initial commit

terraform/unifi/dns.tf

@@ -0,0 +1,29 @@
+resource "unifi_static_dns" "home_assistant" {
+  key = "ha.local"
+  value = "192.168.1.206"
+  record_type = "A"
+  enabled = true
+}
+
+resource "unifi_static_dns" "debmini" {
+  key = "debmini.local"
+  value = "192.168.1.206"
+  record_type = "A"
+  enabled = true
+}
+
+resource "unifi_static_dns" "pihole" {
+  key = "pihole.local"
+  value = "192.168.1.207"
+  record_type = "A"
+  enabled = true
+}
+
+resource "unifi_static_dns" "imagevault" {
+  key         = "imagevault.local"
+  value       = "192.168.1.208"
+  record_type = "A"
+  enabled     = true
+}
+
+

terraform/unifi/firewall.tf

@@ -0,0 +1,45 @@
+resource "unifi_firewall_rule" "block_iot_to_trusted" {
+  name = "Isolate IOT"
+  ruleset = "LAN_IN"
+  action = "drop"
+  protocol = "all"
+
+  src_network_id = unifi_network.iot.id
+  src_network_type = "NETv4"
+  dst_network_id = unifi_network.trusted.id
+  dst_network_type = "NETv4"
+
+  state_new = true
+  state_established = false
+  state_invalid = true
+  state_related = false
+}
+
+resource "unifi_firewall_rule" "allow_trusted_to_iot" {
+  name = "Allow Trusted to IOT"
+  ruleset = "LAN_IN"
+  action = "accept"
+  protocl = "all"
+
+  src_network_id = unifi_network.trusted.id
+  src_network_type = "NETv4"
+  dst_network_id = unifi_network.iot.id
+  dst_network_type = "NETv4"
+}
+
+resource "unifi_firewall_rule" "block_iot_to_trusted" {
+  name     = "Isolate IOT"
+  ruleset  = "LAN_IN"
+  action   = "drop"
+  protocol = "all"
+
+  src_network_id   = unifi_network.iot.id
+  src_network_type = "NETv4"
+  dst_network_id   = unifi_network.trusted.id
+  dst_network_type = "NETv4"
+
+  state_new         = true
+  state_established = false
+  state_invalid     = true
+  state_related     = false
+}

terraform/unifi/main.tf

@@ -0,0 +1,9 @@
+provider "unifi" {
+  username = var.username
+  password = var.password
+  api_url = var.api_url
+
+  # site = "express7"
+
+  allow_insecure = true
+}

terraform/unifi/networks.tf

@@ -0,0 +1,18 @@
+resource "unifi_network" "trusted" {
+  name = "Trusted"
+  vlan_id = 10
+  subnet = "192.168.10.1/24"
+}
+
+resource "unifi_network" "iot" {
+  name = "IOT"
+  vlan_id = 20
+  subnet = "192.168.1.20.1/24"
+}
+
+resource "unifi_network" "guest" {
+  name = "Guest"
+  vlan_id = 30
+  subnet = "192.168.1.30.1/24"
+  purpose = "Guest"
+}

terraform/unifi/port_foward.tf

@@ -0,0 +1,22 @@
+resource "unifi_port_forward" "rev_proxy_https" {
+  name = "UVC_HTTPs_ChooChoo"
+  enabled = true
+  port_forward_interface = "wan"
+  src_ip = "any"
+  dst_port = "443"
+  fwd_ip = "192.168.1.206"
+  fwd_port = "443"
+  protocol = "tcp"
+  log = true
+}
+
+resource "unifi_port_forward" "rev_proxy_http" {
+  name = "UVC_HTTP_ChooChoo"
+  enabled = true
+  port_forward_interface = "wan"
+  src_ip = "any"
+  dst_port = "80"
+  fwd_ip = "192.168.1.206"
+  fwd_port = "80"
+  protocol = "tcp"
+}

terraform/unifi/vault.tf

@@ -0,0 +1,9 @@
+resource "vault_mount" "kvv2" {
+  path = "secret"
+  type = "kv"
+  options = { version = "2" }
+}
+
+data "vault_kv_secret" "networking" {
+  path = "${vault_mount.kvv2.path}/networking"
+}

terraform/unifi/wifi.tf

@@ -0,0 +1,20 @@
+resource "unifi_ap_group" "default" {
+  name = "Default AP Group"
+  for_wlanconf = true
+}
+
+resource "unifi_wlan" "main" {
+  name            = data.vault_kv_secret.networking.data["main_ap_ssid"]
+  passphrase      = data.vault_kv_secret.networking.data["main_ap_pass"]
+  security        = "wpapsk"
+  ap_group_ids    = [unifi_ap_group.default.id]
+  network_conf_id = unifi_network.trusted.id
+}
+
+resource "unifi_wlan" "iot" {
+  name            = data.vault_kv_secret.networking.data["iot_ap_ssid"]
+  passphrase      = data.vault_kv_secret.networking.data["iot_ap_pass"]
+  security        = "wpapsk"
+  ap_group_ids    = [unifi_ap_group.default.id]
+  network_conf_id = unifi_network.iot.id
+}