Switch to nat gateway free network on both prod and dev

ooni · Oct 1, 2024 · e55f4c7 · e55f4c7
1 parent 461d1a1
commit e55f4c7
Show file tree

Hide file tree

Showing 5 changed files with 7 additions and 239 deletions.
diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf
@@ -112,7 +112,7 @@ module "ansible_inventory" {
 }
 
 module "network" {
-  source = "../../modules/network_noipv6"
+  source = "../../modules/network"
 
   az_count            = var.az_count
   vpc_main_cidr_block = "10.0.0.0/16"

diff --git a/tf/modules/network/main.tf b/tf/modules/network/main.tf
@@ -7,7 +7,7 @@ resource "aws_vpc" "main" {
   cidr_block           = var.vpc_main_cidr_block
   enable_dns_hostnames = true
   enable_dns_support   = true
-
+ 
   assign_generated_ipv6_cidr_block = true
 
   tags = var.tags
@@ -17,9 +17,7 @@ resource "aws_subnet" "public" {
   count = var.az_count
 
   cidr_block = cidrsubnet(aws_vpc.main.cidr_block, 8, count.index)
-
   ipv6_cidr_block                 = cidrsubnet(aws_vpc.main.ipv6_cidr_block, 8, count.index)
-  assign_ipv6_address_on_creation = true
 
   availability_zone       = element(var.aws_availability_zones_available.names, count.index)
   vpc_id                  = aws_vpc.main.id
@@ -42,11 +40,10 @@ resource "aws_subnet" "private" {
   cidr_block = cidrsubnet(aws_vpc.main.cidr_block, 8, local.private_net_offset + count.index)
 
   ipv6_cidr_block                 = cidrsubnet(aws_vpc.main.ipv6_cidr_block, 8, local.private_net_offset + count.index)
-  assign_ipv6_address_on_creation = true
 
   availability_zone       = element(var.aws_availability_zones_available.names, count.index)
   vpc_id                  = aws_vpc.main.id
-  map_public_ip_on_launch = false
+  map_public_ip_on_launch = true
 
   depends_on = [aws_internet_gateway.gw]
 
@@ -59,41 +56,13 @@ resource "aws_subnet" "private" {
   }
 }
 
-
-resource "aws_eip" "nat" {
-  count      = var.az_count
-  domain     = "vpc"
-  depends_on = [aws_internet_gateway.gw]
-}
-
-resource "aws_nat_gateway" "nat_gw" {
-  count = var.az_count
-
-  allocation_id = element(aws_eip.nat[*].id, count.index)
-  subnet_id     = element(aws_subnet.public[*].id, count.index)
-
-  depends_on = [aws_internet_gateway.gw]
-
-  tags = {
-    Name = "ooni-nat-gw"
-  }
-}
-
 resource "aws_internet_gateway" "gw" {
   vpc_id = aws_vpc.main.id
   tags = {
     Name = "ooni-internet-gw"
   }
 }
 
-resource "aws_egress_only_internet_gateway" "egress_gw" {
-  vpc_id = aws_vpc.main.id
-
-  tags = {
-    Name = "ooni-egressonly-gw"
-  }
-}
-
 resource "aws_route_table" "public" {
   vpc_id = aws_vpc.main.id
 
@@ -102,11 +71,6 @@ resource "aws_route_table" "public" {
     gateway_id = aws_internet_gateway.gw.id
   }
 
-  route {
-    ipv6_cidr_block        = "::/0"
-    egress_only_gateway_id = aws_egress_only_internet_gateway.egress_gw.id
-  }
-
   tags = {
     Name = "ooni-public-route-table"
   }
@@ -119,28 +83,22 @@ resource "aws_route_table_association" "public" {
 }
 
 resource "aws_route_table" "private" {
-  count  = var.az_count
   vpc_id = aws_vpc.main.id
 
   route {
-    cidr_block     = "0.0.0.0/0"
-    nat_gateway_id = element(aws_nat_gateway.nat_gw[*].id, count.index)
-  }
-
-  route {
-    ipv6_cidr_block        = "::/0"
-    egress_only_gateway_id = aws_egress_only_internet_gateway.egress_gw.id
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.gw.id
   }
 
   tags = {
-    Name = "ooni-private-route-table-${count.index}"
+    Name = "ooni-private-route-table"
   }
 }
 
 resource "aws_route_table_association" "private" {
   count          = var.az_count
   subnet_id      = element(aws_subnet.private[*].id, count.index)
-  route_table_id = element(aws_route_table.private[*].id, count.index)
+  route_table_id = aws_route_table.private.id
 
   lifecycle {
     create_before_destroy = true

diff --git a/tf/modules/network_noipv6/main.tf b/tf/modules/network_noipv6/main.tf
diff --git a/tf/modules/network_noipv6/outputs.tf b/tf/modules/network_noipv6/outputs.tf
diff --git a/tf/modules/network_noipv6/variables.tf b/tf/modules/network_noipv6/variables.tf