ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
177
terraform/external/oci-relay/security.tf
vendored
Normal file
177
terraform/external/oci-relay/security.tf
vendored
Normal file
|
|
@ -0,0 +1,177 @@
|
|||
resource "oci_core_network_security_group_security_rule" "web" {
|
||||
for_each = toset(["80", "443"])
|
||||
|
||||
network_security_group_id = oci_core_network_security_group.relay.id
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
source = "0.0.0.0/0"
|
||||
source_type = "CIDR_BLOCK"
|
||||
stateless = false
|
||||
description = "Public L4 relay TCP ${each.value}"
|
||||
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
min = tonumber(each.value)
|
||||
max = tonumber(each.value)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
locals {
|
||||
mail_ingress_source_cidrs_by_port = {
|
||||
"25" = var.smtp_ingress_source_cidrs
|
||||
"465" = var.submissions_ingress_source_cidrs
|
||||
"993" = var.imaps_ingress_source_cidrs
|
||||
}
|
||||
mail_health_checks_by_port = {
|
||||
"25" = var.smtp_health_check_enabled
|
||||
"465" = var.submissions_health_check_enabled
|
||||
"993" = var.imaps_health_check_enabled
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "mail" {
|
||||
for_each = merge([
|
||||
for port, source_cidrs in local.mail_ingress_source_cidrs_by_port : {
|
||||
for source in source_cidrs : "${source}:${port}" => {
|
||||
source = source
|
||||
port = tonumber(port)
|
||||
}
|
||||
}
|
||||
]...)
|
||||
|
||||
network_security_group_id = oci_core_network_security_group.relay.id
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
source = each.value.source
|
||||
source_type = "CIDR_BLOCK"
|
||||
stateless = false
|
||||
description = "Mail relay TCP ${each.value.port} from ${each.value.source}"
|
||||
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
min = each.value.port
|
||||
max = each.value.port
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "mail_monitoring" {
|
||||
for_each = merge([
|
||||
for port, enabled in local.mail_health_checks_by_port : {
|
||||
for source in enabled ? toset([
|
||||
for address in var.monitoring_source_ipv4 : "${address}/32"
|
||||
if !anytrue([
|
||||
for source_cidr in local.mail_ingress_source_cidrs_by_port[port] : cidrcontains(source_cidr, address)
|
||||
])
|
||||
]) : toset([]) : "${source}:${port}" => {
|
||||
source = source
|
||||
port = tonumber(port)
|
||||
}
|
||||
}
|
||||
]...)
|
||||
|
||||
network_security_group_id = oci_core_network_security_group.relay.id
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
source = each.value.source
|
||||
source_type = "CIDR_BLOCK"
|
||||
stateless = false
|
||||
description = "Mail health TCP ${each.value.port} from ${each.value.source}"
|
||||
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
min = each.value.port
|
||||
max = each.value.port
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "wireguard" {
|
||||
network_security_group_id = oci_core_network_security_group.relay.id
|
||||
direction = "INGRESS"
|
||||
protocol = "17"
|
||||
source = "0.0.0.0/0"
|
||||
source_type = "CIDR_BLOCK"
|
||||
stateless = false
|
||||
description = "Home WireGuard peer"
|
||||
|
||||
udp_options {
|
||||
destination_port_range {
|
||||
min = var.wireguard_listen_port
|
||||
max = var.wireguard_listen_port
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [source]
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "icmp_fragmentation" {
|
||||
network_security_group_id = oci_core_network_security_group.relay.id
|
||||
direction = "INGRESS"
|
||||
protocol = "1"
|
||||
source = "0.0.0.0/0"
|
||||
source_type = "CIDR_BLOCK"
|
||||
stateless = false
|
||||
description = "IPv4 path MTU discovery"
|
||||
|
||||
icmp_options {
|
||||
type = 3
|
||||
code = 4
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "egress" {
|
||||
network_security_group_id = oci_core_network_security_group.relay.id
|
||||
direction = "EGRESS"
|
||||
protocol = "all"
|
||||
destination = "0.0.0.0/0"
|
||||
destination_type = "CIDR_BLOCK"
|
||||
stateless = false
|
||||
description = "Relay egress"
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group" "image_builder" {
|
||||
compartment_id = local.compartment_id
|
||||
vcn_id = oci_core_vcn.relay.id
|
||||
display_name = "oci-l4-relay-image-builder"
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "image_builder_ssh" {
|
||||
count = var.image_builder_ssh_source_cidr == null ? 0 : 1
|
||||
|
||||
network_security_group_id = oci_core_network_security_group.image_builder.id
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
source = var.image_builder_ssh_source_cidr
|
||||
source_type = "CIDR_BLOCK"
|
||||
stateless = false
|
||||
description = "Operator SSH to temporary image builders"
|
||||
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
min = 22
|
||||
max = 22
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
precondition {
|
||||
condition = var.image_builder_ssh_source_cidr != null
|
||||
error_message = "image_builder_ssh_source_cidr must be an IPv4 /32 for image builds."
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "image_builder_egress" {
|
||||
network_security_group_id = oci_core_network_security_group.image_builder.id
|
||||
direction = "EGRESS"
|
||||
protocol = "all"
|
||||
destination = "0.0.0.0/0"
|
||||
destination_type = "CIDR_BLOCK"
|
||||
stateless = false
|
||||
description = "Temporary image-builder egress"
|
||||
}
|
||||
Loading…
Reference in a new issue