266 lines
15 KiB
HCL
266 lines
15 KiB
HCL
resource "oci_core_instance" "relay" {
|
|
availability_domain = data.oci_identity_availability_domains.available.availability_domains[var.availability_domain_index].name
|
|
compartment_id = local.compartment_id
|
|
display_name = "oci-l4-relay"
|
|
shape = var.shape
|
|
freeform_tags = var.freeform_tags
|
|
defined_tags = {
|
|
"${oci_identity_tag_namespace.relay.name}.${oci_identity_tag.address_list_reader.name}" = "enabled"
|
|
"${oci_identity_tag_namespace.relay.name}.${oci_identity_tag.instance_principal.name}" = "enabled"
|
|
}
|
|
|
|
agent_config {
|
|
are_all_plugins_disabled = false
|
|
is_management_disabled = false
|
|
is_monitoring_disabled = false
|
|
|
|
plugins_config {
|
|
desired_state = "ENABLED"
|
|
name = "Compute Instance Run Command"
|
|
}
|
|
}
|
|
|
|
shape_config {
|
|
ocpus = var.ocpus
|
|
memory_in_gbs = var.memory_in_gbs
|
|
}
|
|
|
|
create_vnic_details {
|
|
assign_public_ip = false
|
|
display_name = "oci-l4-relay"
|
|
nsg_ids = [oci_core_network_security_group.relay.id]
|
|
subnet_id = oci_core_subnet.relay.id
|
|
}
|
|
|
|
source_details {
|
|
boot_volume_size_in_gbs = 50
|
|
source_id = local.relay_image_ocid
|
|
source_type = "image"
|
|
}
|
|
|
|
metadata = {
|
|
user_data = base64encode(templatefile("${path.module}/cloud-init.yaml.tftpl", {
|
|
gateway_relay_address = var.gateway_relay_address
|
|
log_ingest_hostname = var.log_ingest_hostname
|
|
smtp_evidence_config_json = jsonencode({
|
|
conntrack_emission_burst = var.relay_conntrack_emission_burst
|
|
conntrack_emission_rate_per_second = var.relay_conntrack_emission_rate_per_second
|
|
conntrack_event_buffer = var.relay_conntrack_event_buffer
|
|
conntrack_sample_denominator = var.relay_conntrack_sample_denominator
|
|
conntrack_services = concat([
|
|
{
|
|
name = "web"
|
|
ports = [80, 443]
|
|
target_address = var.gateway_relay_address
|
|
}
|
|
], var.mail_relay_enabled ? [
|
|
{
|
|
name = "smtp"
|
|
ports = [25]
|
|
target_address = local.home_tunnel_address
|
|
},
|
|
{
|
|
name = "authenticated_mail"
|
|
ports = [465, 993]
|
|
target_address = local.home_tunnel_address
|
|
}
|
|
] : [])
|
|
maximum_records = var.smtp_deny_maximum_addresses
|
|
metrics_listen_address = "${split("/", var.relay_tunnel_address)[0]}:${var.relay_metrics_port}"
|
|
observation_window_seconds = var.smtp_deny_maximum_observation_window_seconds
|
|
snapshot_interval_seconds = var.smtp_evidence_snapshot_interval_seconds
|
|
})
|
|
config_json = jsonencode(merge({
|
|
admission = {
|
|
bucket = oci_objectstorage_bucket.address_lists.name
|
|
maximum_addresses = var.web_allow_maximum_addresses
|
|
minimum_addresses = var.web_allow_minimum_addresses
|
|
minimum_intervals = var.web_allow_minimum_intervals
|
|
namespace = data.oci_objectstorage_namespace.relay.namespace
|
|
object = var.web_allow_bundle_object
|
|
}
|
|
admission_helper = "/usr/local/libexec/oci-l4-relay-admission"
|
|
gateway_relay_address = var.gateway_relay_address
|
|
home_wireguard_public_key = local.home_wireguard_public_key
|
|
log_ingest_hostname = var.log_ingest_hostname
|
|
log_ingest_secret_ocid = oci_vault_secret.log_ingest.id
|
|
monitoring_source_ipv4 = var.monitoring_source_ipv4
|
|
