Skip to content

Commit 499917e

Browse files
chasezhengchasezheng
committed
buncha refactoring
1 parent 9041366 commit 499917e

File tree

2 files changed

+52
-123
lines changed

2 files changed

+52
-123
lines changed

‎main.tf

Lines changed: 42 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -2,47 +2,20 @@
22
# creates and deletes users accordingly
33

44
locals {
5-
metadata = merge(var.metadata, {
6-
sshKeys = "${var.remote_user}:${tls_private_key.ssh-key.public_key_openssh}"
7-
})
8-
ssh_tag = ["allow-ssh"]
9-
openvpn_tag = ["openvpn-${var.name}"]
10-
tags = toset(concat(var.tags, local.ssh_tag, local.openvpn_tag))
11-
12-
output_folder = var.output_dir
135
private_key_file = "private-key.pem"
146
# adding the null_resource to prevent evaluating this until the openvpn_update_users has executed
157
refetch_user_ovpn = null_resource.openvpn_update_users_script.id != "" ? !alltrue([for x in var.users : fileexists("${var.output_dir}/${x}.ovpn")]) : false
16-
name = var.name == "" ? "" : "${var.name}-"
17-
access_config = [{
18-
nat_ip = google_compute_address.default.address
19-
network_tier = var.network_tier
20-
}]
218
}
229

23-
resource "google_compute_firewall" "allow-external-ssh" {
24-
name = "openvpn-${var.name}-allow-external-ssh"
25-
project = var.project_id
26-
network = var.network
27-
28-
allow {
29-
protocol = "tcp"
30-
ports = ["22"]
31-
}
32-
33-
source_ranges = ["0.0.0.0/0"]
34-
target_tags = local.ssh_tag
35-
}
36-
37-
resource "google_compute_firewall" "allow-openvpn-udp-port" {
38-
name = "openvpn-${var.name}-allow"
10+
resource "google_compute_firewall" "allow-ingress-to-openvpn-server" {
11+
name = "openvpn-${var.name}-allow-ingress"
3912
project = var.project_id
4013
network = var.network
4114
description = "Creates firewall rule targeting the openvpn instance"
4215

4316
allow {
4417
protocol = "tcp"
45-
ports = ["1194"]
18+
ports = ["1194", "22"]
4619
}
4720

4821
allow {
@@ -51,10 +24,9 @@ resource "google_compute_firewall" "allow-openvpn-udp-port" {
5124
}
5225

5326
source_ranges = ["0.0.0.0/0"]
54-
target_tags = local.openvpn_tag
27+
target_tags = ["openvpn-${var.name}"]
5528
}
5629

57-
5830
resource "google_compute_address" "default" {
5931
name = "openvpn-${var.name}-global-ip"
6032
project = var.project_id
@@ -63,53 +35,40 @@ resource "google_compute_address" "default" {
6335
}
6436

6537
resource "tls_private_key" "ssh-key" {
66-
algorithm = "RSA"
38+
algorithm = "ECDSA"
39+
ecdsa_curve = "P521"
6740
}
6841

69-
7042
// SSH Private Key
7143
resource "local_sensitive_file" "private_key" {
7244
content = tls_private_key.ssh-key.private_key_pem
7345
filename = "${var.output_dir}/${local.private_key_file}"
7446
file_permission = "0400"
7547
}
7648

77-
resource "random_id" "this" {
78-
byte_length = "8"
79-
}
80-
81-
resource "random_id" "password" {
82-
byte_length = "16"
49+
resource "random_string" "openvpn_server_suffix" {
50+
length = 8
51+
special = false
52+
upper = false
8353
}
8454

