feat(connectivity): enhance network area configuration with STACKIT resolvers and update documentation

Author: mahauber

src/config/hub-and-spoke-firewall.tfvars

@@ -74,6 +74,9 @@ connectivity = {
     min_prefix_length     = 24
     max_prefix_length     = 28
     default_prefix_length = 25
+
+    # Resolvers handed to every network in the area. Left out, the STACKIT resolvers of the configured region apply
+    # default_nameservers = ["192.214.161.53", "213.17.17.17", "188.34.111.111"]
   }
 
   # Delete the variable to skip firewall deployment
@@ -147,7 +150,7 @@ connectivity = {
 #     platform_dns = {
 #       type        = "host"
 #       description = "Resolvers the landing zones are pointed at"
-#       content     = ["1.1.1.1", "1.0.0.1"]
+#       content     = ["192.214.161.53", "213.17.17.17", "188.34.111.111"] # STACKIT resolvers, eu01
 #     }
 #
 #     # Example of a domain based allow rule. A host alias accepts FQDNs and OPNsense re-resolves them on a timer
@@ -193,6 +196,7 @@ connectivity = {
 #       destination_port = "443"
 #     }
 #
+#     # Block everything else to the web GUI since the firewall image allows all traffic by default
 #     block-webgui-from-everywhere-else = {
 #       sequence         = 20
 #       action           = "block"

src/config/hub-and-spoke.tfvars

@@ -74,17 +74,14 @@ connectivity = {
     min_prefix_length     = 24
     max_prefix_length     = 28
     default_prefix_length = 25
+
+    # Resolvers handed to every network in the area. Left out, the STACKIT resolvers of the configured region apply
+    # default_nameservers = ["192.214.161.53", "213.17.17.17", "188.34.111.111"]
   }
 
-  # Optional: site-to-site IPsec VPN terminating in the hub, bridging the network area to
-  # on-premises or another cloud. Uncomment to enable — it provisions a billed VPN gateway.
-  #
-  # Roll out in two steps, because each side needs the other's public IP:
-  #   1. Apply with connections = {} to provision the gateway.
-  #   2. Read `tofu output connectivity_vpn_public_ips` and configure the remote peer.
-  #   3. Fill in remote_address below and apply again.
+  # Optional: site-to-site IPsec VPN terminating in the hub. Uncomment to enable
   #
-  # Pre-shared keys are deliberately not stored here. Supply them separately:
+  # Pre-shared keys need to be supplied separately:
   #   export TF_VAR_vpn_pre_shared_keys='{"onprem"={"tunnel1"="<20+ chars>","tunnel2"="<20+ chars>"}}'
   #
   # vpn = {

src/main.tf

@@ -44,6 +44,7 @@ module "connectivity" {
   parent_container_id = module.governance.folder_container_ids["platform"]
   organization_id     = var.organization_id
   labels              = var.labels
+  region              = var.region
   dns_zones           = var.connectivity.dns_zones
   network_area        = var.connectivity.network_area
   firewall            = var.connectivity.firewall
@@ -150,7 +151,8 @@ module "landing_zone" {
   labels                = var.labels
   role_assignments      = each.value.role_assignments
   network_prefix_length = each.value.network_prefix_length
-  custom_roles          = each.value.custom_roles
-  observability         = each.value.observability
-  firewall_next_hop_ip  = var.connectivity != null && var.connectivity.firewall != null ? module.connectivity[0].firewall_next_hop_ip : null # if firewall is enabled, pass the next hop IP to the landing zones for route configuration
+  ipv4_nameservers     = try(module.connectivity[0].network_area_nameservers, null)
+  custom_roles         = each.value.custom_roles
+  observability        = each.value.observability
+  firewall_next_hop_ip = var.connectivity != null && var.connectivity.firewall != null ? module.connectivity[0].firewall_next_hop_ip : null # if firewall is enabled, pass the next hop IP to the landing zones for route configuration
 }

src/modules/connectivity/1-network-area.tf

@@ -2,6 +2,21 @@
 ## NETWORK AREA ##
 ##################
 
+locals {
+  # STACKIT runs its own resolvers per region and recommends them over public ones.
+  # Regions not listed here have to bring their own network_area.default_nameservers.
+  stackit_regional_nameservers = {
+    eu01 = ["192.214.161.53", "213.17.17.17", "188.34.111.111"]
+    eu02 = ["45.137.172.101", "45.137.172.102", "45.137.172.103"]
+  }
+
+  network_area_nameservers = (
+    var.network_area.default_nameservers != null
+    ? var.network_area.default_nameservers
+    : lookup(local.stackit_regional_nameservers, var.region, [])
+  )
+}
+
 resource "stackit_network_area" "this" {
   organization_id = var.organization_id
   name            = var.network_area_name != null ? var.network_area_name : var.naming_pattern
@@ -11,14 +26,22 @@ resource "stackit_network_area" "this" {
 resource "stackit_network_area_region" "this" {
   organization_id = var.organization_id
   network_area_id = stackit_network_area.this.network_area_id
+  region          = var.region
 
