feat: new terraform stack for new switch (#162)

kid · web-flow · commit fd1e79ce08cd · 2025-04-07T19:42:01.000+02:00
diff --git a/dagger.json b/dagger.json
@@ -4,6 +4,11 @@
   "sdk": {
     "source": "go"
   },
+  "include": [
+    "!**/.devenv",
+    "!**/.direnv",
+    "!**/.terraform"
+  ],
   "dependencies": [
     {
       "name": "containers",
@@ -19,6 +24,5 @@
       "pin": "789200f43579a799b237c660e2faa79a83404104"
     }
   ],
-  "include": ["!**/.devenv", "!**/.direnv", "!**/.terraform"],
   "source": ".dagger"
 }
diff --git a/devenv.lock b/devenv.lock
@@ -65,10 +65,31 @@
         "type": "github"
       }
     },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1742649964,
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
-          "pre-commit-hooks",
+          "git-hooks",
           "nixpkgs"
         ]
       },
@@ -142,33 +163,15 @@
         "type": "github"
       }
     },
-    "pre-commit-hooks": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1737465171,
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "rev": "9364dc02281ce2d37a1f55b6e51f7c0f65a75f17",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "dagger": "dagger",
         "devenv": "devenv",
+        "git-hooks": "git-hooks",
         "nixpkgs": "nixpkgs_2",
-        "pre-commit-hooks": "pre-commit-hooks",
+        "pre-commit-hooks": [
+          "git-hooks"
+        ],
         "talhelper": "talhelper"
       }
     },
diff --git a/devenv.nix b/devenv.nix
@@ -23,6 +23,7 @@
       talosctl
       timoni
       go-task
+      iptables
     ]);
 
   languages = {
diff --git a/terraform/.dagger/main.go b/terraform/.dagger/main.go
@@ -65,7 +65,7 @@ func (m *Terraform) Base() *dagger.Container {
 		Wolfi().
 		Container(dagger.WolfiContainerOpts{
 			Packages: []string{
-				"opentofu=1.8.2",
+				"opentofu=1.9.0",
 				"tflint=0.53.0",
 			},
 		})
diff --git a/terraform/modules/ros-bridge/inputs.tf b/terraform/modules/ros-bridge/inputs.tf
@@ -0,0 +1,16 @@
+variable "bridge_name" {
+  type = string
+}
+
+variable "bridge_ports" {
+  type = map(object({
+    comment  = optional(string)
+    vlan_ids = optional(list(number), [])
+    pvid     = optional(number)
+  }))
+}
+
+variable "ignore_interfaces" {
+  type    = list(string)
+  default = []
+}
diff --git a/terraform/modules/ros-bridge/main.tf b/terraform/modules/ros-bridge/main.tf
@@ -0,0 +1,51 @@
+data "routeros_interfaces" "ether" {
+  filter = {
+    type = "ether"
+  }
+}
+
+locals {
+  interface_list = toset([
+    for idx, item in data.routeros_interfaces.ether.interfaces : item.name
+    if !contains(var.ignore_interfaces, item.name)
+  ])
+  vlan_ids = distinct(flatten([for _, item in var.bridge_ports : try(item.vlan_ids, [])]))
+}
+
+resource "routeros_interface_ethernet" "self" {
+  for_each     = local.interface_list
+  factory_name = each.key
+  name         = each.key
+  comment      = try(var.bridge_ports[each.key].comment, null)
+}
+
+resource "routeros_interface_bridge" "self" {
+  name           = var.bridge_name
+  vlan_filtering = true
+}
+
+resource "routeros_interface_bridge_port" "self" {
+  for_each  = local.interface_list
+  bridge    = routeros_interface_bridge.self.name
+  interface = each.key
+  pvid      = try(var.bridge_ports[each.key].pvid, 1)
+  comment   = try(var.bridge_ports[each.key].comment, null)
+}
+
+resource "routeros_interface_bridge_vlan" "self" {
+  for_each = { for id in local.vlan_ids : "vlan${id}" => id }
+  bridge   = routeros_interface_bridge.self.name
+  vlan_ids = [each.value]
+  tagged = concat(
+    [routeros_interface_bridge.self.name],
