156 lines
3.3 KiB
Terraform
156 lines
3.3 KiB
Terraform
# Port sources: services/*/docker-compose.yml (published ports) and services/todo.md
|
|
# (the documented UFW allow-list). dev has no firewall in architecture.md, but we add
|
|
# one anyway for baseline safety - see conversation history.
|
|
|
|
resource "hcloud_firewall" "dev" {
|
|
name = "dev-firewall"
|
|
|
|
rule { # server ssh
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "22"
|
|
source_ips = var.allowed_ssh_source_ips
|
|
}
|
|
|
|
rule { # gitea ssh (git.luke-else.co.uk, published as 222:22)
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "222"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule { # TraefikRunner http/https (git.luke-else.co.uk, cicd.luke-else.co.uk)
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "80"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "443"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule { # traffic from prod over the private network
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "1-65535"
|
|
source_ips = [var.network_ip_range]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "1-65535"
|
|
source_ips = [var.network_ip_range]
|
|
}
|
|
}
|
|
|
|
resource "hcloud_firewall" "prod" {
|
|
name = "prod-firewall"
|
|
|
|
rule { # server ssh
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "22"
|
|
source_ips = var.allowed_ssh_source_ips
|
|
}
|
|
|
|
rule { # Traefik http/https (Websites, Bitwarden, Misc, Tracking)
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "80"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "443"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule { # rustdesk hbbs
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "21115"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "21116"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "21116"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule { # rustdesk hbbr
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "21117"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "21119"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule { # traffic from dev over the private network
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "1-65535"
|
|
source_ips = [var.network_ip_range]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "1-65535"
|
|
source_ips = [var.network_ip_range]
|
|
}
|
|
}
|
|
|
|
resource "hcloud_firewall" "vpn" {
|
|
name = "vpn-firewall"
|
|
|
|
rule { # server ssh
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "22"
|
|
source_ips = var.allowed_ssh_source_ips
|
|
}
|
|
|
|
rule { # TraefikVPN http/https (traefik.vpn.luke-else.co.uk)
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "80"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "443"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "1194"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
}
|