terraform-binarylane

Terraform/Terragrunt for BinaryLane cloud infrastructure.

Layout

environments/root.hcl                # consul state backend
environments/global/terragrunt.hcl
modules/binarylane/

make plan / make apply reconcile every unit. make pre-commit runs the hooks. State lives in Consul under infra/terraform/binarylane/<unit>/state.

Auth

The BinaryLane API token is read from kv/service/terraform/binarylane (field token) and passed in as TF_VAR_binarylane_token; Consul state creds come from consul_root/au/syd1/creds/terraform-binarylane. Both are granted to the terraform_binarylane AppRole and the woodpecker_terraform_binarylane k8s role in terraform-vault.

Mail edge

Each DMZ VPC (syd, mel) holds a postfix edge host and a vpn host. The vpn host runs wg0 to prodnxsr0020 and forwards the lab routes for its VPC; the edge host reaches the lab through it and has no WireGuard. wg0 is bootstrapped from a key in user_data (readable via the BinaryLane API); Puppet then manages it from Vault, so rotate by replacing wireguard_asymmetric_key.vpn here and letting Puppet roll it out.