terraform: azure, google - usability improvements (#24)

clstokes · web-flow · commit 283d310c8603 · 2024-09-17T09:11:19.000-07:00
closes #22
diff --git a/terraform/aws/aws-ec2-autoscaling-dual-subnet/main.tf b/terraform/aws/aws-ec2-autoscaling-dual-subnet/main.tf
@@ -90,7 +90,7 @@ module "tailscale_aws_ec2_autoscaling" {
   tailscale_set_preferences = local.tailscale_set_preferences
 
   depends_on = [
-    module.vpc.natgw_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
+    module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
   ]
 }
 
diff --git a/terraform/aws/aws-ec2-autoscaling-session-recorder/main.tf b/terraform/aws/aws-ec2-autoscaling-session-recorder/main.tf
@@ -190,7 +190,7 @@ module "tailscale_aws_ec2_autoscaling" {
   ]
 
   depends_on = [
-    module.vpc.natgw_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
+    module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
   ]
 }
 
diff --git a/terraform/aws/aws-ec2-autoscaling/main.tf b/terraform/aws/aws-ec2-autoscaling/main.tf
@@ -78,7 +78,7 @@ module "tailscale_aws_ec2_autoscaling" {
   tailscale_set_preferences = local.tailscale_set_preferences
 
   depends_on = [
-    module.vpc.natgw_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
+    module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
   ]
 }
 
diff --git a/terraform/aws/aws-ec2-instance-dual-stack-ipv4-ipv6/main.tf b/terraform/aws/aws-ec2-instance-dual-stack-ipv4-ipv6/main.tf
@@ -68,7 +68,7 @@ module "tailscale_aws_ec2" {
   tailscale_set_preferences = local.tailscale_set_preferences
 
   depends_on = [
-    module.vpc.natgw_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
+    module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
   ]
 }
 
diff --git a/terraform/aws/aws-ec2-instance/main.tf b/terraform/aws/aws-ec2-instance/main.tf
@@ -65,7 +65,7 @@ module "tailscale_aws_ec2" {
   tailscale_set_preferences = local.tailscale_set_preferences
 
   depends_on = [
-    module.vpc.natgw_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
+    module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
   ]
 }
 
diff --git a/terraform/aws/internal-modules/aws-vpc/outputs.tf b/terraform/aws/internal-modules/aws-vpc/outputs.tf
@@ -25,9 +25,9 @@ output "nat_public_ips" {
   value = module.vpc.nat_public_ips
 }
 
-output "natgw_ids" {
+output "nat_ids" {
   description = "Useful for using within `depends_on` for other resources"
-  value       = module.vpc.natgw_ids
+  value       = module.vpc.nat_ids
 }
 
 output "public_route_table_ids" {
diff --git a/terraform/azure/azure-linux-vm/main.tf b/terraform/azure/azure-linux-vm/main.tf
@@ -1,24 +1,51 @@
 locals {
   name = "example-${basename(path.cwd)}"
 
-  tags = {
+  azure_tags = {
     Name = local.name
   }
+
+  tailscale_acl_tags = [
+    "tag:example-infra",
+    "tag:example-exitnode",
+    "tag:example-subnetrouter",
+    "tag:example-appconnector",
+  ]
+  tailscale_set_preferences = [
+    "--auto-update",
+    "--ssh",
+    "--advertise-connector",
+    "--advertise-exit-node",
+    "--advertise-routes=${join(",", coalescelist(
+      local.vpc_cidr_block,
+    ))}",
+  ]
+
+  // Modify these to use your own VPC
+  resource_group_name = azurerm_resource_group.main.name
+  location            = azurerm_resource_group.main.location
+
+  vpc_cidr_block            = module.vpc.vnet_address_space
+  vpc_id                    = module.vpc.vnet_id
+  subnet_id                 = module.vpc.public_subnet_id
+  network_security_group_id = azurerm_network_security_group.tailscale_ingress.id
+  instance_type             = "Standard_DS1_v2"
+  admin_public_key_path     = var.admin_public_key_path
 }
 
 resource "azurerm_resource_group" "main" {
   location = "centralus"
   name     = local.name
 }
 
