wip

josielsouzanordcloud · josielsouzanordcloud · commit 28dd09383f32 · 2026-03-05T18:31:22.000Z
diff --git a/Makefile b/Makefile
@@ -4,7 +4,8 @@ include scripts/terraform/terraform.mk
 .DEFAULT_GOAL := help
 
 .PHONY: clean config dependencies githooks-config githooks-run help test test-lint test-unit _install-uv \
-	up down restart logs build rebuild run-pacs run-mwl run-listener run-upload ps shell docker-clean
+	up down restart logs build rebuild run-pacs run-mwl run-listener run-upload ps shell docker-clean \
+	review dev preprod prod
 .SILENT: help
 
 # ---------------------------------------------------------------------------
diff --git a/infrastructure/environments/dev/variables.sh b/infrastructure/environments/dev/variables.sh
@@ -0,0 +1,8 @@
+ENV_CONFIG=dev
+ENVIRONMENT=dev
+AZURE_SUBSCRIPTION="Breast Screening - Manage Breast Screening - Dev"
+HUB_SUBSCRIPTION="Digital Screening DToS - DevOps"
+HUB=dev
+TERRAFORM_MODULES_REF=main
+ENABLE_SOFT_DELETE=false
+ADO_MANAGEMENT_POOL=private-pool-dev-uks
diff --git a/infrastructure/environments/dev/variables.tfvars b/infrastructure/environments/dev/variables.tfvars
@@ -0,0 +1,2 @@
+vnet_address_space     = "10.130.0.0/16"
+enable_gateway_test_vm = true
diff --git a/infrastructure/environments/preprod/variables.sh b/infrastructure/environments/preprod/variables.sh
@@ -0,0 +1,8 @@
+ENV_CONFIG=preprod
+ENVIRONMENT=preprod
+AZURE_SUBSCRIPTION="Breast Screening - Manage Breast Screening - PreProd"
+HUB_SUBSCRIPTION="Digital Screening DToS - Core Services Prod Hub"
+HUB=preprod
+TERRAFORM_MODULES_REF=main
+ENABLE_SOFT_DELETE=true
+ADO_MANAGEMENT_POOL=private-pool-prod-uks
diff --git a/infrastructure/environments/preprod/variables.tfvars b/infrastructure/environments/preprod/variables.tfvars
@@ -0,0 +1 @@
+# All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true
diff --git a/infrastructure/environments/prod/variables.sh b/infrastructure/environments/prod/variables.sh
@@ -0,0 +1,8 @@
+ENV_CONFIG=prod
+ENVIRONMENT=prod
+AZURE_SUBSCRIPTION="Breast Screening - Manage Breast Screening - Prod"
+HUB_SUBSCRIPTION="Digital Screening DToS - Core Services Prod Hub"
+HUB=prod
+TERRAFORM_MODULES_REF=main
+ENABLE_SOFT_DELETE=true
+ADO_MANAGEMENT_POOL=private-pool-prod-uks
diff --git a/infrastructure/environments/prod/variables.tfvars b/infrastructure/environments/prod/variables.tfvars
@@ -0,0 +1 @@
+# All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true
diff --git a/infrastructure/environments/review/variables.tfvars b/infrastructure/environments/review/variables.tfvars
@@ -1,3 +1,2 @@
-vnet_address_space = "10.131.0.0/16"
-enable_arc_servers = true
-bastion_sku        = "Standard"
+vnet_address_space     = "10.131.0.0/16"
+enable_gateway_test_vm = true
diff --git a/infrastructure/modules/arc-infra/bastion.tf b/infrastructure/modules/arc-infra/bastion.tf
@@ -1,14 +1,15 @@
 module "bastion" {
+  count  = var.enable_gateway_test_vm ? 1 : 0
   source = "../dtos-devops-templates/infrastructure/modules/bastion"
 
   name                = "bas-${var.app_short_name}-${var.env_config}-uks"
   public_ip_name      = "pip-bastion-${var.app_short_name}-${var.env_config}-uks"
-  resource_group_name = azurerm_resource_group.main.name
+  resource_group_name = azurerm_resource_group.main[0].name
   location            = var.region
   sku                 = var.bastion_sku
-  subnet_id           = module.subnet_bastion.id
+  subnet_id           = module.subnet_bastion[0].id
 
-  log_analytics_workspace_id                      = module.log_analytics_workspace.id
+  log_analytics_workspace_id                      = module.log_analytics_workspace[0].id
   monitor_diagnostic_setting_bastion_enabled_logs = ["BastionAuditLogs"]
   monitor_diagnostic_setting_bastion_metrics      = ["AllMetrics"]
 }
diff --git a/infrastructure/modules/arc-infra/main.tf b/infrastructure/modules/arc-infra/main.tf
@@ -1,16 +1,19 @@
 # Main resource group for the Arc infrastructure foundation
 resource "azurerm_resource_group" "main" {
+  count = var.enable_gateway_test_vm ? 1 : 0
+
   name     = var.resource_group_name
   location = var.region
 }
 
