slawek
dac5cea5ee
- Update .gitignore to exclude Terraform files - Enhance README with Azure deployment instructions - Refactor publish.sh to use a container for changelog parsing - Add Azure example files including Terraform configurations - Create cloud-init templates for PKI and default configurations - Implement workload VM setup for testing routing
46 lines
1.9 KiB
Markdown
46 lines
1.9 KiB
Markdown
# Azure example
|
|
|
|
Deploys `vpn-router` on an Azure VM: a two-NIC router (external/WAN and internal/protected),
|
|
a demo protected `workload` subnet routed through it, and cloud-init that installs and
|
|
configures the package on first boot. See the repository's top-level [README](../../README.md)
|
|
for what the package itself does.
|
|
|
|
## Prerequisites
|
|
|
|
- An Azure subscription and `az login` (or another form of Azure credentials Terraform can pick
|
|
up).
|
|
- An SSH key pair for `admin_ssh_public_key`.
|
|
- A build of the `vpn-router` package published to the repository at `repo_url` (default: the
|
|
project's Gitea Debian registry). See [../../debian-package](../../debian-package) for
|
|
`build.sh`/`publish.sh`.
|
|
- That repository must allow anonymous reads, since the router pulls the package with no
|
|
credentials configured. On Gitea this means the `debian` package registry under the
|
|
`slawek` account is set to public/anonymous-read; `publish.sh` still authenticates to
|
|
upload, only reads are anonymous. This is a one-time change made on the Gitea side, outside
|
|
this repository.
|
|
|
|
## Usage
|
|
|
|
```sh
|
|
cp terraform.tfvars.example terraform.tfvars
|
|
$EDITOR terraform.tfvars
|
|
export TF_VAR_psk='change-me' # keep secrets out of tracked files
|
|
```
|
|
|
|
`platform = azure` and `mode = auto` are hard-coded into the cloud-init template call in
|
|
`router.tf`: the router has exactly two NICs, the external one carries the default route (it is
|
|
marked `primary` and holds the public IP), which is exactly the case `mode = auto` is designed
|
|
to detect reliably - see the top-level README's "What mode decides" section.
|
|
|
|
## Verifying
|
|
|
|
```sh
|
|
ssh <admin_username>@$(terraform output -raw router_public_ip)
|
|
systemctl status vpn-router-setup
|
|
swanctl --list-sas
|
|
```
|
|
|
|
Set `deploy_workload_vm = true` and re-apply to add a VM on the `workload` subnet (no public
|
|
IP - reach it via the router or Azure Bastion) for confirming that its traffic to `remote_cidrs`
|
|
actually flows through the router.
|