amadan
infra: relay variable opens stun/turn ingress and outputs the VPC CIDR (spec §6)
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
3 files changed,
+56
−0
infra/modules/region-host/main.tf+45 −0infra/modules/region-host/outputs.tf+5 −0infra/modules/region-host/variables.tf+6 −0
diff --git a/infra/modules/region-host/main.tf b/infra/modules/region-host/main.tf| index ecc59f522..ca23cdd37 100644 |
| --- a/infra/modules/region-host/main.tf |
| +++ b/infra/modules/region-host/main.tf |
| @@ -37,6 +37,41 @@ data "aws_vpcs" "default" { |
| } |
| } |
| +# The VPC's own CIDR, for output vpc_cidr — CARLOS_RELAY_DENY_CIDRS needs it |
| +# so the relay never proxies traffic that is already inside the VPC. |
| +data "aws_vpc" "host" { |
| + id = var.vpc_id != null ? var.vpc_id : one(data.aws_vpcs.default[0].ids) |
| +} |
| + |
| +locals { |
| + # Inline, like the SG's other ingress: a standalone |
| + # aws_vpc_security_group_ingress_rule would fight the in-line set and be |
| + # stripped on every apply (see extra_ingress in variables.tf). |
| + relay_ingress = var.relay ? [ |
| + { |
| + description = "relay stun/turn udp" |
| + from_port = 3478 |
| + to_port = 3478 |
| + protocol = "udp" |
| + cidr_blocks = ["0.0.0.0/0"] |
| + }, |
| + { |
| + description = "relay stun/turn tcp" |
| + from_port = 3478 |
| + to_port = 3478 |
| + protocol = "tcp" |
| + cidr_blocks = ["0.0.0.0/0"] |
| + }, |
| + { |
| + description = "relay allocations" |
| + from_port = 49152 |
| + to_port = 65535 |
| + protocol = "udp" |
| + cidr_blocks = ["0.0.0.0/0"] |
| + }, |
| + ] : [] |
| +} |
| + |
| resource "aws_security_group" "host" { |
| name = var.name |
| description = var.sg_description |
| @@ -81,6 +116,16 @@ resource "aws_security_group" "host" { |
| cidr_blocks = ingress.value.cidr_blocks |
| } |
| } |
| + dynamic "ingress" { |
| + for_each = local.relay_ingress |
| + content { |
| + description = ingress.value.description |
| + from_port = ingress.value.from_port |
| + to_port = ingress.value.to_port |
| + protocol = ingress.value.protocol |
| + cidr_blocks = ingress.value.cidr_blocks |
| + } |
| + } |
| # No SSH ingress: admin access is SSM Session Manager only, and the |
| # carlos binary arrives from the deployment bucket, not over scp. |
| egress { |
diff --git a/infra/modules/region-host/outputs.tf b/infra/modules/region-host/outputs.tf| index 0468a3a3e..880471296 100644 |
| --- a/infra/modules/region-host/outputs.tf |
| +++ b/infra/modules/region-host/outputs.tf |
| @@ -27,3 +27,8 @@ output "ami_id" { |
| description = "Resolved AMI id (most recent matching image) — reusable by sibling boxes in the same root." |
| value = data.aws_ami.debian_arm64.id |
| } |
| + |
| +output "vpc_cidr" { |
| + description = "CIDR of the VPC the host lives in — the value for CARLOS_RELAY_DENY_CIDRS on a box that runs the relay." |
| + value = data.aws_vpc.host.cidr_block |
| +} |
diff --git a/infra/modules/region-host/variables.tf b/infra/modules/region-host/variables.tf| index 1c9e3164e..89dda8a1b 100644 |
| --- a/infra/modules/region-host/variables.tf |
| +++ b/infra/modules/region-host/variables.tf |
| @@ -188,3 +188,9 @@ variable "sibling_staging_arns" { |
| type = list(string) |
| default = [] |
| } |
| + |
| +variable "relay" { |
| + description = "Open the platform STUN/TURN relay's ports (udp+tcp 3478, udp 49152-65535). Off by default; a box also needs /etc/carlos/relay-masters before the unit starts." |
| + type = bool |
| + default = false |
| +} |