   ipv4 = {
     network_ranges        = [for r in var.network_area.ranges : { prefix = r }]
     transfer_network      = var.network_area.transfer_network
     max_prefix_length     = var.network_area.max_prefix_length
     min_prefix_length     = var.network_area.min_prefix_length
     default_prefix_length = var.network_area.default_prefix_length
-    default_nameservers   = var.network_area.default_nameservers
+    default_nameservers   = local.network_area_nameservers
+  }
+
+  lifecycle {
+    precondition {
+      condition     = length(local.network_area_nameservers) > 0
+      error_message = "No STACKIT resolvers are known for region ${var.region}. Set connectivity.network_area.default_nameservers explicitly."
+    }
   }
 }
 

src/modules/connectivity/README.md

@@ -51,12 +51,13 @@ No modules.
 | <a name="input_firewall"></a> [firewall](#input\_firewall) | Firewall configuration. Set to null to skip firewall deployment (network area and routing are still created). lan\_network\_range and wan\_network\_range must be CIDRs within the network area range. lan\_ip and wan\_ip are optional; when omitted, the 5th address of the respective prefix is used (STACKIT reserves the first usable address as the gateway). | <pre>object({<br/>    zone                     = string<br/>    flavor                   = string<br/>    name                     = string<br/>    volume_performance_class = optional(string, "storage_premium_perf4")<br/>    volume_size              = optional(number, 16)<br/>    lan_network_range        = string<br/>    wan_network_range        = string<br/>    lan_ip                   = optional(string, null)<br/>    wan_ip                   = optional(string, null)<br/>  })</pre> | `null` | no |
 | <a name="input_labels"></a> [labels](#input\_labels) | Additional labels to apply to all resources. | `map(string)` | `{}` | no |
 | <a name="input_naming_pattern"></a> [naming\_pattern](#input\_naming\_pattern) | Naming prefix for all resources in this module, e.g. "myco-pltfm-hub-prod". | `string` | n/a | yes |
-| <a name="input_network_area"></a> [network\_area](#input\_network\_area) | Network area configuration including IP ranges, transfer network, and prefix length settings. | <pre>object({<br/>    ranges                = list(string)<br/>    transfer_network      = string<br/>    min_prefix_length     = optional(number, 24)<br/>    max_prefix_length     = optional(number, 28)<br/>    default_prefix_length = optional(number, 28)<br/>    default_nameservers   = optional(list(string), ["1.0.0.1", "1.1.1.1"])<br/>  })</pre> | n/a | yes |
+| <a name="input_network_area"></a> [network\_area](#input\_network\_area) | Network area configuration including IP ranges, transfer network, and prefix length settings. default\_nameservers falls back to the STACKIT resolvers of var.region when unset. | <pre>object({<br/>    ranges                = list(string)<br/>    transfer_network      = string<br/>    min_prefix_length     = optional(number, 24)<br/>    max_prefix_length     = optional(number, 28)<br/>    default_prefix_length = optional(number, 28)<br/>    default_nameservers   = optional(list(string), null)<br/>  })</pre> | n/a | yes |
 | <a name="input_network_area_name"></a> [network\_area\_name](#input\_network\_area\_name) | Name of the network area to create for this region. | `string` | `null` | no |
 | <a name="input_organization_id"></a> [organization\_id](#input\_organization\_id) | Organization ID, required for network area and route configuration. | `string` | n/a | yes |
 | <a name="input_owner_email"></a> [owner\_email](#input\_owner\_email) | Email address of the owner for the project. Required for STACKIT resource manager. | `string` | n/a | yes |
 | <a name="input_parent_container_id"></a> [parent\_container\_id](#input\_parent\_container\_id) | Parent container ID (folder or organization) where the project will be created. | `string` | n/a | yes |
 | <a name="input_project_name"></a> [project\_name](#input\_project\_name) | Name of the STACKIT project to create. Falls back to naming\_pattern if not set. | `string` | `null` | no |
+| <a name="input_region"></a> [region](#input\_region) | STACKIT region the network area region is created in. Also selects the default resolvers when network\_area.default\_nameservers is unset. | `string` | `"eu01"` | no |
 | <a name="input_role_assignments"></a> [role\_assignments](#input\_role\_assignments) | List of role assignments for the project. Subject can be a user email or service account email. | <pre>list(object({<br/>    role    = string<br/>    subject = string<br/>  }))</pre> | `[]` | no |
