92 lines
3.5 KiB
Terraform
92 lines
3.5 KiB
Terraform
# Root module: wires together the shared network and the three host modules
|
|
# (one per server in docs/architecture.md). Each host module owns its own
|
|
# firewall - see modules/<host>/main.tf. Persistent data lives in named Docker
|
|
# volumes backed up to S3 (see services/<host>/backup-docker-compose.yml), not
|
|
# on Hetzner volumes.
|
|
|
|
locals {
|
|
# SSH to dev/prod is only permitted from the vpn server's public IP: admins must
|
|
# tunnel through the VPN first, whose egress traffic is then sourced from this IP.
|
|
# vpn itself can't require tunneling through itself, so it keeps
|
|
# var.allowed_ssh_source_ips for direct SSH access.
|
|
vpn_ssh_source_ips = ["${module.vpn.ipv4}/32"]
|
|
|
|
# IDs for every named key in var.ssh_key_names - installed on every server.
|
|
ssh_key_ids = [for k in data.hcloud_ssh_key.main : k.id]
|
|
|
|
# Every A record currently referenced by a Traefik Host() rule anywhere under
|
|
# services/ - kept in sync with the actual compose files, not aspirational.
|
|
# "dev.luke-else.co.uk" is a *website* served from prod (a dev-tagged build of
|
|
# luke-else.co.uk), not the dev server - don't confuse the two.
|
|
dns_records = [
|
|
{ zone = "luke-else.co.uk", name = "@", value = module.prod.ipv4 },
|
|
{ zone = "luke-else.co.uk", name = "dev", value = module.prod.ipv4 },
|
|
{ zone = "luke-else.co.uk", name = "metarius", value = module.prod.ipv4 },
|
|
{ zone = "luke-else.co.uk", name = "traefik", value = module.prod.ipv4 },
|
|
{ zone = "luke-else.co.uk", name = "status", value = module.prod.ipv4 },
|
|
{ zone = "luke-else.co.uk", name = "bitwarden", value = module.prod.ipv4 },
|
|
{ zone = "luke-else.co.uk", name = "rd", value = module.prod.ipv4 },
|
|
{ zone = "luke-else.co.uk", name = "git", value = module.dev.ipv4 },
|
|
{ zone = "luke-else.co.uk", name = "traefik.cicd", value = module.dev.ipv4 },
|
|
{ zone = "luke-else.co.uk", name = "vpn", value = module.vpn.ipv4 },
|
|
{ zone = "luke-else.co.uk", name = "traefik.vpn", value = module.vpn.ipv4 },
|
|
]
|
|
}
|
|
|
|
module "network" {
|
|
source = "./modules/network"
|
|
|
|
ip_range = var.network_ip_range
|
|
network_zone = var.network_zone
|
|
subnet_ip_range = var.subnet_ip_range
|
|
}
|
|
|
|
module "dev" {
|
|
source = "./modules/dev"
|
|
|
|
server_type = var.dev_server_type
|
|
image = var.server_image
|
|
location = var.location
|
|
ssh_key_ids = local.ssh_key_ids
|
|
network_id = module.network.id
|
|
private_ip = var.dev_private_ip
|
|
allowed_ssh_source_ips = local.vpn_ssh_source_ips
|
|
network_ip_range = var.network_ip_range
|
|
|
|
# module.network.id alone doesn't guarantee the subnet exists yet, and a server
|
|
# can't join a network before it has a subnet.
|
|
depends_on = [module.network]
|
|
}
|
|
|
|
module "prod" {
|
|
source = "./modules/prod"
|
|
|
|
server_type = var.prod_server_type
|
|
image = var.server_image
|
|
location = var.location
|
|
ssh_key_ids = local.ssh_key_ids
|
|
network_id = module.network.id
|
|
private_ip = var.prod_private_ip
|
|
allowed_ssh_source_ips = local.vpn_ssh_source_ips
|
|
network_ip_range = var.network_ip_range
|
|
|
|
depends_on = [module.network]
|
|
}
|
|
|
|
module "vpn" {
|
|
source = "./modules/vpn"
|
|
|
|
server_type = var.vpn_server_type
|
|
image = var.server_image
|
|
location = var.location
|
|
ssh_key_ids = local.ssh_key_ids
|
|
allowed_ssh_source_ips = var.allowed_ssh_source_ips
|
|
}
|
|
|
|
module "dns" {
|
|
source = "./modules/dns"
|
|
|
|
zone_names = var.dns_zones
|
|
records = local.dns_records
|
|
}
|