854 lines
24 KiB
Terraform
854 lines
24 KiB
Terraform
# =============================================================================
|
|
# CONFIGURATION : VAULT SETTINGS
|
|
# =============================================================================
|
|
|
|
variable "vault_url" {
|
|
description = "URL du serveur Vault"
|
|
type = string
|
|
default = "https://vault.tips-of-mine.com"
|
|
}
|
|
|
|
variable "vault_token" {
|
|
description = "Token d'authentification Vault (fourni par CI/CD)"
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "vault_cloudflare_path" {
|
|
description = "Chemin vers les secrets Cloudflare dans Vault"
|
|
type = string
|
|
default = "secret/cloudflare"
|
|
}
|
|
|
|
variable "vault_authentik_path" {
|
|
description = "Chemin vers les secrets Authentik dans Vault"
|
|
type = string
|
|
default = "secret/authentik"
|
|
}
|
|
|
|
variable "vault_azure_path" {
|
|
description = "Chemin vers les secrets Azure Entra ID dans Vault (brique IdP Azure)"
|
|
type = string
|
|
default = "secret/azure"
|
|
}
|
|
|
|
variable "vault_skip_tls_verify" {
|
|
description = "Désactiver la vérification TLS vers Vault (dépannage uniquement — laisser à false)"
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
# =============================================================================
|
|
# CLOUDFLARE CONFIGURATION : AUTHENTIK SETTINGS
|
|
# =============================================================================
|
|
|
|
#variable "authentik_oidc_client_id_cloudflare" {
|
|
# description = "Client ID for Authentik"
|
|
# type = string
|
|
# default = "exemple"
|
|
#}
|
|
|
|
#variable "authentik_oidc_secret_cloudflare" {
|
|
# description = "Secret for Authentik"
|
|
# type = string
|
|
# default = "exemple"
|
|
#}
|
|
|
|
# =============================================================================
|
|
# CLOUDFLARE CONFIGURATION
|
|
# =============================================================================
|
|
|
|
# NOM de la zone (le domaine). À ne pas confondre avec l'ID de zone
|
|
# (identifiant hexadécimal) qui, lui, vient de Vault (clé zone_id_org) et
|
|
# sert aux ressources DNS. Les hostnames se construisent avec CE nom.
|
|
variable "cloudflare_zone" {
|
|
description = "Nom de domaine principal de la zone Cloudflare"
|
|
type = string
|
|
default = "tips-of-mine.org"
|
|
}
|
|
|
|
variable "tunnel_name" {
|
|
description = "Nom du tunnel Cloudflare"
|
|
type = string
|
|
default = "home-tunnel"
|
|
}
|
|
|
|
variable "tunnel_network" {
|
|
description = "Network du tunnel Cloudflare"
|
|
type = string
|
|
default = "10.0.0.0/24"
|
|
}
|
|
|
|
variable "tunnel_network_comment" {
|
|
description = "Commentaire du network du tunnel Cloudflare"
|
|
type = string
|
|
default = "tips-of-mine comment for this route."
