Addes support for reverse proxy to home server

2025-06-01 17:14:33 +02:00
parent 8dd48ec2c7
commit b0162abb88
25 changed files with 632 additions and 18 deletions
@@ -0,0 +1,41 @@
+locals {
+  wireguard_version = "1.0.20210914-r4-ls54"
+  wireguard_config = try(templatefile("${path.module}/resources/wireguard/wireguard.conf.tpl", {
+    wireguard_private_key    = var.wireguard_config.private_key
+    wireguard_public_key     = var.wireguard_config.public_key
+    wireguard_pre_shared_key = var.wireguard_config.pre_shared_key
+    wireguard_address        = var.wireguard_config.address
+    wireguard_dns            = var.wireguard_config.dns
+    wireguard_allowed_ips    = join(", ", var.wireguard_config.allowed_ips)
+    wireguard_endpoint       = "${var.wireguard_config.endpoint}:${var.wireguard_config.endpoint_port}"
+  }), "null")
+  wireguard_config_checksum = nonsensitive(sha256(local.wireguard_config))
+
+  default_headers = {
+    "Host" : "$host",
+    "X-Real-IP" : "$remote_addr",
+    "X-Forwarded-For" : "$proxy_add_x_forwarded_for",
+    "X-Forwarded-Proto" : "$scheme",
+    "X-Forwarded-Host" : "$host",
+    "X-Forwarded-Port" : "$server_port",
+  }
+  nginx_config          = file("${path.module}/resources/nginx/nginx.conf")
+  nginx_config_checksum = sha256(local.nginx_config)
+
+  services_config = {
+    for k, v in var.services : "${k}.conf" => coalesce(v.config, templatefile("${path.module}/resources/nginx/conf.d/default.conf.tpl", {
+      http_port  = v.http_port
+      https_port = v.https_port
+      upstream   = v.upstream
+      tls        = v.tls
+      fqdn       = join(" ", v.fqdn)
+      locations = [for l in v.locations : {
+        path    = l.path
+        headers = merge(l.headers, coalesce(v.default_headers, local.default_headers))
+      }]
+      custom_snippet = v.custom_snippet
+    }))
+  }
+  services_config_checksum = sha256(jsonencode(local.services_config))
+}
+