85-
// Use a persistent disk so that it can be remounted on another instance.
86-
resource "google_compute_disk" "this" {
87-
name = "openvpn-${var.name}-disk"
88-
image = var.image_family
89-
size = var.disk_size_gb
90-
type = var.disk_type
91-
project = var.project_id
92-
zone = var.zone
93-
}
94-
95-
#-------------------
96-
# Instance Template
97-
#-------------------
98-
resource "google_compute_instance_template" "tpl" {
99-
name_prefix = "openvpn-${var.name}-"
55+
resource "google_compute_instance" "openvpn_server" {
56+
name = "openvpn-${var.name}-${random_string.openvpn_server_suffix.id}"
10057
project = var.project_id
10158
machine_type = var.machine_type
10259
labels = var.labels
103-
metadata = local.metadata
104-
region = var.region
60+
metadata = merge(
61+
var.metadata,
62+
{ sshKeys = "${var.remote_user}:${tls_private_key.ssh-key.public_key_openssh}" }
63+
)
64+
zone = var.zone
10565

10666
metadata_startup_script = <<SCRIPT
10767
curl -O ${var.install_script_url}
10868
chmod +x openvpn-install.sh
10969
mv openvpn-install.sh /home/${var.remote_user}/
11070
chown ${var.remote_user}:${var.remote_user} /home/${var.remote_user}/openvpn-install.sh
11171
export AUTO_INSTALL=y
112-
export PASS=1
11372
# Using Custom DNS
11473
export DNS=13
11574
export DNS1="${var.dns_servers[0]}"
@@ -119,63 +78,53 @@ resource "google_compute_instance_template" "tpl" {
11978
/home/${var.remote_user}/openvpn-install.sh
12079
SCRIPT
12180

122-
disk {
123-
auto_delete = var.auto_delete_disk
124-
boot = true
125-
source = google_compute_disk.this.name
81+
boot_disk {
82+
auto_delete = true
83+
initialize_params {
84+
type = "pd-standard"
85+
image = "ubuntu-minimal-2004-focal-v20220419a"
86+
}
12687
}
12788

12889
dynamic "service_account" {
129-
for_each = [var.service_account]
90+
for_each = var.service_account == null ? [] : [var.service_account]
13091

13192
content {
132-
email = lookup(service_account.value, "email", null)
133-
scopes = lookup(service_account.value, "scopes", null)
93+
email = try(each.value.email, null)
94+
scopes = try(each.scopes, [])
13495
}
13596
}
13697

13798
network_interface {
13899
network = var.network
139100
subnetwork = var.subnetwork
140101

141-
dynamic "access_config" {
142-
for_each = local.access_config
143-
144-
content {
145-
nat_ip = access_config.value.nat_ip
146-
network_tier = access_config.value.network_tier
147-
}
102+
access_config {
103+
nat_ip = google_compute_address.default.address
104+
network_tier = var.network_tier
148105
}
149106
}
150107

151-
tags = local.tags
108+
tags = toset(
109+
concat(var.tags, tolist(google_compute_firewall.allow-ingress-to-openvpn-server.target_tags))
110+
)
111+
152112

153113
lifecycle {
154114
create_before_destroy = "true"
155115
}
156-
}
157116

158-
resource "google_compute_instance_from_template" "this" {
159-
name = "openvpn-${var.name}"
160-
project = var.project_id
161-
zone = var.zone
162-
163-
network_interface {
164-
network = var.network
165-
subnetwork = var.subnetwork
166-
access_config {
167-
nat_ip = google_compute_address.default.address
168-
network_tier = var.network_tier
169-
}
117+
provisioner "local-exec" {
118+
command = "ssh-keygen -R \"${self.network_interface[0].access_config[0].nat_ip}\" || true"
119+
when = destroy
170120
}
171-
source_instance_template = google_compute_instance_template.tpl.self_link
172121
}
173122

174123
# Updates/creates the users VPN credentials on the VPN server
175124
resource "null_resource" "openvpn_update_users_script" {
176125
triggers = {
177126
users = join(",", var.users)
178-
instance = google_compute_instance_from_template.this.instance_id
127+
instance = google_compute_instance.openvpn_server.instance_id
179128
}
180129

