add cloudflare configs for tunnels and dns [ci skip]

modules/kubernetes/cloudflared/cloudflare.tf

@@ -0,0 +1,82 @@
+# Contents for cloudflare account
+variable "cloudflare_api_key" {}
+variable "cloudflare_email" {}
+variable "cloudflare_proxied_names" {}
+variable "cloudflare_non_proxied_names" {
+  type = list(string)
+}
+variable "cloudflare_zone_id" {
+  description = "Zone ID for your domain"
+  type        = string
+}
+variable "cloudflare_account_id" {
+  type      = string
+  sensitive = true
+}
+variable "cloudflare_tunnel_id" {
+  type      = string
+  sensitive = true
+}
+variable "public_ip" {
+  type = string
+}
+
+
+terraform {
+  required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = ">= 4.48.0"
+    }
+  }
+}
+provider "cloudflare" {
+  api_key = var.cloudflare_api_key # I gave up on getting the permissions on the token...
+  email   = var.cloudflare_email
+}
+
+resource "cloudflare_zero_trust_tunnel_cloudflared_config" "sof" {
+  account_id = var.cloudflare_account_id
+  tunnel_id  = var.cloudflare_tunnel_id
+
+  config {
+    warp_routing {
+      enabled = true
+    }
+    dynamic "ingress_rule" {
+      for_each = toset(var.cloudflare_proxied_names)
+      content {
+        hostname = ingress_rule.value == "viktorbarzin.me" ? ingress_rule.value : "${ingress_rule.value}.viktorbarzin.me"
+        path     = "/"
+        service  = "https://10.0.20.202:443"
+        origin_request {
+          no_tls_verify = true
+        }
+      }
+    }
+    ingress_rule {
+      service = "http_status:404"
+    }
+  }
+}
+
+resource "cloudflare_record" "dns_record" {
+  count   = length(var.cloudflare_proxied_names)
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  name    = var.cloudflare_proxied_names[count.index]
+  proxied = true
+  ttl     = 1
+  type    = "CNAME"
+  zone_id = var.cloudflare_zone_id
+}
+
+resource "cloudflare_record" "non_proxied_dns_record" {
+  count = length(var.cloudflare_non_proxied_names)
+  # content = var.non_proxied_names[count.index].ip
+  content = var.public_ip
+  name    = var.cloudflare_non_proxied_names[count.index]
+  proxied = false
+  ttl     = 1
+  type    = "A"
+  zone_id = var.cloudflare_zone_id
+}

modules/kubernetes/cloudflared/main.tf

@@ -1,4 +1,7 @@
+# Contents for cloudflare tunnel
+
 variable "tls_secret_name" {}
+variable "cloudflare_tunnel_token" {}
 resource "kubernetes_namespace" "cloudflared" {
   metadata {
     name = "cloudflared"
@@ -40,8 +43,14 @@ resource "kubernetes_deployment" "cloudflared" {
       }
       spec {
         container {
-          image = "wisdomsky/cloudflared-web:latest"
-          name  = "cloudflared"
+          # image = "wisdomsky/cloudflared-web:latest"
+          image   = "cloudflare/cloudflared"
+          name    = "cloudflared"
+          command = ["cloudflared", "tunnel", "run"]
+          env {
+            name  = "TUNNEL_TOKEN"
+            value = var.cloudflare_tunnel_token
+          }
 
           port {
             container_port = 14333
@@ -108,4 +117,3 @@ resource "kubernetes_ingress_v1" "cloudflared" {
     }
   }
 }
-

modules/kubernetes/main.tf

@@ -66,6 +66,15 @@ variable "authentik_postgres_password" {}
 variable "linkwarden_postgresql_password" {}
 variable "linkwarden_authentik_client_id" {}
 variable "linkwarden_authentik_client_secret" {}
+variable "cloudflare_tunnel_token" {}
+variable "cloudflare_api_key" {}
+variable "cloudflare_email" {}
+variable "cloudflare_account_id" {}
+variable "cloudflare_zone_id" {}
+variable "cloudflare_tunnel_id" {}
+variable "public_ip" {}
+variable "cloudflare_proxied_names" {}
+variable "cloudflare_non_proxied_names" {}
 
 resource "null_resource" "core_services" {
   # List all the core modules that must be provisioned first
@@ -425,6 +434,16 @@ module "frigate" {
 module "cloudflared" {
   source          = "./cloudflared"
   tls_secret_name = var.tls_secret_name
+
+  cloudflare_api_key           = var.cloudflare_api_key
+  cloudflare_email             = var.cloudflare_email
+  cloudflare_account_id        = var.cloudflare_account_id
+  cloudflare_zone_id           = var.cloudflare_zone_id
+  cloudflare_tunnel_id         = var.cloudflare_tunnel_id
+  public_ip                    = var.public_ip
+  cloudflare_proxied_names     = var.cloudflare_proxied_names
+  cloudflare_non_proxied_names = var.cloudflare_non_proxied_names
+  cloudflare_tunnel_token      = var.cloudflare_tunnel_token
 }
 
 # module "istio" {