CloudRouterAdvanced/terraform/main.tf

data "vkcs_images_image" "ubuntu24" {
  visibility  = "public"
  most_recent = true
  properties = {
    mcs_os_distro  = "ubuntu"
    mcs_os_version = "24.04"
  }
}

data "vkcs_networking_network" "extnet" {
  name = "internet"
  sdn  = "sprut"
}

# Every VK Cloud project auto-creates a "default" security group with a
# UUID unique to that project - resolve it dynamically instead of
# hardcoding one project's UUID. var.default_security_group_id is a
# last-resort manual override (e.g. non-standard name/SDN in a project).
data "vkcs_networking_secgroup" "default" {
  name = "default"
  sdn  = "sprut"
}

locals {
  default_security_group_id = coalesce(
    var.default_security_group_id,
    data.vkcs_networking_secgroup.default.id
  )
}

# LAN Network
resource "vkcs_networking_network" "lan_net" {
  name           = "router-lan-net"
  sdn            = "sprut"
  admin_state_up = true
}

resource "vkcs_networking_subnet" "lan_subnet" {
  network_id      = vkcs_networking_network.lan_net.id
  name            = "router-lan-subnet"
  cidr            = "10.200.10.0/24"
  gateway_ip      = "10.200.10.1"
  dns_nameservers = ["8.8.8.8", "1.1.1.1"]
  sdn             = "sprut"

  allocation_pool {
    start = "10.200.10.100"
    end   = "10.200.10.200"
  }
}

# Security Groups
resource "vkcs_networking_secgroup" "router_sg" {
  name = "router-sg"
  sdn  = "sprut"
}

resource "vkcs_networking_secgroup" "private_sg" {
  name = "private-sg"
  sdn  = "sprut"
}

# Private SG rules
resource "vkcs_networking_secgroup_rule" "from_rfc_net192_in" {
  direction         = "ingress"
  remote_ip_prefix  = "192.168.0.0/16"
  security_group_id = vkcs_networking_secgroup.private_sg.id
  sdn               = "sprut"
}

resource "vkcs_networking_secgroup_rule" "from_rfc_net172_in" {
  direction         = "ingress"
  remote_ip_prefix  = "172.16.0.0/12"
  security_group_id = vkcs_networking_secgroup.private_sg.id
  sdn               = "sprut"
}

resource "vkcs_networking_secgroup_rule" "from_rfc_net10_in" {
  direction         = "ingress"
  remote_ip_prefix  = "10.0.0.0/8"
  security_group_id = vkcs_networking_secgroup.private_sg.id
  sdn               = "sprut"
}

# Router SG rules
resource "vkcs_networking_secgroup_rule" "router_ssh" {
  direction         = "ingress"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = vkcs_networking_secgroup.router_sg.id
  sdn               = "sprut"
}

resource "vkcs_networking_secgroup_rule" "router_icmp" {
  direction         = "ingress"
  protocol          = "icmp"
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = vkcs_networking_secgroup.router_sg.id
  sdn               = "sprut"
}

resource "vkcs_networking_secgroup_rule" "router_ipsec_ike" {
  direction         = "ingress"
  protocol          = "udp"
  port_range_min    = 500
  port_range_max    = 500
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = vkcs_networking_secgroup.router_sg.id
  sdn               = "sprut"
}

resource "vkcs_networking_secgroup_rule" "router_ipsec_nat_t" {
  direction         = "ingress"
  protocol          = "udp"
  port_range_min    = 4500
  port_range_max    = 4500
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = vkcs_networking_secgroup.router_sg.id
  sdn               = "sprut"
}

# Per-router private interfaces: one shared private network per admin-supplied
# CIDR in private_network_cidrs (no shared LAN with the priv_srv_* segment,
# no VRRP), each router getting its own port/IP inside every such network.
locals {
  private_roles = [for idx in range(length(var.private_network_cidrs)) : "priv${idx + 1}"]

  private_network_cidr = {
    for idx, cidr in var.private_network_cidrs :
    "priv${idx + 1}" => cidr
  }
}

resource "vkcs_networking_network" "router_priv_net" {
  for_each       = local.private_network_cidr
  name           = "router-${each.key}-net"
  sdn            = "sprut"
  admin_state_up = true
}

resource "vkcs_networking_subnet" "router_priv_subnet" {
  for_each   = local.private_network_cidr
  network_id = vkcs_networking_network.router_priv_net[each.key].id
  name       = "router-${each.key}-subnet"
  cidr       = each.value
  gateway_ip = cidrhost(each.value, 1)
  sdn        = "sprut"
}

