36 lines
1.6 KiB
Markdown
36 lines
1.6 KiB
Markdown
# terraform-binarylane
|
|
|
|
Terraform/Terragrunt for BinaryLane cloud infrastructure.
|
|
|
|
## Layout
|
|
|
|
```
|
|
environments/root.hcl # consul state backend
|
|
environments/global/terragrunt.hcl
|
|
modules/binarylane/
|
|
```
|
|
|
|
`make plan` / `make apply` reconcile every unit. `make pre-commit` runs the
|
|
hooks. State lives in Consul under `infra/terraform/binarylane/<unit>/state`.
|
|
|
|
## Auth
|
|
|
|
The BinaryLane API token is read from `kv/service/terraform/binarylane` (field
|
|
`token`) and passed in as `TF_VAR_binarylane_token`; Consul state creds come
|
|
from `consul_root/au/syd1/creds/terraform-binarylane`. Both are granted to the
|
|
`terraform_binarylane` AppRole and the `woodpecker_terraform_binarylane` k8s
|
|
role in terraform-vault.
|
|
|
|
## Mail edge
|
|
|
|
Each DMZ VPC (`syd` 172.18.30.0/24, `bne` 172.18.32.0/24, `mel` 172.18.31.0/24; mel is gated off until BinaryLane has stock) holds a postfix edge host and a vpn host. The vpn
|
|
host runs wg0 as a /31 point-to-point link to its own prodnxsr0020 interface
|
|
(`wg-syd` on 51821, `wg-bne` on 51822, `wg-mel` on 51823; `router_links` output) and forwards the
|
|
lab routes for its VPC; the edge host reaches the lab through it and has no
|
|
WireGuard. Link /31s and vpn loopbacks (dum0) come from 198.18.2.160/27. Lab
|
|
traffic is sourced from the /31 until Puppet brings up FRR, which peers OSPF
|
|
over wg0 and advertises the loopback and VPC to the router. Router keys live at `kv/service/wireguard/binarylane/prodnxsr0020-<region>`.
|
|
wg0 is bootstrapped from a key in `user_data` (readable via the BinaryLane
|
|
API); Puppet then manages it from Vault, so rotate by replacing
|
|
`wireguard_asymmetric_key.vpn` here and letting Puppet roll it out.
|