cortex/deploy/terraform/main.tf at main · CortexLM/cortex · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
locals {
  base_tags = distinct(concat(
    [
      var.project_name,
      "managed-by:terraform",
      "cost-center:base",
    ],
    var.tags,
  ))

  # Normalize operator sources to CIDR form for the firewall API.
  operator_ssh_sources = [
    for c in var.operator_ipv4_cidrs :
    can(regex("/", c)) ? c : "${c}/32"
  ]
}

resource "digitalocean_droplet" "host" {
  for_each = var.environments

  name   = each.value.name
  region = var.region
  size   = var.droplet_size
  image  = var.image

  ssh_keys = var.ssh_key_ids

  # Monitoring + IPv6; private networking helps later VPC work.
  monitoring = true
  ipv6       = true
  vpc_uuid   = null

  tags = distinct(concat(local.base_tags, [
    "env:${each.key}",
    "role:base-host",
  ]))

  user_data = templatefile("${path.module}/cloud-init.yaml.tftpl", {
    env_name = each.key
  })

  lifecycle {
    ignore_changes = [
      # Avoid recreate if DO rewrites user_data whitespace on read-back.
      user_data,
    ]
  }
}

resource "digitalocean_firewall" "base" {
  name = "${var.project_name}-hosts"

  droplet_ids = [for d in digitalocean_droplet.host : d.id]

  tags = local.base_tags

  # SSH: operator IP only (never 0.0.0.0/0).
  inbound_rule {
    protocol         = "tcp"
    port_range       = "22"
    source_addresses = local.operator_ssh_sources
  }

  # HTTP / HTTPS open to the world (TLS terminates on-box later).
  inbound_rule {
    protocol         = "tcp"
    port_range       = "80"
    source_addresses = ["0.0.0.0/0", "::/0"]
  }

  inbound_rule {
    protocol         = "tcp"
    port_range       = "443"
    source_addresses = ["0.0.0.0/0", "::/0"]
  }

  # Control-plane private VPC: gateway:8080 between staging master and validators.
  inbound_rule {
    protocol         = "tcp"
    port_range       = "8080"
    source_addresses = ["10.116.0.0/20"]
  }

  # ICMP for diagnostics.
  inbound_rule {
    protocol         = "icmp"
    source_addresses = ["0.0.0.0/0", "::/0"]
  }

  outbound_rule {
    protocol              = "tcp"
    port_range            = "1-65535"
    destination_addresses = ["0.0.0.0/0", "::/0"]
  }

  outbound_rule {
    protocol              = "udp"
    port_range            = "1-65535"
    destination_addresses = ["0.0.0.0/0", "::/0"]
  }

  outbound_rule {
    protocol              = "icmp"
    destination_addresses = ["0.0.0.0/0", "::/0"]
  }
}