resource "vkcs_networking_port" "router_priv_port" {
  for_each = {
    for pair in setproduct(range(var.router_count), local.private_roles) :
    "router${pair[0] + 1}-${pair[1]}" => {
      router_index = pair[0]
      role         = pair[1]
    }
  }
  name                         = "router-${each.key}-port"
  network_id                   = vkcs_networking_network.router_priv_net[each.value.role].id
  admin_state_up               = true
  port_security_enabled        = false
  full_security_groups_control = true
  security_group_ids           = []
  sdn                          = "sprut"
  fixed_ip {
    subnet_id  = vkcs_networking_subnet.router_priv_subnet[each.value.role].id
    ip_address = cidrhost(local.private_network_cidr[each.value.role], each.value.router_index + 2)
  }
}

resource "vkcs_compute_instance" "router" {
  count             = var.router_count
  name              = "router${count.index + 1}"
  image_id          = data.vkcs_images_image.ubuntu24.id
  flavor_name       = "STD3-4-4"
  availability_zone = element(var.router_availability_zones, count.index % length(var.router_availability_zones))
  key_pair          = var.ssh_key_name

  security_group_ids = [
    vkcs_networking_secgroup.router_sg.id,
    local.default_security_group_id
  ]

  config_drive = true

  # Configure persistent networking using script: WAN via heuristic public-IP
  # detection, private interfaces matched by their expected CIDR.
  user_data = templatefile("${path.module}/scripts/network-init.sh.tpl", {
    private_interfaces = [
      for role in local.private_roles : {
        name = "eth${index(local.private_roles, role) + 1}"
        cidr = local.private_network_cidr[role]
      }
    ]
  })

  # WAN: dynamically created port
  network {
    uuid = data.vkcs_networking_network.extnet.id
  }

  # Private: one pre-created port per role, into that role's shared network
  dynamic "network" {
    for_each = local.private_roles
    content {
      port = vkcs_networking_port.router_priv_port["router${count.index + 1}-${network.value}"].id
    }
  }

  block_device {
    uuid                  = data.vkcs_images_image.ubuntu24.id
    source_type           = "image"
    volume_size           = 20
    boot_index            = 0
    destination_type      = "volume"
    volume_type           = "ceph-ssd"
    delete_on_termination = true
  }
}

resource "vkcs_compute_instance" "priv_srv_01" {
  name              = "Priv-SRV-01"
  image_id          = data.vkcs_images_image.ubuntu24.id
  flavor_name       = "STD3-4-4"
  availability_zone = "ME1"
  key_pair          = var.ssh_key_name

  security_group_ids = [
    vkcs_networking_secgroup.private_sg.id,
    local.default_security_group_id
  ]

  network {
    uuid = vkcs_networking_network.lan_net.id
  }

  block_device {
    uuid                  = data.vkcs_images_image.ubuntu24.id
    source_type           = "image"
    volume_size           = 20
    boot_index            = 0
    destination_type      = "volume"
    volume_type           = "ceph-ssd"
    delete_on_termination = true
  }

}

resource "vkcs_compute_instance" "priv_srv_02" {
  name              = "Priv-SRV-02"
  image_id          = data.vkcs_images_image.ubuntu24.id
  flavor_name       = "STD3-4-4"
  availability_zone = "ME1"
  key_pair          = var.ssh_key_name

  security_group_ids = [
    vkcs_networking_secgroup.private_sg.id,
    local.default_security_group_id
  ]

  network {
    uuid = vkcs_networking_network.lan_net.id
  }

  block_device {
    uuid                  = data.vkcs_images_image.ubuntu24.id
    source_type           = "image"
    volume_size           = 20
    boot_index            = 0
    destination_type      = "volume"
    volume_type           = "ceph-ssd"
    delete_on_termination = true
  }
}

resource "vkcs_compute_instance" "priv_srv_03" {
  name              = "Priv-SRV-03"
  image_id          = data.vkcs_images_image.ubuntu24.id
  flavor_name       = "STD3-4-4"
  availability_zone = "MS1"
  key_pair          = var.ssh_key_name

  security_group_ids = [
    vkcs_networking_secgroup.private_sg.id,
    local.default_security_group_id
  ]

  network {
    uuid = vkcs_networking_network.lan_net.id
  }

  block_device {
    uuid                  = data.vkcs_images_image.ubuntu24.id
    source_type           = "image"
    volume_size           = 20
    boot_index            = 0
    destination_type      = "volume"
    volume_type           = "ceph-ssd"
    delete_on_termination = true
  }
}