88 lines
1.9 KiB
HCL
88 lines
1.9 KiB
HCL
resource "hcloud_network" "network" {
|
|
name = "proxy-network"
|
|
ip_range = local.network_cidr
|
|
}
|
|
|
|
resource "hcloud_network_subnet" "subnet" {
|
|
type = "cloud"
|
|
network_id = hcloud_network.network.id
|
|
network_zone = "eu-central"
|
|
ip_range = local.subnet_cidr
|
|
}
|
|
|
|
/* -------------------------------------------------------------------------- */
|
|
|
|
resource "hcloud_primary_ip" "public_ip" {
|
|
name = "proxy-public-ip"
|
|
datacenter = local.datacenter
|
|
type = "ipv4"
|
|
assignee_type = "server"
|
|
auto_delete = false
|
|
}
|
|
|
|
resource "hcloud_ssh_key" "ssh_key" {
|
|
name = "proxy-ssh-key"
|
|
public_key = file(var.public_ssh_key_path)
|
|
}
|
|
|
|
resource "hcloud_server" "server_instance" {
|
|
name = "proxy-server"
|
|
image = local.server_image
|
|
server_type = local.server_type
|
|
datacenter = local.datacenter
|
|
ssh_keys = [hcloud_ssh_key.ssh_key.id]
|
|
|
|
public_net {
|
|
ipv4_enabled = true
|
|
ipv4 = hcloud_primary_ip.public_ip.id
|
|
ipv6_enabled = false
|
|
}
|
|
|
|
network {
|
|
network_id = hcloud_network.network.id
|
|
ip = local.proxy_ip
|
|
alias_ips = [ ]
|
|
}
|
|
|
|
depends_on = [ hcloud_network_subnet.subnet ]
|
|
}
|
|
|
|
resource "hcloud_firewall" "server_firewall" {
|
|
name = "proxy-server-firewall"
|
|
|
|
# Allow ICMP.
|
|
rule {
|
|
direction = "in"
|
|
protocol = "icmp"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
# Allow all out.
|
|
rule {
|
|
direction = "out"
|
|
protocol = "tcp"
|
|
port = "any"
|
|
destination_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
|
|
# Allow ingress for in-network.
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
source_ips = [local.network_cidr]
|
|
}
|
|
|
|
# Poke holes for SSH.
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "22"
|
|
source_ips = ["0.0.0.0/0", "::/0"]
|
|
}
|
|
}
|
|
|
|
resource "hcloud_firewall_attachment" "server_fw_attachment" {
|
|
firewall_id = hcloud_firewall.server_firewall.id
|
|
server_ids = [hcloud_server.server_instance.id]
|
|
}
|