93 lines
4.3 KiB
Terraform
93 lines
4.3 KiB
Terraform
# =============================================================================
|
|
# CLOUDFLARE : Networks : Routes : CIDR
|
|
# =============================================================================
|
|
|
|
# Route du réseau domestique via le tunnel principal
|
|
resource "cloudflare_zero_trust_tunnel_cloudflared_route" "home_tunnel_route" {
|
|
account_id = local.cloudflare_account_id
|
|
network = var.tunnel_network
|
|
tunnel_id = cloudflare_zero_trust_tunnel_cloudflared.home_tunnel.id
|
|
comment = var.tunnel_network_comment
|
|
}
|
|
|
|
#======================================================
|
|
# Routes des tunnels cloud, rattachées à leur réseau virtuel
|
|
# Chaque route publie le CIDR privé du cloud dans le réseau Cloudflare,
|
|
# isolé dans son propre réseau virtuel (défini dans
|
|
# Networks-Routes-Virtual_Networks.tf)
|
|
#======================================================
|
|
|
|
resource "cloudflare_zero_trust_tunnel_cloudflared_route" "aws_tunnel_route" {
|
|
account_id = local.cloudflare_account_id
|
|
network = var.aws_private_cidr
|
|
tunnel_id = cloudflare_zero_trust_tunnel_cloudflared.aws_tunnel.id
|
|
virtual_network_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.zero_trust_tunnel_cloudflared_virtual_network_aws.id
|
|
comment = "Route AWS private subnet -> vpc-aws"
|
|
}
|
|
|
|
resource "cloudflare_zero_trust_tunnel_cloudflared_route" "gcp_tunnel_route" {
|
|
account_id = local.cloudflare_account_id
|
|
network = var.gcp_infra_cidr
|
|
tunnel_id = cloudflare_zero_trust_tunnel_cloudflared.gcp_tunnel.id
|
|
virtual_network_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.zero_trust_tunnel_cloudflared_virtual_network_gcp.id
|
|
comment = "Route GCP infra subnet -> vpc-gcp"
|
|
}
|
|
|
|
resource "cloudflare_zero_trust_tunnel_cloudflared_route" "azure_tunnel_route" {
|
|
account_id = local.cloudflare_account_id
|
|
network = var.azure_subnet_cidr
|
|
tunnel_id = cloudflare_zero_trust_tunnel_cloudflared.azure_tunnel.id
|
|
virtual_network_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.zero_trust_tunnel_cloudflared_virtual_network_azure.id
|
|
comment = "Route Azure subnet -> vpc-azure"
|
|
}
|
|
|
|
resource "cloudflare_zero_trust_tunnel_cloudflared_route" "ovh_tunnel_route" {
|
|
account_id = local.cloudflare_account_id
|
|
network = var.ovh_private_cidr
|
|
tunnel_id = cloudflare_zero_trust_tunnel_cloudflared.ovh_tunnel.id
|
|
virtual_network_id = cloudflare_zero_trust_tunnel_cloudflared_virtual_network.zero_trust_tunnel_cloudflared_virtual_network_ovh.id
|
|
comment = "Route OVH private subnet -> vpc-ovh"
|
|
}
|
|
|
|
# =============================================================================
|
|
# DNS RECORDS (un par application)
|
|
# =============================================================================
|
|
|
|
# Ici, zone_id (l'identifiant hexadécimal, depuis Vault) est le bon usage :
|
|
# l'API DNS attend l'ID de zone, pas le nom de domaine.
|
|
resource "cloudflare_dns_record" "applications" {
|
|
for_each = var.applications
|
|
|
|
zone_id = local.cloudflare_zone_id
|
|
name = each.value.subdomain
|
|
content = "${cloudflare_zero_trust_tunnel_cloudflared.home_tunnel.id}.cfargotunnel.com"
|
|
type = "CNAME"
|
|
ttl = var.dns_ttl
|
|
proxied = var.dns_proxied
|
|
comment = "Managed by Terraform - ${each.key} via Cloudflare Tunnel"
|
|
}
|
|
|
|
# =============================================================================
|
|
# TUNNEL CONFIGURATION
|
|
# =============================================================================
|
|
|
|
# CORRECTIF : le bloc lifecycle { ignore_changes = [config] } a été retiré.
|
|
# Terraform est désormais LA source de vérité pour les règles d'ingress :
|
|
# - ajouter/modifier une application dans variables.auto.tfvars met bien à
|
|
# jour le tunnel au prochain apply (ce n'était plus le cas avant) ;
|
|
# - ACTION EXTERNE : toute modification faite à la main dans le dashboard
|
|
# (onglet "Public Hostnames" du tunnel) sera ÉCRASÉE au prochain apply.
|
|
# Reporter d'abord dans le tfvars ce qui a été configuré à la main.
|
|
resource "cloudflare_zero_trust_tunnel_cloudflared_config" "home_tunnel_config" {
|
|
account_id = local.cloudflare_account_id
|
|
tunnel_id = cloudflare_zero_trust_tunnel_cloudflared.home_tunnel.id
|
|
|
|
config = {
|
|
warp_routing = {
|
|
enabled = var.tunnel_warp_routing_enabled
|
|
}
|
|
|
|
ingress = local.ingress_rules
|
|
}
|
|
}
|