luke-else/server
1
0
Fork 0
Code Issues 5 Pull Requests Projects Releases Wiki Activity

feat: Limited rustdesk to vpn IP only

Browse Source
This commit is contained in:
luke-else
2026-08-06 21:06:50 +01:00
parent 0add4d3221
commit eef5c568bb
11 changed files with 39 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/main.tf
+22 -22
View File
@@ -8,7 +8,7 @@ locals {
# SSH to dev/prod is only permitted from the vpn server's public IP: admins must
# tunnel through the VPN first, whose egress traffic is then sourced from this IP.
# vpn itself can't require tunneling through itself, so it keeps
# var.allowed_ssh_source_ips for direct SSH access.
# var.allowed_source_ips for direct SSH access.
vpn_ssh_source_ips = ["${module.vpn.ipv4}/32"]
# IDs for every named key in var.ssh_key_names - installed on every server.
@@ -56,14 +56,14 @@ module "network" {
module "dev" {
source = "./modules/dev"
server_type = var.dev_server_type
image = var.server_image
location = var.location
ssh_key_ids = local.ssh_key_ids
network_id = module.network.id
private_ip = var.dev_private_ip
allowed_ssh_source_ips = local.vpn_ssh_source_ips
network_ip_range = var.network_ip_range
server_type = var.dev_server_type
image = var.server_image
location = var.location
ssh_key_ids = local.ssh_key_ids
network_id = module.network.id
private_ip = var.dev_private_ip
allowed_source_ips = local.vpn_ssh_source_ips
network_ip_range = var.network_ip_range
# module.network.id alone doesn't guarantee the subnet exists yet, and a server
# can't join a network before it has a subnet.
@@ -73,14 +73,14 @@ module "dev" {
module "prod" {
source = "./modules/prod"
server_type = var.prod_server_type
image = var.server_image
location = var.location
ssh_key_ids = local.ssh_key_ids
network_id = module.network.id
private_ip = var.prod_private_ip
allowed_ssh_source_ips = local.vpn_ssh_source_ips
network_ip_range = var.network_ip_range
server_type = var.prod_server_type
image = var.server_image
location = var.location
ssh_key_ids = local.ssh_key_ids
network_id = module.network.id
private_ip = var.prod_private_ip
allowed_source_ips = local.vpn_ssh_source_ips
network_ip_range = var.network_ip_range
depends_on = [module.network]
}
@@ -88,11 +88,11 @@ module "prod" {
module "vpn" {
source = "./modules/vpn"
server_type = var.vpn_server_type
image = var.server_image
location = var.location
ssh_key_ids = local.ssh_key_ids
allowed_ssh_source_ips = var.allowed_ssh_source_ips
server_type = var.vpn_server_type
image = var.server_image
location = var.location
ssh_key_ids = local.ssh_key_ids
allowed_source_ips = var.allowed_source_ips
}
module "dns" {