linux-cloud-router/examples/azure/README.md

Azure example

Deploys vpn-router on an Azure VM: a two-NIC router (external/WAN and internal/protected), a demo protected workload subnet routed through it, and cloud-init that installs and configures the package on first boot. See the repository's top-level README for what the package itself does.

Prerequisites

• An Azure subscription and az login (or another form of Azure credentials Terraform can pick up).
• An SSH key pair for admin_ssh_public_key.
• A build of the vpn-router package published to the repository at repo_url (default: the project's Gitea Debian registry). See ../../debian-package for build.sh/publish.sh.
• That repository must allow anonymous reads, since the router pulls the package with no credentials configured. On Gitea this means the debian package registry under the slawek account is set to public/anonymous-read; publish.sh still authenticates to upload, only reads are anonymous. This is a one-time change made on the Gitea side, outside this repository.

Usage

cp terraform.tfvars.example terraform.tfvars
$EDITOR terraform.tfvars
export TF_VAR_psk='change-me'   # keep secrets out of tracked files

platform = azure and mode = auto are hard-coded into the cloud-init template call in router.tf: the router has exactly two NICs, the external one carries the default route (it is marked primary and holds the public IP), which is exactly the case mode = auto is designed to detect reliably - see the top-level README's "What mode decides" section.

Verifying

ssh <admin_username>@$(terraform output -raw router_public_ip)
systemctl status vpn-router-setup
swanctl --list-sas

Set deploy_workload_vm = true and re-apply to add a VM on the workload subnet (no public IP - reach it via the router or Azure Bastion) for confirming that its traffic to remote_cidrs actually flows through the router.