initial commit

terraform/unifi/dns.tf

@@ -0,0 +1,29 @@
+resource "unifi_static_dns" "home_assistant" {
+  key = "ha.local"
+  value = "192.168.1.206"
+  record_type = "A"
+  enabled = true
+}
+
+resource "unifi_static_dns" "debmini" {
+  key = "debmini.local"
+  value = "192.168.1.206"
+  record_type = "A"
+  enabled = true
+}
+
+resource "unifi_static_dns" "pihole" {
+  key = "pihole.local"
+  value = "192.168.1.207"
+  record_type = "A"
+  enabled = true
+}
+
+resource "unifi_static_dns" "imagevault" {
+  key         = "imagevault.local"
+  value       = "192.168.1.208"
+  record_type = "A"
+  enabled     = true
+}
+
+

terraform/unifi/firewall.tf

@@ -0,0 +1,45 @@
+resource "unifi_firewall_rule" "block_iot_to_trusted" {
+  name = "Isolate IOT"
+  ruleset = "LAN_IN"
+  action = "drop"
+  protocol = "all"
+
+  src_network_id = unifi_network.iot.id
+  src_network_type = "NETv4"
+  dst_network_id = unifi_network.trusted.id
+  dst_network_type = "NETv4"
+
+  state_new = true
+  state_established = false
+  state_invalid = true
+  state_related = false
+}
+
+resource "unifi_firewall_rule" "allow_trusted_to_iot" {
+  name = "Allow Trusted to IOT"
+  ruleset = "LAN_IN"
+  action = "accept"
+  protocl = "all"
+
+  src_network_id = unifi_network.trusted.id
+  src_network_type = "NETv4"
+  dst_network_id = unifi_network.iot.id
+  dst_network_type = "NETv4"
+}
+
+resource "unifi_firewall_rule" "block_iot_to_trusted" {
+  name     = "Isolate IOT"
+  ruleset  = "LAN_IN"
+  action   = "drop"
+  protocol = "all"
+
+  src_network_id   = unifi_network.iot.id
+  src_network_type = "NETv4"
+  dst_network_id   = unifi_network.trusted.id
+  dst_network_type = "NETv4"
+
+  state_new         = true
+  state_established = false
+  state_invalid     = true
+  state_related     = false
+}

terraform/unifi/main.tf

@@ -0,0 +1,9 @@
+provider "unifi" {
+  username = var.username
+  password = var.password
+  api_url = var.api_url
+
+  # site = "express7"
+
+  allow_insecure = true
+}

terraform/unifi/networks.tf

@@ -0,0 +1,18 @@
+resource "unifi_network" "trusted" {
+  name = "Trusted"
+  vlan_id = 10
+  subnet = "192.168.10.1/24"
+}
+
+resource "unifi_network" "iot" {
+  name = "IOT"
+  vlan_id = 20
+  subnet = "192.168.1.20.1/24"
+}
+
+resource "unifi_network" "guest" {
+  name = "Guest"
+  vlan_id = 30
+  subnet = "192.168.1.30.1/24"
+  purpose = "Guest"
+}

terraform/unifi/port_foward.tf

@@ -0,0 +1,22 @@
+resource "unifi_port_forward" "rev_proxy_https" {
+  name = "UVC_HTTPs_ChooChoo"
+  enabled = true
+  port_forward_interface = "wan"
+  src_ip = "any"
+  dst_port = "443"
+  fwd_ip = "192.168.1.206"
+  fwd_port = "443"
+  protocol = "tcp"
+  log = true
+}
+
+resource "unifi_port_forward" "rev_proxy_http" {
+  name = "UVC_HTTP_ChooChoo"
+  enabled = true
+  port_forward_interface = "wan"
+  src_ip = "any"
+  dst_port = "80"
+  fwd_ip = "192.168.1.206"
+  fwd_port = "80"
+  protocol = "tcp"
+}

terraform/unifi/vault.tf

@@ -0,0 +1,9 @@
+resource "vault_mount" "kvv2" {
+  path = "secret"
+  type = "kv"
+  options = { version = "2" }
+}
+
+data "vault_kv_secret" "networking" {
+  path = "${vault_mount.kvv2.path}/networking"
+}

