OpenVPN with Docker and Terraform

In short this package launches an OpenVPN stack in "the cloud" using Terraform.io.

More specifically, this package;

Creates a Digital Ocean Droplet.
Deploys Docker on the Droplet using docker-machine.
Installs docker-compose on the Droplet.
Uploads several container configs and a docker-compose.yml file.
Launches a full OpenVPN, FreeRadius, MySQL stack.
Creates a Digital Ocean Firewall to secure the Droplet.
Registers the Droplet's name in AWS Route53.

At this time this package is highly customized for my own use. If any interest is shown I may attempt to make it more generalized to support other cloud providers, containers, configurations etc. At a minimum this serves as a working example of integrating Docker with Terraform.

Prerequisites

There are many. I will continue to improve this list and add detail as time permits.

Accounts and API Keys
- AWS (Route53)
- Digital Ocean
- Docker Hub
Software
- Terraform
- Docker
- Docker Compose
- Docker Machine
Other Stuff
- Secrets
- Container Prerequisites

Secrets

The following required variables can be stored in a secret.auto.tfvars file in the root directory.

# Terraform Digital Ocean API Key
variable "do_token" {}

# Digital Ocean SSH Keys
variable "do_ssh_keys" {}

# AWS API credentials
variable "aws_access_key" {}
variable "aws_secret_key" {}

# CloudInit Variables
variable "user_name" {}
variable "user_passwd" {}
variable "ssh_authorized-key" {}

Production variables for Docker Containers should also be stored here to override the defaults provided in 'docker-vars.tf'

Container Prerequisites

The OpenVPN and FreeRadius containers used by this package are maintained by me and are publicly available. Please see each containers documentation for prerequisites and dependencies.

docker-ovpn - https://hub.docker.com/r/2stacks/docker-ovpn/
freeradius - https://hub.docker.com/r/2stacks/freeradius/
mysql - https://hub.docker.com/_/mysql/

This package is known not to work with MySQL version 8.x due to a change in the Preferred Authentication Plugin from previous versions.

Run this example using:

terraform init
terraform plan
terraform apply

Support for Terraform Workspaces

This allows creating a parallel development server for testing updates and changes.

git branch dev
terraform workspace new dev
terraform workspace select dev
terraform init -upgrade
terraform plan
terraform apply

Note: this will create an additional server whose host name is tagged with 'dev'

To Do

Use secrets management instead of ENV Variables
Use local-exec call to docker-compose instead of remote-exec

FAQ

Why execute docker-compose with remote-exec?
- When I first developed this there was a bug in Terraform that prevented passing ENV variables to local-exec. Now that it has been resolved I need to update main.tf to pass docker-machine connection variables to local-exec prior to local-exec call docker-compose.
Why use docker-machine and docker-compose instead of the native Terraform Docker provider? Seems rather janky.
- Terraform doesn't support updating the Docker Provider during execution so there's no good way to use native Docker support with a remote server that hasn't been created yet. Since I'm already using docker-machine to install Docker on the newly created resources it just made sense.

2stacks/terraform-openvpn

ErrorLooks like something went wrong!

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Languages

Error
Looks like something went wrong!

Packages