|
|
}
|
|
|
|
# NOTE : le provider Cloudflare lit désormais son token depuis Vault
|
|
# (secret/cloudflare, clé api_token). Cette variable est conservée pour
|
|
# compatibilité mais n'est plus utilisée — d'où le default vide.
|
|
variable "cloudflare_api_token" {
|
|
description = "Token d'API Cloudflare (obsolète : le token vient de Vault)"
|
|
type = string
|
|
sensitive = true
|
|
default = ""
|
|
}
|
|
|
|
variable "cloudflare_access_tags" {
|
|
type = list(string)
|
|
description = "Liste des tags Cloudflare Zero Trust à créer"
|
|
}
|
|
|
|
variable "cloudflare_email_domain" {
|
|
description = "Email Domain used for email authentication in App policies"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_authentik_domain" {
|
|
description = "Email Domain used for email authentication in App policies"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_team_name" {
|
|
description = "Name of the Team in Cloudflare, essentially zero-trust org name"
|
|
type = string
|
|
}
|
|
|
|
# =============================================================================
|
|
# APPLICATIONS CONFIGURATION
|
|
# =============================================================================
|
|
|
|
variable "applications" {
|
|
description = "Liste des applications à exposer via le tunnel"
|
|
type = map(object({
|
|
subdomain = string
|
|
origin_url = string
|
|
no_tls_verify = optional(bool, true)
|
|
access_enabled = optional(bool, false)
|
|
access_team_name = optional(string, "")
|
|
access_aud_tags = optional(list(string), [])
|
|
}))
|
|
default = {}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Group
|
|
# =============================================================================
|
|
|
|
#
|
|
|
|
#======================================================
|
|
# CLOUDFLARE WARP CONNECTOR CONFIGURATION
|
|
#======================================================
|
|
|
|
variable "cloudflare_default_cgnat_routes" {
|
|
description = "default cgnat routes"
|
|
type = list(object({
|
|
address = string
|
|
description = string
|
|
}))
|
|
default = [{
|
|
address = "100.64.0.0/10"
|
|
description = "Default CGNAT Range"
|
|
}]
|
|
}
|
|
|
|
variable "cloudflare_custom_cgnat_routes" {
|
|
description = "List of custom CGNAT routes to add to the device profile"
|
|
type = list(object({
|
|
address = string
|
|
description = string
|
|
}))
|
|
}
|
|
|
|
variable "cloudflare_warp_cgnat_cidr" {
|
|
description = "default ip range for WARP when overriding local interface IP"
|
|
type = string
|
|
}
|
|
|
|
# =============================================================================
|
|
# ADVANCED OPTIONS
|
|
# =============================================================================
|
|
variable "tunnel_warp_routing_enabled" {
|
|
description = "Activer le routage WARP pour le tunnel"
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
variable "dns_ttl" {
|
|
description = "TTL pour les enregistrements DNS"
|
|
type = number
|
|
default = 1
|
|
}
|
|
|
|
variable "dns_proxied" {
|
|
description = "Activer le proxy Cloudflare pour les DNS"
|
|
type = bool
|
|
default = true
|
|
}
|
|
|
|
#======================================================
|
|
# IDENTITY PROVIDERS
|
|
#======================================================
|
|
#variable "cloudflare_okta_identity_provider_id" {
|
|
# description = "Okta Identity Provider ID in Cloudflare"
|
|
# type = string
|
|
# sensitive = true
|
|
#}
|
|
|
|
#variable "cloudflare_otp_identity_provider_id" {
|
|
# description = "OneTime PIN identity provider ID in Cloudflare"
|
|
# type = string
|
|
# sensitive = true
|
|
#}
|
|
|
|
#variable "cloudflare_azure_identity_provider_id" {
|
|
# description = "Azure Entra ID identity provider ID in Cloudflare"
|
|
# type = string
|
|
# sensitive = true
|
|
#}
|
|
|
|
#variable "cloudflare_azure_admin_rule_group_id" {
|
|
# description = "Azure Administrators Rule Group ID in Cloudflare"
|
|
# type = string
|
|
# sensitive = true
|
|
#}
|
|
|
|
variable "cloudflare_gateway_posture_id" {
|
|
description = "Gateway posture ID in Cloudflare"
