feat: Limited rustdesk to vpn IP only

infra/modules/dev/main.tf

@@ -8,7 +8,7 @@ resource "hcloud_firewall" "this" {
     direction  = "in"
     protocol   = "tcp"
     port       = "22"
-    source_ips = var.allowed_ssh_source_ips
+    source_ips = var.allowed_source_ips
   }
 
   rule { # gitea ssh

infra/modules/dev/variables.tf

@@ -28,7 +28,7 @@ variable "private_ip" {
   type        = string
 }
 
-variable "allowed_ssh_source_ips" {
+variable "allowed_source_ips" {
   description = "CIDRs allowed to reach port 22 on dev. Set by the root module to the vpn server's public IP."
   type        = list(string)
 }

infra/modules/prod/main.tf

@@ -6,7 +6,7 @@ resource "hcloud_firewall" "this" {
     direction  = "in"
     protocol   = "tcp"
     port       = "22"
-    source_ips = var.allowed_ssh_source_ips
+    source_ips = var.allowed_source_ips
   }
 
   rule { # Traefik http/https
@@ -27,35 +27,35 @@ resource "hcloud_firewall" "this" {
     direction  = "in"
     protocol   = "tcp"
     port       = "21115"
-    source_ips = ["0.0.0.0/0", "::/0"]
+    source_ips = var.allowed_source_ips
   }
 
   rule {
     direction  = "in"
     protocol   = "tcp"
     port       = "21116"
-    source_ips = ["0.0.0.0/0", "::/0"]
+    source_ips = var.allowed_source_ips
   }
 
   rule {
     direction  = "in"
     protocol   = "udp"
     port       = "21116"
-    source_ips = ["0.0.0.0/0", "::/0"]
+    source_ips = var.allowed_source_ips
   }
 
   rule { # rustdesk hbbr
     direction  = "in"
     protocol   = "tcp"
     port       = "21117"
-    source_ips = ["0.0.0.0/0", "::/0"]
+    source_ips = var.allowed_source_ips
   }
 
   rule {
     direction  = "in"
     protocol   = "tcp"
     port       = "21119"
-    source_ips = ["0.0.0.0/0", "::/0"]
+    source_ips = var.allowed_source_ips
   }
 
   rule { # traffic from over the private network

infra/modules/prod/variables.tf

@@ -28,7 +28,7 @@ variable "private_ip" {
   type        = string
 }
 
-variable "allowed_ssh_source_ips" {
+variable "allowed_source_ips" {
   description = "CIDRs allowed to reach port 22 on prod. Set by the root module to the vpn server's public IP."
   type        = list(string)
 }

infra/modules/vpn/main.tf

@@ -6,7 +6,7 @@ resource "hcloud_firewall" "this" {
     direction  = "in"
     protocol   = "tcp"
     port       = "22"
-    source_ips = var.allowed_ssh_source_ips
+    source_ips = var.allowed_source_ips
   }
 
   rule { # Traefik http/https

infra/modules/vpn/variables.tf

@@ -18,7 +18,7 @@ variable "ssh_key_ids" {
   type        = list(string)
 }
 
-variable "allowed_ssh_source_ips" {
+variable "allowed_source_ips" {
   description = "CIDRs allowed to reach port 22 on vpn."
   type        = list(string)
 }