Terraform Modules¶

Reusable Terraform modules published by b'nerd for common infrastructure patterns on b'nerd Cloud (OpenStack-based).

Source: app/terraform/common

Available Modules¶

ipsec-gateway¶

Deploys a Linux IPsec VPN gateway VM on OpenStack — a lightweight site-to-site tunnel endpoint with one public/management NIC and one dedicated NIC per tunnel.

What it does¶

• Creates one OpenStack network + subnet + router interface per tunnel.
• Creates a public/management port on an existing network you provide.
• Associates a pre-allocated floating IP with the first tunnel port.
• Creates two security groups: public (IKE/NAT-T/ESP/SSH) and internal ("allow all" on tunnel-side ports).
• Bootstraps the VM via cloud-init: enables IP forwarding and installs strongswan + strongswan-swanctl.

What it does NOT do¶

• Configure swanctl, PSKs, iptables forwarding rules, or any application running on top (HAProxy, BGP, etc.). Software configuration is done separately — typically with Ansible against the floating IP after apply.
• Create the router, management network/subnet, or floating IP — provide these as inputs.
• Generate or manage SSH keys; you supply a public key.

Architecture¶

  Site A ── IPsec Tunnel 1 ──►┐
                               │  Gateway VM (<floating_ip>)
                               │  Ubuntu 24.04 + strongSwan
  Site B ── IPsec Tunnel 2 ──►│
                               │  eth0: public/mgmt NIC
                               │  eth1: tunnel1 NIC (10.0.0.0/24)
                               │  eth2: tunnel2 NIC (10.0.1.0/24)
                               └──► Existing OpenStack router
                                    (each tunnel subnet attached as
                                     router interface)

The floating IP binds to the first tunnel port by default, which is where incoming IKE/NAT-T packets should terminate. Use floating_ip_target = "mgmt" only when external SSH must reach the VM without depending on L3-router conntrack.

Prerequisites¶

• Terraform >= 1.5
• OpenStack provider ~> 3.0 (credentials via OS_* env vars or clouds.yaml)
• An existing OpenStack router
• An existing network + subnet for the management port, attached to that router
• A pre-allocated floating IP
• A VM image (Ubuntu 24.04 recommended)

Usage¶

From the Git source (recommended — pin a tag):

module "ipsec_gateway" {
  source = "git::https://git.bnerd.net/cloud/terraform/common.git//modules/ipsec-gateway?ref=v1.0.0"

  prefix         = "acme-gw"
  router_id      = data.openstack_networking_router_v2.router.id
  network_id     = "<management-network-uuid>"
  subnet_id      = "<management-subnet-uuid>"
  floating_ip    = "203.0.113.10"
  image_id       = data.openstack_images_image_v2.ubuntu.id
  ssh_public_key = tls_private_key.gateway.public_key_openssh

  tunnels = [
    {
      name         = "tunnel1"
      local_cidr   = "10.0.0.0/24"
      remote_cidrs = ["192.168.10.0/24"]
    },
    {
      name         = "tunnel2"
      local_cidr   = "10.0.1.0/24"
      remote_cidrs = ["192.168.20.0/24", "192.168.30.0/24"]
    },
  ]
}

Vendored locally:

module "ipsec_gateway" {
  source = "../../path/to/terraform/common/modules/ipsec-gateway"
  # same inputs as above
}

Inputs¶

Required¶

Optional¶

Outputs¶

Security model¶

The public security group (<prefix>-ipsec-gw) allows:

The internal security group (<prefix>-ipsec-internal) allows all IPv4 ingress on the tunnel-side ports — required because the gateway forwards arbitrary traffic from remote sites that OpenStack port security would otherwise drop. Each tunnel port also has allowed_address_pairs entries for the local subnet and every declared remote subnet.

Notes¶

• First tunnel is special: var.tunnels[0] is the entry whose port carries the floating IP. Reordering the list will recreate the association.
• Existing router only: the module attaches to a router you already own — it never creates one, avoiding collisions with shared networks.
• Next steps: after terraform apply, configure swanctl/PSKs/iptables on the VM (typically via Ansible against the floating IP).
• A complete, runnable example is in the source under modules/ipsec-gateway/examples/basic/.

See Also¶

• Terraform Provider — manage b'nerd Cloud resources as code
• Infrastructure as Code guide