113 lines
3.7 KiB
Terraform
113 lines
3.7 KiB
Terraform
data "http" "repo_gpg_key" {
|
|
url = "${var.repo_url}/repository.key"
|
|
}
|
|
|
|
locals {
|
|
supply_pki = var.ca_cert_file != ""
|
|
|
|
cloud_init_vars = {
|
|
hostname = var.name
|
|
fqdn = var.local_fqdn
|
|
repo_url = var.repo_url
|
|
repo_gpg_key = data.http.repo_gpg_key.response_body
|
|
ubuntu_codename = var.ubuntu_codename
|
|
|
|
# Contents of /etc/vpn-router/vpn-router.json.
|
|
config = {
|
|
general = { platform = "azure", mode = "auto" }
|
|
wan = { local_fqdn = var.local_fqdn }
|
|
local = { cidrs = local.local_cidr_list }
|
|
site_to_site = {
|
|
"remote-site" = {
|
|
addrs = [for a in split(",", var.remote_addrs) : trimspace(a) if trimspace(a) != ""]
|
|
id = var.remote_id
|
|
cidrs = local.remote_cidr_list
|
|
local_cidrs = local.local_cidr_list
|
|
local_id_mode = var.local_id_mode
|
|
psk = var.psk
|
|
}
|
|
}
|
|
p2s = { enabled = var.p2s_enabled, address_pool = var.p2s_address_pool, ca_name = "VPN Router CA" }
|
|
wireguard = { enabled = var.wireguard_enabled, address = var.wireguard_address, listen_port = var.wireguard_listen_port }
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "azurerm_public_ip" "ext" {
|
|
name = "pip-${var.name}-ext"
|
|
resource_group_name = azurerm_resource_group.this.name
|
|
location = azurerm_resource_group.this.location
|
|
allocation_method = "Static"
|
|
sku = "Standard"
|
|
}
|
|
|
|
resource "azurerm_network_interface" "ext" {
|
|
name = "${var.name}-ext-nic"
|
|
resource_group_name = azurerm_resource_group.this.name
|
|
location = azurerm_resource_group.this.location
|
|
ip_forwarding_enabled = true
|
|
|
|
ip_configuration {
|
|
name = "ext"
|
|
subnet_id = azurerm_subnet.ext.id
|
|
private_ip_address_allocation = "Dynamic"
|
|
public_ip_address_id = azurerm_public_ip.ext.id
|
|
}
|
|
}
|
|
|
|
resource "azurerm_network_interface" "int" {
|
|
name = "${var.name}-int-nic"
|
|
resource_group_name = azurerm_resource_group.this.name
|
|
location = azurerm_resource_group.this.location
|
|
ip_forwarding_enabled = true
|
|
|
|
ip_configuration {
|
|
name = "int"
|
|
subnet_id = azurerm_subnet.int.id
|
|
private_ip_address_allocation = "Dynamic"
|
|
}
|
|
}
|
|
|
|
resource "azurerm_linux_virtual_machine" "router" {
|
|
name = var.name
|
|
resource_group_name = azurerm_resource_group.this.name
|
|
location = azurerm_resource_group.this.location
|
|
size = var.vm_size
|
|
admin_username = var.admin_username
|
|
admin_password = var.admin_password != "" ? var.admin_password : null
|
|
disable_password_authentication = var.admin_password == ""
|
|
|
|
network_interface_ids = [
|
|
azurerm_network_interface.ext.id,
|
|
azurerm_network_interface.int.id,
|
|
]
|
|
|
|
admin_ssh_key {
|
|
username = var.admin_username
|
|
public_key = var.admin_ssh_public_key
|
|
}
|
|
|
|
os_disk {
|
|
caching = "ReadWrite"
|
|
storage_account_type = "StandardSSD_LRS"
|
|
}
|
|
|
|
source_image_reference {
|
|
publisher = "Canonical"
|
|
offer = "ubuntu-24_04-lts"
|
|
sku = "server"
|
|
version = "latest"
|
|
}
|
|
|
|
custom_data = base64encode(
|
|
local.supply_pki
|
|
? templatefile("${path.module}/../cloud-init-with-pki.yaml.tpl", merge(local.cloud_init_vars, {
|
|
label = split(".", var.local_fqdn)[0]
|
|
ca_cert = file(var.ca_cert_file)
|
|
server_cert = file(var.server_cert_file)
|
|
server_key = file(var.server_key_file)
|
|
}))
|
|
: templatefile("${path.module}/../cloud-init.yaml.tpl", local.cloud_init_vars)
|
|
)
|
|
}
|