forked from jmhale/terraform-aws-wireguard
-
Notifications
You must be signed in to change notification settings - Fork 1
/
main.tf
51 lines (46 loc) · 1.89 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
data "template_file" "user_data" {
template = file("${path.module}/templates/user-data.txt")
vars = {
wg_server_private_key = data.aws_ssm_parameter.wg_server_private_key.value
wg_server_net = var.wg_server_net
wg_server_port = var.wg_server_port
network_interface_name = var.network_interface_name
peers = join("\n", data.template_file.wg_client_data_json.*.rendered)
eip_id = var.eip_id
}
}
data "template_file" "wg_client_data_json" {
template = file("${path.module}/templates/client-data.tpl")
count = length(var.wg_client_public_keys)
vars = {
client_pub_key = element(values(var.wg_client_public_keys[count.index]), 0)
client_ip = element(keys(var.wg_client_public_keys[count.index]), 0)
persistent_keepalive = var.wg_persistent_keepalive
}
}
# We're using ubuntu images - this lets us grab the latest image for our region from Canonical
data "aws_ami" "ubuntu" {
most_recent = true
filter {
name = "name"
values = ["ubuntu/images/hvm-ssd/ubuntu-*-20.04-amd64-server-*"]
}
filter {
name = "virtualization-type"
values = ["hvm"]
}
owners = ["099720109477"] # Canonical
}
resource "aws_instance" "wireguard" {
ami = data.aws_ami.ubuntu.id
instance_type = var.instance_type
key_name = var.ssh_key_id
iam_instance_profile = aws_iam_instance_profile.wireguard_profile.name
user_data = data.template_file.user_data.rendered
subnet_id = var.subnet_ids[0]
vpc_security_group_ids = length(compact(var.additional_security_group_ids)) != 0 ? concat([aws_security_group.sg_wireguard_external.id], var.additional_security_group_ids) : [aws_security_group.sg_wireguard_external.id]
associate_public_ip_address = true
tags = {
Name = "wireguard-${var.env}"
}
}