Connect to a Private Environment from Your Computer

variable "network_id" {
  description = "The environment's Redpanda network ID."
  type        = string
}

variable "environment_cidr" {
  description = "The environment's CIDR block."
  type        = string
}

variable "subnet_id" {
  description = "One of the environment's private subnets tagged kubernetes.io/role/internal-elb=1."
  type        = string
}

variable "vpn_client_cidr" {
  description = "An address range for VPN clients, /12 to /22, that doesn't overlap the environment's CIDR block."
  type        = string
}

variable "server_certificate_arn" {
  description = "The ARN of the server certificate in AWS Certificate Manager."
  type        = string
}

variable "client_root_certificate_arn" {
  description = "The ARN of the certificate authority that issued the client certificate, in AWS Certificate Manager."
  type        = string
}

data "aws_vpc" "environment" {
  tags = { Name = "network-${var.network_id}" }
}

resource "aws_security_group" "client_vpn" {
  name   = "client-vpn"
  vpc_id = data.aws_vpc.environment.id
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_ec2_client_vpn_endpoint" "environment" {
  server_certificate_arn = var.server_certificate_arn
  client_cidr_block      = var.vpn_client_cidr
  split_tunnel           = true
  vpc_id                 = data.aws_vpc.environment.id
  security_group_ids     = [aws_security_group.client_vpn.id]

  authentication_options {
    type                       = "certificate-authentication"
    root_certificate_chain_arn = var.client_root_certificate_arn
  }

  connection_log_options {
    enabled = false
  }
}

resource "aws_ec2_client_vpn_network_association" "environment" {
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.environment.id
  subnet_id              = var.subnet_id
}

resource "aws_ec2_client_vpn_authorization_rule" "environment" {
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.environment.id
  target_network_cidr    = var.environment_cidr
  authorize_all_groups   = true
}

output "endpoint_id" {
  value = aws_ec2_client_vpn_endpoint.environment.id
}

variable "network_id" {
  description = "The environment's Redpanda network ID."
  type        = string
}

variable "environment_project_id" {
  description = "The project you deployed the environment into."
  type        = string
}

variable "region" {
  description = "The environment's region."
  type        = string
}

variable "office_vpn_ip" {
  description = "Your VPN device's public IP address."
  type        = string
}

variable "office_cidr" {
  description = "Your network's address range."
  type        = string
}

variable "shared_secret" {
  description = "The pre-shared key, also configured on your VPN device."
  type        = string
  sensitive   = true
}

data "google_compute_network" "environment" {
  name    = "redpanda-${var.network_id}"
  project = var.environment_project_id
}

resource "google_compute_address" "vpn" {
  name    = "office-vpn"
  project = var.environment_project_id
  region  = var.region
}

resource "google_compute_vpn_gateway" "office" {
  name    = "office-vpn"
  project = var.environment_project_id
  region  = var.region
  network = data.google_compute_network.environment.self_link
}

locals {
  ipsec = {
    esp     = { protocol = "ESP", port = null }
    udp500  = { protocol = "UDP", port = "500" }
    udp4500 = { protocol = "UDP", port = "4500" }
  }
}

resource "google_compute_forwarding_rule" "vpn" {
  for_each    = local.ipsec
  name        = "office-vpn-${each.key}"
  project     = var.environment_project_id
  region      = var.region
  ip_protocol = each.value.protocol
  port_range  = each.value.port
  ip_address  = google_compute_address.vpn.address
  target      = google_compute_vpn_gateway.office.id
}

resource "google_compute_vpn_tunnel" "office" {
  name                    = "office-vpn"
  project                 = var.environment_project_id
  region                  = var.region
  target_vpn_gateway      = google_compute_vpn_gateway.office.id
  peer_ip                 = var.office_vpn_ip
  shared_secret           = var.shared_secret
  ike_version             = 2
  local_traffic_selector  = ["0.0.0.0/0"]
  remote_traffic_selector = ["0.0.0.0/0"]
  depends_on              = [google_compute_forwarding_rule.vpn]
}

# The environment's route back to your network, through the tunnel.
resource "google_compute_route" "office" {
  name                = "office-vpn"
  project             = var.environment_project_id
  network             = data.google_compute_network.environment.self_link
  dest_range          = var.office_cidr
  next_hop_vpn_tunnel = google_compute_vpn_tunnel.office.id
}

output "gateway_ip" {
  value = google_compute_address.vpn.address
}