Skip to content

Commit fd57147

Browse files
akerlakerl
committed
add proxy cert
1 parent 8687da3 commit fd57147

File tree

3 files changed

+262
-10
lines changed

3 files changed

+262
-10
lines changed

‎servers.tf

+16
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,22 @@ module "charts_ext_validation" {
3838
zone_id = module.zones["akerl.app"].zone_id
3939
}
4040

41+
module "frameproxy_proxy_validation" {
42+
source = "armorfret/r53-certbot/aws"
43+
version = "0.6.4"
44+
admin_email = var.admin_email
45+
cert_name = "frameproxy.a-rwx.org"
46+
zone_id = module.zones["a-rwx.org"].zone_id
47+
}
48+
49+
resource "aws_route53_record" "frameproxy_a-rwx_org" {
50+
zone_id = module.zones["a-rwx.org"].zone_id
51+
name = "frameproxy.a-rwx.org"
52+
type = "A"
53+
ttl = "60"
54+
records = ["10.0.1.80"]
55+
}
56+
4157
module "frameproxy_validation" {
4258
source = "armorfret/r53-certbot/aws"
4359
version = "0.6.4"

‎terraform.tfstate

+234-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"version": 4,
33
"terraform_version": "1.5.2",
4-
"serial": 12820,
4+
"serial": 12826,
55
"lineage": "6a6e3f47-d4c8-46eb-a34e-885062b7c62a",
66
"outputs": {
77
"domains": {
@@ -4137,6 +4137,44 @@
41374137
}
41384138
]
41394139
},
4140+
{
4141+
"mode": "managed",
4142+
"type": "aws_route53_record",
4143+
"name": "frameproxy_a-rwx_org",
4144+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
4145+
"instances": [
4146+
{
4147+
"schema_version": 2,
4148+
"attributes": {
4149+
"alias": [],
4150+
"allow_overwrite": null,
4151+
"cidr_routing_policy": [],
4152+
"failover_routing_policy": [],
4153+
"fqdn": "frameproxy.a-rwx.org",
4154+
"geolocation_routing_policy": [],
4155+
"geoproximity_routing_policy": [],
4156+
"health_check_id": "",
4157+
"id": "Z06324102J3IVSSCKNZ4A_frameproxy.a-rwx.org_A",
4158+
"latency_routing_policy": [],
4159+
"multivalue_answer_routing_policy": false,
4160+
"name": "frameproxy.a-rwx.org",
4161+
"records": [
4162+
"10.0.1.80"
4163+
],
4164+
"set_identifier": "",
4165+
"ttl": 60,
4166+
"type": "A",
4167+
"weighted_routing_policy": [],
4168+
"zone_id": "Z06324102J3IVSSCKNZ4A"
4169+
},
4170+
"sensitive_attributes": [],
4171+
"private": "eyJzY2hlbWFfdmVyc2lvbiI6IjIifQ==",
4172+
"dependencies": [
4173+
"module.zones.aws_route53_zone.this"
4174+
]
4175+
}
4176+
]
4177+
},
41404178
{
41414179
"mode": "managed",
41424180
"type": "aws_route53_record",
@@ -36319,6 +36357,200 @@
3631936357
}
3632036358
]
3632136359
},
36360+
{
36361+
"module": "module.frameproxy_proxy_validation",
36362+
"mode": "data",
36363+
"type": "aws_iam_policy_document",
36364+
"name": "certbot_validation",
36365+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
36366+
"instances": [
36367+
{
36368+
"schema_version": 0,
36369+
"attributes": {
36370+
"id": "4158311214",
36371+
"json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"route53:ListHostedZonesByName\",\n \"route53:ListHostedZones\",\n \"route53:GetChange\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"route53:ListResourceRecordSets\",\n \"route53:GetHostedZone\"\n ],\n \"Resource\": \"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A\"\n },\n {\n \"Effect\": \"Allow\",\n \"Action\": \"route53:ChangeResourceRecordSets\",\n \"Resource\": \"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A\",\n \"Condition\": {\n \"ForAllValues:StringEquals\": {\n \"route53:ChangeResourceRecordSetsNormalizedRecordNames\": \"_acme-challenge.frameproxy.a-rwx.org\"\n }\n }\n }\n ]\n}",