public_key_secret_ocid = oci_vault_secret.wireguard_public_key.id
|
|
rate_limit_mbit = var.relay_rate_limit_mbit
|
|
relay_http_quarantine_enabled = var.relay_http_quarantine_enabled
|
|
relay_http_quarantine_minutes = var.relay_http_quarantine_minutes
|
|
relay_https_recent_minutes = var.relay_https_recent_minutes
|
|
relay_metrics_port = var.relay_metrics_port
|
|
relay_auth_packet_aggregate_burst = var.relay_auth_packet_aggregate_burst
|
|
relay_auth_packet_aggregate_rate_per_second = var.relay_auth_packet_aggregate_rate_per_second
|
|
relay_auth_syn_aggregate_burst = var.relay_auth_syn_aggregate_burst
|
|
relay_auth_syn_aggregate_rate_per_second = var.relay_auth_syn_aggregate_rate_per_second
|
|
relay_auth_syn_burst = var.relay_auth_syn_burst
|
|
relay_auth_syn_rate_per_minute = var.relay_auth_syn_rate_per_minute
|
|
relay_smtp_packet_aggregate_burst = var.relay_smtp_packet_aggregate_burst
|
|
relay_smtp_packet_aggregate_rate_per_second = var.relay_smtp_packet_aggregate_rate_per_second
|
|
relay_smtp_syn_aggregate_burst = var.relay_smtp_syn_aggregate_burst
|
|
relay_smtp_syn_aggregate_rate_per_second = var.relay_smtp_syn_aggregate_rate_per_second
|
|
relay_smtp_syn_burst = var.relay_smtp_syn_burst
|
|
relay_smtp_syn_rate_per_minute = var.relay_smtp_syn_rate_per_minute
|
|
relay_tracker_max_sources = var.relay_tracker_max_sources
|
|
relay_tunnel_address = var.relay_tunnel_address
|
|
relay_tunnel_mtu = var.relay_tunnel_mtu
|
|
relay_unmatched_http_burst = var.relay_unmatched_http_burst
|
|
relay_unmatched_http_rate_per_hour = var.relay_unmatched_http_rate_per_hour
|
|
relay_web_packet_aggregate_burst = var.relay_web_packet_aggregate_burst
|
|
relay_web_packet_aggregate_rate_per_second = var.relay_web_packet_aggregate_rate_per_second
|
|
relay_web_syn_aggregate_burst = var.relay_web_syn_aggregate_burst
|
|
relay_web_syn_aggregate_rate_per_second = var.relay_web_syn_aggregate_rate_per_second
|
|
relay_web_syn_burst = var.relay_web_syn_burst
|
|
relay_web_syn_rate_per_minute = var.relay_web_syn_rate_per_minute
|
|
wireguard_listen_port = var.wireguard_listen_port
|
|
wireguard_seed_secret_ocid = oci_vault_secret.wireguard_seed.id
|
|
}, jsondecode(var.mail_relay_enabled ? jsonencode({
|
|
mail_relay_address = local.home_tunnel_address
|
|
smtp_deny = {
|
|
bucket = oci_objectstorage_bucket.address_lists.name
|
|
maximum_addresses = var.smtp_deny_maximum_addresses
|
|
maximum_intervals = var.smtp_deny_maximum_intervals
|
|
maximum_lifetime_seconds = var.smtp_deny_maximum_lifetime_seconds
|
|
maximum_observation_window_seconds = var.smtp_deny_maximum_observation_window_seconds
|
|
minimum_observations = var.smtp_deny_minimum_observations
|
|
namespace = data.oci_objectstorage_namespace.relay.namespace
|
|
object = var.smtp_deny_bundle_object
|
|
}
|
|
smtp_deny_helper = "/usr/local/libexec/oci-l4-relay-smtp-deny"
|
|
}) : "{}")))
|
|
}))
|
|
}
|
|
|
|
preserve_boot_volume = false
|
|
|
|
lifecycle {
|
|
replace_triggered_by = [terraform_data.relay_instance_generation]
|
|
ignore_changes = [defined_tags["Oracle-Tags.CreatedBy"], defined_tags["Oracle-Tags.CreatedOn"]]
|
|
}
|
|
|
|
depends_on = [oci_identity_policy.relay]
|
|
}
|
|
|
|
data "oci_core_vnic_attachments" "relay" {
|
|
compartment_id = local.compartment_id
|
|
