terraform-cloudflare-tunnel-zone-org/Access_Controls-Applications.tf

# =============================================================================
# CLOUDFLARE : Access Controls : Applications
# =============================================================================

#======================================================
# INFRASTRUCTURE APP: TEST
#======================================================

resource "cloudflare_zero_trust_access_application" "zero_trust_access_application" {
  account_id        = local.cloudflare_account_id

  type              = "self_hosted"
  name              = "Home Network Access Application"
  domain            = "home.tips-of-mine.org"
  session_duration  = "24h"
  skip_interstitial = true
#  tags              = ["engineers"]
  tags              = [for tag in cloudflare_zero_trust_access_tag.tags : tag.name]

  depends_on = [
    cloudflare_zero_trust_access_tag.tags
  ]
}

data "cloudflare_zero_trust_access_application" "zero_trust_access_application" {
  account_id = local.cloudflare_account_id

  app_id     = cloudflare_zero_trust_access_application.zero_trust_access_application.id
}

#======================================================
# INFRASTRUCTURE APP: MySQL Database (Infrastructure)
#======================================================

# Creating the Target
resource "cloudflare_zero_trust_access_infrastructure_target" "gcp_ssh_target" {
  account_id = local.cloudflare_account_id

  hostname   = var.cloudflare_target_ssh_name
  ip = {
    ipv4 = {
      ip_addr = var.gcp_vm_internal_ip
    }
  }
}

# Creating the infrastructure Application
resource "cloudflare_zero_trust_access_application" "cloudflare_app_ssh_infra" {
  account_id                   = local.cloudflare_account_id

  type                         = "infrastructure"
  name                         = var.cloudflare_infra_app_name
  logo_url                     = "https://upload.wikimedia.org/wikipedia/commons/0/01/Google-cloud-platform.svg"
  tags                         = ["engineers"]
  custom_deny_url              = "https://denied.tips-of-mine.org/"
  custom_non_identity_deny_url = "https://denied.tips-of-mine.org/"

  target_criteria = [{
    port     = "22",
    protocol = "SSH"
    target_attributes = {
      hostname = [var.cloudflare_target_ssh_name]
    },
  }]

  policies = [{
    name     = "SSH GCP Infrastructure Policy"
    decision = "allow"

    allowed_idps                = [var.cloudflare_okta_identity_provider_id]
    auto_redirect_to_identity   = true
    allow_authenticate_via_warp = false

    include = [
      {
        saml = {
          identity_provider_id = var.cloudflare_okta_identity_provider_id
          attribute_name       = "groups"
          attribute_value      = var.okta_infra_admin_saml_group_name
        }
      },
      {
        saml = {
          identity_provider_id = var.cloudflare_okta_identity_provider_id
          attribute_name       = "groups"
          attribute_value      = var.okta_contractors_saml_group_name
        }
      },
      {
        email_domain = {
          domain = var.cloudflare_email_domain
        }
      }
    ]
    require = [
      {
        device_posture = {
          integration_uid = var.cloudflare_gateway_posture_id
        }
      },
      {
        auth_method = {
          auth_method = "mfa"
        }
      }
    ]
    exclude = [
      {
        auth_method = {
          auth_method = "sms"
        }
      }
    ]
    connection_rules = {
      ssh = {
        allow_email_alias = true
        usernames         = [] # None
      }
    }
  }]
}

#======================================================
# SELF-HOSTED APP: DB Server
#======================================================

# Creating the Self-hosted Application for Browser rendering SSH
resource "cloudflare_zero_trust_access_application" "cloudflare_app_ssh_browser" {
  account_id                   = local.cloudflare_account_id

  type                         = "ssh"
  name                         = var.cloudflare_browser_ssh_app_name
  app_launcher_visible         = true
  logo_url                     = "https://cdn.iconscout.com/icon/free/png-256/free-database-icon-download-in-svg-png-gif-file-formats--ui-elements-pack-user-interface-icons-444649.png"
  tags                         = ["engineers"]
  session_duration             = "0s"
  custom_deny_url              = "https://denied.tips-of-mine.org/"
  custom_non_identity_deny_url = "https://denied.tips-of-mine.org/"

  destinations = [{
    type = "public"
    uri  = var.cloudflare_subdomain_ssh
  }]

  allowed_idps                = [var.cloudflare_okta_identity_provider_id, var.cloudflare_otp_identity_provider_id]
  auto_redirect_to_identity   = false
  allow_authenticate_via_warp = false

  policies = [
    {
      id = cloudflare_zero_trust_access_policy.policies["employees_browser_rendering"].id
    },
    {
      id = cloudflare_zero_trust_access_policy.policies["contractors_browser_rendering"].id
    }
  ]
}