36372+
"override_json": null,
36373+
"override_policy_documents": null,
36374+
"policy_id": null,
36375+
"source_json": null,
36376+
"source_policy_documents": null,
36377+
"statement": [
36378+
{
36379+
"actions": [
36380+
"route53:GetChange",
36381+
"route53:ListHostedZones",
36382+
"route53:ListHostedZonesByName"
36383+
],
36384+
"condition": [],
36385+
"effect": "Allow",
36386+
"not_actions": [],
36387+
"not_principals": [],
36388+
"not_resources": [],
36389+
"principals": [],
36390+
"resources": [
36391+
"*"
36392+
],
36393+
"sid": ""
36394+
},
36395+
{
36396+
"actions": [
36397+
"route53:GetHostedZone",
36398+
"route53:ListResourceRecordSets"
36399+
],
36400+
"condition": [],
36401+
"effect": "Allow",
36402+
"not_actions": [],
36403+
"not_principals": [],
36404+
"not_resources": [],
36405+
"principals": [],
36406+
"resources": [
36407+
"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A"
36408+
],
36409+
"sid": ""
36410+
},
36411+
{
36412+
"actions": [
36413+
"route53:ChangeResourceRecordSets"
36414+
],
36415+
"condition": [
36416+
{
36417+
"test": "ForAllValues:StringEquals",
36418+
"values": [
36419+
"_acme-challenge.frameproxy.a-rwx.org"
36420+
],
36421+
"variable": "route53:ChangeResourceRecordSetsNormalizedRecordNames"
36422+
}
36423+
],
36424+
"effect": "Allow",
36425+
"not_actions": [],
36426+
"not_principals": [],
36427+
"not_resources": [],
36428+
"principals": [],
36429+
"resources": [
36430+
"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A"
36431+
],
36432+
"sid": ""
36433+
}
36434+
],
36435+
"version": "2012-10-17"
36436+
},
36437+
"sensitive_attributes": []
36438+
}
36439+
]
36440+
},
36441+
{
36442+
"module": "module.frameproxy_proxy_validation",
36443+
"mode": "managed",
36444+
"type": "aws_iam_user",
36445+
"name": "this",
36446+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
36447+
"instances": [
36448+
{
36449+
"schema_version": 0,
36450+
"attributes": {
36451+
"arn": "arn:aws:iam::764218738161:user/certbot_frameproxy.a-rwx.org",
36452+
"force_destroy": false,
36453+
"id": "certbot_frameproxy.a-rwx.org",
36454+
"name": "certbot_frameproxy.a-rwx.org",
36455+
"path": "/",
36456+
"permissions_boundary": "",
36457+
"tags": null,
36458+
"tags_all": {},
36459+
"unique_id": "AIDA3D3X4QXYTS67RMN3D"
36460+
},
36461+
"sensitive_attributes": [],
36462+
"private": "bnVsbA=="
36463+
}
36464+
]
36465+
},
36466+
{
36467+
"module": "module.frameproxy_proxy_validation",
36468+
"mode": "managed",
36469+
"type": "aws_iam_user_policy",
36470+
"name": "this",
36471+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
36472+
"instances": [
36473+
{
36474+
"schema_version": 0,
36475+
"attributes": {
36476+
"id": "certbot_frameproxy.a-rwx.org:certbot_frameproxy.a-rwx.org",
36477+
"name": "certbot_frameproxy.a-rwx.org",
36478+
"name_prefix": "",
36479+
"policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"route53:ListHostedZonesByName\",\"route53:ListHostedZones\",\"route53:GetChange\"],\"Effect\":\"Allow\",\"Resource\":\"*\"},{\"Action\":[\"route53:ListResourceRecordSets\",\"route53:GetHostedZone\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A\"},{\"Action\":\"route53:ChangeResourceRecordSets\",\"Condition\":{\"ForAllValues:StringEquals\":{\"route53:ChangeResourceRecordSetsNormalizedRecordNames\":\"_acme-challenge.frameproxy.a-rwx.org\"}},\"Effect\":\"Allow\",\"Resource\":\"arn:aws:route53:::hostedzone/Z06324102J3IVSSCKNZ4A\"}]}",
36480+
"user": "certbot_frameproxy.a-rwx.org"
36481+
},
36482+
"sensitive_attributes": [],
36483+
"private": "bnVsbA==",
36484+
"dependencies": [
36485+
"module.frameproxy_proxy_validation.aws_iam_user.this",
36486+
"module.frameproxy_proxy_validation.data.aws_iam_policy_document.certbot_validation"
36487+
]
36488+
}
36489+
]
36490+
},
36491+
{
36492+
"module": "module.frameproxy_proxy_validation",
36493+
"mode": "managed",
36494+
"type": "aws_route53_record",
36495+
"name": "caa",
36496+
"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
36497+
"instances": [
36498+
{
36499+
"schema_version": 2,
36500+
"attributes": {
36501+
"alias": [],
36502+
"allow_overwrite": null,
36503+
"cidr_routing_policy": [],
36504+
"failover_routing_policy": [],
36505+
"fqdn": "frameproxy.a-rwx.org",
36506+
"geolocation_routing_policy": [],
36507+
"geoproximity_routing_policy": [],
36508+
"health_check_id": "",
36509+
"id": "Z06324102J3IVSSCKNZ4A_frameproxy.a-rwx.org_CAA",
36510+
"latency_routing_policy": [],
36511+
"multivalue_answer_routing_policy": false,
36512+
"name": "frameproxy.a-rwx.org",
36513+
"records": [
36514+
"0 iodef \"mailto:[email protected]\"",
36515+
"0 issue \"letsencrypt.org; validationmethods=dns-01\"",
36516+
"0 issuewild \";\""
36517+
],
36518+
"set_identifier": "",
36519+
"ttl": 60,
36520+
"type": "CAA",
36521+
"weighted_routing_policy": [],
36522+
"zone_id": "Z06324102J3IVSSCKNZ4A"
36523+
},
36524+
"sensitive_attributes": [],
36525+
"private": "eyJzY2hlbWFfdmVyc2lvbiI6IjIifQ==",
36526+
"dependencies": [
36527+
"module.zones.aws_route53_zone.this"
36528+
]
36529+
}
36530+
]
36531+
},
36532+
{
36533+
"module": "module.frameproxy_proxy_validation",
36534+
"mode": "managed",
36535+
"type": "awscreds_iam_access_key",
36536+
"name": "this",
36537+
"provider": "provider[\"registry.terraform.io/armorfret/awscreds\"]",
36538+
"instances": [
36539+
{
36540+
"schema_version": 0,
36541+
"attributes": {
36542+
"file": "creds/certbot_frameproxy.a-rwx.org",
36543+
"id": "AKIA3D3X4QXY7GAT3ENL",
36544+
"user": "certbot_frameproxy.a-rwx.org"
36545+
},
36546+
"sensitive_attributes": [],
36547+
"private": "bnVsbA==",
36548+
"dependencies": [
36549+
"module.frameproxy_proxy_validation.aws_iam_user.this"
36550+
]
36551+
}
36552+
]
36553+
},
3632236554
{
3632336555
"module": "module.frameproxy_validation",
3632436556
"mode": "data",
@@ -36489,6 +36721,7 @@
3648936721
"sensitive_attributes": [],
3649036722
"private": "eyJzY2hlbWFfdmVyc2lvbiI6IjIifQ==",
3649136723
"dependencies": [
36724+
"aws_route53_delegation_set.main",
3649236725
"module.zones.aws_route53_zone.this"
3649336726
]
3649436727
}