instance_id = oci_core_instance.relay.id
|
|
}
|
|
|
|
data "oci_core_private_ips" "relay" {
|
|
vnic_id = data.oci_core_vnic_attachments.relay.vnic_attachments[0].vnic_id
|
|
}
|
|
|
|
resource "oci_core_public_ip" "relay" {
|
|
compartment_id = local.compartment_id
|
|
display_name = "oci-l4-relay"
|
|
lifetime = "RESERVED"
|
|
private_ip_id = one([for address in data.oci_core_private_ips.relay.private_ips : address.id if address.is_primary])
|
|
freeform_tags = var.freeform_tags
|
|
|
|
lifecycle {
|
|
prevent_destroy = true
|
|
}
|
|
}
|
|
|
|
resource "oci_identity_dynamic_group" "relay" {
|
|
compartment_id = local.tenancy_ocid
|
|
name = "oci-l4-relay"
|
|
description = "OCI L4 relay instance principal"
|
|
matching_rule = "ALL {instance.compartment.id = '${local.compartment_id}', tag.${oci_identity_tag_namespace.relay.name}.${oci_identity_tag.instance_principal.name}.value = 'enabled'}"
|
|
}
|
|
|
|
resource "oci_identity_policy" "relay" {
|
|
compartment_id = local.tenancy_ocid
|
|
name = "oci-l4-relay"
|
|
description = "Allow relay key derivation and public-key publication"
|
|
statements = [
|
|
"Allow dynamic-group ${oci_identity_dynamic_group.relay.name} to read secret-bundles in compartment id ${local.compartment_id} where target.secret.id = '${oci_vault_secret.wireguard_seed.id}'",
|
|
"Allow dynamic-group ${oci_identity_dynamic_group.relay.name} to read secret-bundles in compartment id ${local.compartment_id} where target.secret.id = '${oci_vault_secret.wireguard_public_key.id}'",
|
|
"Allow dynamic-group ${oci_identity_dynamic_group.relay.name} to read secret-bundles in compartment id ${local.compartment_id} where target.secret.id = '${oci_vault_secret.log_ingest.id}'",
|
|
"Allow dynamic-group ${oci_identity_dynamic_group.relay.name} to {SECRET_UPDATE} in compartment id ${local.compartment_id} where target.secret.id = '${oci_vault_secret.wireguard_public_key.id}'",
|
|
"Allow dynamic-group ${oci_identity_dynamic_group.relay.name} to use instance-agent-command-execution-family in compartment id ${local.compartment_id} where request.instance.id = target.instance.id",
|
|
]
|
|
}
|
|
|
|
resource "terraform_data" "relay_instance_generation" {
|
|
triggers_replace = [
|
|
"relay",
|
|
filesha256("${path.module}/cloud-init.yaml.tftpl"),
|
|
jsonencode(merge({
|
|
web_allow_bundle_object = var.web_allow_bundle_object
|
|
web_allow_maximum_addresses = var.web_allow_maximum_addresses
|
|
web_allow_minimum_addresses = var.web_allow_minimum_addresses
|
|
web_allow_minimum_intervals = var.web_allow_minimum_intervals
|
|
gateway_relay_address = var.gateway_relay_address
|
|
log_ingest_hostname = var.log_ingest_hostname
|
|
relay_image_ocid = local.relay_image_ocid
|
|
monitoring_source_ipv4 = var.monitoring_source_ipv4
|
|
relay_http_quarantine_enabled = var.relay_http_quarantine_enabled
|
|
relay_http_quarantine_minutes = var.relay_http_quarantine_minutes
|
|
relay_https_recent_minutes = var.relay_https_recent_minutes
|
|
relay_auth_packet_aggregate_burst = var.relay_auth_packet_aggregate_burst
|
|
relay_auth_packet_aggregate_rate_per_second = var.relay_auth_packet_aggregate_rate_per_second
|
|
relay_auth_syn_aggregate_burst = var.relay_auth_syn_aggregate_burst
|
|
relay_auth_syn_aggregate_rate_per_second = var.relay_auth_syn_aggregate_rate_per_second
