migrate
This commit is contained in:
Mike McFetridge
@@ -0,0 +1,145 @@
|
||||
<%- if domain_mode == "free" %>
|
||||
data "netbird_reverse_proxy_domain" "free" {
|
||||
type = "free"
|
||||
}
|
||||
|
||||
<%- endif %>
|
||||
<%- if domain_mode == "custom" %>
|
||||
data "netbird_reverse_proxy_domain" "custom" {
|
||||
domain = "<< custom_domain >>"
|
||||
validated = true
|
||||
}
|
||||
|
||||
<%- endif %>
|
||||
<%- if target_type == "peer" %>
|
||||
data "netbird_peer" "target_peer" {
|
||||
name = "<< target_peer_name >>"
|
||||
}
|
||||
|
||||
<%- endif %>
|
||||
<%- if target_type == "host" %>
|
||||
data "netbird_network" "target_network" {
|
||||
name = "<< target_network_name >>"
|
||||
}
|
||||
|
||||
data "netbird_network_resource" "target_resource" {
|
||||
network_id = data.netbird_network.target_network.id
|
||||
name = "<< target_host_name >>"
|
||||
}
|
||||
|
||||
<%- endif %>
|
||||
<%- if target_type == "domain" %>
|
||||
data "netbird_network" "target_network" {
|
||||
name = "<< target_network_name >>"
|
||||
}
|
||||
|
||||
data "netbird_network_resource" "target_resource" {
|
||||
network_id = data.netbird_network.target_network.id
|
||||
name = "<< target_domain_name >>"
|
||||
}
|
||||
|
||||
<%- endif %>
|
||||
<%- if target_type == "subnet" %>
|
||||
data "netbird_network" "target_network" {
|
||||
name = "<< target_network_name >>"
|
||||
}
|
||||
|
||||
data "netbird_network_resource" "target_resource" {
|
||||
network_id = data.netbird_network.target_network.id
|
||||
name = "<< target_subnet_name >>"
|
||||
}
|
||||
|
||||
<%- endif %>
|
||||
<%- if target_type != "peer" %>
|
||||
locals {
|
||||
reverse_proxy_target_resource_type = can(cidrnetmask(data.netbird_network_resource.target_resource.address)) ? "subnet" : (length(regexall(":", data.netbird_network_resource.target_resource.address)) > 0 ? "host" : (length(regexall("[A-Za-z*]", data.netbird_network_resource.target_resource.address)) > 0 ? "domain" : "host"))
|
||||
}
|
||||
|
||||
<%- endif %>
|
||||
<%- if bearer_distribution_group_names %>
|
||||
locals {
|
||||
reverse_proxy_bearer_group_names = [
|
||||
for name in split(",", "<< bearer_distribution_group_names >>") : trimspace(name)
|
||||
if trimspace(name) != ""
|
||||
]
|
||||
}
|
||||
|
||||
data "netbird_group" "bearer_distribution_groups" {
|
||||
for_each = toset(local.reverse_proxy_bearer_group_names)
|
||||
name = each.value
|
||||
}
|
||||
|
||||
<%- endif %>
|
||||
resource "netbird_reverse_proxy_service" "reverse_proxy_service" {
|
||||
name = "<< service_name >>"
|
||||
<%- if domain_mode == "free" %>
|
||||
domain = data.netbird_reverse_proxy_domain.free.domain
|
||||
<%- endif %>
|
||||
<%- if domain_mode == "custom" %>
|
||||
domain = data.netbird_reverse_proxy_domain.custom.domain
|
||||
<%- endif %>
|
||||
enabled = << service_enabled | lower >>
|
||||
pass_host_header = << pass_host_header | lower >>
|
||||
rewrite_redirects = << rewrite_redirects | lower >>
|
||||
|
||||
targets = [{
|
||||
<%- if target_type == "peer" %>
|
||||
target_id = data.netbird_peer.target_peer.id
|
||||
<%- endif %>
|
||||
<%- if target_type == "host" %>
|
||||
target_id = data.netbird_network_resource.target_resource.id
|
||||
<%- endif %>
|
||||
<%- if target_type == "domain" %>
|
||||
target_id = data.netbird_network_resource.target_resource.id
|
||||
<%- endif %>
|
||||
<%- if target_type == "subnet" %>
|
||||
target_id = data.netbird_network_resource.target_resource.id
|
||||
<%- endif %>
|
||||
<%- if target_type == "peer" %>
|
||||
target_type = "peer"
