恢复 OCI Terraform 与站点网络 IaC

2026-09-17 13:22:49 +00:00
parent a08c8a7303
commit 71eea7d8fc
41 changed files with 1786 additions and 10 deletions
@@ -0,0 +1,48 @@
+locals {
+  wireguard_home_prefixes = ["192.168.10.0/24", "10.60.0.0/24", "10.61.0.0/24"]
+}
+
+# route table -> subnet -> instance 已存在依赖，不能反向引用实例的私有 IP。
+# 此值从现有 AMD VNIC 核对；重建实例后必须重新查询，禁止继续使用旧 OCID。
+variable "amd_router_private_ip_ocid" {
+  type    = string
+  default = "ocid1.privateip.oc1.ap-osaka-1.abvwsljrhxq2cw46zhjyrnn5zbz4rrynjbzlynkz6ubhiedadr72zcaideaq"
+}
+
+resource "oci_core_network_security_group" "wireguard" {
+  compartment_id = var.compartment_ocid
+  vcn_id         = oci_core_vcn.vcn.id
+  display_name   = "homelab-amd-wireguard"
+}
+
+resource "oci_core_network_security_group_security_rule" "wireguard" {
+  network_security_group_id = oci_core_network_security_group.wireguard.id
+  direction                 = "INGRESS"
+  protocol                  = "17"
+  source                    = "0.0.0.0/0"
+  source_type               = "CIDR_BLOCK"
+  stateless                 = false
+  description               = "WireGuard NAT traversal; peer public key authenticates clients"
+  udp_options {
+    destination_port_range {
+      min = 51820
+      max = 51820
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "dn42_first_peer" {
+  network_security_group_id = oci_core_network_security_group.wireguard.id
+  direction                 = "INGRESS"
+  protocol                  = "17"
+  source                    = "0.0.0.0/0"
+  source_type               = "CIDR_BLOCK"
+  stateless                 = false
+  description               = "DN42 first external WireGuard peer; public key authentication"
+  udp_options {
+    destination_port_range {
+      min = 51821
+      max = 51821
+    }
+  }
+}