migrate

Terraform/netbird-policy/files/main.tf

@@ -0,0 +1,84 @@
+locals {
+  policy_source_group_names = [
+    for name in split(",", "<< source_group_names >>") : trimspace(name)
+    if trimspace(name) != ""
+  ]
+  policy_destination_group_names = [
+    for name in split(",", "<< destination_group_names >>") : trimspace(name)
+    if trimspace(name) != ""
+  ]
+<%- if source_posture_check_names %>
+  policy_source_posture_check_names = [
+    for name in split(",", "<< source_posture_check_names >>") : trimspace(name)
+    if trimspace(name) != ""
+  ]
+<%- endif %>
+<%- if authorized_group_entries %>
+  policy_authorized_group_entries = [
+    for entry in split(";", "<< authorized_group_entries >>") : trimspace(entry)
+    if trimspace(entry) != ""
+  ]
+  policy_authorized_group_map = {
+    for entry in local.policy_authorized_group_entries :
+    trimspace(split("|", entry)[0]) => [
+      for username in split(",", split("|", entry)[1]) : trimspace(username)
+      if trimspace(username) != ""
+    ]
+  }
+<%- endif %>
+  policy_group_names = distinct(concat(
+    local.policy_source_group_names,
+    local.policy_destination_group_names,
+<%- if authorized_group_entries %>
+    keys(local.policy_authorized_group_map),
+<%- endif %>
+    []
+  ))
+}
+
+data "netbird_group" "policy_groups" {
+  for_each = toset(local.policy_group_names)
+  name     = each.value
+}
+
+<%- if source_posture_check_names %>
+data "netbird_posture_check" "source_posture_checks" {
+  for_each = toset(local.policy_source_posture_check_names)
+  name     = each.value
+}
+
+<%- endif %>
+resource "netbird_policy" "policy" {
+  name = "<< policy_name >>"
+<%- if policy_description %>
+  description = "<< policy_description >>"
+<%- endif %>
+  enabled = << policy_enabled | lower >>
+<%- if source_posture_check_names %>
+  source_posture_checks = [for name in local.policy_source_posture_check_names : data.netbird_posture_check.source_posture_checks[name].id]
+<%- endif %>
+
+  rule {
+    name          = "<< rule_name >>"
+    action        = "<< rule_action >>"
+    bidirectional = << rule_bidirectional | lower >>
+    enabled       = << rule_enabled | lower >>
+    protocol      = "<< rule_protocol >>"
+    sources       = [for name in local.policy_source_group_names : data.netbird_group.policy_groups[name].id]
+    destinations  = [for name in local.policy_destination_group_names : data.netbird_group.policy_groups[name].id]
+<%- if rule_description %>
+    description   = "<< rule_description >>"
+<%- endif %>
+<%- if ports %>
+    ports         = [<< ports >>]
+<%- endif %>
+<%- if rule_protocol == "netbird-ssh" %>
+<%- if authorized_group_entries %>
+    authorized_groups = {
+      for group_name, users in local.policy_authorized_group_map :
+      data.netbird_group.policy_groups[group_name].id => users
+    }
+<%- endif %>
+<%- endif %>
+  }
+}