181130
connection {
@@ -184,6 +133,7 @@ resource "null_resource" "openvpn_update_users_script" {
184133
host = google_compute_address.default.address
185134
private_key = tls_private_key.ssh-key.private_key_pem
186135
agent = false
136+
timeout = "60s"
187137
}
188138

189139
provisioner "file" {
@@ -195,9 +145,10 @@ resource "null_resource" "openvpn_update_users_script" {
195145
# Create New User with MENU_OPTION=1
196146
provisioner "remote-exec" {
197147
inline = [
198-
"while [ ! -f /etc/openvpn/server.conf ]; do sleep 10; done",
148+
"while [ ! -f /etc/openvpn/server.conf ]; do sleep 1; done",
149+
"while [ ! -f /etc/openvpn/client-template.txt ]; do sleep 1; done",
199150
"chmod +x ~${var.remote_user}/update_users.sh",
200-
"sudo ROUTE_ONLY_PRIVATE_IPS='${var.route_only_private_ips}' ~${var.remote_user}/update_users.sh ${join(" ", var.users)}",
151+
"sudo REVOKE_ALL_CLIENT_CERTIFICATES=n ROUTE_ONLY_PRIVATE_IPS='${var.route_only_private_ips}' ~${var.remote_user}/update_users.sh ${join(" ", var.users)}",
201152
]
202153
when = create
203154
}
@@ -208,10 +159,9 @@ resource "null_resource" "openvpn_update_users_script" {
208159
when = create
209160
}
210161

211-
depends_on = [google_compute_instance_from_template.this, local_sensitive_file.private_key]
162+
depends_on = [google_compute_instance.openvpn_server, local_sensitive_file.private_key, tls_private_key.ssh-key]
212163
}
213164

214-
215165
# Download user configurations to output_dir
216166
resource "null_resource" "openvpn_download_configurations" {
217167
triggers = {

‎variables.tf

Lines changed: 10 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -27,35 +27,14 @@ variable "subnetwork" {
2727
default = null
2828
}
2929

30-
variable "image_family" {
31-
type = string
32-
default = "ubuntu-2004-lts"
33-
}
34-
35-
variable "disk_type" {
36-
description = "(Optional) The GCE disk type. Can be either pd-ssd, local-ssd, pd-balanced or pd-standard"
37-
default = "pd-standard"
38-
}
39-
40-
variable "disk_size_gb" {
41-
type = string
42-
default = "30"
43-
}
44-
45-
variable "auto_delete_disk" {
46-
description = "Whether or not the boot disk should be auto-deleted"
47-
default = false
48-
}
49-
5030
variable "service_account" {
51-
default = {
52-
email = null
53-
scopes = []
54-
}
55-
type = object({
56-
email = string,
57-
scopes = set(string)
58-
})
31+
default = null
32+
type = object(
33+
{
34+
email = string,
35+
scopes = set(string)
36+
}
37+
)
5938
description = "Service account to attach to the instance. See https://www.terraform.io/docs/providers/google/r/compute_instance_template.html#service_account."
6039
}
6140

@@ -97,7 +76,7 @@ variable "remote_user" {
9776

9877
variable "machine_type" {
9978
description = "Machine type to create, e.g. n1-standard-1"
100-
default = "n1-standard-1"
79+
default = "e2-micro"
10180
}
10281

10382
variable "route_only_private_ips" {
@@ -106,9 +85,9 @@ variable "route_only_private_ips" {
10685
}
10786

10887
variable "install_script_url" {
109-
description = "The commit sha we are using in order to determine which version of the install file to use: https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh"
88+
description = "Openvpn install script url."
11089
type = string
111-
default = "https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh"
90+
default = "https://raw.githubusercontent.com/angristan/openvpn-install/b3b7593b2d4dd146f9c9da810bcec9b07a69c026/openvpn-install.sh"
11291
}
11392

11493
variable "dns_servers" {

0 commit comments

Comments
 (0)