feat: First version

.terraform-docs.yml

@@ -0,0 +1,5 @@
+formatter: markdown document
+output:
+  file: "README.md"
+settings:
+  anchor: false

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 DO! DevOps
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,175 @@
+# Azure VPN management
+
+## Introduction
+
+This module manages VPN connectivity in Azure.
+
+## Usage
+
+Instantiate the module by calling it from Terraform like this:
+
+```hcl
+module "azure-vpn" {
+  source  = "dodevops/vpn/azure"
+  version = "<version>"
+}
+```
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+The following providers are used by this module:
+
+- azurerm
+
+## Modules
+
+No modules.
+
+## Resources
+
+The following resources are used by this module:
+
+- [azurerm_local_network_gateway.local](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/local_network_gateway) (resource)
+- [azurerm_public_ip.publicip](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/public_ip) (resource)
+- [azurerm_subnet.gateway](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet) (resource)
+- [azurerm_virtual_network.vpnnet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network) (resource)
+- [azurerm_virtual_network_gateway.vnetgw](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network_gateway) (resource)
+- [azurerm_virtual_network_gateway_connection.connection](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network_gateway_connection) (resource)
+- [azurerm_virtual_network_peering.peeringvpn](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network_peering) (resource)
+- [azurerm_virtual_network_peering.peeringvpnrev](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network_peering) (resource)
+- [azurerm_virtual_network.target_vnet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/virtual_network) (data source)
+
+## Required Inputs
+
+The following input variables are required:
+
+### gatewaynet
+
+Description: IP network to use for the gateway
+
+Type: `string`
+
+### local\_gateway\_ip
+
+Description: IP of the local (on-prem) vpn gateway
+
+Type: `string`
+
+### local\_nets
+
+Description: A list of local (on-prem) IP adress ranges to connect
+
+Type: `list(string)`
+
+### location
+
+Description: The azure location used for azure
+
+Type: `string`
+
+### project
+
+Description: Three letter project key
+
+Type: `string`
+
+### resource\_group
+
+Description: Azure Resource Group to use
+
+Type: `string`
+
+### shared\_key
+
+Description: The preshared key of the connection
+
+Type: `string`
+
+### stage
+
+Description: Stage for this ressource group
+
+Type: `string`
+
+### target\_vnet\_name
+
+Description: Name of the target virtual network
+
+Type: `string`
+
+## Optional Inputs
+
+The following input variables are optional (have default values):
+
+### ipsec\_policy
+
+Description: IPSec policy to use with the VPN. See the
+[Microsoft documentation](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell)  
+for details
+
+Type:
+
+```hcl
+list(object({
+    dh_group         = string
+    ike_encryption   = string
+    ike_integrity    = string
+    ipsec_encryption = string
+    ipsec_integrity  = string
+    pfs_group        = string
+    sa_lifetime      = number
+  }))
+```
+
+Default:
+
+```json
+[
+  {
+    "dh_group": "DHGroup2",
+    "ike_encryption": "AES256",
+    "ike_integrity": "SHA256",
+    "ipsec_encryption": "AES256",
+    "ipsec_integrity": "SHA256",
+    "pfs_group": "None",
+    "sa_lifetime": 27000
+  }
+]
+```
+
+### vnetgwsku
+
+Description: SKU to use for the virtual network gateway
+
+Type: `string`
+
+Default: `"VpnGw1"`
+
+## Outputs
+
+The following outputs are exported:
+
+### location
+
+Description: The location input variable (can be used for dependency resolution)
+
+### ppg\_id
+
+Description: The ID of the generated proximity placement group
+
+### resource\_group
+
+Description: The name of the generated resource group
+<!-- END_TF_DOCS -->
+
+## Development
+
+Use [terraform-docs](https://terraform-docs.io/) to generate the API documentation by running
+
+    terraform fmt .
+    terraform-docs .

