terraform-hcloud-firewalls/variables.tf at main · peterpramb/terraform-hcloud-firewalls · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
# =====================================
# Manage firewalls in the Hetzner Cloud
# =====================================


# ---------------
# Input Variables
# ---------------

variable "firewalls" {
  description = "The list of firewall objects to be managed. Each firewall object supports the following parameters: 'name' (string, required), 'rules' (list of rule objects, optional), 'server' (server object, optional), 'labels' (map of KV pairs, optional). Each rule object supports the following parameters: 'direction' (string, required), 'protocol' (string, required), 'port' (string, required for TCP/UDP), 'remote_ips' (list of IP addresses, required), 'description' (string, optional). The server object supports the following parameters: 'ids' (list of server IDs, optional), 'labels' (list of label selectors, optional)."

  type        = list(
    object({
      name   = string
      rules  = list(
        object({
          direction   = string
          protocol    = string
          port        = string
          remote_ips  = list(string)
          description = string
        })
      )
      server = object({
        ids    = list(string)
        labels = list(string)
      })
      labels = map(string)
    })
  )

  default     = [
    {
      name   = "firewall-1"
      rules  = [
        {
          direction   = "in"
          protocol    = "icmp"
          port        = null
          remote_ips  = [
            "0.0.0.0/0",
            "::/0"
          ]
          description = "allow ICMP in"
        },
        {
          direction   = "in"
          protocol    = "tcp"
          port        = "22"
          remote_ips  = [
            "0.0.0.0/0",
            "::/0"
          ]
          description = "allow SSH in"
        }
      ]
      server = null
      labels = {}
    }
  ]

  validation {
    condition     = can([
      for firewall in var.firewalls : regex("\\w+", firewall.name)
    ])
    error_message = "All firewalls must have a valid 'name' attribute specified."
  }

  validation {
    condition     = can([
      for firewall in var.firewalls : [
        for rule in firewall.rules : regex("\\w+", rule.direction)
      ] if lookup(firewall, "rules", null) != null
    ])
    error_message = "All firewall rules must have a valid 'direction' attribute specified."
  }

  validation {
    condition     = can([
      for firewall in var.firewalls : [
        for rule in firewall.rules : regex("\\w+", rule.protocol)
      ] if lookup(firewall, "rules", null) != null
    ])
    error_message = "All firewall rules must have a valid 'protocol' attribute specified."
  }

  validation {
    condition     = can([
      for firewall in var.firewalls : [
        for rule in firewall.rules : regex("\\w+", rule.port)
          if(rule.protocol == "tcp" || rule.protocol == "udp")
      ] if lookup(firewall, "rules", null) != null
    ])
    error_message = "All TCP/UDP firewall rules must have a valid 'port' attribute specified."
  }

  validation {
    condition     = can([
      for firewall in var.firewalls : [
        for rule in firewall.rules : element(rule.remote_ips, 0)
      ] if lookup(firewall, "rules", null) != null
    ])
    error_message = "All firewall rules must have at least one remote IP specified."
  }

  validation {
    condition     = can([
      for firewall in var.firewalls : [
        for rule in firewall.rules : [
          for remote_ip in rule.remote_ips: regex("\\w+", remote_ip)
        ]
      ] if lookup(firewall, "rules", null) != null
    ])
    error_message = "All firewall rules must have valid remote IPs specified."
  }
}