quorate/terraform/external/oci-relay/security.tf

resource "oci_core_network_security_group_security_rule" "web" {
  for_each = toset(["80", "443"])

  network_security_group_id = oci_core_network_security_group.relay.id
  direction                 = "INGRESS"
  protocol                  = "6"
  source                    = "0.0.0.0/0"
  source_type               = "CIDR_BLOCK"
  stateless                 = false
  description               = "Public L4 relay TCP ${each.value}"

  tcp_options {
    destination_port_range {
      min = tonumber(each.value)
      max = tonumber(each.value)
    }
  }
}

locals {
  mail_ingress_source_cidrs_by_port = {
    "25"  = var.smtp_ingress_source_cidrs
    "465" = var.submissions_ingress_source_cidrs
    "993" = var.imaps_ingress_source_cidrs
  }
  mail_health_checks_by_port = {
    "25"  = var.smtp_health_check_enabled
    "465" = var.submissions_health_check_enabled
    "993" = var.imaps_health_check_enabled
  }
}

resource "oci_core_network_security_group_security_rule" "mail" {
  for_each = merge([
    for port, source_cidrs in local.mail_ingress_source_cidrs_by_port : {
      for source in source_cidrs : "${source}:${port}" => {
        source = source
        port   = tonumber(port)
      }
    }
  ]...)

  network_security_group_id = oci_core_network_security_group.relay.id
  direction                 = "INGRESS"
  protocol                  = "6"
  source                    = each.value.source
  source_type               = "CIDR_BLOCK"
  stateless                 = false
  description               = "Mail relay TCP ${each.value.port} from ${each.value.source}"

  tcp_options {
    destination_port_range {
      min = each.value.port
      max = each.value.port
    }
  }
}

resource "oci_core_network_security_group_security_rule" "mail_monitoring" {
  for_each = merge([
    for port, enabled in local.mail_health_checks_by_port : {
      for source in enabled ? toset([
        for address in var.monitoring_source_ipv4 : "${address}/32"
        if !anytrue([
          for source_cidr in local.mail_ingress_source_cidrs_by_port[port] : cidrcontains(source_cidr, address)
        ])
        ]) : toset([]) : "${source}:${port}" => {
        source = source
        port   = tonumber(port)
      }
    }
  ]...)

  network_security_group_id = oci_core_network_security_group.relay.id
  direction                 = "INGRESS"
  protocol                  = "6"
  source                    = each.value.source
  source_type               = "CIDR_BLOCK"
  stateless                 = false
  description               = "Mail health TCP ${each.value.port} from ${each.value.source}"

  tcp_options {
    destination_port_range {
      min = each.value.port
      max = each.value.port
    }
  }
}

resource "oci_core_network_security_group_security_rule" "wireguard" {
  network_security_group_id = oci_core_network_security_group.relay.id
  direction                 = "INGRESS"
  protocol                  = "17"
  source                    = "0.0.0.0/0"
  source_type               = "CIDR_BLOCK"
  stateless                 = false
  description               = "Home WireGuard peer"

  udp_options {
    destination_port_range {
      min = var.wireguard_listen_port
      max = var.wireguard_listen_port
    }
  }

  lifecycle {
    ignore_changes = [source]
  }
}

resource "oci_core_network_security_group_security_rule" "icmp_fragmentation" {
  network_security_group_id = oci_core_network_security_group.relay.id
  direction                 = "INGRESS"
  protocol                  = "1"
  source                    = "0.0.0.0/0"
  source_type               = "CIDR_BLOCK"
  stateless                 = false
  description               = "IPv4 path MTU discovery"

  icmp_options {
    type = 3
    code = 4
  }
}

resource "oci_core_network_security_group_security_rule" "egress" {
  network_security_group_id = oci_core_network_security_group.relay.id
  direction                 = "EGRESS"
  protocol                  = "all"
  destination               = "0.0.0.0/0"
  destination_type          = "CIDR_BLOCK"
  stateless                 = false
  description               = "Relay egress"
}

resource "oci_core_network_security_group" "image_builder" {
  compartment_id = local.compartment_id
  vcn_id         = oci_core_vcn.relay.id
  display_name   = "oci-l4-relay-image-builder"
  freeform_tags  = var.freeform_tags
}

resource "oci_core_network_security_group_security_rule" "image_builder_ssh" {
  count = var.image_builder_ssh_source_cidr == null ? 0 : 1

  network_security_group_id = oci_core_network_security_group.image_builder.id
  direction                 = "INGRESS"
  protocol                  = "6"
  source                    = var.image_builder_ssh_source_cidr
  source_type               = "CIDR_BLOCK"
  stateless                 = false
  description               = "Operator SSH to temporary image builders"

  tcp_options {
    destination_port_range {
      min = 22
      max = 22
    }
  }

  lifecycle {
    precondition {
      condition     = var.image_builder_ssh_source_cidr != null
      error_message = "image_builder_ssh_source_cidr must be an IPv4 /32 for image builds."
    }
  }
}

resource "oci_core_network_security_group_security_rule" "image_builder_egress" {
  network_security_group_id = oci_core_network_security_group.image_builder.id
  direction                 = "EGRESS"
  protocol                  = "all"
  destination               = "0.0.0.0/0"
  destination_type          = "CIDR_BLOCK"
  stateless                 = false
  description               = "Temporary image-builder egress"
}