This repository has been archived by the owner on Mar 6, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 17
/
Copy pathlocals.tf
122 lines (105 loc) · 5.25 KB
/
locals.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
locals {
default_site_config = {
always_on = "true"
}
site_config = merge(local.default_site_config, var.site_config)
app_service_id = "/subscriptions/${data.azurerm_subscription.current_subscription.subscription_id}/resourceGroups/${var.resource_group_name}/providers/Microsoft.Web/sites/${local.app_service_name}"
app_insights = try(data.azurerm_application_insights.app_insights[0], try(azurerm_application_insights.app_insights[0], {}))
default_app_settings = var.application_insights_enabled ? {
APPLICATION_INSIGHTS_IKEY = try(local.app_insights.instrumentation_key, "")
APPINSIGHTS_INSTRUMENTATIONKEY = try(local.app_insights.instrumentation_key, "")
APPLICATIONINSIGHTS_CONNECTION_STRING = try(local.app_insights.connection_string, "")
} : {}
app_settings = merge(local.default_app_settings, var.app_settings)
default_ip_restrictions_headers = {
x_azure_fdid = null
x_fd_health_probe = null
x_forwarded_for = null
x_forwarded_host = null
}
ip_restriction_headers = var.ip_restriction_headers != null ? [merge(local.default_ip_restrictions_headers, var.ip_restriction_headers)] : []
cidrs = [for cidr in var.authorized_ips : {
name = "ip_restriction_cidr_${join("", [1, index(var.authorized_ips, cidr)])}"
ip_address = cidr
virtual_network_subnet_id = null
service_tag = null
subnet_id = null
priority = join("", [1, index(var.authorized_ips, cidr)])
action = "Allow"
headers = local.ip_restriction_headers
}]
subnets = [for subnet in var.authorized_subnet_ids : {
name = "ip_restriction_subnet_${join("", [1, index(var.authorized_subnet_ids, subnet)])}"
ip_address = null
virtual_network_subnet_id = subnet
service_tag = null
subnet_id = subnet
priority = join("", [1, index(var.authorized_subnet_ids, subnet)])
action = "Allow"
headers = local.ip_restriction_headers
}]
service_tags = [for service_tag in var.authorized_service_tags : {
name = "service_tag_restriction_${join("", [1, index(var.authorized_service_tags, service_tag)])}"
ip_address = null
virtual_network_subnet_id = null
service_tag = service_tag
subnet_id = null
priority = join("", [1, index(var.authorized_service_tags, service_tag)])
action = "Allow"
headers = local.ip_restriction_headers
}]
scm_ip_restriction_headers = var.scm_ip_restriction_headers != null ? [merge(local.default_ip_restrictions_headers, var.scm_ip_restriction_headers)] : []
scm_cidrs = [for cidr in var.scm_authorized_ips : {
name = "scm_ip_restriction_cidr_${join("", [1, index(var.scm_authorized_ips, cidr)])}"
ip_address = cidr
virtual_network_subnet_id = null
service_tag = null
subnet_id = null
priority = join("", [1, index(var.scm_authorized_ips, cidr)])
action = "Allow"
headers = local.scm_ip_restriction_headers
}]
scm_subnets = [for subnet in var.scm_authorized_subnet_ids : {
name = "scm_ip_restriction_subnet_${join("", [1, index(var.scm_authorized_subnet_ids, subnet)])}"
ip_address = null
virtual_network_subnet_id = subnet
service_tag = null
subnet_id = subnet
priority = join("", [1, index(var.scm_authorized_subnet_ids, subnet)])
action = "Allow"
headers = local.scm_ip_restriction_headers
}]
scm_service_tags = [for service_tag in var.scm_authorized_service_tags : {
name = "scm_service_tag_restriction_${join("", [1, index(var.scm_authorized_service_tags, service_tag)])}"
ip_address = null
virtual_network_subnet_id = null
service_tag = service_tag
subnet_id = null
priority = join("", [1, index(var.scm_authorized_service_tags, service_tag)])
action = "Allow"
headers = local.scm_ip_restriction_headers
}]
auth_settings = merge(
{
enabled = false
issuer = format("https://sts.windows.net/%s/", data.azurerm_client_config.main.tenant_id)
token_store_enabled = false
unauthenticated_client_action = "RedirectToLoginPage"
default_provider = "AzureActiveDirectory"
allowed_external_redirect_urls = []
active_directory = null
},
var.auth_settings)
auth_settings_active_directory = merge(
{
client_id = null
client_secret = null
allowed_audiences = []
},
local.auth_settings.active_directory == null ? local.auth_settings_ad_default : var.auth_settings.active_directory)
auth_settings_ad_default = {
client_id = null
client_secret = null
allowed_audiences = []
}
}