Skip to content

Commit 49b0c46

Browse files
blakeneyopsblakeneyops
committed
Refactored for standardization
1 parent e3e8fe0 commit 49b0c46

File tree

4 files changed

+108
-124
lines changed

4 files changed

+108
-124
lines changed

‎certs/main.tf‎

Lines changed: 51 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,13 @@
1-
# openvpn_server
1+
# OpenVPN Server
22

3+
## Configures providers
34
provider "aws" {
45
region = "${var.region}"
56
}
67

7-
/* ---------------------------- */
8-
/* IAM Role & Instance Profile */
9-
/* ---------------------------- */
10-
8+
## Creates IAM role & policies
119
resource "aws_iam_role" "vpn_role" {
12-
name = "${var.region}-${var.stack_item_label}-vpn"
10+
name = "${var.stack_item_label}-${var.region}"
1311
path = "/"
1412

1513
assume_role_policy = <<EOF
@@ -42,8 +40,8 @@ resource "aws_iam_role_policy" "s3_vpn_ro" {
4240
"s3:Get*"
4341
],
4442
"Resource": [
45-
"arn:aws:s3:::${var.s3_path}",
46-
"arn:aws:s3:::${var.s3_path}/*"
43+
"arn:aws:s3:::${var.s3_bucket}/${var.s3_bucket_prefix}",
44+
"arn:aws:s3:::${var.s3_bucket}/${var.s3_bucket_prefix}/*"
4745
]
4846
},
4947
{
@@ -83,77 +81,56 @@ resource "aws_iam_role_policy" "tags" {
8381
EOF
8482
}
8583

84+
## Creates IAM instance profile
8685
resource "aws_iam_instance_profile" "vpn_profile" {
87-
name = "${var.region}-${var.stack_item_label}-vpn"
86+
name = "${var.stack_item_label}-${var.region}"
8887
roles = ["${aws_iam_role.vpn_role.name}"]
8988
}
9089

91-
/* ---------------------------- */
92-
/* Security Group */
93-
/* ---------------------------- */
90+
## Creates security group rules
9491
resource "aws_security_group_rule" "allow_all_out" {
95-
type = "egress"
96-
from_port = 0
97-
to_port = 0
98-
protocol = "-1"
99-
cidr_blocks = ["0.0.0.0/0"]
100-
101-
security_group_id = "${module.asg.sg_id}"
92+
type = "egress"
93+
from_port = 0
94+
to_port = 0
95+
protocol = "-1"
96+
cidr_blocks = ["0.0.0.0/0"]
97+
security_group_id = "${module.cluster.sg_id}"
10298
}
10399

104100
resource "aws_security_group_rule" "allow_ssh_in_tcp" {
105-
type = "ingress"
106-
from_port = 22
107-
to_port = 22
108-
protocol = "tcp"
109-
cidr_blocks = ["${split(",",var.cidr_whitelist)}"]
110-
111-
security_group_id = "${module.asg.sg_id}"
101+
type = "ingress"
102+
from_port = 22
103+
to_port = 22
104+
protocol = "tcp"
105+
cidr_blocks = ["${split(",",var.cidr_whitelist)}"]
106+
security_group_id = "${module.cluster.sg_id}"
112107
}
113108

114-
resource "aws_security_group_rule" "allow_openvpn_in_tdp" {
115-
type = "ingress"
116-
from_port = 1194
117-
to_port = 1194
118-
protocol = "tcp"
119-
cidr_blocks = ["${split(",",var.cidr_whitelist)}"]
120-
121-
security_group_id = "${module.asg.sg_id}"
122-
}
123-
124-
resource "aws_security_group_rule" "allow_ping_request_icmp" {
125-
type = "ingress"
126-
from_port = 8
127-
to_port = 0
128-
protocol = "icmp"
129-
cidr_blocks = ["0.0.0.0/0"]
130-
131-
security_group_id = "${module.asg.sg_id}"
109+
resource "aws_security_group_rule" "allow_openvpn_in_tcp" {
110+
type = "ingress"
111+
from_port = 1194
112+
to_port = 1194
113+
protocol = "tcp"
114+
cidr_blocks = ["${split(",",var.cidr_whitelist)}"]
115+
security_group_id = "${module.cluster.sg_id}"
132116
}
133117

