# Azure example

Deploys `vpn-router` on an Azure VM: a two-NIC router (external/WAN and internal/protected),
a demo protected `workload` subnet routed through it, and cloud-init that installs and
configures the package on first boot. See the repository's top-level [README](../../README.md)
for what the package itself does.

## Prerequisites

- An Azure subscription and `az login` (or another form of Azure credentials Terraform can pick
  up).
- An SSH key pair for `admin_ssh_public_key`.
- A build of the `vpn-router` package published to the repository at `repo_url` (default: the
  project's Gitea Debian registry). See [../../debian-package](../../debian-package) for
  `build.sh`/`publish.sh`.
- That repository must allow anonymous reads, since the router pulls the package with no
  credentials configured. On Gitea this means the `debian` package registry under the
  `slawek` account is set to public/anonymous-read; `publish.sh` still authenticates to
  upload, only reads are anonymous. This is a one-time change made on the Gitea side, outside
  this repository.

## Usage

```sh
cp terraform.tfvars.example terraform.tfvars
$EDITOR terraform.tfvars
export TF_VAR_psk='change-me'   # keep secrets out of tracked files
```

`platform = azure` and `mode = auto` are hard-coded into the cloud-init template call in
`router.tf`: the router has exactly two NICs, the external one carries the default route (it is
marked `primary` and holds the public IP), which is exactly the case `mode = auto` is designed
to detect reliably - see the top-level README's "What mode decides" section.

## Verifying

```sh
ssh <admin_username>@$(terraform output -raw router_public_ip)
systemctl status vpn-router-setup
swanctl --list-sas
```

Set `deploy_workload_vm = true` and re-apply to add a VM on the `workload` subnet (no public
IP - reach it via the router or Azure Bastion) for confirming that its traffic to `remote_cidrs`
actually flows through the router.