49 lines
1.7 KiB
Terraform
49 lines
1.7 KiB
Terraform
locals {
|
|
wireguard_home_prefixes = ["192.168.10.0/24", "10.60.0.0/24", "10.61.0.0/24"]
|
|
}
|
|
|
|
# route table -> subnet -> instance 已存在依赖，不能反向引用实例的私有 IP。
|
|
# 此值从现有 AMD VNIC 核对；重建实例后必须重新查询，禁止继续使用旧 OCID。
|
|
variable "amd_router_private_ip_ocid" {
|
|
type = string
|
|
default = "ocid1.privateip.oc1.ap-osaka-1.abvwsljrhxq2cw46zhjyrnn5zbz4rrynjbzlynkz6ubhiedadr72zcaideaq"
|
|
}
|
|
|
|
resource "oci_core_network_security_group" "wireguard" {
|
|
compartment_id = var.compartment_ocid
|
|
vcn_id = oci_core_vcn.vcn.id
|
|
display_name = "homelab-amd-wireguard"
|
|
}
|
|
|
|
resource "oci_core_network_security_group_security_rule" "wireguard" {
|
|
network_security_group_id = oci_core_network_security_group.wireguard.id
|
|
direction = "INGRESS"
|
|
protocol = "17"
|
|
source = "0.0.0.0/0"
|
|
source_type = "CIDR_BLOCK"
|
|
stateless = false
|
|
description = "WireGuard NAT traversal; peer public key authenticates clients"
|
|
udp_options {
|
|
destination_port_range {
|
|
min = 51820
|
|
max = 51820
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "oci_core_network_security_group_security_rule" "dn42_first_peer" {
|
|
network_security_group_id = oci_core_network_security_group.wireguard.id
|
|
direction = "INGRESS"
|
|
protocol = "17"
|
|
source = "0.0.0.0/0"
|
|
source_type = "CIDR_BLOCK"
|
|
stateless = false
|
|
description = "DN42 first external WireGuard peer; public key authentication"
|
|
udp_options {
|
|
destination_port_range {
|
|
min = 51821
|
|
max = 51821
|
|
}
|
|
}
|
|
}
|