hochlaf/but3-iac_RH
1
0
Fork 0
forked from pierront/but3-iac
Code Pull Requests Activity

maj

Browse Source
This commit is contained in:
Raphael HOCHLAF
2025-12-03 17:02:13 +01:00
parent 80ddec8234
commit 9cc824d41c
3 changed files with 57 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
terraform/environments/dev/main.tf
View File

@@ -52,12 +52,9 @@ module "iam" {
# Fichier template Ansible # Fichier template Ansible
# ------------------------ # ------------------------
data "template" "ansible_cfg" { data "local_file" "ansible_cfg" {
template = file("${path.module}/../../template/ansible.cfg.tpl") filename = "${path.module}/ansible.cfg"
content = templatefile("${path.module}/../../template/ansible.cfg.tpl", {
vars = { remote_user = "raphael.hochlaf@gmail.com"
frontend_ip = module.compute.frontend_public_ip })
backend_ip = module.compute.internal_ips["backend"]
db_ip = module.compute.internal_ips["database"]
}
} }

54
terraform/modules/network/main.tf
View File

@@ -1,35 +1,34 @@
# À vous de créer : resource "google_compute_network" "vpc" {
# 1. Un VPC personnalisé avec auto_create_subnetworks = false name = "${var.project_name}-vpc"
resource "google_compute_network" "VPC" {
name = "vpc"
auto_create_subnetworks = false auto_create_subnetworks = false
} }
# 2. Trois sous-réseaux (frontend, backend, database)
resource "google_compute_subnetwork" "frontend" { resource "google_compute_subnetwork" "frontend" {
name = "${var.project_name}-frontend" name = "${var.project_name}-frontend"
region = var.region
network = google_compute_network.vpc.self_link
ip_cidr_range = var.frontend_cidr ip_cidr_range = var.frontend_cidr
region = var.region
network = google_compute_network.vpc.id
}
resource "google_compute_subnetwork" "backend" {
name = "${var.project_name}-backend"
ip_cidr_range = var.backend_cidr
region = var.region
network = google_compute_network.vpc.id
}
resource "google_compute_subnetwork" "database" {
name = "${var.project_name}-database"
ip_cidr_range = var.database_cidr
region = var.region
network = google_compute_network.vpc.id
} }
# 3. Règles de firewall : resource "google_compute_subnetwork" "backend" {
# HTTP/HTTPS → frontend name = "${var.project_name}-backend"
region = var.region
network = google_compute_network.vpc.self_link
ip_cidr_range = var.backend_cidr
}
resource "google_compute_subnetwork" "database" {
name = "${var.project_name}-database"
region = var.region
network = google_compute_network.vpc.self_link
ip_cidr_range = var.database_cidr
}
# Firewall rules ------------------
resource "google_compute_firewall" "frontend_http" { resource "google_compute_firewall" "frontend_http" {
name = "${var.project_name}-frontend-http" name = "${var.project_name}-frontend-http"
network = google_compute_network.vpc.name network = google_compute_network.vpc.self_link
allow { allow {
protocol = "tcp" protocol = "tcp"
@@ -40,10 +39,9 @@ resource "google_compute_firewall" "frontend_http" {
source_ranges = ["0.0.0.0/0"] source_ranges = ["0.0.0.0/0"]
} }
# SSH → all
resource "google_compute_firewall" "ssh" { resource "google_compute_firewall" "ssh" {
name = "${var.project_name}-ssh" name = "${var.project_name}-ssh"
network = google_compute_network.vpc.name network = google_compute_network.vpc.self_link
allow { allow {
protocol = "tcp" protocol = "tcp"
@@ -51,13 +49,12 @@ resource "google_compute_firewall" "ssh" {
} }
target_tags = ["ssh"] target_tags = ["ssh"]
source_ranges = ["0.0.0.0/0"] source_ranges = [var.ssh_source_ranges]
} }
# Port 8000 : frontend → backend
resource "google_compute_firewall" "frontend_backend" { resource "google_compute_firewall" "frontend_backend" {
name = "${var.project_name}-frontend-to-backend" name = "${var.project_name}-frontend-to-backend"
network = google_compute_network.vpc.name network = google_compute_network.vpc.self_link
allow { allow {
protocol = "tcp" protocol = "tcp"
@@ -68,10 +65,9 @@ resource "google_compute_firewall" "frontend_backend" {
target_tags = ["backend"] target_tags = ["backend"]
} }
# Port 3306 : backend → database
resource "google_compute_firewall" "backend_database" { resource "google_compute_firewall" "backend_database" {
name = "${var.project_name}-backend-to-database" name = "${var.project_name}-backend-to-database"
network = google_compute_network.vpc.name network = google_compute_network.vpc.self_link
allow { allow {
protocol = "tcp" protocol = "tcp"