unkin/terraform-provider-tomswallapi
4
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'Add snat/netmap/nat provider resources' (#2) from benvin/nat-resources into main

Browse Source 
Reviewed-on: #2
This commit was merged in pull request #2.
This commit is contained in:
BenVincent
2026-07-24 22:51:16 +10:00
parent 940e334e48 08fc9b209b
commit 241e5167c5
6 changed files with 568 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3
View File
@@ -33,6 +33,9 @@ provider "tomswallapi" {
| `tomswallapi_device` | name | `class` = router/firewall, `fabric`, `resolver`, `settings` |
| `tomswallapi_binding` | device:zone | zone→interface map (import as `device:zone`) |
| `tomswallapi_rule` | id | shorewall-style `source`/`dest` element lists |
| `tomswallapi_snat` | id | masquerade/SNAT; `source` zone-or-CIDR, `egress` zone |
| `tomswallapi_netmap` | id | net-to-net map, anchored `device:zone`\|`device:interface` |
| `tomswallapi_nat` | id | 1:1 static NAT bound to a `device` |
## Example
examples/main.tf
+26
View File
@@ -88,3 +88,29 @@ resource "tomswallapi_rule" "a_to_cloudflare" {
dest = ["net:+asn_cloudflare"]
portgroup = tomswallapi_portgroup.https.name
}
# --- NAT tier ---------------------------------------------------------------
# Masquerade zone-a out the internet edge. Renders on devices binding both
# zone-a and net (i.e. edge firewalls), on their net-facing interface.
resource "tomswallapi_snat" "masq_zone_a" {
action = "masquerade"
source = tomswallapi_zone.zone_a.name
egress = tomswallapi_zone.net.name
}
# 1:1 static NAT of a public IP to an internal host, on fw-a.
resource "tomswallapi_nat" "web" {
device = tomswallapi_device.fw_a.name
external = "203.0.113.10"
internal = "10.1.0.10"
interface = "eth0"
}
# Network-to-network map anchored at fw-a's net interface.
resource "tomswallapi_netmap" "remap" {
type = "dnat"
from_net = "10.0.0.0/24"
to_net = "192.168.1.0/24"
anchor = "${tomswallapi_device.fw_a.name}:${tomswallapi_zone.net.name}"
}
internal/provider/provider.go
+3
View File
@@ -75,6 +75,9 @@ func (p *tomswallProvider) Resources(_ context.Context) []func() resource.Resour
NewDeviceResource,
NewBindingResource,
NewRuleResource,
NewSNATResource,
NewNetmapResource,
NewNATResource,
}
}
internal/provider/resource_nat.go
+173
View File
@@ -0,0 +1,173 @@
package provider
import (
"context"
"strconv"
"github.com/hashicorp/terraform-plugin-framework/path"
"github.com/hashicorp/terraform-plugin-framework/resource"
"github.com/hashicorp/terraform-plugin-framework/resource/schema"
"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
"github.com/hashicorp/terraform-plugin-framework/types"
)
var (
_ resource.Resource = &natResource{}
_ resource.ResourceWithImportState = &natResource{}
)
type natResource struct{ client *apiClient }
type natModel struct {
ID types.Int64 `tfsdk:"id"`
Device types.String `tfsdk:"device"`
External types.String `tfsdk:"external"`
Internal types.String `tfsdk:"internal"`
Interface types.String `tfsdk:"interface"`
Comment types.String `tfsdk:"comment"`
}
type natAPI struct {
ID int64 `json:"id,omitempty"`
Device string `json:"device"`
External string `json:"external"`
Internal string `json:"internal"`
Interface string `json:"interface,omitempty"`
Comment string `json:"comment,omitempty"`
}
func NewNATResource() resource.Resource { return &natResource{} }
func (r *natResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
resp.TypeName = req.ProviderTypeName + "_nat"
}
func (r *natResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
resp.Schema = schema.Schema{
Description: "A one-to-one static NAT bound to the device that owns the external IP.",
Attributes: map[string]schema.Attribute{
"id": schema.Int64Attribute{
Description: "Server-assigned id.",
Computed: true,
PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()},
},
"device": schema.StringAttribute{
Description: "Device that holds the external address.",
Required: true,
},
"external": schema.StringAttribute{
Description: "External IP address.",
Required: true,
},
"internal": schema.StringAttribute{
Description: "Internal IP address.",
Required: true,
},
"interface": schema.StringAttribute{
Description: "Interface that has the external address.",
Optional: true,
},
"comment": schema.StringAttribute{Optional: true},
},
}
}
func (r *natResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
r.client = configureClient(req, resp)
}
func (r *natResource) body(plan natModel) natAPI {
return natAPI{
Device: plan.Device.ValueString(),
External: plan.External.ValueString(),
Internal: plan.Internal.ValueString(),
Interface: plan.Interface.ValueString(),
Comment: plan.Comment.ValueString(),
}
}
func (r *natResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
var plan natModel
resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
if resp.Diagnostics.HasError() {
return
}
var out natAPI
if err := r.client.post(ctx, "/api/v1/nat", r.body(plan), &out); err != nil {
resp.Diagnostics.AddError("create nat failed", err.Error())
return
}
resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
}
// Update: the nat API is create/delete only, so recreate and delete the old id.