 | <a name="input_vpn"></a> [vpn](#input\_vpn) | IPsec VPN gateway for the hub, attached to the network area through the connectivity project. Set to null to skip. The gateway is HA: it terminates two tunnels in separate availability zones, each with its own public IP. Connections are created in a second apply once the remote peer addresses are known. Supports POLICY\_BASED and ROUTE\_BASED routing. | <pre>object({<br/>    display_name = optional(string, null)<br/>    plan_id      = optional(string, "p100")<br/>    routing_type = optional(string, "ROUTE_BASED")<br/>    availability_zones = object({<br/>      tunnel1 = string<br/>      tunnel2 = string<br/>    })<br/>    connections = optional(map(object({<br/>      display_name   = optional(string, null)<br/>      enabled        = optional(bool, true)<br/>      local_subnets  = optional(list(string), null)<br/>      remote_subnets = optional(list(string), null)<br/>      static_routes  = optional(list(string), null)<br/>      tunnel1 = object({<br/>        remote_address = string<br/>        peering = optional(object({<br/>          local_address  = string<br/>          remote_address = string<br/>        }), null)<br/>        phase1 = optional(object({<br/>          encryption_algorithms = optional(list(string), ["aes256"])<br/>          integrity_algorithms  = optional(list(string), ["sha2_384"])<br/>          dh_groups             = optional(list(string), ["ecp384"])<br/>          rekey_time            = optional(number, null)<br/>        }), {})<br/>        phase2 = optional(object({<br/>          encryption_algorithms = optional(list(string), ["aes256"])<br/>          integrity_algorithms  = optional(list(string), ["sha2_384"])<br/>          dh_groups             = optional(list(string), ["ecp384"])<br/>          rekey_time            = optional(number, null)<br/>          dpd_action            = optional(string, null)<br/>          start_action          = optional(string, null)<br/>        }), {})<br/>      })<br/>      tunnel2 = object({<br/>        remote_address = string<br/>        peering = optional(object({<br/>          local_address  = string<br/>          remote_address = string<br/>        }), null)<br/>        phase1 = optional(object({<br/>          encryption_algorithms = optional(list(string), ["aes256"])<br/>          integrity_algorithms  = optional(list(string), ["sha2_384"])<br/>          dh_groups             = optional(list(string), ["ecp384"])<br/>          rekey_time            = optional(number, null)<br/>        }), {})<br/>        phase2 = optional(object({<br/>          encryption_algorithms = optional(list(string), ["aes256"])<br/>          integrity_algorithms  = optional(list(string), ["sha2_384"])<br/>          dh_groups             = optional(list(string), ["ecp384"])<br/>          rekey_time            = optional(number, null)<br/>          dpd_action            = optional(string, null)<br/>          start_action          = optional(string, null)<br/>        }), {})<br/>      })<br/>    })), {})<br/>  })</pre> | `null` | no |
 | <a name="input_vpn_pre_shared_keys"></a> [vpn\_pre\_shared\_keys](#input\_vpn\_pre\_shared\_keys) | Pre-shared keys per VPN connection key, one per tunnel. Kept separate from var.vpn so the connection topology stays committable; supply through TF\_VAR\_vpn\_pre\_shared\_keys or a gitignored tfvars file. Minimum 20 characters. | <pre>map(object({<br/>    tunnel1 = string<br/>    tunnel2 = string<br/>  }))</pre> | `{}` | no |
@@ -70,6 +71,7 @@ No modules.
 | <a name="output_firewall_next_hop_ip"></a> [firewall\_next\_hop\_ip](#output\_firewall\_next\_hop\_ip) | The IP address to be used as next hop for the default route in the landing zones (firewall LAN IP). |
 | <a name="output_firewall_public_ip"></a> [firewall\_public\_ip](#output\_firewall\_public\_ip) | The public IP address of the firewall WAN interface. |
 | <a name="output_network_area_id"></a> [network\_area\_id](#output\_network\_area\_id) | The ID of the created network area. |
+| <a name="output_network_area_nameservers"></a> [network\_area\_nameservers](#output\_network\_area\_nameservers) | Resolvers configured as the network area default, either from network\_area.default\_nameservers or the STACKIT resolvers of the region. |
 | <a name="output_project_container_id"></a> [project\_container\_id](#output\_project\_container\_id) | The container ID of the created STACKIT project. |
 | <a name="output_project_id"></a> [project\_id](#output\_project\_id) | The project ID of the created STACKIT project. |
 | <a name="output_project_name"></a> [project\_name](#output\_project\_name) | The name of the created STACKIT project. |

src/modules/connectivity/outputs.tf

@@ -23,6 +23,11 @@ output "network_area_id" {
   value       = stackit_network_area.this.network_area_id
 }
 