|
||||
<%- endif %>
|
||||
<%- if target_type != "peer" %>
|
||||
target_type = local.reverse_proxy_target_resource_type
|
||||
<%- endif %>
|
||||
port = << target_port >>
|
||||
protocol = "<< target_protocol >>"
|
||||
enabled = << target_enabled | lower >>
|
||||
<%- if target_host %>
|
||||
host = "<< target_host >>"
|
||||
<%- endif %>
|
||||
<%- if not target_host and target_type != "peer" %>
|
||||
host = local.reverse_proxy_target_resource_type == "subnet" ? split("/", data.netbird_network_resource.target_resource.address)[0] : null
|
||||
<%- endif %>
|
||||
<%- if target_path %>
|
||||
path = "<< target_path >>"
|
||||
<%- endif %>
|
||||
}]
|
||||
|
||||
auth = {
|
||||
<%- if auth_mode == "link" %>
|
||||
link_auth = {
|
||||
enabled = true
|
||||
}
|
||||
<%- endif %>
|
||||
<%- if auth_mode == "password" %>
|
||||
password_auth = {
|
||||
enabled = true
|
||||
password = "<< auth_password >>"
|
||||
}
|
||||
<%- endif %>
|
||||
<%- if auth_mode == "pin" %>
|
||||
pin_auth = {
|
||||
enabled = true
|
||||
pin = "<< auth_pin >>"
|
||||
}
|
||||
<%- endif %>
|
||||
<%- if auth_mode == "bearer" %>
|
||||
bearer_auth = {
|
||||
enabled = true
|
||||
<%- if bearer_distribution_group_names %>
|
||||
distribution_groups = [for name in local.reverse_proxy_bearer_group_names : data.netbird_group.bearer_distribution_groups[name].id]
|
||||
<%- endif %>
|
||||
}
|
||||
<%- endif %>
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,283 @@
|
||||
{
|
||||
"slug": "netbird-reverse-proxy-service",
|
||||
"kind": "terraform",
|
||||
"metadata": {
|
||||
"name": "NetBird Reverse Proxy Service",
|
||||
"description": "Creates a NetBird reverse proxy service with one backend target and configurable authentication.",
|
||||
"tags": [
|
||||
"netbird",
|
||||
"terraform",
|
||||
"reverse-proxy"
|
||||
],
|
||||
"icon": {
|
||||
"provider": "selfhst",
|
||||
"id": "netbird"
|
||||
},
|
||||
"draft": false,
|
||||
"version": {
|
||||
"name": "0.0.17",
|
||||
"source_dep_name": "manual/netbird-reverse-proxy-service"
|
||||
}
|
||||
},
|
||||
"variables": [
|
||||
{
|
||||
"title": "General",
|
||||
"name": "general",
|
||||
"items": [
|
||||
{
|
||||
"name": "service_name",
|
||||
"type": "str",
|
||||
"title": "Service Name",
|
||||
"required": true,
|
||||
"config": {
|
||||
"placeholder": "web-app"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "domain_mode",
|
||||
"type": "enum",
|
||||
"title": "Domain Mode",
|
||||
"required": true,
|
||||
"default": "free",
|
||||
"config": {
|
||||
"options": [
|
||||
"free",
|
||||
"custom"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "custom_domain",
|
||||
"type": "str",
|
||||
"title": "Custom Domain",
|
||||
"required": true,
|
||||
"description": "Validated custom domain for the reverse proxy service.",
|
||||
"needs": [
|
||||
"domain_mode=custom"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "app.example.com"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "service_enabled",
|
||||
"type": "bool",
|
||||
"title": "Enabled",
|
||||
"required": false,
|
||||
"default": true
|
||||
},
|
||||
{
|
||||
"name": "pass_host_header",
|
||||
"type": "bool",
|
||||
"title": "Pass Host Header",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Pass the original client Host header through to the backend."
|
||||
},
|
||||
{
|
||||
"name": "rewrite_redirects",
|
||||
"type": "bool",
|
||||
"title": "Rewrite Redirects",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Rewrite backend redirect locations to the public-facing service domain."