func (r *natResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
var plan, state natModel
resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
if resp.Diagnostics.HasError() {
return
}
var out natAPI
if err := r.client.post(ctx, "/api/v1/nat", r.body(plan), &out); err != nil {
resp.Diagnostics.AddError("recreate nat failed", err.Error())
return
}
if id := state.ID.ValueInt64(); id != 0 {
if err := r.client.del(ctx, "/api/v1/nat/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
resp.Diagnostics.AddError("delete old nat failed", err.Error())
return
}
}
resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
}
func (r *natResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
var state natModel
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
if resp.Diagnostics.HasError() {
return
}
var out natAPI
if err := r.client.get(ctx, "/api/v1/nat/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
if isNotFound(err) {
resp.State.RemoveResource(ctx)
return
}
resp.Diagnostics.AddError("read nat failed", err.Error())
return
}
resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, state))...)
}
func (r *natResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
var state natModel
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
if resp.Diagnostics.HasError() {
return
}
if err := r.client.del(ctx, "/api/v1/nat/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
resp.Diagnostics.AddError("delete nat failed", err.Error())
}
}
func (r *natResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
id, err := strconv.ParseInt(req.ID, 10, 64)
if err != nil {
resp.Diagnostics.AddError("invalid import ID", "nat id must be an integer")
return
}
resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
}
func (r *natResource) toModel(api natAPI, prior natModel) natModel {
return natModel{
ID: types.Int64Value(api.ID),
Device: types.StringValue(api.Device),
External: types.StringValue(api.External),
Internal: types.StringValue(api.Internal),
Interface: optionalString(api.Interface, prior.Interface),
Comment: optionalString(api.Comment, prior.Comment),
}
}
internal/provider/resource_netmap.go
+173
View File
@@ -0,0 +1,173 @@
package provider
import (
"context"
"strconv"
"github.com/hashicorp/terraform-plugin-framework/path"
"github.com/hashicorp/terraform-plugin-framework/resource"
"github.com/hashicorp/terraform-plugin-framework/resource/schema"
"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
"github.com/hashicorp/terraform-plugin-framework/types"
)
var (
_ resource.Resource = &netmapResource{}
_ resource.ResourceWithImportState = &netmapResource{}
)
type netmapResource struct{ client *apiClient }
type netmapModel struct {
ID types.Int64 `tfsdk:"id"`
Type types.String `tfsdk:"type"`
FromNet types.String `tfsdk:"from_net"`
ToNet types.String `tfsdk:"to_net"`
Anchor types.String `tfsdk:"anchor"`
Comment types.String `tfsdk:"comment"`
}
type netmapAPI struct {
ID int64 `json:"id,omitempty"`
Type string `json:"type"`
FromNet string `json:"from_net"`
ToNet string `json:"to_net"`
Anchor string `json:"anchor"`
Comment string `json:"comment,omitempty"`
}
func NewNetmapResource() resource.Resource { return &netmapResource{} }
func (r *netmapResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
resp.TypeName = req.ProviderTypeName + "_netmap"
}
func (r *netmapResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
resp.Schema = schema.Schema{
Description: "A network-to-network mapping (netmap), anchored at a device:zone or device:interface. It renders on the anchored device with the zone resolved to its bound interface.",
Attributes: map[string]schema.Attribute{
"id": schema.Int64Attribute{
Description: "Server-assigned id.",
Computed: true,
PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()},
},
"type": schema.StringAttribute{
Description: "dnat or snat.",
Required: true,
},
"from_net": schema.StringAttribute{
Description: "Network (CIDR) to match.",
Required: true,
},
"to_net": schema.StringAttribute{
Description: "Network (CIDR) to rewrite to.",
Required: true,
},
"anchor": schema.StringAttribute{
Description: "Anchor as device:zone or device:interface.",
Required: true,
},
"comment": schema.StringAttribute{Optional: true},
},
}
}
func (r *netmapResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
