gensokyo-zone/infrastructure
1
0
Fork 0
mirror of https://github.com/gensokyo-zone/infrastructure.git synced 2026-02-09 04:19:19 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(tf): more tailscale tags

Browse source
This commit is contained in:
arcnmx 2024-09-05 13:51:29 -07:00
parent 08cd0e2203
commit 70e3c0cab4
7 changed files with 214 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

36
tf/tailscale_devices.tf
View file

@ -1,8 +1,24 @@
locals {
tailscale_tag_infra = "tag:infrastructure"
tailscale_tag_genso = "tag:gensokyo"
tailscale_tag_reisen = "tag:reisen"
tailscale_tag_arc = "tag:arc"
tailscale_tag_kat = "tag:kat"
tailscale_group_admin = "autogroup:admin"
tailscale_user_arc = "arc@${var.tailscale_tailnet}"
tailscale_user_kat = "kat@${var.tailscale_tailnet}"
}
resource "tailscale_acl" "tailnet" {
acl = jsonencode({
tagOwners = {
"tag:reisen" : ["autogroup:admin"],
"tag:gensokyo" : ["autogroup:admin"],
"${local.tailscale_tag_infra}" : [local.tailscale_group_admin],
"${local.tailscale_tag_reisen}" : [local.tailscale_group_admin, local.tailscale_tag_infra],
"${local.tailscale_tag_genso}" : [local.tailscale_group_admin, local.tailscale_tag_arc, local.tailscale_tag_kat],
"${local.tailscale_tag_arc}" : [local.tailscale_user_arc],
"${local.tailscale_tag_kat}" : [local.tailscale_user_kat],
}
acls = [
{
@ -30,7 +46,16 @@ resource "tailscale_tailnet_key" "reisen" {
ephemeral = false
preauthorized = true
description = "Reisen VM"
tags = ["tag:gensokyo", "tag:reisen"]
tags = [local.tailscale_tag_infra, local.tailscale_tag_genso, local.tailscale_tag_reisen]
depends_on = [tailscale_acl.tailnet]
}
resource "tailscale_tailnet_key" "gensokyo" {
reusable = true
ephemeral = false
preauthorized = true
description = "Reisen VM"
tags = [local.tailscale_tag_infra, local.tailscale_tag_genso]
depends_on = [tailscale_acl.tailnet]
}
@ -38,3 +63,8 @@ output "tailscale_key_reisen" {
value = tailscale_tailnet_key.reisen.key
sensitive = true
}
output "tailscale_key_gensokyo" {
value = tailscale_tailnet_key.gensokyo.key
sensitive = true
}