‎terraform.tfstate.backup

+12-9
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"version": 4,
33
"terraform_version": "1.5.2",
4-
"serial": 12818,
4+
"serial": 12820,
55
"lineage": "6a6e3f47-d4c8-46eb-a34e-885062b7c62a",
66
"outputs": {
77
"domains": {
@@ -11254,7 +11254,7 @@
1125411254
],
1125511255
"primary_name_server": "ns-1505.awsdns-60.org",
1125611256
"private_zone": false,
11257-
"resource_record_set_count": 22,
11257+
"resource_record_set_count": 23,
1125811258
"tags": {},
1125911259
"vpc_id": null,
1126011260
"zone_id": "Z06340373MQ1RZIP7YOXL"
@@ -12977,7 +12977,7 @@
1297712977
],
1297812978
"primary_name_server": "ns-1505.awsdns-60.org",
1297912979
"private_zone": false,
12980-
"resource_record_set_count": 22,
12980+
"resource_record_set_count": 23,
1298112981
"tags": {},
1298212982
"vpc_id": null,
1298312983
"zone_id": "Z06340373MQ1RZIP7YOXL"
@@ -13237,7 +13237,7 @@
1323713237
],
1323813238
"primary_name_server": "ns-1505.awsdns-60.org",
1323913239
"private_zone": false,
13240-
"resource_record_set_count": 22,
13240+
"resource_record_set_count": 23,
1324113241
"tags": {},
1324213242
"vpc_id": null,
1324313243
"zone_id": "Z06340373MQ1RZIP7YOXL"
@@ -20635,7 +20635,7 @@
2063520635
],
2063620636
"primary_name_server": "ns-1505.awsdns-60.org",
2063720637
"private_zone": false,
20638-
"resource_record_set_count": 22,
20638+
"resource_record_set_count": 23,
2063920639
"tags": {},
2064020640
"vpc_id": null,
2064120641
"zone_id": "Z06340373MQ1RZIP7YOXL"
@@ -24752,7 +24752,7 @@
2475224752
],
2475324753
"primary_name_server": "ns-1505.awsdns-60.org",
2475424754
"private_zone": false,
24755-
"resource_record_set_count": 22,
24755+
"resource_record_set_count": 23,
2475624756
"tags": {},
2475724757
"vpc_id": null,
2475824758
"zone_id": "Z06340373MQ1RZIP7YOXL"
@@ -34192,7 +34192,7 @@
3419234192
],
3419334193
"primary_name_server": "ns-1505.awsdns-60.org",
3419434194
"private_zone": false,
34195-
"resource_record_set_count": 22,
34195+
"resource_record_set_count": 23,
3419634196
"tags": {},
3419734197
"vpc_id": null,
3419834198
"zone_id": "Z06340373MQ1RZIP7YOXL"
@@ -36416,7 +36416,7 @@
3641636416
"name": "certbot_frame.akerl.app",
3641736417
"path": "/",
3641836418
"permissions_boundary": "",
36419-
"tags": null,
36419+
"tags": {},
3642036420
"tags_all": {},
3642136421
"unique_id": "AIDA3D3X4QXY2X75WDHKM"
3642236422
},
@@ -36444,8 +36444,10 @@
3644436444
"sensitive_attributes": [],
3644536445
"private": "bnVsbA==",
3644636446
"dependencies": [
36447+
"aws_route53_delegation_set.main",
3644736448
"module.frameproxy_validation.aws_iam_user.this",
36448-
"module.frameproxy_validation.data.aws_iam_policy_document.certbot_validation"
36449+
"module.frameproxy_validation.data.aws_iam_policy_document.certbot_validation",
36450+
"module.zones.aws_route53_zone.this"
3644936451
]
3645036452
}
3645136453
]
@@ -36474,6 +36476,7 @@
3647436476
"name": "frame.akerl.app",
3647536477
"records": [
3647636478
"0 iodef \"mailto:[email protected]\"",
36479+
"0 issue \"amazon.com\"",
3647736480
"0 issue \"letsencrypt.org; validationmethods=dns-01\"",
3647836481
"0 issuewild \";\""
3647936482
],

0 commit comments

Comments
 (0)