|
|
relay_auth_syn_burst = var.relay_auth_syn_burst
|
|
relay_auth_syn_rate_per_minute = var.relay_auth_syn_rate_per_minute
|
|
relay_rate_limit_mbit = var.relay_rate_limit_mbit
|
|
relay_smtp_packet_aggregate_burst = var.relay_smtp_packet_aggregate_burst
|
|
relay_smtp_packet_aggregate_rate_per_second = var.relay_smtp_packet_aggregate_rate_per_second
|
|
relay_smtp_syn_aggregate_burst = var.relay_smtp_syn_aggregate_burst
|
|
relay_smtp_syn_aggregate_rate_per_second = var.relay_smtp_syn_aggregate_rate_per_second
|
|
relay_smtp_syn_burst = var.relay_smtp_syn_burst
|
|
relay_smtp_syn_rate_per_minute = var.relay_smtp_syn_rate_per_minute
|
|
relay_web_packet_aggregate_burst = var.relay_web_packet_aggregate_burst
|
|
relay_web_packet_aggregate_rate_per_second = var.relay_web_packet_aggregate_rate_per_second
|
|
relay_web_syn_aggregate_burst = var.relay_web_syn_aggregate_burst
|
|
relay_web_syn_aggregate_rate_per_second = var.relay_web_syn_aggregate_rate_per_second
|
|
relay_tracker_max_sources = var.relay_tracker_max_sources
|
|
relay_tunnel_mtu = var.relay_tunnel_mtu
|
|
relay_tunnel_address = var.relay_tunnel_address
|
|
relay_metrics_port = var.relay_metrics_port
|
|
relay_conntrack_emission_burst = var.relay_conntrack_emission_burst
|
|
relay_conntrack_emission_rate_per_second = var.relay_conntrack_emission_rate_per_second
|
|
relay_conntrack_event_buffer = var.relay_conntrack_event_buffer
|
|
relay_conntrack_sample_denominator = var.relay_conntrack_sample_denominator
|
|
relay_unmatched_http_burst = var.relay_unmatched_http_burst
|
|
relay_unmatched_http_rate_per_hour = var.relay_unmatched_http_rate_per_hour
|
|
relay_web_syn_burst = var.relay_web_syn_burst
|
|
relay_web_syn_rate_per_minute = var.relay_web_syn_rate_per_minute
|
|
wireguard_listen_port = var.wireguard_listen_port
|
|
}, jsondecode(var.mail_relay_enabled ? jsonencode({
|
|
mail_relay_address = local.home_tunnel_address
|
|
smtp_deny_bundle_object = var.smtp_deny_bundle_object
|
|
smtp_deny_maximum_addresses = var.smtp_deny_maximum_addresses
|
|
smtp_deny_maximum_intervals = var.smtp_deny_maximum_intervals
|
|
smtp_deny_maximum_lifetime_seconds = var.smtp_deny_maximum_lifetime_seconds
|
|
smtp_deny_maximum_observation_window_seconds = var.smtp_deny_maximum_observation_window_seconds
|
|
smtp_deny_minimum_observations = var.smtp_deny_minimum_observations
|
|
smtp_evidence_snapshot_interval_seconds = var.smtp_evidence_snapshot_interval_seconds
|
|
}) : "{}")))
|
|
]
|
|
}
|
|
|
|
resource "oci_identity_tag_namespace" "relay" {
|
|
compartment_id = local.tenancy_ocid
|
|
name = "quorate_relay"
|
|
description = "Authorization boundary for OCI L4 relay resources"
|
|
is_retired = false
|
|
}
|
|
|
|
resource "oci_identity_tag" "instance_principal" {
|
|
tag_namespace_id = oci_identity_tag_namespace.relay.id
|
|
name = "instance_principal"
|
|
description = "Admits an instance to the OCI L4 relay dynamic group"
|
|
is_retired = false
|
|
}
|
|
|
|
|
|
resource "oci_identity_tag" "address_list_reader" {
|
|
tag_namespace_id = oci_identity_tag_namespace.relay.id
|
|
name = "address_list_reader"
|
|
description = "Admits an instance to read validated relay address-list objects"
|
|
is_retired = false
|
|
}
|