Skip to content
Snippets Groups Projects
Select Git revision
  • master
1 result

Exceptions.inc

Blame
    • firewall.tf 1.35 KiB
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39 
    

    

    

    resource "openstack_networking_secgroup_v2" "all" {
	name = var.domain
	description = "${title(var.domain)} all security group"
}

resource "openstack_networking_secgroup_rule_v2" "all_self" {
	for_each = toset(["0.0.0.0/0", "::/0"])
	direction = "ingress"
	ethertype = length(regexall(":", each.value)) == 0 ? "IPv4" : "IPv6"
	remote_group_id = openstack_networking_secgroup_v2.all.id
	security_group_id = openstack_networking_secgroup_v2.all.id
}

resource "openstack_networking_secgroup_rule_v2" "all_icmp" {
	for_each = toset(["0.0.0.0/0", "::/0"])
	direction = "ingress"
	ethertype = length(regexall(":", each.value)) == 0 ? "IPv4" : "IPv6"
	protocol = each.value == "0.0.0.0/0" ? "icmp" : "ipv6-icmp"
	security_group_id = openstack_networking_secgroup_v2.all.id
}

resource "openstack_networking_secgroup_rule_v2" "all_other" {
	for_each = var.security_trusted_cidr
	direction = "ingress"
	ethertype = length(regexall(":", each.value)) == 0 ? "IPv4" : "IPv6"
	remote_ip_prefix = each.key
	security_group_id = openstack_networking_secgroup_v2.all.id
}

resource "openstack_networking_secgroup_rule_v2" "ssh" {
	for_each = var.security_admin_cidr
	direction = "ingress"
	ethertype = length(regexall(":", each.value)) == 0 ? "IPv4" : "IPv6"
	port_range_min = 22
	port_range_max = 22
	remote_ip_prefix = each.key
	security_group_id = openstack_networking_secgroup_v2.all.id
}