1.6 KiB
terraform-binarylane
Terraform/Terragrunt for BinaryLane cloud infrastructure.
Layout
environments/root.hcl # consul state backend
environments/global/terragrunt.hcl
modules/binarylane/
make plan / make apply reconcile every unit. make pre-commit runs the
hooks. State lives in Consul under infra/terraform/binarylane/<unit>/state.
Auth
The BinaryLane API token is read from kv/service/terraform/binarylane (field
token) and passed in as TF_VAR_binarylane_token; Consul state creds come
from consul_root/au/syd1/creds/terraform-binarylane. Both are granted to the
terraform_binarylane AppRole and the woodpecker_terraform_binarylane k8s
role in terraform-vault.
Mail edge
Each DMZ VPC (syd 198.18.30.0/24, mel 198.18.31.0/24) holds a postfix edge host and a vpn host. The vpn
host runs wg0 as a /31 point-to-point link to its own prodnxsr0020 interface
(wg-syd on 51821, wg-mel on 51822; router_links output) and forwards the
lab routes for its VPC; the edge host reaches the lab through it and has no
WireGuard. The VPC /24 is connected on both hosts, so it wins over the lab
198.18.0.0/16 route via the vpn host. Link /31s and vpn loopbacks (dum0) come from 198.18.2.160/27. Lab
traffic is sourced from the /31 until Puppet brings up FRR, which peers OSPF
over wg0 and advertises the loopback and VPC to the router. Router keys live at kv/service/wireguard/binarylane/prodnxsr0020-<region>.
wg0 is bootstrapped from a key in user_data (readable via the BinaryLane
API); Puppet then manages it from Vault, so rotate by replacing
wireguard_asymmetric_key.vpn here and letting Puppet roll it out.