93 lines
3 KiB
HCL
93 lines
3 KiB
HCL
resource "oci_identity_compartment" "ingress" {
|
|
provider = oci.home
|
|
compartment_id = local.tenancy
|
|
name = "short"
|
|
description = "Tier S ingress through NLB and Site-to-Site VPN"
|
|
enable_delete = true
|
|
}
|
|
resource "oci_core_vcn" "ingress" {
|
|
compartment_id = oci_identity_compartment.ingress.id
|
|
cidr_blocks = [var.vcn_cidr]
|
|
display_name = "short"
|
|
# OCI DNS labels cannot change without replacing the network.
|
|
dns_label = "latency"
|
|
}
|
|
resource "oci_core_internet_gateway" "ingress" {
|
|
compartment_id = oci_identity_compartment.ingress.id
|
|
vcn_id = oci_core_vcn.ingress.id
|
|
display_name = "short"
|
|
enabled = true
|
|
}
|
|
resource "oci_core_drg" "ingress" {
|
|
compartment_id = oci_identity_compartment.ingress.id
|
|
display_name = "short"
|
|
}
|
|
resource "oci_core_drg_attachment" "ingress" {
|
|
drg_id = oci_core_drg.ingress.id
|
|
network_details {
|
|
id = oci_core_vcn.ingress.id
|
|
type = "VCN"
|
|
}
|
|
display_name = "short"
|
|
}
|
|
resource "oci_core_route_table" "ingress" {
|
|
compartment_id = oci_identity_compartment.ingress.id
|
|
vcn_id = oci_core_vcn.ingress.id
|
|
route_rules {
|
|
destination = "0.0.0.0/0"
|
|
destination_type = "CIDR_BLOCK"
|
|
network_entity_id = oci_core_internet_gateway.ingress.id
|
|
}
|
|
route_rules {
|
|
destination = "${var.tunnel_address}/32"
|
|
destination_type = "CIDR_BLOCK"
|
|
network_entity_id = oci_core_drg.ingress.id
|
|
}
|
|
}
|
|
resource "oci_core_security_list" "empty" {
|
|
compartment_id = oci_identity_compartment.ingress.id
|
|
vcn_id = oci_core_vcn.ingress.id
|
|
display_name = "short-empty"
|
|
}
|
|
resource "oci_core_subnet" "ingress" {
|
|
compartment_id = oci_identity_compartment.ingress.id
|
|
vcn_id = oci_core_vcn.ingress.id
|
|
cidr_block = var.subnet_cidr
|
|
display_name = "short"
|
|
dns_label = "ingress"
|
|
route_table_id = oci_core_route_table.ingress.id
|
|
security_list_ids = [oci_core_security_list.empty.id]
|
|
}
|
|
resource "oci_core_network_security_group" "ingress" {
|
|
compartment_id = oci_identity_compartment.ingress.id
|
|
vcn_id = oci_core_vcn.ingress.id
|
|
display_name = "short"
|
|
}
|
|
resource "oci_core_network_security_group_security_rule" "web" {
|
|
for_each = toset(["80", "443"])
|
|
network_security_group_id = oci_core_network_security_group.ingress.id
|
|
direction = "INGRESS"
|
|
protocol = "6"
|
|
source = "0.0.0.0/0"
|
|
source_type = "CIDR_BLOCK"
|
|
tcp_options {
|
|
destination_port_range {
|
|
min = tonumber(each.value)
|
|
max = tonumber(each.value)
|
|
}
|
|
}
|
|
}
|
|
resource "oci_core_network_security_group_security_rule" "backend" {
|
|
for_each = toset(["80", "443"])
|
|
network_security_group_id = oci_core_network_security_group.ingress.id
|
|
direction = "EGRESS"
|
|
protocol = "6"
|
|
destination = "${var.tunnel_address}/32"
|
|
destination_type = "CIDR_BLOCK"
|
|
tcp_options {
|
|
destination_port_range {
|
|
min = tonumber(each.value)
|
|
max = tonumber(each.value)
|
|
}
|
|
}
|
|
}
|