-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.tf
72 lines (62 loc) · 1.94 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
terraform {
required_providers {
# https://registry.terraform.io/providers/kreuzwerker/docker/latest/docs
docker = {
source = "kreuzwerker/docker"
version = "3.0.2"
}
# https://github.com/tailscale/terraform-provider-tailscale
tailscale = {
source = "tailscale/tailscale"
version = "0.13.7"
}
}
}
#
# Disabling Magic DNS
# https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/dns_preferences
resource "tailscale_dns_preferences" "preferences" {
magic_dns = false
}
#
# Setting custom DNS server IP address
# https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/dns_nameservers
resource "tailscale_dns_nameservers" "nameservers" {
nameservers = [
data.tailscale_devices.dns.devices[0].addresses[0]
]
}
#
# Setting ACL Rules
# https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/acl
resource "tailscale_acl" "default_acl" {
acl = jsonencode(var.TAILSCALE_ACL)
}
#
# Disabling key expiry on servers
# https://registry.terraform.io/providers/davidsbond/tailscale/latest/docs/resources/device_key
resource "tailscale_device_key" "server" {
for_each = {
for index, device in data.tailscale_devices.servers.devices: device.name => device
}
device_id = each.value.id
key_expiry_disabled = true
}
#
# Tagging devices based on naming convention
# https://registry.terraform.io/providers/tailscale/tailscale/latest/docs/resources/device_tags
locals {
allowed_tags = [
for k, v in var.TAILSCALE_ACL.tagOwners: k
]
}
resource "tailscale_device_tags" "tags" {
for_each = {
for index, device in data.tailscale_devices.devices.devices: device.name => device
}
device_id = each.value.id
tags = [
for t in split("-", split(".", each.value.name)[0]):
"tag:${t}" if contains(local.allowed_tags, "tag:${t}")
]
}