-module "network" {
+module "vpc" {
   source = "../internal-modules/azure-network"
 
   name = local.name
-  tags = local.tags
+  tags = local.azure_tags
 
-  location            = azurerm_resource_group.main.location
-  resource_group_name = azurerm_resource_group.main.name
+  location            = local.location
+  resource_group_name = local.resource_group_name
 
   cidrs = ["10.0.0.0/22"]
   subnet_cidrs = [
@@ -39,40 +66,49 @@ resource "tailscale_tailnet_key" "main" {
   preauthorized       = true
   reusable            = true
   recreate_if_invalid = "always"
-  tags = [
-    "tag:example-infra",
-    "tag:example-exitnode",
-    "tag:example-subnetrouter",
-    "tag:example-appconnector",
-  ]
+  tags                = local.tailscale_acl_tags
 }
 
 module "tailscale_azure_linux_virtual_machine" {
   source = "../internal-modules/azure-linux-vm"
 
-  location            = azurerm_resource_group.main.location
-  resource_group_name = azurerm_resource_group.main.name
+  location            = local.location
+  resource_group_name = local.resource_group_name
 
   # public subnet
-  primary_subnet_id = module.network.public_subnet_id
+  primary_subnet_id         = local.subnet_id
+  network_security_group_id = local.network_security_group_id
 
   machine_name          = local.name
-  machine_size          = "Standard_DS1_v2"
-  admin_public_key_path = var.admin_public_key_path
-  resource_tags         = local.tags
+  machine_size          = local.instance_type
+  admin_public_key_path = local.admin_public_key_path
+  resource_tags         = local.azure_tags
 
   # Variables for Tailscale resources
-  tailscale_hostname = local.name
-  tailscale_auth_key = tailscale_tailnet_key.main.key
-  tailscale_set_preferences = [
-    "--auto-update",
-    "--ssh",
-    "--advertise-connector",
-    "--advertise-exit-node",
-    "--advertise-routes=${join(",", module.network.vnet_address_space)}",
-  ]
+  tailscale_hostname        = local.name
+  tailscale_auth_key        = tailscale_tailnet_key.main.key
+  tailscale_set_preferences = local.tailscale_set_preferences
 
   depends_on = [
-    module.network.natgw_ids, # for private subnets - ensure NAT gateway is available before instance provisioning
+    module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
   ]
 }
+
+resource "azurerm_network_security_group" "tailscale_ingress" {
+  location            = local.location
+  resource_group_name = local.resource_group_name
+
+  name = "nsg-tailscale-ingress"
+
+  security_rule {
+    name                       = "AllowTailscaleInbound"
+    access                     = "Allow"
+    direction                  = "Inbound"
+    priority                   = 100
+    protocol                   = "Udp"
+    source_address_prefix      = "Internet"
+    source_port_range          = "*"
+    destination_address_prefix = "*"
+    destination_port_range     = "41641"
+  }
+}
diff --git a/terraform/azure/azure-linux-vm/outputs.tf b/terraform/azure/azure-linux-vm/outputs.tf
@@ -1,20 +1,20 @@
 output "vpc_id" {
-  value = module.network.vnet_id
+  value = module.vpc.vnet_id
 }
 
 output "nat_public_ips" {
-  value = module.network.nat_public_ips
+  value = module.vpc.nat_public_ips
 }
 
 output "public_subnet_id" {
-  value = module.network.public_subnet_id
+  value = module.vpc.public_subnet_id
 }
 output "private_subnet_id" {
-  value = module.network.private_subnet_id
+  value = module.vpc.private_subnet_id
 }
 
 output "private_dns_resolver_inbound_endpoint_ip" {
-  value = module.network.private_dns_resolver_inbound_endpoint_ip
+  value = module.vpc.private_dns_resolver_inbound_endpoint_ip
 }
 output "internal_domain_name_suffix" {
   value = module.tailscale_azure_linux_virtual_machine.internal_domain_name_suffix
diff --git a/terraform/azure/internal-modules/azure-linux-vm/main.tf b/terraform/azure/internal-modules/azure-linux-vm/main.tf
@@ -28,26 +28,7 @@ resource "azurerm_network_interface" "primary" {
 
