luke-else/server
1
0
Fork 0
Code Issues 5 Pull Requests Projects Releases Wiki Activity

feat: Limited rustdesk to vpn IP only

Browse Source
This commit is contained in:
luke-else
2026-08-06 21:06:50 +01:00
parent 0add4d3221
commit eef5c568bb
11 changed files with 39 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/main.tf
+22 -22
View File
@@ -8,7 +8,7 @@ locals {
# SSH to dev/prod is only permitted from the vpn server's public IP: admins must
# tunnel through the VPN first, whose egress traffic is then sourced from this IP.
# vpn itself can't require tunneling through itself, so it keeps
# var.allowed_ssh_source_ips for direct SSH access.
# var.allowed_source_ips for direct SSH access.
vpn_ssh_source_ips = ["${module.vpn.ipv4}/32"]
# IDs for every named key in var.ssh_key_names - installed on every server.
@@ -56,14 +56,14 @@ module "network" {
module "dev" {
source = "./modules/dev"
server_type = var.dev_server_type
image = var.server_image
location = var.location
ssh_key_ids = local.ssh_key_ids
network_id = module.network.id
private_ip = var.dev_private_ip
allowed_ssh_source_ips = local.vpn_ssh_source_ips
network_ip_range = var.network_ip_range
server_type = var.dev_server_type
image = var.server_image
location = var.location
ssh_key_ids = local.ssh_key_ids
network_id = module.network.id
private_ip = var.dev_private_ip
allowed_source_ips = local.vpn_ssh_source_ips
network_ip_range = var.network_ip_range
# module.network.id alone doesn't guarantee the subnet exists yet, and a server
# can't join a network before it has a subnet.
@@ -73,14 +73,14 @@ module "dev" {
module "prod" {
source = "./modules/prod"
server_type = var.prod_server_type
image = var.server_image
location = var.location
ssh_key_ids = local.ssh_key_ids
network_id = module.network.id
private_ip = var.prod_private_ip
allowed_ssh_source_ips = local.vpn_ssh_source_ips
network_ip_range = var.network_ip_range
server_type = var.prod_server_type
image = var.server_image
location = var.location
ssh_key_ids = local.ssh_key_ids
network_id = module.network.id
private_ip = var.prod_private_ip
allowed_source_ips = local.vpn_ssh_source_ips
network_ip_range = var.network_ip_range
depends_on = [module.network]
}
@@ -88,11 +88,11 @@ module "prod" {
module "vpn" {
source = "./modules/vpn"
server_type = var.vpn_server_type
image = var.server_image
location = var.location
ssh_key_ids = local.ssh_key_ids
allowed_ssh_source_ips = var.allowed_ssh_source_ips
server_type = var.vpn_server_type
image = var.server_image
location = var.location
ssh_key_ids = local.ssh_key_ids
allowed_source_ips = var.allowed_source_ips
}
module "dns" {
infra/modules/dev/main.tf
+1 -1
View File
@@ -8,7 +8,7 @@ resource "hcloud_firewall" "this" {
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
source_ips = var.allowed_source_ips
}
rule { # gitea ssh
infra/modules/dev/variables.tf
+1 -1
View File
@@ -28,7 +28,7 @@ variable "private_ip" {
type = string
}
variable "allowed_ssh_source_ips" {
variable "allowed_source_ips" {
description = "CIDRs allowed to reach port 22 on dev. Set by the root module to the vpn server's public IP."
type = list(string)
}
infra/modules/prod/main.tf
+6 -6
View File
@@ -6,7 +6,7 @@ resource "hcloud_firewall" "this" {
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
source_ips = var.allowed_source_ips
}
rule { # Traefik http/https
@@ -27,35 +27,35 @@ resource "hcloud_firewall" "this" {
direction = "in"
protocol = "tcp"
port = "21115"
source_ips = ["0.0.0.0/0", "::/0"]
source_ips = var.allowed_source_ips
}
rule {
direction = "in"
protocol = "tcp"
port = "21116"
source_ips = ["0.0.0.0/0", "::/0"]
source_ips = var.allowed_source_ips
}
rule {
direction = "in"
protocol = "udp"
port = "21116"
source_ips = ["0.0.0.0/0", "::/0"]
source_ips = var.allowed_source_ips
}
rule { # rustdesk hbbr
direction = "in"
protocol = "tcp"
port = "21117"
source_ips = ["0.0.0.0/0", "::/0"]
source_ips = var.allowed_source_ips
}
rule {
direction = "in"
protocol = "tcp"
port = "21119"
source_ips = ["0.0.0.0/0", "::/0"]
source_ips = var.allowed_source_ips
}
rule { # traffic from over the private network
infra/modules/prod/variables.tf
+1 -1
View File
@@ -28,7 +28,7 @@ variable "private_ip" {
type = string
}
variable "allowed_ssh_source_ips" {
variable "allowed_source_ips" {
description = "CIDRs allowed to reach port 22 on prod. Set by the root module to the vpn server's public IP."
type = list(string)
}
infra/modules/vpn/main.tf
+1 -1
View File
@@ -6,7 +6,7 @@ resource "hcloud_firewall" "this" {
direction = "in"
protocol = "tcp"
port = "22"
source_ips = var.allowed_ssh_source_ips
source_ips = var.allowed_source_ips
}
rule { # Traefik http/https
infra/modules/vpn/variables.tf
+1 -1
View File
@@ -18,7 +18,7 @@ variable "ssh_key_ids" {
type = list(string)
}
variable "allowed_ssh_source_ips" {
variable "allowed_source_ips" {
description = "CIDRs allowed to reach port 22 on vpn."
type = list(string)
}
infra/terraform.tfvars.example
+1 -1
View File
@@ -14,5 +14,5 @@ ssh_key_names = ["luke-else@PC", "luke-else@laptop"]
# dev_server_type = "cx23"
# prod_server_type = "cx23"
# vpn_server_type = "cx23"
# allowed_ssh_source_ips = ["0.0.0.0/0"]
# allowed_source_ips = ["0.0.0.0/0"]
# dns_zones = ["luke-else.co.uk"]
infra/variables.tf
+1 -1
View File
@@ -63,7 +63,7 @@ variable "ssh_key_names" {
type = list(string)
}
variable "allowed_ssh_source_ips" {
variable "allowed_source_ips" {
description = "CIDRs allowed to reach port 22 on the vpn server. Narrow this to your own IP(s) once known. dev and prod don't use this - their SSH is restricted to the vpn server's own public IP instead (see infra/main.tf)."
type = list(string)
default = ["0.0.0.0/0", "::/0"]