terraform/unifi/wifi.tf

@@ -0,0 +1,20 @@
+resource "unifi_ap_group" "default" {
+  name = "Default AP Group"
+  for_wlanconf = true
+}
+
+resource "unifi_wlan" "main" {
+  name            = data.vault_kv_secret.networking.data["main_ap_ssid"]
+  passphrase      = data.vault_kv_secret.networking.data["main_ap_pass"]
+  security        = "wpapsk"
+  ap_group_ids    = [unifi_ap_group.default.id]
+  network_conf_id = unifi_network.trusted.id
+}
+
+resource "unifi_wlan" "iot" {
+  name            = data.vault_kv_secret.networking.data["iot_ap_ssid"]
+  passphrase      = data.vault_kv_secret.networking.data["iot_ap_pass"]
+  security        = "wpapsk"
+  ap_group_ids    = [unifi_ap_group.default.id]
+  network_conf_id = unifi_network.iot.id
+}

terraform/vault-debmini/approles.hcl

@@ -0,0 +1,21 @@
+resource "vault_auth_backend" "approle" {
+   type = "approle"
+}
+
+resource "vault_approle_auth_backend_role" "unifi" {
+  backend = vault_auth_backend.approle.path
+  role_name = "unifi-role"
+  token_policies = ["default", "networking"]
+}
+
+resource "vault_approle_auth_backend_role "iot" {
+  backend = vault_auth_backend.approle.path
+  role_name = "iot-role"
+  token_policies = ["default", "iot"]
+}
+
+resource "vault_approle_auth_backend_role "infra_tools" {
+  backend = vault_auth_backend.approle.path
+  role_name = "infra-role"
+  token_policies = ["default", "infra_tools"]
+}

terraform/vault-debmini/main.tf

@@ -0,0 +1,66 @@
+resource "vault_token" "superuser" {
+  policies = ["super-user"]
+  display_name = "superuser"
+  renewable = true
+  ttl = "768h"
+  metadata = {
+   "purpose" = "service account for managing vault"
+  }
+  lifecycle {
+   create_before_destroy = true
+  }
+}
+
+resource "vault_policy" "super_user" {
+  name = "super-user"
+  policy = <<EOT
+path "sys/policies/acl" {
+    capabilities = ["list"]
+}
+path "sys/policies/acl/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "auth/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "sys/auth/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "sys/auth" {
+    capabilities = ["read"]
+}
+path "identity/*" {
+    capabilities = ["create", "read", "update", "delete", "list"]
+}
+path "secret/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "pki/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "pki_root/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "pki_intermediate/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "sys/leases/*" {
+    capabilities = ["read", "update", "list"]
+}
+path "sys/namespaces/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "sys/mounts" {
+    capabilities = ["read"]
+}
+path "sys/internal/ui/mounts" {
+    capabilities = ["read"]
+}
+path "sys/license" {
+    capabilities = ["create", "read", "update", "delete", "list"]
+}
+path "sys/config/ui" {
+    capabilities = ["read", "update", "delete", "list"]
+}
+EOT
+}

terraform/vault-debmini/policies.tf

@@ -0,0 +1,35 @@
+resource "vault_policy" "infra_tools" {
+  name = "infra_tools"
+  policy = <<EOT
+path "secret/infrastructure/*" {
+    capabilities = ["create", "read", "update", "list", "patch"]
+}
+path "secret/infrastructure" {
+    capabilities = ["read", "list"]
+}
+EOT
+}
+
+resource "vault_policy" "iot" {
+  name = "iot"
+  policy = <<EOT
+path "secret/iot/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "secret/iot" {
+    capabilities = ["read", "list"]
+}
+EOT
+}
+
+resource "vault_policy" "networking" {
+  name = "networking"
+  policy = <<EOT
+path "secret/networking/*" {
+    capabilities = ["create", "read", "update", "delete", "list", "patch"]
+}
+path "secret/networking" {
+    capabilities = ["read", "list"]
+}
+EOT
+}