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "cloudflare_macos_posture_id" {
|
|
description = "Latest macOS version posture ID in Cloudflare"
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "cloudflare_windows_posture_id" {
|
|
description = "Latest Windows version posture ID in Cloudflare"
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "cloudflare_linux_posture_id" {
|
|
description = "Latest Linux Kernel version posture ID in Cloudflare"
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "cloudflare_device_os" {
|
|
description = "This is the OS you are running on your own client machine"
|
|
type = string
|
|
}
|
|
|
|
|
|
#======================================================
|
|
# OKTA SAML GROUPS
|
|
#======================================================
|
|
variable "okta_infra_admin_saml_group_name" {
|
|
description = "SAML Group name for InfrastructureAdmin group"
|
|
type = string
|
|
}
|
|
|
|
variable "okta_contractors_saml_group_name" {
|
|
description = "SAML Group name for Contractors group"
|
|
type = string
|
|
}
|
|
|
|
variable "okta_sales_eng_saml_group_name" {
|
|
description = "SAML Group name for SalesEngineering group"
|
|
type = string
|
|
}
|
|
|
|
variable "okta_sales_saml_group_name" {
|
|
description = "SAML Group name for Sales group"
|
|
type = string
|
|
}
|
|
|
|
variable "okta_itadmin_saml_group_name" {
|
|
description = "SAML Group name for ITAdmin group"
|
|
type = string
|
|
}
|
|
|
|
#======================================================
|
|
# OKTA USER LOGINS
|
|
#======================================================
|
|
variable "okta_bob_user_login" {
|
|
description = "User login for bob, in an email format"
|
|
type = string
|
|
}
|
|
|
|
variable "okta_matthieu_user_login" {
|
|
description = "User login for matthieu, in an email format"
|
|
type = string
|
|
}
|
|
|
|
#======================================================
|
|
# AZURE INFRASTRUCTURE
|
|
#======================================================
|
|
#variable "azure_engineering_group_id" {
|
|
# description = "Object ID of Azure_Engineering group from Azure AD"
|
|
# type = string
|
|
#}
|
|
|
|
#variable "azure_sales_group_id" {
|
|
# description = "Object ID of Azure_Sales group from Azure AD"
|
|
# type = string
|
|
#}
|
|
|
|
#variable "azure_subnet_cidr" {
|
|
# description = "Azure address prefix, subnet for VM in Azure"
|
|
# type = string
|
|
#}
|
|
|
|
#======================================================
|
|
# CLOUDFLARE APPLICATION PORTS
|
|
#======================================================
|
|
|
|
variable "cloudflare_intranet_app_port" {
|
|
description = "Port for the Intranet web App in Cloudflare"
|
|
type = number
|
|
}
|
|
|
|
variable "cloudflare_competition_app_port" {
|
|
description = "Port for the Competition web App in Cloudflare"
|
|
type = number
|
|
}
|
|
|
|
variable "cloudflare_domain_controller_rdp_port" {
|
|
description = "Port for the RDP domain controller"
|
|
type = number
|
|
}
|
|
|
|
#======================================================
|
|
#
|
|
#======================================================
|
|
|
|
#variable "cloudflare_subdomain_ssh" {
|
|
# description = "cloudflare_subdomain_ssh"
|
|
# type = string
|
|
# default = "ssh-database.tips-of-mine.com"
|
|
#}
|
|
|
|
#variable "cloudflare_subdomain_vnc" {
|
|
# description = "cloudflare_subdomain_vnc"
|
|
# type = string
|
|
# default = "vnc.tips-of-mine.com"
|
|
#}
|
|
|
|
#variable "cloudflare_subdomain_web" {
|
|
# description = "cloudflare_subdomain_web"
|
|
# type = string
|
|
# default = "intranet.tips-of-mine.com"
|
|
#}
|
|
|
|
#variable "cloudflare_subdomain_rdp" {
|
|
# description = "cloudflare_subdomain_rdp"
|
|
# type = string
|
|
# default = "rdp.tips-of-mine.com"
|
|
#}
|
|
|
|
#variable "cloudflare_subdomain_web_sensitive" {
|
|
# description = "cloudflare_subdomain_web_sensitive"
|
|
# type = string
|
|
# default = "competition.tips-of-mine.com"
|
|
#}
|
|
|
|
#variable "cloudflare_subdomain_training_status" {
|
|
# description = "cloudflare_subdomain_training_status"
|
