examples-infrastructure-as-code/terraform/google/google-compute-instance/main.tf at 27a7fb77c092214ddd804b7ba83e64c4d52f3451 · tailscale-dev/examples-infrastructure-as-code · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
locals {
  name = "example-${basename(path.cwd)}"

  google_metadata = {
    Name = local.name
  }

  tailscale_acl_tags = [
    "tag:example-infra",
    "tag:example-exitnode",
    "tag:example-subnetrouter",
    "tag:example-appconnector",
  ]
  tailscale_set_preferences = [
    "--auto-update",
    "--ssh",
    "--advertise-connector",
    "--advertise-exit-node",
    "--advertise-routes=${join(",", coalescelist(
      local.vpc_cidr_block,
    ))}",
  ]

  // Modify these to use your own VPC
  project_id     = var.project_id
  region         = var.region
  zone           = var.zone
  vpc_cidr_block = module.vpc.subnets_ips
  subnet_id      = module.vpc.subnets_ids[0]
  instance_type  = "e2-medium"
  instance_tags  = ["tailscale-instance"]
}

module "vpc" {
  source = "../internal-modules/google-vpc"

  project_id = local.project_id
  region     = local.region

  name = local.name
}

resource "tailscale_tailnet_key" "main" {
  ephemeral           = true
  preauthorized       = true
  reusable            = true
  recreate_if_invalid = "always"
  tags                = local.tailscale_acl_tags
}

module "tailscale_instance" {
  source = "../internal-modules/google-compute-instance"

  zone         = local.zone
  machine_name = local.name
  machine_type = local.instance_type
  subnet       = local.subnet_id

  instance_metadata = local.google_metadata
  instance_tags     = local.instance_tags

  # Variables for Tailscale resources
  tailscale_hostname        = local.name
  tailscale_auth_key        = tailscale_tailnet_key.main.key
  tailscale_set_preferences = local.tailscale_set_preferences

  depends_on = [
    module.vpc.nat_ids, # remove if using your own VPC otherwise ensure provisioned NAT gateway is available
  ]
}

resource "google_compute_firewall" "tailscale_ingress_ipv4" {
  name    = "${local.name}-tailscale-ingress-ipv4"
  network = module.vpc.vpc_id

  allow {
    protocol = "udp"
    ports    = ["41641"]
  }

  source_ranges = [
    "0.0.0.0/0",
  ]
  target_tags = local.instance_tags
}

resource "google_compute_firewall" "tailscale_ingress_ipv6" {
  name    = "${local.name}-tailscale-ingress-ipv6"
  network = module.vpc.vpc_id

  allow {
    protocol = "udp"
    ports    = ["41641"]
  }

  source_ranges = [
    "::/0",
  ]
  target_tags = local.instance_tags
}