39 lines
2.1 KiB
Plaintext
39 lines
2.1 KiB
Plaintext
|
# Copy to terraform.tfvars.local (git-ignored) and fill in.
|
||
|
|
# Secrets never belong in a committed file: pass them as environment variables
|
||
|
|
# instead — TF_VAR_wireguard_relay_private_key, CLOUDFLARE_API_TOKEN,
|
||
|
|
# TENCENTCLOUD_SECRET_ID, TENCENTCLOUD_SECRET_KEY.
|
||
|
|
|
||
|
|
# ── Cloudflare (existing zone) ───────────────────────────────────────────────
|
||
|
|
cloudflare_zone_id = "REPLACE_WITH_ZONE_ID"
|
||
|
|
tunnel_id = "REPLACE_WITH_TUNNEL_UUID"
|
||
|
|
|
||
|
|
# Adopt existing records with `terraform import` before the first apply, or the
|
||
|
|
# create call collides with the hand-made record of the same name.
|
||
|
|
cloudflare_tunnel_hostnames = ["paperless", "img", "poimen"]
|
||
|
|
|
||
|
|
# Leave false until the tunnel config import is understood. True makes
|
||
|
|
# Terraform replace the entire ingress list with tunnel_ingress.
|
||
|
|
manage_tunnel_config = false
|
||
|
|
tunnel_ingress = {}
|
||
|
|
|
||
|
|
# ── China edge (Tencent Cloud) ───────────────────────────────────────────────
|
||
|
|
china_domain = "REPLACE.example.cn"
|
||
|
|
china_hostnames = ["paperless", "img"]
|
||
|
|
|
||
|
|
# Mainland regions require an ICP filing for the domain. Use ap-hongkong or
|
||
|
|
# ap-singapore when no filing exists.
|
||
|
|
tencent_region = "ap-guangzhou"
|
||
|
|
tencent_availability_zone = "ap-guangzhou-6"
|
||
|
|
relay_instance_type = "S5.SMALL2"
|
||
|
|
relay_image_id = "REPLACE_WITH_IMAGE_ID"
|
||
|
|
relay_ssh_public_key = "ssh-ed25519 AAAA... operator@laptop"
|
||
|
|
relay_admin_cidr = "REPLACE_WITH_OPERATOR_CIDR"
|
||
|
|
|
||
|
|
# ── WireGuard between the relay and the cluster ──────────────────────────────
|
||
|
|
# The relay private key comes from `wg genkey`. Keep it in the environment, or
|
||
|
|
# in a SOPS file mounted for the run. It is not written by this module.
|
||
|
|
wireguard_port = 51820
|
||
|
|
wireguard_homelab_public_key = "REPLACE_WITH_HOMELAB_WG_PUBKEY"
|
||
|
|
wireguard_relay_address = "10.88.0.1/24"
|
||
|
|
wireguard_homelab_address = "10.88.0.2/24"
|