freezer/mareshq-cthulhunetes-infrastructure-v3
Archived
1
0
Fork 0
Code Activity

feat: add all of the terraform files

Browse source 
Signed-off-by: Vojtech Mares <iam@vojtechmares.com>
This commit is contained in:
Vojtěch Mareš 2024-01-22 15:03:40 +01:00
parent 4dff9a8639
commit 3a2ac8bc50
Signed by: vojtech.mares
GPG key ID: C6827B976F17240D
9 changed files with 453 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

95
terraform/firewalls.tf Normal file
View file

@ -0,0 +1,95 @@
resource "hcloud_firewall" "cthulhu_nodes_public" {
name = "cthulhu-nodes-public"
rule {
description = "Allow ICMP (ping)"
direction = "in"
protocol = "icmp"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
rule {
description = "Allow SSH"
direction = "in"
protocol = "tcp"
port = "22"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
rule {
description = "Allow HTTP"
direction = "in"
protocol = "tcp"
port = "80"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
rule {
description = "Allow HTTPS"
direction = "in"
protocol = "tcp"
port = "443"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
rule {
description = "Allow HTTP/3"
direction = "in"
protocol = "udp"
port = "443"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
rule {
description = "Allow Kubernetes API Server"
direction = "in"
protocol = "tcp"
port = "6443"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
}
resource "hcloud_firewall" "cthulhu_nodes_private" {
name = "cthulhu-nodes-private"
rule {
description = "Allow ICMP (ping)"
direction = "in"
protocol = "icmp"
source_ips = [hcloud_network.cthulhu.ip_range]
}
rule {
description = "Allow eveyrthing TCP on all ports"
direction = "in"
protocol = "tcp"
port = "any"
source_ips = [hcloud_network.cthulhu.ip_range]
}
rule {
description = "Allow eveyrthing UDP on all ports"
direction = "in"
protocol = "udp"
port = "any"
source_ips = [hcloud_network.cthulhu.ip_range]
}
}