 resource "azurerm_network_interface_security_group_association" "tailscale" {
   network_interface_id      = azurerm_network_interface.primary.id
-  network_security_group_id = azurerm_network_security_group.tailscale_ingress.id
-}
-
-resource "azurerm_network_security_group" "tailscale_ingress" {
-  location            = var.location
-  resource_group_name = var.resource_group_name
-
-  name = "nsg-tailscale-ingress"
-
-  security_rule {
-    name                       = "AllowTailscaleInbound"
-    access                     = "Allow"
-    direction                  = "Inbound"
-    priority                   = 100
-    protocol                   = "Udp"
-    source_address_prefix      = "Internet"
-    source_port_range          = "*"
-    destination_address_prefix = "*"
-    destination_port_range     = "41641"
-  }
+  network_security_group_id = var.network_security_group_id
 }
 
 resource "azurerm_linux_virtual_machine" "tailscale_instance" {
diff --git a/terraform/azure/internal-modules/azure-linux-vm/variables.tf b/terraform/azure/internal-modules/azure-linux-vm/variables.tf
@@ -25,6 +25,10 @@ variable "primary_subnet_id" {
   description = "The primary subnet (typically PUBLIC) to assign to the virtual machine"
   type        = string
 }
+variable "network_security_group_id" {
+  description = "The network security group to assign to the virtual machine"
+  type        = string
+}
 variable "machine_size" {
   description = "The machine size to assign the virtual machine"
   type        = string
diff --git a/terraform/azure/internal-modules/azure-network/main.tf b/terraform/azure/internal-modules/azure-network/main.tf
@@ -1,4 +1,4 @@
-module "network" {
+module "vpc" {
   # https://registry.terraform.io/modules/Azure/network/azurerm/latest
   source  = "Azure/network/azurerm"
   version = ">= 5.0, < 6.0"
@@ -37,28 +37,28 @@ module "network" {
 data "azurerm_subnet" "public" {
   resource_group_name = var.resource_group_name
 
-  virtual_network_name = module.network.vnet_name
+  virtual_network_name = module.vpc.vnet_name
   name                 = var.subnet_name_public
 
-  depends_on = [module.network.vnet_subnets]
+  depends_on = [module.vpc.vnet_subnets]
 }
 
 data "azurerm_subnet" "private" {
   resource_group_name = var.resource_group_name
 
-  virtual_network_name = module.network.vnet_name
+  virtual_network_name = module.vpc.vnet_name
   name                 = var.subnet_name_private
 
-  depends_on = [module.network.vnet_subnets]
+  depends_on = [module.vpc.vnet_subnets]
 }
 
 data "azurerm_subnet" "dns-inbound" {
   resource_group_name = var.resource_group_name
 
-  virtual_network_name = module.network.vnet_name
+  virtual_network_name = module.vpc.vnet_name
   name                 = var.subnet_name_private_dns_resolver
 
-  depends_on = [module.network.vnet_subnets]
+  depends_on = [module.vpc.vnet_subnets]
 }
 #
 # Private DNS resolver resources
@@ -70,7 +70,7 @@ resource "azurerm_private_dns_resolver" "main" {
   name = var.name
   tags = var.tags
 
-  virtual_network_id = module.network.vnet_id
+  virtual_network_id = module.vpc.vnet_id
 }
 
 resource "azurerm_private_dns_resolver_inbound_endpoint" "main" {
diff --git a/terraform/azure/internal-modules/azure-network/outputs.tf b/terraform/azure/internal-modules/azure-network/outputs.tf
@@ -1,14 +1,14 @@
 output "vnet_id" {
-  value = module.network.vnet_id
+  value = module.vpc.vnet_id
 }
 output "vnet_name" {
-  value = module.network.vnet_name
+  value = module.vpc.vnet_name
 }
 output "vnet_address_space" {
-  value = module.network.vnet_address_space
+  value = module.vpc.vnet_address_space
 }
 output "vnet_subnets" {
-  value = module.network.vnet_subnets
+  value = module.vpc.vnet_subnets
 }
 
 output "public_subnet_id" {
@@ -40,7 +40,7 @@ output "nat_public_ips" {
   value = azurerm_public_ip.nat.*.ip_address
 }
 
-output "natgw_ids" {
+output "nat_ids" {
   description = "Useful for using within `depends_on` for other resources"
   value       = azurerm_nat_gateway.nat.*.id
 }
diff --git a/terraform/google/google-compute-instance/main.tf b/terraform/google/google-compute-instance/main.tf
diff --git a/terraform/google/internal-modules/google-compute-instance/main.tf b/terraform/google/internal-modules/google-compute-instance/main.tf