|
# type = string
|
|
# default = "training-status.tips-of-mine.com"
|
|
#}
|
|
|
|
#======================================================
|
|
# GCP Networking
|
|
#======================================================
|
|
|
|
variable "aws_vm_internal_ip" {
|
|
description = "Internal Private IP of AWS Compute Engine Instance"
|
|
type = string
|
|
}
|
|
|
|
variable "gcp_vm_internal_ip" {
|
|
description = "Internal Private IP of GCP Compute Engine Instance"
|
|
type = string
|
|
}
|
|
|
|
variable "gcp_windows_vm_internal_ip" {
|
|
description = "Internal Private IP of GCP Compute Engine Instance running Windows RDP"
|
|
type = string
|
|
}
|
|
|
|
variable "gcp_infra_cidr" {
|
|
description = "CIDR Range for GCP VMs running cloudflared"
|
|
type = string
|
|
}
|
|
|
|
variable "gcp_warp_cidr" {
|
|
description = "CIDR Range for GCP VMs running warp"
|
|
type = string
|
|
}
|
|
|
|
variable "gcp_windows_rdp_cidr" {
|
|
description = "CIDR Range for GCP VMs running cloudflared, Windows and RDP Server"
|
|
type = string
|
|
}
|
|
|
|
#======================================================
|
|
# AWS Networking
|
|
#======================================================
|
|
|
|
variable "aws_vpc_cidr" {
|
|
description = "AWS vpc cidr, subnet for vpc in AWS"
|
|
type = string
|
|
}
|
|
|
|
variable "aws_windows_vm_internal_ip" {
|
|
description = "Internal Private IP of AWS Compute Engine Instance running Windows RDP"
|
|
type = string
|
|
}
|
|
|
|
variable "aws_private_cidr" {
|
|
description = "AWS private subnet, subnet for VMs in AWS"
|
|
type = string
|
|
}
|
|
|
|
variable "aws_public_cidr" {
|
|
description = "AWS public subnet"
|
|
type = string
|
|
}
|
|
|
|
#======================================================
|
|
# AZURE Networking
|
|
#======================================================
|
|
|
|
variable "azure_subnet_cidr" {
|
|
description = "Azure address prefix, subnet for VM in Azure"
|
|
type = string
|
|
}
|
|
|
|
variable "azure_vnet_cidr" {
|
|
description = "Azure address vnet, subnet for vnet in Azure"
|
|
type = string
|
|
}
|
|
|
|
variable "azure_public_dns_domain" {
|
|
description = "Azure Public DNS Domain"
|
|
type = string
|
|
}
|
|
|
|
#======================================================
|
|
# TUNNEL CONFIGURATION
|
|
#======================================================
|
|
|
|
variable "cloudflare_tunnel_name_gcp" {
|
|
description = "Name of the Cloudflared tunnel for GCP"
|
|
type = string
|
|
}
|
|
|
|
#variable "cloudflare_tunnel_name_aws" {
|
|
# description = "Name of the Cloudflared tunnel for AWS"
|
|
# type = string
|
|
#}
|
|
|
|
#variable "cloudflare_tunnel_name_azure" {
|
|
# description = "Name of the Cloudflared tunnel for Azure"
|
|
# type = string
|
|
#}
|
|
|
|
#variable "cloudflare_tunnel_name_ovh" {
|
|
# description = "Name of the Cloudflared tunnel for OVH"
|
|
# type = string
|
|
#}
|
|
|
|
variable "cloudflare_windows_rdp_tunnel_name_gcp" {
|
|
description = "Name of the Cloudflared tunnel for Windows RDP Server GCP"
|
|
type = string
|
|
}
|
|
|
|
#======================================================
|
|
# WARP CONNECTOR TUNNEL IDS
|
|
#======================================================
|
|
|
|
#variable "cloudflare_tunnel_warp_connector_azure_id" {
|
|
# description = "ID of the WARP Connector Tunnel manually created for Azure in UI"
|
|
# type = string
|
|
#}
|
|
|
|
#variable "cloudflare_tunnel_warp_connector_gcp_id" {
|
|
# description = "ID of the WARP Connector Tunnel manually created for GCP in UI"
|
|
# type = string
|
|
#}
|
|
|
|
#variable "cloudflare_tunnel_warp_connector_aws_id" {
|
|
# description = "ID of the WARP Connector Tunnel manually created for AWS in UI"
|
|
# type = string
|
|
#}
|
|
|
|
#variable "cloudflare_tunnel_warp_connector_ovh_id" {
|
|
# description = "ID of the WARP Connector Tunnel manually created for OVH in UI"
|
|
# type = string
|
|
#}
|
|
|
|
#======================================================
|
|
# CLOUDFLARE DNS SUBDOMAIN CONFIGURATION AWS
|
|
#======================================================
|
|
|
