Skip to content

Commit 19e094b

Browse files
yuhunglinyuhunglin
committed
Merge pull request #3 from unifio/yl-generate-certs
Initial release of generate-certs module
2 parents 3f581b0 + b53c5c0 commit 19e094b

File tree

6 files changed

+297
-0
lines changed

6 files changed

+297
-0
lines changed

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,12 @@
33
### ???
44

55
- Feature: Automatically push instance's subnet route into `server.conf`
6+
- export `zone_id`, `dns_name` from aws_elb
7+
- Fix the 4 subnet fixed mapping
8+
- Fill in some examples
9+
10+
### 0.0.5
11+
- Initial release of `generate-certs` module
612

713
### 0.0.4
814
- Standardization with other Unif.io OSS terraform modules

‎examples/.gitkeep‎

Whitespace-only changes.

‎generate-certs/main.tf‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
# OpenVPN Generate Certs
2+
3+
## Creates IAM Role & Instance Profile
4+
# TODO: figure out how to de-dup
5+
resource "aws_iam_role" "gen_certs_role" {
6+
name = "${var.stack_item_label}-${var.region}-gen-certs"
7+
path = "/"
8+
9+
assume_role_policy = <<EOF
10+
{
11+
"Version": "2012-10-17",
12+
"Statement": [
13+
{
14+
"Effect": "Allow",
15+
"Action": "sts:AssumeRole",
16+
"Principal": {
17+
"Service": "ec2.amazonaws.com"
18+
}
19+
}
20+
]
21+
}
22+
EOF
23+
}
24+
25+
resource "aws_iam_role_policy" "s3_gen_certs" {
26+
name = "s3_gen_certs"
27+
role = "${aws_iam_role.gen_certs_role.id}"
28+
29+
policy = <<EOF
30+
{
31+
"Version": "2012-10-17",
32+
"Statement": [
33+
{
34+
"Effect": "Allow",
35+
"Action": [
36+
"s3:Get*",
37+
"s3:PutObject"
38+
],
39+
"Resource": [
40+
"arn:aws:s3:::${replace(var.s3_root_path,"/(\/)+$/","")}",
41+
"arn:aws:s3:::${replace(var.s3_root_path,"/(\/)+$/","")}/*"
42+
]
43+
},
44+
{
45+
"Effect": "Allow",
46+
"Action": [
47+
"s3:List*"
48+
],
49+
"Resource": [
50+
"arn:aws:s3:::${element(split("/", var.s3_root_path), 0)}"
51+
]
52+
}
53+
]
54+
}
55+
EOF
56+
}
57+
58+
resource "aws_iam_role_policy" "gen_certs_tags" {
59+
name = "gen-certs-tags"
60+
role = "${aws_iam_role.gen_certs_role.id}"
61+
62+
policy = <<EOF
63+
{
64+
"Version": "2012-10-17",
65+
"Statement": [
66+
{
67+
"Effect": "Allow",
68+
"Action": [
69+
"ec2:CreateTags",
70+
"ec2:AssociateAddress",
71+
"ec2:DescribeAddresses",
72+
"ec2:DescribeInstances"
73+
],
74+
"Resource": "*"
75+
}
76+
]
77+
}
78+
EOF
79+
}
80+
81+
## Creates IAM instance profile
82+
resource "aws_iam_instance_profile" "gen_certs_profile" {
83+
name = "${var.stack_item_label}-${var.region}-gen-certs"
84+
roles = ["${aws_iam_role.gen_certs_role.name}"]
85+
}
86+
87+
## Creates security group rules
88+
resource "aws_security_group" "generate_certs_sg" {
89+
name = "${var.stack_item_label}-${var.region}-gen-certs-sg"
90+
description = "${stack_item_fullname} security group"
91+
}
92+
93+
resource "aws_security_group_rule" "allow_ssh_in_tcp" {
94+
type = "ingress"
95+
from_port = 22
96+
to_port = 22
97+
protocol = "tcp"
98+
cidr_blocks = ["${split(",",var.cidr_whitelist)}"]
99+
security_group_id = "${aws_security_group.generate_certs_sg.id}"
100+
}
101+
102+
## Creates user instance data
103+
resource "template_file" "user_data" {
104+
template = "${file("${path.module}/templates/user_data.tpl")}"
105+
106+
vars {
107+
s3_region = "${var.region}"
108+
s3_cert_root_path = "s3://${var.s3_root_path}"
109+
key_size = "${var.cert_key_size}"
110+
s3_dir_override = "${var.s3_dir_override}"
111+
key_city = "${var.key_city}"
112+
key_org = "${var.key_org}"
113+
key_email = "${var.key_email}"
114+
key_ou = "${var.key_ou}"
115+
cert_key_name = "${var.cert_key_name}"
116+
key_country = "${var.key_country}"
117+
key_province = "${var.key_province}"
118+
active_clients = "${var.active_clients}"
119+
revoked_clients = "${var.revoked_clients}"
120+
openvpn_host = "${var.openvpn_host}"
121+
force_cert_regen = "${var.force_cert_regen}"
122+
s3_push_dryrun = "${var.s3_push_dryrun}"
123+
}
124+
}
125+
126+
## Creates instance
127+
resource "aws_instance" "generate_certs" {
128+
count = 1
129+
ami = "${coalesce(lookup(var.ami_region_lookup, var.ami_region), var.ami_custom)}"
130+
instance_type = "${var.instance_type}"
131+
key_name = "${var.key_name}"
132+
security_groups = ["${aws_security_group.generate_certs_sg.name}"]
133+
associate_public_ip_address = true
134+
iam_instance_profile = "${aws_iam_instance_profile.gen_certs_profile.id}"
135+
136+
tags {
137+
Name = "${var.stack_item_label}-generate-certs"
138+
application = "${var.stack_item_label}-generate-certs"
139+
managed_by = "terraform"
140+
}
141+
142+
user_data = "${template_file.user_data.rendered}"
143+
}