Original file line number	Diff line number	Diff line change
`@@ -90,7 +90,7 @@ module "tailscale_aws_ec2_autoscaling" {`
`90`	`90`	`tailscale_set_preferences = local.tailscale_set_preferences`
`91`	`91`
`92`	`92`	`depends_on = [`
`93`		`- module.vpc.natgw_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available`
	`93`	`+ module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available`
`94`	`94`	`]`
`95`	`95`	`}`
`96`	`96`
Original file line number	Diff line number	Diff line change
`@@ -190,7 +190,7 @@ module "tailscale_aws_ec2_autoscaling" {`
`190`	`190`	`]`
`191`	`191`
`192`	`192`	`depends_on = [`
`193`		`- module.vpc.natgw_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available`
	`193`	`+ module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available`
`194`	`194`	`]`
`195`	`195`	`}`
`196`	`196`
Original file line number	Diff line number	Diff line change
`@@ -78,7 +78,7 @@ module "tailscale_aws_ec2_autoscaling" {`
`78`	`78`	`tailscale_set_preferences = local.tailscale_set_preferences`
`79`	`79`
`80`	`80`	`depends_on = [`
`81`		`- module.vpc.natgw_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available`
	`81`	`+ module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available`
`82`	`82`	`]`
`83`	`83`	`}`
`84`	`84`
Original file line number	Diff line number	Diff line change
`@@ -68,7 +68,7 @@ module "tailscale_aws_ec2" {`
`68`	`68`	`tailscale_set_preferences = local.tailscale_set_preferences`
`69`	`69`
`70`	`70`	`depends_on = [`
`71`		`- module.vpc.natgw_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available`
	`71`	`+ module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available`
`72`	`72`	`]`
`73`	`73`	`}`
`74`	`74`
Original file line number	Diff line number	Diff line change
`@@ -65,7 +65,7 @@ module "tailscale_aws_ec2" {`
`65`	`65`	`tailscale_set_preferences = local.tailscale_set_preferences`
`66`	`66`
`67`	`67`	`depends_on = [`
`68`		`- module.vpc.natgw_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available`
	`68`	`+ module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available`
`69`	`69`	`]`
`70`	`70`	`}`
`71`	`71`
Original file line number	Diff line number	Diff line change
`@@ -25,9 +25,9 @@ output "nat_public_ips" {`
`25`	`25`	`value = module.vpc.nat_public_ips`
`26`	`26`	`}`
`27`	`27`
`28`		`-output "natgw_ids" {`
	`28`	`+output "nat_ids" {`
`29`	`29`	description = "Useful for using within `depends_on` for other resources"
`30`		`- value = module.vpc.natgw_ids`
	`30`	`+ value = module.vpc.nat_ids`
`31`	`31`	`}`
`32`	`32`
`33`	`33`	`output "public_route_table_ids" {`
Original file line number	Diff line number	Diff line change
`@@ -1,20 +1,20 @@`
`1`	`1`	`output "vpc_id" {`
`2`		`- value = module.network.vnet_id`
	`2`	`+ value = module.vpc.vnet_id`
`3`	`3`	`}`
`4`	`4`
`5`	`5`	`output "nat_public_ips" {`
`6`		`- value = module.network.nat_public_ips`
	`6`	`+ value = module.vpc.nat_public_ips`
`7`	`7`	`}`
`8`	`8`
`9`	`9`	`output "public_subnet_id" {`
`10`		`- value = module.network.public_subnet_id`
	`10`	`+ value = module.vpc.public_subnet_id`
`11`	`11`	`}`
`12`	`12`	`output "private_subnet_id" {`
`13`		`- value = module.network.private_subnet_id`
	`13`	`+ value = module.vpc.private_subnet_id`
`14`	`14`	`}`
`15`	`15`
`16`	`16`	`output "private_dns_resolver_inbound_endpoint_ip" {`
`17`		`- value = module.network.private_dns_resolver_inbound_endpoint_ip`
	`17`	`+ value = module.vpc.private_dns_resolver_inbound_endpoint_ip`
`18`	`18`	`}`
`19`	`19`	`output "internal_domain_name_suffix" {`
`20`	`20`	`value = module.tailscale_azure_linux_virtual_machine.internal_domain_name_suffix`