|
variable "cloudflare_aws_subdomain_ssh" {
|
|
description = "Name of the subdomain for ssh public hostname of tunnel"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_aws_subdomain_vnc" {
|
|
description = "Name of the subdomain for VNC public hostname of tunnel"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_aws_subdomain_web" {
|
|
description = "Name of the subdomain for web public hostname of tunnel"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_aws_subdomain_web_sensitive" {
|
|
description = "Name of the subdomain for web sensitive public hostname of tunnel"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_aws_subdomain_rdp" {
|
|
description = "Name of the subdomain for rdp browser rendered public hostname"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_aws_subdomain_training_status" {
|
|
description = "Name of the subdomain for training status admin portal (OPTIONAL: only needed if using optional-cloudflare-apps.tf)"
|
|
type = string
|
|
}
|
|
|
|
#======================================================
|
|
# CLOUDFLARE DNS SUBDOMAIN CONFIGURATION GCP
|
|
#======================================================
|
|
|
|
variable "cloudflare_gcp_subdomain_ssh" {
|
|
description = "Name of the subdomain for ssh public hostname of tunnel"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_gcp_subdomain_vnc" {
|
|
description = "Name of the subdomain for VNC public hostname of tunnel"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_gcp_subdomain_web" {
|
|
description = "Name of the subdomain for web public hostname of tunnel"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_gcp_subdomain_web_sensitive" {
|
|
description = "Name of the subdomain for web sensitive public hostname of tunnel"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_gcp_subdomain_rdp" {
|
|
description = "Name of the subdomain for rdp browser rendered public hostname"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_gcp_subdomain_training_status" {
|
|
description = "Name of the subdomain for training status admin portal (OPTIONAL: only needed if using optional-cloudflare-apps.tf)"
|
|
type = string
|
|
}
|
|
|
|
#======================================================
|
|
# CLOUDFLARE TARGET NAMES
|
|
#======================================================
|
|
|
|
variable "cloudflare_aws_target_ssh_name" {
|
|
description = "Friendly name for the Target hostname in Infrastructure App"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_gcp_target_ssh_name" {
|
|
description = "Friendly name for the Target hostname in Infrastructure App"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_aws_target_rdp_name" {
|
|
description = "Friendly name for the Target hostname in RDP windows browser rendered App"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_gcp_target_rdp_name" {
|
|
description = "Friendly name for the Target hostname in RDP windows browser rendered App"
|
|
type = string
|
|
}
|
|
|
|
#======================================================
|
|
# CLOUDFLARE ACCESS APPLICATION CONFIGURATION
|
|
#======================================================
|
|
|
|
variable "cloudflare_sensitive_web_app_name" {
|
|
description = "Name of the Sensitive web App in Cloudflare"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_intranet_web_app_name" {
|
|
description = "Name of the Intranet web App in Cloudflare"
|
|
type = string
|
|
}
|
|
|
|
#======================================================
|
|
# CLOUDFLARE ACCESS APPLICATION CONFIGURATION AWS
|
|
#======================================================
|
|
|
|
variable "cloudflare_aws_browser_ssh_app_name" {
|
|
description = "Name of the Browser Rendering SSH App in Cloudflare"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_aws_browser_vnc_app_name" {
|
|
description = "Name of the Browser Rendering VNC App in Cloudflare"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_aws_infra_app_name" {
|
|
description = "Name of the Infrastructure App in Cloudflare"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_aws_browser_rdp_app_name" {