‎generate-certs/outputs.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+

‎generate-certs/templates/user_data.tpl‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#cloud-config
2+
manage_etc_hosts: True
3+
4+
runcmd:
5+
- echo "S3_REGION=\"ap-northeast-1\"" > /etc/default/openvpn-cert-generator
6+
- echo "S3_CERT_ROOT_PATH=\"${s3_cert_root_path}\"" >> /etc/default/openvpn-cert-generator
7+
- echo "KEY_SIZE=${key_size}" >> /etc/default/openvpn-cert-generator
8+
- echo "S3_DIR_OVERRIDE=${s3_dir_override}" >> /etc/default/openvpn-cert-generator
9+
- echo "KEY_CITY=${key_city}" >> /etc/default/openvpn-cert-generator
10+
- echo "KEY_ORG=${key_org}" >> /etc/default/openvpn-cert-generator
11+
- echo "KEY_EMAIL=${key_email}" >> /etc/default/openvpn-cert-generator
12+
- echo "KEY_OU=${key_ou}" >> /etc/default/openvpn-cert-generator
13+
- echo "KEY_NAME=${cert_key_name}" >> /etc/default/openvpn-cert-generator
14+
- echo "KEY_COUNTRY=${key_country}" >> /etc/default/openvpn-cert-generator
15+
- echo "KEY_PROVINCE=${key_province}" >> /etc/default/openvpn-cert-generator
16+
- echo "ACTIVE_CLIENTS=${active_clients}" >> /etc/default/openvpn-cert-generator
17+
- echo "REVOKED_CLIENTS=${revoked_clients}" >> /etc/default/openvpn-cert-generator
18+
- echo "OPENVPN_HOST=${openvpn_host}" >> /etc/default/openvpn-cert-generator
19+
- echo "FORCE_CERT_REGEN=${force_cert_regen}" >> /etc/default/openvpn-cert-generator
20+
- echo "S3_PUSH_DRYRUN=${s3_push_dryrun}" >> /etc/default/openvpn-cert-generator
21+
22+
- systemctl start openvpn-cert-generator.service
23+
24+
output : { all : '| tee -a /var/log/cloud-init-output.log' }

‎generate-certs/variables.tf‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
# openvpn-generate-certs - Variables
2+
3+
variable "ami_region" {
4+
type = "string"
5+
}
6+
7+
variable "ami_region_lookup" {
8+
# Not meant to be overwritten
9+
type = "map"
10+
11+
default = {
12+
us-east-1 = "ami-6934c804"
13+
ap-northeast-1 = "ami-b036d9d1"
14+
custom = ""
15+
}
16+
}
17+
18+
variable "ami_custom" {
19+
type = "string"
20+
description = "Artifact AMI"
21+
default = ""
22+
}
23+
24+
variable "stack_item_fullname" {
25+
type = "string"
26+
}
27+
28+
variable "stack_item_label" {}
29+
30+
variable "instance_type" {
31+
type = "string"
32+
default = "m3.medium"
33+
}
34+
35+
variable "region" {}
36+
37+
variable "key_name" {}
38+
39+
# Do not include the s3:// prefix
40+
# Format should be something like <bucket name>/<folder path>
41+
variable "s3_root_path" {
42+
type = "string"
43+
}
44+
45+
# From AWS limits, max rules for an SG is ~50
46+
variable "cidr_whitelist" {
47+
default = "0.0.0.0/0"
48+
}
49+
50+
variable "cert_key_size" {
51+
default = 4096
52+
}
53+
54+
variable "s3_dir_override" {
55+
type = "string"
56+
default = ""
57+
}
58+
59+
variable "key_city" {
60+
type = "string"
61+
default = "San Francisco"
62+
}
63+
64+
variable "key_org" {
65+
type = "string"
66+
default = "Fort-Funston"
67+
}
68+
69+
# This should probably stick around to help with notifications
70+
variable "key_email" {
71+
type = "string"
72+
default = "cert-admin@example.com"
73+
}
74+
75+
variable "key_ou" {
76+
type = "string"
77+
default = "MyOrgUnit"
78+
}
79+
80+
variable "cert_key_name" {
81+
type = "string"
82+
default = "EasyRSA"
83+
}
84+
85+
variable "key_country" {
86+
type = "string"
87+
default = "US"
88+
}
89+
90+
variable "key_province" {
91+
type = "string"
92+
default = "CA"
93+
}
94+
95+
# Comma delimited list
96+
variable "active_clients" {
97+
type = "string"
98+
default = "client"
99+
}
100+
101+
# Comma delimited list
102+
variable "revoked_clients" {
103+
type = "string"
104+
default = ""
105+
}
106+
107+
variable "openvpn_host" {
108+
description = "Publicly accessible hostname to openvpn server(s)"
109+
type = "string"
110+
default = "localhost"
111+
}
112+
113+
variable "force_cert_regen" {
114+
description = "Force all certificates to be regenerated"
115+
type = "string"
116+
default = "false"
117+
}
118+
119+
variable "s3_push_dryrun" {
120+
description = "Dry-run push of certificates into s3 location"
121+
type = "string"
122+
default = "false"
123+
}

0 commit comments

Comments
 (0)