 # Log Analytics workspace for monitoring Arc-enabled servers
 module "log_analytics_workspace" {
+  count  = var.enable_gateway_test_vm ? 1 : 0
   source = "../dtos-devops-templates/infrastructure/modules/log-analytics-workspace"
 
   name                = "log-${var.app_short_name}-${var.env_config}-uks"
   location            = var.region
-  resource_group_name = azurerm_resource_group.main.name
+  resource_group_name = azurerm_resource_group.main[0].name
   law_sku             = "PerGB2018"
   retention_days      = 30
 
diff --git a/infrastructure/modules/arc-infra/networking.tf b/infrastructure/modules/arc-infra/networking.tf
@@ -1,13 +1,14 @@
 # Virtual network for Arc infrastructure
 module "vnet" {
+  count  = var.enable_gateway_test_vm ? 1 : 0
   source = "../dtos-devops-templates/infrastructure/modules/vnet"
 
   name                = "vnet-${var.app_short_name}-${var.env_config}-uks"
-  resource_group_name = azurerm_resource_group.main.name
+  resource_group_name = azurerm_resource_group.main[0].name
   location            = var.region
   vnet_address_space  = var.vnet_address_space
 
-  log_analytics_workspace_id                   = module.log_analytics_workspace.id
+  log_analytics_workspace_id                   = module.log_analytics_workspace[0].id
   monitor_diagnostic_setting_vnet_enabled_logs = ["VMProtectionAlerts"]
   monitor_diagnostic_setting_vnet_metrics      = ["AllMetrics"]
 }
@@ -132,47 +133,50 @@ locals {
 # Subnet for Azure Bastion — name must be exactly "AzureBastionSubnet"
 # cidrsubnet(vnet/16, 10, 0) → /26 (minimum required for Bastion)
 module "subnet_bastion" {
+  count  = var.enable_gateway_test_vm ? 1 : 0
   source = "../dtos-devops-templates/infrastructure/modules/subnet"
 
-  name                 = "AzureBastionSubnet"
-  resource_group_name  = azurerm_resource_group.main.name
-  vnet_name            = module.vnet.name
-  address_prefixes     = [cidrsubnet(var.vnet_address_space, 10, 0)]
-  location             = var.region
-  create_nsg           = true
+  name                             = "AzureBastionSubnet"
+  resource_group_name              = azurerm_resource_group.main[0].name
+  vnet_name                        = module.vnet[0].name
+  address_prefixes                 = [cidrsubnet(var.vnet_address_space, 10, 0)]
+  location                         = var.region
+  create_nsg                       = true
   network_security_group_name      = "nsg-bastion-${var.env_config}-uks"
   network_security_group_nsg_rules = local.bastion_nsg_rules
 
-  log_analytics_workspace_id                                     = module.log_analytics_workspace.id
+  log_analytics_workspace_id                                     = module.log_analytics_workspace[0].id
   monitor_diagnostic_setting_network_security_group_enabled_logs = ["NetworkSecurityGroupEvent", "NetworkSecurityGroupRuleCounter"]
 }
 
 # Subnet for Arc-enabled servers and future review Windows VMs
 # cidrsubnet(vnet/16, 8, 1) → /24
 module "subnet_arc_servers" {
+  count  = var.enable_gateway_test_vm ? 1 : 0
   source = "../dtos-devops-templates/infrastructure/modules/subnet"
 
-  name                 = "snet-arc-servers-${var.env_config}-uks"
-  resource_group_name  = azurerm_resource_group.main.name
-  vnet_name            = module.vnet.name
-  address_prefixes     = [cidrsubnet(var.vnet_address_space, 8, 1)]
-  location             = var.region
-  create_nsg           = false
+  name                        = "snet-arc-servers-${var.env_config}-uks"
+  resource_group_name         = azurerm_resource_group.main[0].name
+  vnet_name                   = module.vnet[0].name
+  address_prefixes            = [cidrsubnet(var.vnet_address_space, 8, 1)]
+  location                    = var.region
+  create_nsg                  = false
   network_security_group_name = "nsg-arc-servers-${var.env_config}-uks"
 
-  log_analytics_workspace_id                                     = module.log_analytics_workspace.id
+  log_analytics_workspace_id                                     = module.log_analytics_workspace[0].id
   monitor_diagnostic_setting_network_security_group_enabled_logs = []
 }
 
 # NAT gateway for outbound internet access from the arc-servers subnet.
 # Required because Azure no longer provides default outbound SNAT for new VMs.
 # Arc agents need outbound HTTPS to Microsoft endpoints to register and report status.
 module "nat_gateway" {
+  count  = var.enable_gateway_test_vm ? 1 : 0
   source = "../dtos-devops-templates/infrastructure/modules/nat-gateway"
 