|
|
description = "Name of the RDP windows browser rendered App in Cloudflare"
|
|
type = string
|
|
}
|
|
|
|
#======================================================
|
|
# CLOUDFLARE ACCESS APPLICATION CONFIGURATION GCP
|
|
#======================================================
|
|
|
|
variable "cloudflare_gcp_browser_ssh_app_name" {
|
|
description = "Name of the Browser Rendering SSH App in Cloudflare"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_gcp_browser_vnc_app_name" {
|
|
description = "Name of the Browser Rendering VNC App in Cloudflare"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_gcp_infra_app_name" {
|
|
description = "Name of the Infrastructure App in Cloudflare"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_gcp_browser_rdp_app_name" {
|
|
description = "Name of the RDP windows browser rendered App in Cloudflare"
|
|
type = string
|
|
}
|
|
|
|
variable "cloudflare_gcp_sensitive_web_app_name" {
|
|
description = "Name of the Sensitive web App (GCP) in Cloudflare"
|
|
type = string
|
|
default = "Competition App : GCP"
|
|
}
|
|
|
|
variable "cloudflare_gcp_intranet_web_app_name" {
|
|
description = "Name of the Intranet web App (GCP) in Cloudflare"
|
|
type = string
|
|
default = "Intranet : GCP"
|
|
}
|
|
|
|
#======================================================
|
|
# BRIQUE IdP AZURE ENTRA ID
|
|
#======================================================
|
|
|
|
variable "azure_idp_enabled" {
|
|
description = "Activer la brique IdP Azure Entra ID (nécessite le secret Vault secret/azure — voir ACTIONS_EXTERNES.md)"
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
variable "azure_admin_group_id" {
|
|
description = "Object ID du groupe Entra ID des administrateurs (vide = rule group Azure non créé)"
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
#======================================================
|
|
# BRIQUE SITES DISTANTS
|
|
#======================================================
|
|
|
|
variable "remote_sites" {
|
|
description = "Sites distants d'entreprise : un tunnel cloudflared + un réseau virtuel + une route par site. Les CIDR peuvent se chevaucher entre sites (isolation par réseau virtuel)."
|
|
type = map(object({
|
|
cidr = string
|
|
comment = string
|
|
}))
|
|
default = {
|
|
site-paris = {
|
|
cidr = "10.100.0.0/16"
|
|
comment = "Site Paris - siege"
|
|
}
|
|
site-lyon = {
|
|
cidr = "10.100.0.0/16"
|
|
comment = "Site Lyon - agence (meme CIDR que Paris : isole par reseau virtuel)"
|
|
}
|
|
}
|
|
}
|
|
|
|
variable "cloudflare_tunnel_warp_connector_site_a_id" {
|
|
description = "ID du WARP Connector du site A (créé manuellement dans le dashboard — vide = brique inerte)"
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "cloudflare_tunnel_warp_connector_site_b_id" {
|
|
description = "ID du WARP Connector du site B (créé manuellement dans le dashboard — vide = brique inerte)"
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
#======================================================
|
|
# BRIQUE DEX
|
|
#======================================================
|
|
|
|
variable "dex_enabled" {
|
|
description = "Activer les tests DEX (nécessite la permission 'Digital Experience Monitoring : Edit' sur le token API Cloudflare)"
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
#======================================================
|
|
# BRIQUE DLP
|
|
#======================================================
|
|
|
|
variable "dlp_enabled" {
|
|
description = "Activer la brique DLP (nécessite l'abonnement DLP sur le compte Cloudflare)"
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
#======================================================
|
|
# BRIQUE LOGPUSH
|
|
#======================================================
|
|
|
|
variable "logpush_enabled" {
|
|
description = "Activer l'export Logpush des logs Gateway HTTP (nécessite logpush_destination_conf)"
|
|
type = bool
|
|
default = false
|
|
}
|
|
|
|
variable "logpush_destination_conf" {
|
|
description = "Destination Logpush (ex : s3://bucket/gateway?region=eu-north-1 ou r2://...)"
