initial commit

.gitignore

@@ -0,0 +1,15 @@
+# os files
+.DS_Store
+
+# working directories
+local/
+
+# terraform files
+.terraform/
+.terraform.*
+*.tfstate
+*.tfstate.backup
+*.tfvars
+
+# ansible files
+*.retry

01-ssh.tf

@@ -0,0 +1,13 @@
+resource "local_file" "ssh_config" {
+  content = templatefile("templates/ssh.cfg.tpl", {
+    server_name = var.vpn_server.name,
+    server_ip = var.vpn_server.local_ip,
+    ssh_username  = var.vpn_server.username,
+    ssh_key_file  = var.vpn_server.ssh_key_file
+    })
+
+  filename        = "local/ssh.cfg"
+  file_permission = "0640"
+}
+
+

02-ansible.tf

@@ -0,0 +1,66 @@
+## render the run script
+
+resource "local_file" "run_playbook" {
+  content = templatefile("templates/ansible/run-ansible.sh.tpl", {
+      inventory_file = "inventory.ini"
+    })
+  filename = "local/ansible/run-ansible.sh"
+  file_permission = "0755"
+}
+
+
+## render the playbook
+
+resource "local_file" "playbook" {
+  content = templatefile("templates/ansible/playbook.yml.tpl", {
+      gateway_role = local.gateway_role,
+      iptables_role = local.iptables_role,
+      pimd_role = local.pimd_role,
+      wireguard_role = local.wireguard_role
+    })
+  filename = "local/ansible/playbook.yml"
+}
+
+
+## render host variables
+
+resource "local_file" "hostvars" {
+
+  content = templatefile("templates/ansible/hostvars.yml.tpl", {
+    server_name      = var.vpn_server.name,
+    server_ifname    = var.vpn_server.interface,
+    private_ip       = var.vpn_server.local_ip,
+    cidr_block       = var.local_network.cidr_block
+    gateway          = var.local_network.gateway
+
+    vpn_endpoint_address = var.vpn_network.endpoint,
+    vpn_endpoint_port    = var.vpn_network.listen_port
+
+    vpn_cidr_block   = var.vpn_network.cidr_block
+    vpn_netlen       = split("/", var.vpn_network.cidr_block)[1]
+    vpn_ip           = local.vpn_server_vpn_ip
+    vpn_private_key  = wireguard_asymmetric_key.vpn_server.private_key,
+
+    clients = [for client in var.vpn_clients :
+        {
+          name = client
+          vpn_ip  = local.vpn_client_vpn_ips[index(var.vpn_clients, client)]
+          public_key = wireguard_asymmetric_key.vpn_clients[client].public_key
+        }
+      ]
+    })
+
+  filename        = "local/ansible/host_vars/${var.vpn_server.name}.yml"
+  file_permission = "0640"
+}
+
+
+## render the inventory file
+
+resource "local_file" "inventory" {
+  content = templatefile("templates/ansible/inventory.ini.tpl", {
+    server = var.vpn_server.name
+    })
+  filename = "local/ansible/inventory.ini"
+  file_permission = "0640"
+}

03-gateway.tf

@@ -0,0 +1,27 @@
+
+locals {
+  gateway_role = "gateway"
+  iptables_role = "iptables"
+  pimd_role = "pimd"
+}
+
+resource "template_dir" "gateway" {
+  source_dir      = "templates/ansible-roles/${local.gateway_role}"
+  destination_dir = "local/ansible/roles/${local.gateway_role}"
+
+  vars = {}
+}
+
+resource "template_dir" "iptables" {
+  source_dir      = "templates/ansible-roles/${local.iptables_role}"
+  destination_dir = "local/ansible/roles/${local.iptables_role}"
+
+  vars = {}
+}
+
+resource "template_dir" "pimd" {
+  source_dir      = "templates/ansible-roles/${local.pimd_role}"
+  destination_dir = "local/ansible/roles/${local.pimd_role}"
+
+  vars = {}
+}

04-wireguard-server.tf

@@ -0,0 +1,19 @@
+
+locals {
+  wireguard_role = "wireguard"
+}
+
+resource "wireguard_asymmetric_key" "vpn_server" {
+}
+
+resource "wireguard_asymmetric_key" "vpn_clients" {
+  for_each = toset(var.vpn_clients)
+}
+
+
+resource "template_dir" "wireguard" {
+  source_dir      = "templates/ansible-roles/${local.wireguard_role}"
+  destination_dir = "local/ansible/roles/${local.wireguard_role}"
+
+  vars = {}
+}

05-wireguard-clients.tf

@@ -0,0 +1,18 @@
+
+resource "local_file" "client_configs" {
+  for_each = toset(var.vpn_clients)
+
+  content = templatefile("templates/wireguard-client.conf.tpl", {
+    vpn_ip           = local.vpn_client_vpn_ips[index(var.vpn_clients, each.key)]
+    vpn_netlen       = split("/", var.vpn_network.cidr_block)[1]
+    vpn_private_key  = wireguard_asymmetric_key.vpn_clients[each.key].private_key,
+
+    vpn_endpoint            = var.vpn_network.endpoint
+    vpn_endpoint_port       = var.vpn_network.listen_port
+    vpn_endpoint_public_key = wireguard_asymmetric_key.vpn_server.public_key
+  })
+
+  filename        = "local/clients/${each.key}.conf"
+  file_permission = "0640"
+}
+

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 Paul Ryan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.