41 lines
1.6 KiB
Terraform
41 lines
1.6 KiB
Terraform
|
output "cloudflare_records" {
|
||
|
|
description = "Hostnames now managed in the Cloudflare zone."
|
||
|
|
value = sort(keys(cloudflare_dns_record.tunnel))
|
||
|
|
}
|
||
|
|
|
||
|
|
output "tunnel_config_managed" {
|
||
|
|
description = "Whether Terraform owns the tunnel ingress list. False means the dashboard still does."
|
||
|
|
value = var.manage_tunnel_config
|
||
|
|
}
|
||
|
|
|
||
|
|
output "relay_public_ip" {
|
||
|
|
description = "Public address of the Tencent relay. Point the .cn DNS at it, or let the module do it."
|
||
|
|
value = tencentcloud_instance.relay.public_ip
|
||
|
|
}
|
||
|
|
|
||
|
|
output "china_hostnames" {
|
||
|
|
description = "Fully qualified China hostnames served by the relay."
|
||
|
|
value = [for host in var.china_hostnames : "${host}.${var.china_domain}"]
|
||
|
|
}
|
||
|
|
|
||
|
|
output "wireguard_peer" {
|
||
|
|
description = "Peer stanza for the homelab side. Add it to the cluster's wg0.conf; the relay already trusts this public key."
|
||
|
|
value = <<-EOT
|
||
|
|
[Peer]
|
||
|
|
PublicKey = <relay public key; see /etc/wireguard/wg0.conf on the relay>
|
||
|
|
Endpoint = ${tencentcloud_instance.relay.public_ip}:${var.wireguard_port}
|
||
|
|
AllowedIPs = ${var.wireguard_relay_address}
|
||
|
|
PersistentKeepalive = 25
|
||
|
|
EOT
|
||
|
|
}
|
||
|
|
|
||
|
|
output "next_manual_steps" {
|
||
|
|
description = "What this module cannot do for you."
|
||
|
|
value = [
|
||
|
|
"Confirm the ICP filing for ${var.china_domain} if the relay is in a mainland region.",
|
||
|
|
"Issue a certificate for the China hostnames on the relay (Caddy ACME needs the DNS-01 challenge for a .cn domain).",
|
||
|
|
"Run a WireGuard peer in the cluster that dials ${tencentcloud_instance.relay.public_ip}:${var.wireguard_port}.",
|
||
|
|
"Add the .cn origins to the OIDC client redirect URIs before any China user logs in.",
|
||
|
|
]
|
||
|
|
}
|