48 lines
1.5 KiB
Terraform
48 lines
1.5 KiB
Terraform
|
# terraform/edge — the China-facing edge, plus DNS ownership for the existing zone
|
||
|
|
#
|
||
|
|
# Purpose: give users in mainland China a short, stable path to the homelab
|
||
|
|
# without touching the Cloudflare path that serves everyone else.
|
||
|
|
#
|
||
|
|
# China user -> <service>.<china_domain> -> Tencent CVM (this module)
|
||
|
|
# -> WireGuard tunnel -> ingress-nginx (192.168.1.160) -> service
|
||
|
|
#
|
||
|
|
# Everyone else -> Cloudflare -> cloudflared tunnel -> same ingress (unchanged)
|
||
|
|
#
|
||
|
|
# The homelab still opens no inbound port: the tunnel is established outbound
|
||
|
|
# from the cluster to the CVM.
|
||
|
|
#
|
||
|
|
# Credentials come from the environment, never from a file in git:
|
||
|
|
# export CLOUDFLARE_API_TOKEN=...
|
||
|
|
# export TENCENTCLOUD_SECRET_ID=...
|
||
|
|
# export TENCENTCLOUD_SECRET_KEY=...
|
||
|
|
# terraform -chdir=terraform/edge init
|
||
|
|
# terraform -chdir=terraform/edge plan -var china_domain=example.cn ...
|
||
|
|
#
|
||
|
|
# State is local and git-ignored, same as terraform/zitadel. It carries no
|
||
|
|
# credential today, but it will once InstanceData or certificates are added, so
|
||
|
|
# treat it as a secret and move it to MinIO before a second operator applies.
|
||
|
|
terraform {
|
||
|
|
required_version = ">= 1.6.0"
|
||
|
|
|
||
|
|
required_providers {
|
||
|
|
cloudflare = {
|
||
|
|
source = "cloudflare/cloudflare"
|
||
|
|
version = "5.28.1"
|
||
|
|
}
|
||
|
|
tencentcloud = {
|
||
|
|
source = "tencentcloudstack/tencentcloud"
|
||
|
|
version = "1.83.38"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
provider "cloudflare" {
|
||
|
|
api_token = var.cloudflare_api_token
|
||
|
|
}
|
||
|
|
|
||
|
|
provider "tencentcloud" {
|
||
|
|
secret_id = var.tencent_secret_id
|
||
|
|
secret_key = var.tencent_secret_key
|
||
|
|
region = var.tencent_region
|
||
|
|
}
|