134-
resource "aws_security_group_rule" "allow_ping_reply_icmp" {
135-
type = "ingress"
136-
from_port = 0
137-
to_port = 0
138-
protocol = "icmp"
139-
cidr_blocks = ["0.0.0.0/0"]
140-
141-
security_group_id = "${module.asg.sg_id}"
118+
resource "aws_security_group_rule" "allow_ping_in_icmp" {
119+
type = "ingress"
120+
from_port = 0
121+
to_port = 0
122+
protocol = "icmp"
123+
cidr_blocks = ["0.0.0.0/0"]
124+
security_group_id = "${module.cluster.sg_id}"
142125
}
143126

144-
/* ---------------------------- */
145-
/* User Data */
146-
/* ---------------------------- */
127+
## Creates instance user data
147128
resource "template_file" "user_data" {
148129
template = "${file("${path.module}/templates/user_data.tpl")}"
149130

150131
vars {
151-
instance_number = "${count.index}"
152-
hostname = "${var.role}-${count.index}"
153-
region = "${var.region}"
154-
stack_item_label = "${var.stack_item_label}"
155-
role = "${var.role}"
156-
s3_path = "${var.s3_path}"
132+
s3_bucket = "${var.s3_bucket}"
133+
s3_bucket_prefix = "${var.s3_bucket_prefix}"
157134
route_cidrs = "${var.route_cidrs}"
158135
}
159136

@@ -162,12 +139,13 @@ resource "template_file" "user_data" {
162139
}
163140
}
164141

165-
module "asg" {
142+
## Creates auto scaling cluster
143+
module "cluster" {
166144
source = "github.com/unifio/terraform-aws-asg?ref=v0.2.0//group"
167145

168146
# Resource tags
169-
stack_item_label = "${var.stack_item_label}-vpn-asg"
170-
stack_item_fullname = "${var.stack_item_fullname}-vpn"
147+
stack_item_label = "${var.stack_item_label}"
148+
stack_item_fullname = "${var.stack_item_fullname}"
171149

172150
# VPC parameters
173151
vpc_id = "${var.vpc_id}"
@@ -186,17 +164,16 @@ module "asg" {
186164
max_size = 2
187165
min_size = 1
188166
hc_grace_period = 300
189-
hc_check_type = "EC2"
190167
min_elb_capacity = 1
191168
load_balancers = "${aws_elb.elb.id}"
192169
}
193170

194-
# Create a new load balancer
171+
## Creates a load balancer
195172
resource "aws_elb" "elb" {
196-
name = "${var.stack_item_label}-vpn-elb"
173+
name = "${var.stack_item_label}"
197174
subnets = ["${split(",",var.subnets)}"]
198175
internal = false
199-
security_groups = ["${module.asg.sg_id}"]
176+
security_groups = ["${module.cluster.sg_id}"]
200177

201178
listener {
202179
instance_port = 1194
@@ -214,11 +191,12 @@ resource "aws_elb" "elb" {
214191
}
215192

216193
tags {
217-
Name = "${var.stack_item_label}-vpn-elb"
218-
application = "${var.stack_item_label}-vpn"
194+
Name = "${var.stack_item_label}"
195+
application = "${var.stack_item_fullname}"
219196
managed_by = "terraform"
220197
}
221-
}
222-
223-
# Create a Route53 record
224198

199+
lifecycle {
200+
create_before_destroy = true
201+
}
202+
}

‎certs/outputs.tf‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,7 @@
1-
# openvpn_server - Output Variables
1+
# Outputs
22

3-
/* ---------------------------- */
4-
## VPN server security group ID */
5-
/* ---------------------------- */
63
output "vpn_server_sg_id" {
7-
value = "${module.asg.sg_id}"
4+
value = "${module.cluster.sg_id}"
85
}
96

107
output "cidr_whitelist" {

‎certs/templates/user_data.tpl‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,6 @@
11
#cloud-config
2-
environment:
3-
stack_item_label: ${stack_item_label}
4-
hostname: ${hostname}
5-
aws_region: ${region}
6-
instance_role: ${role}
7-
instance_number: ${instance_number}
82
runcmd:
9-
- echo "OPENVPN_CERT_SOURCE=s3://${s3_path}" > /etc/openvpn/get-openvpn-certs.env
3+
- echo "OPENVPN_CERT_SOURCE=s3://${s3_bucket}/${s3_bucket_prefix}" > /etc/openvpn/get-openvpn-certs.env
104
- echo "push \"route $(ip route get 8.8.8.8| grep src| sed 's/.*src \(.*\)$/\1/g') 255.255.255.255 net_gateway\"" >> /etc/openvpn/server.conf
115
- echo "push \"route ${cidrhost(element(split(",",route_cidrs),1), 0)} ${cidrnetmask(element(split(",",route_cidrs),1))}\"" >> /etc/openvpn/server.conf
126
- echo "push \"route ${cidrhost(element(split(",",route_cidrs),2), 0)} ${cidrnetmask(element(split(",",route_cidrs),2))}\"" >> /etc/openvpn/server.conf

