105 lines
2.6 KiB
Terraform
105 lines
2.6 KiB
Terraform
# vpn: OpenVPN + Traefik. Not attached to the private network (see docs/architecture.md).
|
|
resource "hcloud_firewall" "this" {
|
|
name = "vpn-firewall"
|
|
|
|
rule { # server ssh
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "22"
|
|
source_ips = var.allowed_ssh_source_ips
|
|
}
|
|
|
|
rule { # Traefik http/https (traefik.vpn.luke-else.co.uk)
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "80"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "443"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "1194"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
}
|
|
|
|
resource "hcloud_server" "this" {
|
|
name = "vpn"
|
|
server_type = var.server_type
|
|
image = var.image
|
|
location = var.location
|
|
ssh_keys = var.ssh_key_ids
|
|
firewall_ids = [hcloud_firewall.this.id]
|
|
|
|
connection {
|
|
type = "ssh"
|
|
host = self.ipv4_address
|
|
user = "root"
|
|
private_key = file(var.ssh_private_key_path)
|
|
}
|
|
|
|
provisioner "file" {
|
|
content = var.bootstrap_script
|
|
destination = "/root/bootstrap.sh"
|
|
}
|
|
|
|
provisioner "remote-exec" {
|
|
inline = [
|
|
"chmod +x /root/bootstrap.sh",
|
|
"/root/bootstrap.sh",
|
|
]
|
|
}
|
|
}
|
|
|
|
locals {
|
|
vpn_static_files = sort(fileset("${path.root}/../services/vpn", "**"))
|
|
|
|
vpn_static_files_hash = sha1(join("", [
|
|
for f in local.vpn_static_files : filesha1("${path.root}/../services/vpn/${f}")
|
|
]))
|
|
}
|
|
|
|
# Copies services/vpn to the server on every apply that changes it (a
|
|
# hand-edited compose file, ...) or recreates the server - not just once at
|
|
# first creation. Split from hcloud_server.this so it's triggered by content
|
|
# changes independently of the bootstrap provisioners above.
|
|
resource "null_resource" "deploy_services" {
|
|
triggers = {
|
|
server_id = hcloud_server.this.id
|
|
static_files = local.vpn_static_files_hash
|
|
}
|
|
|
|
connection {
|
|
type = "ssh"
|
|
host = hcloud_server.this.ipv4_address
|
|
user = "root"
|
|
private_key = file(var.ssh_private_key_path)
|
|
}
|
|
|
|
provisioner "remote-exec" {
|
|
inline = ["mkdir -p /home/${var.deploy_user}/services"]
|
|
}
|
|
|
|
provisioner "file" {
|
|
source = "${path.root}/../services/vpn"
|
|
destination = "/home/${var.deploy_user}/services"
|
|
}
|
|
|
|
provisioner "remote-exec" {
|
|
inline = [
|
|
"chown -R ${var.deploy_user}:${var.deploy_user} /home/${var.deploy_user}/services",
|
|
"chmod +x /home/${var.deploy_user}/services/vpn/*.sh",
|
|
]
|
|
}
|
|
|
|
depends_on = [hcloud_server.this]
|
|
}
|