asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

terraform

Browse source
This commit is contained in:
Sergei Poljanski 2025-11-01 13:43:31 +02:00
commit 33a12b643f
15 changed files with 1021 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

278
terraform/firewall.tf Normal file
View file

@ -0,0 +1,278 @@
resource "hcloud_firewall" "ops_fw" {
name = "asxpio-ops-fw"
# VPC
rule {
direction = "in"
protocol = "tcp"
port = "any"
source_ips = [
"10.10.0.0/20"
]
}
rule {
direction = "in"
protocol = "udp"
port = "any"
source_ips = [
"10.10.0.0/20"
]
}
rule {
direction = "in"
protocol = "icmp"
source_ips = [
"10.10.0.0/20"
]
}
# WireGuard
rule {
direction = "in"
protocol = "tcp"
port = "any"
source_ips = [
"10.20.0.0/24"
]
}
rule {
direction = "in"
protocol = "udp"
port = "any"
source_ips = [
"10.20.0.0/24"
]
}
rule {
direction = "in"
protocol = "icmp"
source_ips = [
"10.20.0.0/24"
]
}
# SSH TODO: Remove
rule {
direction = "in"
protocol = "tcp"
port = "22"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
rule {
direction = "in"
protocol = "tcp"
port = "80"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
rule {
direction = "in"
protocol = "tcp"
port = "443"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
# WireGuard VPN
rule {
direction = "in"
protocol = "udp"
port = "60101"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
}
resource "hcloud_firewall" "services_fw" {
name = "asxpio-services-fw"
# VPC
rule {
direction = "in"
protocol = "tcp"
port = "any"
source_ips = [
"10.10.0.0/20"
]
}
rule {
direction = "in"
protocol = "udp"
port = "any"
source_ips = [
"10.10.0.0/20"
]
}
rule {
direction = "in"
protocol = "icmp"
source_ips = [
"10.10.0.0/20"
]
}
# WireGuard
rule {
direction = "in"
protocol = "tcp"
port = "any"
source_ips = [
"10.20.0.0/24"
]
}
rule {
direction = "in"
protocol = "udp"
port = "any"
source_ips = [
"10.20.0.0/24"
]
}
rule {
direction = "in"
protocol = "icmp"
source_ips = [
"10.20.0.0/24"
]
}
# SSH TODO:Remove
rule {
direction = "in"
protocol = "tcp"
port = "22"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
# Minecraft Server
rule {
direction = "in"
protocol = "tcp"
port = "25565"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
# Minecraft Geyser
rule {
direction = "in"
protocol = "udp"
port = "19132"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
# Valheim Server (UDP port range)
rule {
direction = "in"
protocol = "udp"
port = "2456-2458"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
# Factorio Server
rule {
direction = "in"
protocol = "udp"
port = "34197"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
# Prosody XMPP - Client connections
rule {
direction = "in"
protocol = "tcp"
port = "5222"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
# Prosody XMPP - Server-to-server
rule {
direction = "in"
protocol = "tcp"
port = "5269"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
# Prosody XMPP - HTTP/BOSH
rule {
direction = "in"
protocol = "tcp"
port = "5280"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
# Prosody XMPP - HTTPS
rule {
direction = "in"
protocol = "tcp"
port = "5281"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
# TURN/STUN Server (UDP)
rule {
direction = "in"
protocol = "udp"
port = "3478"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
# TURN/STUN Server (TCP)
rule {
direction = "in"
protocol = "tcp"
port = "3478"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
}