocation = "Dynamic"
+  }
+}
+
+resource "azurerm_linux_virtual_machine" "router" {
+  name                            = var.name
+  resource_group_name             = azurerm_resource_group.this.name
+  location                        = azurerm_resource_group.this.location
+  size                             = var.vm_size
+  admin_username                   = var.admin_username
+  admin_password                   = var.admin_password != "" ? var.admin_password : null
+  disable_password_authentication  = var.admin_password == ""
+
+  network_interface_ids = [
+    azurerm_network_interface.ext.id,
+    azurerm_network_interface.int.id,
+  ]
+
+  admin_ssh_key {
+    username   = var.admin_username
+    public_key = var.admin_ssh_public_key
+  }
+
+  os_disk {
+    caching              = "ReadWrite"
+    storage_account_type = "StandardSSD_LRS"
+  }
+
+  source_image_reference {
+    publisher = "Canonical"
+    offer     = "ubuntu-24_04-lts"
+    sku       = "server"
+    version   = "latest"
+  }
+
+  custom_data = base64encode(
+    local.supply_pki
+    ? templatefile("${path.module}/../cloud-init-with-pki.yaml.tpl", merge(local.cloud_init_vars, {
+      label       = split(".", var.local_fqdn)[0]
+      ca_cert     = file(var.ca_cert_file)
+      server_cert = file(var.server_cert_file)
+      server_key  = file(var.server_key_file)
+    }))
+    : templatefile("${path.module}/../cloud-init.yaml.tpl", local.cloud_init_vars)
+  )
+}