connections.tf

@@ -0,0 +1,47 @@
+resource "azurerm_local_network_gateway" "local" {
+  address_space       = var.local_nets
+  gateway_address     = var.local_gateway_ip
+  location            = var.location
+  name                = "${lower(var.project)}${lower(var.stage)}netlocalgw"
+  resource_group_name = var.resource_group
+}
+
+resource "azurerm_virtual_network_gateway_connection" "connection" {
+  location                   = var.location
+  name                       = "${lower(var.project)}${lower(var.stage)}netvnconnection"
+  resource_group_name        = var.resource_group
+  type                       = "IPsec"
+  virtual_network_gateway_id = azurerm_virtual_network_gateway.vnetgw.id
+  local_network_gateway_id   = azurerm_local_network_gateway.local.id
+  shared_key                 = var.shared_key
+
+  ipsec_policy = var.ipsec_policy
+}
+
+data "azurerm_virtual_network" "target_vnet" {
+  name                = var.target_vnet_name
+  resource_group_name = var.resource_group
+}
+
+resource "azurerm_virtual_network_peering" "peeringvpn" {
+  name                      = "${lower(var.project)}${lower(var.stage)}netpeering"
+  remote_virtual_network_id = data.azurerm_virtual_network.target_vnet.id
+  resource_group_name       = var.resource_group
+  virtual_network_name      = azurerm_virtual_network.vpnnet.name
+
+  allow_gateway_transit        = true
+  allow_forwarded_traffic      = true
+  allow_virtual_network_access = true
+}
+
+resource "azurerm_virtual_network_peering" "peeringvpnrev" {
+  name                      = "${lower(var.project)}${lower(var.stage)}netpeeringrev"
+  remote_virtual_network_id = azurerm_virtual_network.vpnnet.id
+  resource_group_name       = var.resource_group
+  virtual_network_name      = var.target_vnet_name
+
+  allow_gateway_transit        = false
+  allow_forwarded_traffic      = true
+  allow_virtual_network_access = true
+  use_remote_gateways          = true
+}

gateway.tf

@@ -0,0 +1,34 @@
+resource "azurerm_virtual_network" "vpnnet" {
+  address_space = [
+    var.gatewaynet
+  ]
+  location            = var.location
+  name                = "${lower(var.project)}${lower(var.stage)}netvnetworkvpn"
+  resource_group_name = var.resource_group
+}
+
+resource "azurerm_subnet" "gateway" {
+  address_prefixes     = [var.gatewaynet]
+  name                 = "GatewaySubnet"
+  resource_group_name  = var.resource_group
+  virtual_network_name = azurerm_virtual_network.vpnnet.name
+}
+
+resource "azurerm_public_ip" "publicip" {
+  location            = var.location
+  name                = "${lower(var.project)}${lower(var.stage)}ipvpn"
+  resource_group_name = var.resource_group
+  allocation_method   = "Dynamic"
+}
+
+resource "azurerm_virtual_network_gateway" "vnetgw" {
+  location            = var.location
+  name                = "${lower(var.project)}${lower(var.stage)}netvirtualgw"
+  resource_group_name = var.resource_group
+  sku                 = var.vnetgwsku
+  type                = "Vpn"
+  ip_configuration {
+    subnet_id            = azurerm_subnet.gateway.id
+    public_ip_address_id = azurerm_public_ip.publicip.id
+  }
+}

outputs.tf

@@ -0,0 +1,14 @@
+output "resource_group" {
+  description = "The name of the generated resource group"
+  value       = azurerm_resource_group.azure-resource-group.name
+}
+
+output "location" {
+  description = "The location input variable (can be used for dependency resolution)"
+  value       = var.location
+}
+
+output "ppg_id" {
+  description = "The ID of the generated proximity placement group"
+  value       = azurerm_proximity_placement_group.ppg.id
+}

vars.tf

@@ -0,0 +1,76 @@
+variable "location" {
+  type        = string
+  description = "The azure location used for azure"
+}
+
+variable "project" {
+  type        = string
+  description = "Three letter project key"
+}
+
+variable "stage" {
+  type        = string
+  description = "Stage for this ressource group"
+}
+
+variable "gatewaynet" {
+  type        = string
+  description = "IP network to use for the gateway"
+}
+
+variable "resource_group" {
+  type        = string
+  description = "Azure Resource Group to use"
+}
+
+variable "vnetgwsku" {
+  type        = string
+  description = "SKU to use for the virtual network gateway"
+  default     = "VpnGw1"
+}
+
+variable "target_vnet_name" {
+  type        = string
+  description = "Name of the target virtual network"
+}
+
+variable "local_nets" {
+  type        = list(string)
+  description = "A list of local (on-prem) IP adress ranges to connect"
+}
+
+variable "local_gateway_ip" {
+  type        = string
+  description = "IP of the local (on-prem) vpn gateway"
+}
+
+variable "shared_key" {
+  type        = string
+  description = "The preshared key of the connection"
+}
+
+variable "ipsec_policy" {
+  type = list(object({
+    dh_group         = string
+    ike_encryption   = string
+    ike_integrity    = string
+    ipsec_encryption = string
+    ipsec_integrity  = string
+    pfs_group        = string
+    sa_lifetime      = number
+  }))
+  default = [{
+    dh_group         = "DHGroup2"
+    ike_encryption   = "AES256"
+    ike_integrity    = "SHA256"
+    ipsec_encryption = "AES256"
+    ipsec_integrity  = "SHA256"
+    pfs_group        = "None"
+    sa_lifetime      = 27000
+  }]
+  description = <<-EOL
+  IPSec policy to use with the VPN. See the
+  [Microsoft documentation](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell)
+  for details
+  EOL
+}