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Target",
|
||||
"name": "target",
|
||||
"items": [
|
||||
{
|
||||
"name": "target_type",
|
||||
"type": "enum",
|
||||
"title": "Target Type",
|
||||
"required": true,
|
||||
"default": "peer",
|
||||
"description": "Target type for the backend service.",
|
||||
"config": {
|
||||
"options": [
|
||||
"peer",
|
||||
"host",
|
||||
"domain",
|
||||
"subnet"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "target_peer_name",
|
||||
"type": "str",
|
||||
"title": "Peer Name",
|
||||
"required": true,
|
||||
"description": "Existing NetBird peer name to resolve via `data \"netbird_peer\"` when `target_type=peer`.",
|
||||
"needs": [
|
||||
"target_type=peer"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "web-app"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "target_network_name",
|
||||
"type": "str",
|
||||
"title": "Network Name",
|
||||
"required": true,
|
||||
"description": "Existing NetBird network name that contains the selected host, domain, or subnet resource.",
|
||||
"needs": [
|
||||
"target_type=host,domain,subnet"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "production-network"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "target_host_name",
|
||||
"type": "str",
|
||||
"title": "Host Resource Name",
|
||||
"required": true,
|
||||
"description": "Existing NetBird network resource name for a host target.",
|
||||
"needs": [
|
||||
"target_type=host"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "internal-app-host"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "target_domain_name",
|
||||
"type": "str",
|
||||
"title": "Domain Resource Name",
|
||||
"required": true,
|
||||
"description": "Existing NetBird network resource name for a domain target.",
|
||||
"needs": [
|
||||
"target_type=domain"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "app.example.internal"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "target_subnet_name",
|
||||
"type": "str",
|
||||
"title": "Subnet Resource Name",
|
||||
"required": true,
|
||||
"description": "Existing NetBird network resource name for a subnet target.",
|
||||
"needs": [
|
||||
"target_type=subnet"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "corp-lan"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "target_port",
|
||||
"type": "int",
|
||||
"title": "Target Port",
|
||||
"required": true,
|
||||
"default": 8080,
|
||||
"description": "Backend port for the target.",
|
||||
"config": {
|
||||
"placeholder": "8080"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "target_protocol",
|
||||
"type": "enum",
|
||||
"title": "Target Protocol",
|
||||
"required": true,
|
||||
"default": "http",
|
||||
"config": {
|
||||
"options": [
|
||||
"http",
|
||||
"https"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "target_enabled",
|
||||
"type": "bool",
|
||||
"title": "Target Enabled",
|
||||
"required": false,
|
||||
"default": true
|
||||
},
|
||||
{
|
||||
"name": "target_host",
|
||||
"type": "str",
|
||||
"title": "Resolved Host",
|
||||
"required": false,
|
||||
"description": "Optional backend IP or domain override for the target. Subnet targets need a host IP within the CIDR range.",
|
||||
"config": {
|
||||
"placeholder": "10.20.30.40"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "target_path",
|
||||
"type": "str",
|
||||
"title": "Path Prefix",
|
||||
"required": false,
|
||||
"description": "Optional URL path prefix for the backend target.",
|
||||
"config": {
|
||||
"placeholder": "/"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Authentication",
|
||||
"name": "authentication",
|
||||
"items": [
|
||||
{
|
||||
"name": "auth_mode",
|
||||
"type": "enum",
|
||||
"title": "Authentication Mode",
|
||||
"required": true,
|
||||
"default": "link",
|
||||
"description": "Authentication method exposed by the reverse proxy service.",
|
||||
"config": {
|
||||
"options": [
|
||||
"link",
|
||||
"none",
|
||||
"password",
|
||||
"pin",
|
||||
"bearer"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "auth_password",
|
||||
"type": "secret",
|
||||
"title": "Password",
|
||||
"required": true,
|
||||
"description": "Shared password for password-based access.",
|
||||
"needs": [
|
||||
"auth_mode=password"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "auth_pin",
|
||||
"type": "secret",
|
||||
"title": "PIN",
|
||||
"required": true,
|
||||
"description": "Shared PIN for PIN-based access.",
|
||||
"needs": [
|
||||
"auth_mode=pin"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "bearer_distribution_group_names",
|
||||
"type": "str",
|
||||
"title": "Bearer Distribution Groups",
|
||||
"required": false,
|
||||
"description": "Comma-separated existing NetBird group names allowed for bearer-auth access.",
|
||||
"needs": [
|
||||
"auth_mode=bearer"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "SRE,Incident Response",
|
||||
"textarea": true
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user