+output "network_area_nameservers" {
+  description = "Resolvers configured as the network area default, either from network_area.default_nameservers or the STACKIT resolvers of the region."
+  value       = local.network_area_nameservers
+}
+
 output "project_container_id" {
   description = "The container ID of the created STACKIT project."
   value       = stackit_resourcemanager_project.this.container_id

src/modules/connectivity/variables.tf

@@ -51,9 +51,9 @@ variable "network_area" {
     min_prefix_length     = optional(number, 24)
     max_prefix_length     = optional(number, 28)
     default_prefix_length = optional(number, 28)
-    default_nameservers   = optional(list(string), ["1.0.0.1", "1.1.1.1"])
+    default_nameservers   = optional(list(string), null)
   })
-  description = "Network area configuration including IP ranges, transfer network, and prefix length settings."
+  description = "Network area configuration including IP ranges, transfer network, and prefix length settings. default_nameservers falls back to the STACKIT resolvers of var.region when unset."
 }
 
 variable "network_area_name" {
@@ -83,6 +83,12 @@ variable "project_name" {
   default     = null
 }
 
+variable "region" {
+  type        = string
+  description = "STACKIT region the network area region is created in. Also selects the default resolvers when network_area.default_nameservers is unset."
+  default     = "eu01"
+}
+
 variable "role_assignments" {
   type = list(object({
     role    = string

src/modules/landing-zone/README.md

@@ -47,7 +47,7 @@ No modules.
 | <a name="input_custom_roles"></a> [custom\_roles](#input\_custom\_roles) | List of custom roles to create for the project. | <pre>list(object({<br/>    name        = string<br/>    description = string<br/>    permissions = list(string)<br/>  }))</pre> | n/a | yes |
 | <a name="input_dns_zone_name"></a> [dns\_zone\_name](#input\_dns\_zone\_name) | Full DNS zone domain name for this landing zone. Set to null to skip DNS zone creation. | `string` | `null` | no |
 | <a name="input_firewall_next_hop_ip"></a> [firewall\_next\_hop\_ip](#input\_firewall\_next\_hop\_ip) | IP address of the firewall next hop. | `string` | `null` | no |
-| <a name="input_ipv4_nameservers"></a> [ipv4\_nameservers](#input\_ipv4\_nameservers) | List of IPv4 nameservers for the network. | `list(string)` | `null` | no |
+| <a name="input_ipv4_nameservers"></a> [ipv4\_nameservers](#input\_ipv4\_nameservers) | List of IPv4 nameservers for the network. Null takes the network area defaults on creation and leaves an existing network untouched. | `list(string)` | `null` | no |
 | <a name="input_labels"></a> [labels](#input\_labels) | Additional labels to apply to all resources. | `map(string)` | `{}` | no |
 | <a name="input_naming_pattern"></a> [naming\_pattern](#input\_naming\_pattern) | Naming prefix for all resources in this module, e.g. "myco-pltfm-hub-prod". | `string` | n/a | yes |
 | <a name="input_network_area_id"></a> [network\_area\_id](#input\_network\_area\_id) | Network Area ID to deploy resources into. Required if corporate is true. | `string` | `null` | no |

src/modules/landing-zone/variables.tf

@@ -74,7 +74,7 @@ variable "firewall_next_hop_ip" {
 
 variable "ipv4_nameservers" {
   type        = list(string)
-  description = "List of IPv4 nameservers for the network."
+  description = "List of IPv4 nameservers for the network. Null takes the network area defaults on creation and leaves an existing network untouched."
   default     = null
 }
 

src/variables.tf

@@ -249,6 +249,8 @@ variable "connectivity" {
       min_prefix_length     = optional(number, 24)
       max_prefix_length     = optional(number, 28)
       default_prefix_length = optional(number, 28)
+      # Unset means the STACKIT resolvers of var.region, see modules/connectivity/1-network-area.tf.
+      default_nameservers = optional(list(string), null)
     }), null)
     firewall = optional(object({
       zone                     = string