rock
091ecdd7bb
Adds terraform/edge, a root module with two providers: - Cloudflare 5.28.1: CNAMEs to the existing tunnel, plus an opt-in resource that can take the tunnel ingress list over when manage_tunnel_config is true. It is off by default because that resource REPLACES the whole list, and the tunnel is remotely managed from the dashboard today. - Tencent Cloud 1.83.38: VPC, subnet, security group with three rules, key pair, one CVM relay with cloud-init (WireGuard listener, forwarding sysctls, Caddy), and DNSPod A records for the .cn hostnames. The design keeps the homelab inbound-free: the relay terminates TLS in China and forwards over a WireGuard tunnel the cluster dials outbound. Cloudflare keeps serving every existing hostname untouched. Verified: terraform init succeeds for both providers, fmt clean, validate reports 0 errors, and plan resolves to 10 creates with placeholder variables. Provider-side name validation caught a real bug during that run: key pair and security group names allow only letters, digits and underscore, so the derived names use underscores. Not applied. Credentials come from CLOUDFLARE_API_TOKEN, TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY; the WireGuard private key is TF_VAR only. State is local and git-ignored like terraform/zitadel. Blocked on facts this module cannot invent: the real .cn domain, whether it has an ICP filing, the CVM image ID, the operator CIDR, and the homelab WireGuard public key.
39 lines
2.1 KiB
Plaintext
39 lines
2.1 KiB
Plaintext
# Copy to terraform.tfvars.local (git-ignored) and fill in.
|
|
# Secrets never belong in a committed file: pass them as environment variables
|
|
# instead — TF_VAR_wireguard_relay_private_key, CLOUDFLARE_API_TOKEN,
|
|
# TENCENTCLOUD_SECRET_ID, TENCENTCLOUD_SECRET_KEY.
|
|
|
|
# ── Cloudflare (existing zone) ───────────────────────────────────────────────
|
|
cloudflare_zone_id = "REPLACE_WITH_ZONE_ID"
|
|
tunnel_id = "REPLACE_WITH_TUNNEL_UUID"
|
|
|
|
# Adopt existing records with `terraform import` before the first apply, or the
|
|
# create call collides with the hand-made record of the same name.
|
|
cloudflare_tunnel_hostnames = ["paperless", "img", "poimen"]
|
|
|
|
# Leave false until the tunnel config import is understood. True makes
|
|
# Terraform replace the entire ingress list with tunnel_ingress.
|
|
manage_tunnel_config = false
|
|
tunnel_ingress = {}
|
|
|
|
# ── China edge (Tencent Cloud) ───────────────────────────────────────────────
|
|
china_domain = "REPLACE.example.cn"
|
|
china_hostnames = ["paperless", "img"]
|
|
|
|
# Mainland regions require an ICP filing for the domain. Use ap-hongkong or
|
|
# ap-singapore when no filing exists.
|
|
tencent_region = "ap-guangzhou"
|
|
tencent_availability_zone = "ap-guangzhou-6"
|
|
relay_instance_type = "S5.SMALL2"
|
|
relay_image_id = "REPLACE_WITH_IMAGE_ID"
|
|
relay_ssh_public_key = "ssh-ed25519 AAAA... operator@laptop"
|
|
relay_admin_cidr = "REPLACE_WITH_OPERATOR_CIDR"
|
|
|
|
# ── WireGuard between the relay and the cluster ──────────────────────────────
|
|
# The relay private key comes from `wg genkey`. Keep it in the environment, or
|
|
# in a SOPS file mounted for the run. It is not written by this module.
|
|
wireguard_port = 51820
|
|
wireguard_homelab_public_key = "REPLACE_WITH_HOMELAB_WG_PUBKEY"
|
|
wireguard_relay_address = "10.88.0.1/24"
|
|
wireguard_homelab_address = "10.88.0.2/24"
|