   name                = "nat-${var.app_short_name}-${var.env_config}-uks"
   public_ip_name      = "pip-nat-${var.app_short_name}-${var.env_config}-uks"
-  resource_group_name = azurerm_resource_group.main.name
+  resource_group_name = azurerm_resource_group.main[0].name
   location            = var.region
-  subnet_id           = module.subnet_arc_servers.id
+  subnet_id           = module.subnet_arc_servers[0].id
 }
diff --git a/infrastructure/modules/arc-infra/outputs.tf b/infrastructure/modules/arc-infra/outputs.tf
@@ -1,6 +1,6 @@
 output "resource_group_name" {
   description = "Name of the main Arc infrastructure resource group"
-  value       = azurerm_resource_group.main.name
+  value       = var.enable_gateway_test_vm ? azurerm_resource_group.main[0].name : null
 }
 
 output "arc_enabled_servers_resource_group_name" {
@@ -15,20 +15,20 @@ output "arc_enabled_servers_resource_group_id" {
 
 output "vnet_id" {
   description = "ID of the Arc infrastructure VNet"
-  value       = module.vnet.vnet.id
+  value       = var.enable_gateway_test_vm ? module.vnet[0].vnet.id : null
 }
 
 output "arc_servers_subnet_id" {
   description = "ID of the Arc servers subnet (used by the windows-vm module)"
-  value       = module.subnet_arc_servers.id
+  value       = var.enable_gateway_test_vm ? module.subnet_arc_servers[0].id : null
 }
 
 output "log_analytics_workspace_id" {
   description = "ID of the Log Analytics workspace for Arc monitoring"
-  value       = module.log_analytics_workspace.id
+  value       = var.enable_gateway_test_vm ? module.log_analytics_workspace[0].id : null
 }
 
 output "log_analytics_workspace_name" {
   description = "Name of the Log Analytics workspace"
-  value       = module.log_analytics_workspace.name
+  value       = var.enable_gateway_test_vm ? module.log_analytics_workspace[0].name : null
 }
diff --git a/infrastructure/modules/arc-infra/variables.tf b/infrastructure/modules/arc-infra/variables.tf
@@ -19,8 +19,9 @@ variable "resource_group_name" {
 }
 
 variable "vnet_address_space" {
-  description = "Address space for the VNet (e.g., 10.130.0.0/16). Subnets are derived automatically via cidrsubnet."
+  description = "Address space for the VNet (e.g., 10.130.0.0/16). Required when enable_gateway_test_vm is true."
   type        = string
+  default     = null
 }
 
 variable "enable_arc_servers" {
@@ -34,3 +35,9 @@ variable "bastion_sku" {
   type        = string
   default     = "Standard"
 }
+
+variable "enable_gateway_test_vm" {
+  description = "Whether to create the test VM infrastructure (VNet, Bastion, NAT Gateway, Log Analytics) for gateway testing"
+  type        = bool
+  default     = false
+}
diff --git a/infrastructure/terraform/main.tf b/infrastructure/terraform/main.tf
@@ -6,7 +6,8 @@ module "arc_infra" {
   env_config          = var.env_config
   resource_group_name = local.resource_group_name
 
-  vnet_address_space = var.vnet_address_space
+  vnet_address_space     = var.vnet_address_space
+  enable_gateway_test_vm = var.enable_gateway_test_vm
 
   enable_arc_servers = var.enable_arc_servers
   bastion_sku        = var.bastion_sku
diff --git a/infrastructure/terraform/variables.tf b/infrastructure/terraform/variables.tf
@@ -21,8 +21,9 @@ variable "hub_subscription_id" {
 }
 
 variable "vnet_address_space" {
-  description = "Address space for the Arc infrastructure VNet (e.g., 10.130.0.0/16). Subnets are derived automatically via cidrsubnet."
+  description = "Address space for the Arc infrastructure VNet (e.g., 10.130.0.0/16). Required when enable_gateway_test_vm is true."
   type        = string
+  default     = null
 }
 
 variable "enable_arc_servers" {
@@ -37,6 +38,12 @@ variable "bastion_sku" {
   default     = "Standard"
 }
 
+variable "enable_gateway_test_vm" {
+  description = "Whether to create the test VM infrastructure (VNet, Bastion, NAT Gateway, Log Analytics) for gateway testing"
+  type        = bool
+  default     = false
+}
+
 locals {
   region              = "uksouth"
   resource_group_name = "rg-${var.app_short_name}-${var.environment}-uks"
diff --git a/scripts/terraform/terraform.mk b/scripts/terraform/terraform.mk
@@ -5,6 +5,15 @@ STORAGE_ACCOUNT_RG=rg-dtos-state-files
 review: # Target the review environment - make review <action>
 	$(eval include infrastructure/environments/review/variables.sh)
 
+dev: # Target the dev environment - make dev <action>
+	$(eval include infrastructure/environments/dev/variables.sh)
+
+preprod: # Target the preprod environment - make preprod <action>
+	$(eval include infrastructure/environments/preprod/variables.sh)
+
+prod: # Target the prod environment - make prod <action>
+	$(eval include infrastructure/environments/prod/variables.sh)
+
 ci: # Skip manual approvals when running in CI - make ci <env> <action>
 	$(eval AUTO_APPROVE=-auto-approve)
 	$(eval SKIP_AZURE_LOGIN=true)

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+vnet_address_space = "10.130.0.0/16"`
	`2`	`+enable_gateway_test_vm = true`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+# All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true`