r.client = configureClient(req, resp)
}
func (r *netmapResource) body(plan netmapModel) netmapAPI {
return netmapAPI{
Type: plan.Type.ValueString(),
FromNet: plan.FromNet.ValueString(),
ToNet: plan.ToNet.ValueString(),
Anchor: plan.Anchor.ValueString(),
Comment: plan.Comment.ValueString(),
}
}
func (r *netmapResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
var plan netmapModel
resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
if resp.Diagnostics.HasError() {
return
}
var out netmapAPI
if err := r.client.post(ctx, "/api/v1/netmap", r.body(plan), &out); err != nil {
resp.Diagnostics.AddError("create netmap failed", err.Error())
return
}
resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
}
// Update: the netmap API is create/delete only, so recreate and delete the old id.
func (r *netmapResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
var plan, state netmapModel
resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
if resp.Diagnostics.HasError() {
return
}
var out netmapAPI
if err := r.client.post(ctx, "/api/v1/netmap", r.body(plan), &out); err != nil {
resp.Diagnostics.AddError("recreate netmap failed", err.Error())
return
}
if id := state.ID.ValueInt64(); id != 0 {
if err := r.client.del(ctx, "/api/v1/netmap/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
resp.Diagnostics.AddError("delete old netmap failed", err.Error())
return
}
}
resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
}
func (r *netmapResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
var state netmapModel
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
if resp.Diagnostics.HasError() {
return
}
var out netmapAPI
if err := r.client.get(ctx, "/api/v1/netmap/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
if isNotFound(err) {
resp.State.RemoveResource(ctx)
return
}
resp.Diagnostics.AddError("read netmap failed", err.Error())
return
}
resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, state))...)
}
func (r *netmapResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
var state netmapModel
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
if resp.Diagnostics.HasError() {
return
}
if err := r.client.del(ctx, "/api/v1/netmap/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
resp.Diagnostics.AddError("delete netmap failed", err.Error())
}
}
func (r *netmapResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
id, err := strconv.ParseInt(req.ID, 10, 64)
if err != nil {
resp.Diagnostics.AddError("invalid import ID", "netmap id must be an integer")
return
}
resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
}
func (r *netmapResource) toModel(api netmapAPI, prior netmapModel) netmapModel {
return netmapModel{
ID: types.Int64Value(api.ID),
Type: types.StringValue(api.Type),
FromNet: types.StringValue(api.FromNet),
ToNet: types.StringValue(api.ToNet),
Anchor: types.StringValue(api.Anchor),
Comment: optionalString(api.Comment, prior.Comment),
}
}
internal/provider/resource_snat.go
+190
View File
@@ -0,0 +1,190 @@
package provider
import (
"context"
"strconv"
"github.com/hashicorp/terraform-plugin-framework/path"
"github.com/hashicorp/terraform-plugin-framework/resource"
"github.com/hashicorp/terraform-plugin-framework/resource/schema"
"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
"github.com/hashicorp/terraform-plugin-framework/types"
)
var (
_ resource.Resource = &snatResource{}
_ resource.ResourceWithImportState = &snatResource{}
)
type snatResource struct{ client *apiClient }
type snatModel struct {
ID types.Int64 `tfsdk:"id"`
Action types.String `tfsdk:"action"`
Source types.String `tfsdk:"source"`
Egress types.String `tfsdk:"egress"`
Address types.String `tfsdk:"address"`
Probability types.Float64 `tfsdk:"probability"`
Comment types.String `tfsdk:"comment"`
}
type snatAPI struct {
ID int64 `json:"id,omitempty"`
Action string `json:"action"`
Source string `json:"source"`
Egress string `json:"egress"`
Address string `json:"address,omitempty"`
Probability *float64 `json:"probability,omitempty"`
Comment string `json:"comment,omitempty"`
}
func NewSNATResource() resource.Resource { return &snatResource{} }
func (r *snatResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
resp.TypeName = req.ProviderTypeName + "_snat"
}
func (r *snatResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
