77 lines
2.7 KiB
Terraform
77 lines
2.7 KiB
Terraform
# Root module: wires together the shared network and the three host modules
|
|
# (one per server in docs/architecture.md). Each host module owns its own
|
|
# firewall (and volume, where applicable) - see modules/<host>/main.tf.
|
|
|
|
locals {
|
|
# SSH to dev/prod is only permitted from the vpn server's public IP: admins must
|
|
# tunnel through the VPN first, whose egress traffic is then sourced from this IP.
|
|
# vpn itself can't require tunneling through itself, so it keeps
|
|
# var.allowed_ssh_source_ips for direct SSH access.
|
|
vpn_ssh_source_ips = ["${module.vpn.ipv4}/32"]
|
|
|
|
# Rendered once and uploaded+run by every host module immediately after its
|
|
# server is created - see scripts/bootstrap.sh.tftpl.
|
|
bootstrap_script = templatefile("${path.module}/scripts/bootstrap.sh.tftpl", {
|
|
deploy_user = var.deploy_user
|
|
})
|
|
}
|
|
|
|
module "network" {
|
|
source = "./modules/network"
|
|
|
|
ip_range = var.network_ip_range
|
|
network_zone = var.network_zone
|
|
subnet_ip_range = var.subnet_ip_range
|
|
}
|
|
|
|
module "dev" {
|
|
source = "./modules/dev"
|
|
|
|
server_type = var.dev_server_type
|
|
image = var.server_image
|
|
location = var.location
|
|
ssh_key_id = data.hcloud_ssh_key.main.id
|
|
network_id = module.network.id
|
|
private_ip = var.dev_private_ip
|
|
volume_size = var.dev_volume_size
|
|
allowed_ssh_source_ips = local.vpn_ssh_source_ips
|
|
network_ip_range = var.network_ip_range
|
|
bootstrap_script = local.bootstrap_script
|
|
ssh_private_key_path = var.ssh_private_key_path
|
|
runner_count = var.dev_runner_count
|
|
|
|
# module.network.id alone doesn't guarantee the subnet exists yet, and a server
|
|
# can't join a network before it has a subnet.
|
|
depends_on = [module.network]
|
|
}
|
|
|
|
module "prod" {
|
|
source = "./modules/prod"
|
|
|
|
server_type = var.prod_server_type
|
|
image = var.server_image
|
|
location = var.location
|
|
ssh_key_id = data.hcloud_ssh_key.main.id
|
|
network_id = module.network.id
|
|
private_ip = var.prod_private_ip
|
|
volume_size = var.prod_volume_size
|
|
allowed_ssh_source_ips = local.vpn_ssh_source_ips
|
|
network_ip_range = var.network_ip_range
|
|
bootstrap_script = local.bootstrap_script
|
|
ssh_private_key_path = var.ssh_private_key_path
|
|
|
|
depends_on = [module.network]
|
|
}
|
|
|
|
module "vpn" {
|
|
source = "./modules/vpn"
|
|
|
|
server_type = var.vpn_server_type
|
|
image = var.server_image
|
|
location = var.location
|
|
ssh_key_id = data.hcloud_ssh_key.main.id
|
|
allowed_ssh_source_ips = var.allowed_ssh_source_ips
|
|
bootstrap_script = local.bootstrap_script
|
|
ssh_private_key_path = var.ssh_private_key_path
|
|
}
|