‎certs/variables.tf‎

Lines changed: 54 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,81 @@
1-
# openvpn_server - Variables
1+
# Input Variables
22

3-
variable "ami" {
4-
description = "Artifact AMI"
3+
## Resource tags
4+
variable "stack_item_label" {
5+
type = "string"
6+
description = "Short form identifier for this stack. This value is used to create the 'Name' resource tag for resources created by this stack item, and also serves as a unique key for re-use."
57
}
68

7-
variable "stack_item_fullname" {}
9+
variable "stack_item_fullname" {
10+
type = "string"
11+
description = "Long form descriptive name for this stack item. This value is used to create the 'application' resource tag for resources created by this stack item."
12+
}
813

9-
variable "stack_item_label" {}
14+
## VPC parameters
1015

11-
#
12-
# 0 - if instance is a standalone instance outside a VPC
13-
# 1 - if instance is in a vpc
14-
#
16+
###
17+
### 0 - if instance is a standalone instance outside a VPC
18+
### 1 - if instance is in a vpc
19+
###
1520
variable "in_vpc" {
16-
default = 0
21+
type = "string"
22+
description = "Flag for associating the cluster with a VPC."
23+
default = 1
1724
}
1825

1926
variable "vpc_id" {
20-
default = ""
27+
type = "string"
28+
description = "ID of the target VPC."
2129
}
2230

23-
variable "security_groups" {
24-
default = ""
31+
variable "region" {
32+
type = "string"
33+
description = "AWS region to be utilized."
2534
}
2635

27-
# Which subnet the vpn servers will run in.
2836
variable "subnets" {
29-
default = ""
37+
type = "string"
38+
description = "List of VPC subnets to associate with the cluster."
3039
}
3140

32-
# TODO: expects 4 subnets to map as internal network routes.
33-
# Fix the magic # problem
34-
variable "route_cidrs" {
35-
default = ""
41+
## OpenVPN parameters
42+
variable "ami" {
43+
type = "string"
44+
description = "Amazon Machine Image (AMI) to associate with the launch configuration."
3645
}
3746

38-
variable "key_name" {}
39-
40-
#
41-
# m3.medium - if instance is a standalone instance outside a VPC
42-
# t2.small - if instance is in a vpc
43-
#
44-
variable "instance_type" {}
45-
46-
variable "region" {}
47-
48-
variable "release" {
49-
default = "0.0.2"
47+
variable "instance_type" {
48+
type = "string"
49+
description = "EC2 instance type to associate with the launch configuration."
50+
default = "t2.small"
5051
}
5152

52-
variable "role" {
53-
default = "vpn_server"
53+
variable "key_name" {
54+
type = "string"
55+
description = "SSH key pair to associate with the launch configuration."
5456
}
5557

56-
# Do not include the trailing slash
57-
variable "s3_path" {}
58+
### TODO: expects 4 subnets to map as internal network routes.
59+
### Fix the magic # problem
60+
variable "route_cidrs" {
61+
type = "string"
62+
description = "Routes for the VPN server to expose"
63+
}
5864

59-
variable "s3_bucket" {}
65+
variable "s3_bucket" {
66+
type = "string"
67+
description = "The S3 bucket where certificate and configuration are stored."
68+
}
6069

61-
variable "sns_topic_arn" {}
70+
### Do not include the trailing slash
71+
variable "s3_bucket_prefix" {
72+
type = "string"
73+
description = "The S3 bucket prefix. Certificates and configuration will be sourced from the root if not configured."
74+
default = ""
75+
}
6276

63-
# From AWS limits, max rules for an SG is ~50
6477
variable "cidr_whitelist" {
65-
default = "0.0.0.0/0"
78+
type = "string"
79+
description = "Limit access to the designated list of CIDRs"
80+
default = "0.0.0.0/0"
6681
}

0 commit comments

Comments
 (0)