resp.Schema = schema.Schema{
Description: "A source-NAT / masquerade intent. It renders on devices that bind the egress zone (and, for a zone source, that zone too) — auto-scoping masquerade to edges.",
Attributes: map[string]schema.Attribute{
"id": schema.Int64Attribute{
Description: "Server-assigned id.",
Computed: true,
PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()},
},
"action": schema.StringAttribute{
Description: "masquerade or snat.",
Required: true,
},
"source": schema.StringAttribute{
Description: "Source zone name or a literal CIDR to masquerade/SNAT.",
Required: true,
},
"egress": schema.StringAttribute{
Description: "Egress zone; resolved per device to its egress interface via bindings.",
Required: true,
},
"address": schema.StringAttribute{
Description: "For snat: the address (or range) to rewrite the source to.",
Optional: true,
},
"probability": schema.Float64Attribute{
Description: "Match probability (0-1) for load-balanced SNAT.",
Optional: true,
},
"comment": schema.StringAttribute{Optional: true},
},
}
}
func (r *snatResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
r.client = configureClient(req, resp)
}
func (r *snatResource) body(plan snatModel) snatAPI {
b := snatAPI{
Action: plan.Action.ValueString(),
Source: plan.Source.ValueString(),
Egress: plan.Egress.ValueString(),
Address: plan.Address.ValueString(),
Comment: plan.Comment.ValueString(),
}
if !plan.Probability.IsNull() && !plan.Probability.IsUnknown() {
p := plan.Probability.ValueFloat64()
b.Probability = &p
}
return b
}
func (r *snatResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
var plan snatModel
resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
if resp.Diagnostics.HasError() {
return
}
var out snatAPI
if err := r.client.post(ctx, "/api/v1/snat", r.body(plan), &out); err != nil {
resp.Diagnostics.AddError("create snat failed", err.Error())
return
}
resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
}
// Update: the snat API is create/delete only, so recreate and delete the old id.
func (r *snatResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
var plan, state snatModel
resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
if resp.Diagnostics.HasError() {
return
}
var out snatAPI
if err := r.client.post(ctx, "/api/v1/snat", r.body(plan), &out); err != nil {
resp.Diagnostics.AddError("recreate snat failed", err.Error())
return
}
if id := state.ID.ValueInt64(); id != 0 {
if err := r.client.del(ctx, "/api/v1/snat/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
resp.Diagnostics.AddError("delete old snat failed", err.Error())
return
}
}
resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, plan))...)
}
func (r *snatResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
var state snatModel
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
if resp.Diagnostics.HasError() {
return
}
var out snatAPI
if err := r.client.get(ctx, "/api/v1/snat/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
if isNotFound(err) {
resp.State.RemoveResource(ctx)
return
}
resp.Diagnostics.AddError("read snat failed", err.Error())
return
}
resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(out, state))...)
}
func (r *snatResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
var state snatModel
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
if resp.Diagnostics.HasError() {
return
}
if err := r.client.del(ctx, "/api/v1/snat/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
resp.Diagnostics.AddError("delete snat failed", err.Error())
}
}
func (r *snatResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
id, err := strconv.ParseInt(req.ID, 10, 64)
if err != nil {
resp.Diagnostics.AddError("invalid import ID", "snat id must be an integer")
return
}
resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
}
func (r *snatResource) toModel(api snatAPI, prior snatModel) snatModel {
m := snatModel{
ID: types.Int64Value(api.ID),
Action: types.StringValue(api.Action),
Source: types.StringValue(api.Source),
Egress: types.StringValue(api.Egress),
Address: optionalString(api.Address, prior.Address),
Comment: optionalString(api.Comment, prior.Comment),
}
if api.Probability != nil {
m.Probability = types.Float64Value(*api.Probability)
} else {
m.Probability = prior.Probability
}
return m
}