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
#======================================================
|
|
# CIDR COMPLÉMENTAIRES (déclarations des clés du tfvars)
|
|
# Ces plages documentent le plan d'adressage complet du lab multi-cloud ;
|
|
# elles sont disponibles pour les politiques Gateway et les routes.
|
|
#======================================================
|
|
|
|
variable "aws_infra_cidr" {
|
|
description = "CIDR Range for AWS VMs running cloudflared"
|
|
type = string
|
|
default = "10.10.10.0/24"
|
|
}
|
|
|
|
variable "aws_warp_cidr" {
|
|
description = "CIDR Range for AWS VMs running warp"
|
|
type = string
|
|
default = "10.10.15.0/24"
|
|
}
|
|
|
|
variable "aws_windows_rdp_cidr" {
|
|
description = "CIDR Range for AWS VMs running Windows and RDP Server"
|
|
type = string
|
|
default = "10.10.20.0/24"
|
|
}
|
|
|
|
variable "gcp_vpc_cidr" {
|
|
description = "GCP VPC cidr"
|
|
type = string
|
|
default = "10.13.0.0/20"
|
|
}
|
|
|
|
variable "gcp_public_cidr" {
|
|
description = "GCP public subnet"
|
|
type = string
|
|
default = "10.13.0.0/24"
|
|
}
|
|
|
|
variable "gcp_private_cidr" {
|
|
description = "GCP private subnet"
|
|
type = string
|
|
default = "10.13.1.0/24"
|
|
}
|
|
|
|
variable "azure_public_cidr" {
|
|
description = "Azure public subnet"
|
|
type = string
|
|
default = "10.14.0.0/24"
|
|
}
|
|
|
|
variable "azure_private_cidr" {
|
|
description = "Azure private subnet"
|
|
type = string
|
|
default = "10.14.1.0/24"
|
|
}
|
|
|
|
variable "azure_infra_cidr" {
|
|
description = "CIDR Range for Azure VMs running cloudflared"
|
|
type = string
|
|
default = "10.14.10.0/24"
|
|
}
|
|
|
|
variable "azure_warp_cidr" {
|
|
description = "CIDR Range for Azure VMs running warp"
|
|
type = string
|
|
default = "10.14.15.0/24"
|
|
}
|
|
|
|
variable "azure_windows_rdp_cidr" {
|
|
description = "CIDR Range for Azure VMs running Windows and RDP Server"
|
|
type = string
|
|
default = "10.14.20.0/24"
|
|
}
|
|
|
|
variable "ovh_vpc_cidr" {
|
|
description = "OVH VPC cidr"
|
|
type = string
|
|
default = "10.16.0.0/20"
|
|
}
|
|
|
|
variable "ovh_public_cidr" {
|
|
description = "OVH public subnet"
|
|
type = string
|
|
default = "10.16.0.0/24"
|
|
}
|
|
|
|
variable "ovh_private_cidr" {
|
|
description = "OVH private subnet"
|
|
type = string
|
|
default = "10.16.1.0/24"
|
|
}
|
|
|
|
variable "ovh_infra_cidr" {
|
|
description = "CIDR Range for OVH VMs running cloudflared"
|
|
type = string
|
|
default = "10.16.10.0/24"
|
|
}
|
|
|
|
variable "ovh_warp_cidr" {
|
|
description = "CIDR Range for OVH VMs running warp"
|
|
type = string
|
|
default = "10.16.15.0/24"
|
|
}
|
|
|
|
variable "ovh_windows_rdp_cidr" {
|
|
description = "CIDR Range for OVH VMs running Windows and RDP Server"
|
|
type = string
|
|
default = "10.16.20.0/24"
|
|
} |