+    [for k, v in var.bridge_ports : k if contains(try(v.vlan_ids, []), each.value)]
+  )
+}
+
+output "debug" {
+  value = {
+    bridge_ports = var.bridge_ports
+    vlan_ids     = local.vlan_ids
+    tagged99     = [for k, v in var.bridge_ports : k if contains(try(v.vlan_ids, []), 99)]
+  }
+}
diff --git a/terraform/modules/ros-bridge/outputs.tf b/terraform/modules/ros-bridge/outputs.tf
@@ -0,0 +1,3 @@
+output "bridge_name" {
+  value = routeros_interface_bridge.self.name
+}
diff --git a/terraform/modules/ros-bridge/versions.tf b/terraform/modules/ros-bridge/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9.0"
+
+  required_providers {
+    routeros = {
+      source  = "terraform-routeros/routeros"
+      version = "1.76.7"
+    }
+  }
+}
diff --git a/terraform/modules/ros-management-config/inputs.tf b/terraform/modules/ros-management-config/inputs.tf
@@ -0,0 +1,15 @@
+variable "bridge_name" {
+  type = string
+}
+
+variable "oob_mgmt_port" {
+  type = string
+}
+
+variable "oob_mgmt_address" {
+  type = string
+}
+
+variable "mgmt_vlan_id" {
+  type = number
+}
diff --git a/terraform/modules/ros-management-config/main.tf b/terraform/modules/ros-management-config/main.tf
@@ -0,0 +1,28 @@
+# TODO: add dhcp-server on management subnet
+# TODO: add dhcp-client on admin vlan
+# TODO: implement VRF for services
+
+resource "routeros_interface_list" "admin" {
+  name = "admin-ifces"
+}
+
+resource "routeros_interface_list_member" "admin_port" {
+  list      = routeros_interface_list.admin.name
+  interface = var.oob_mgmt_port
+}
+
+resource "routeros_interface_list_member" "admin_vlan" {
+  list      = routeros_interface_list.admin.name
+  interface = routeros_interface_vlan.admin.name
+}
+
+resource "routeros_interface_vlan" "admin" {
+  interface = var.bridge_name
+  name      = "admin-vlan"
+  vlan_id   = var.mgmt_vlan_id
+}
+
+resource "routeros_ip_address" "admin" {
+  interface = var.oob_mgmt_port
+  address   = var.oob_mgmt_address
+}
diff --git a/terraform/modules/ros-management-config/versions.tf b/terraform/modules/ros-management-config/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9.0"
+
+  required_providers {
+    routeros = {
+      source  = "terraform-routeros/routeros"
+      version = "1.76.7"
+    }
+  }
+}
diff --git a/terraform/stacks/network-new/.terraform.lock.hcl b/terraform/stacks/network-new/.terraform.lock.hcl
diff --git a/terraform/stacks/network-new/datasoures.tf b/terraform/stacks/network-new/datasoures.tf
@@ -0,0 +1,4 @@
+data "sops_file" "routeros" {
+  source_file = "${path.module}/../../../secrets/routeros.sops.yaml"
+  input_type  = "yaml"
+}
diff --git a/terraform/stacks/network-new/inputs.tf b/terraform/stacks/network-new/inputs.tf
@@ -0,0 +1,4 @@
+variable "debug" {
+  type    = bool
+  default = false
+}
diff --git a/terraform/stacks/network-new/main.tf b/terraform/stacks/network-new/main.tf
@@ -0,0 +1,74 @@
+module "crs320_bridge" {
+  providers = {
+    routeros = routeros.by_device["crs320"]
+  }
+
+  source = "../../modules/ros-bridge"
+
+  bridge_name = "bridge1"
+  bridge_ports = {
+    sfp-sfpplus1 = {
+      vlan_ids = [99, 10, 30, 100, 101]
+    }
+    ether1 = {
+      comment  = "office-east"
+      pvid     = 100
+      vlan_ids = [99]
+    }
+    ether3 = {
+      comment = "office-west"
+      pvid    = 100
+    }
+    ether7 = {
+      comment  = "capax1"
+      vlan_ids = [99, 100, 101]
+    }
+    ether9 = {
+      comment  = "capax0"
+      vlan_ids = [99, 100, 101]
+    }
+    ether10 = {
+      comment = "doorbell"
+      pvid    = 101
+    }
+    ether11 = {
+      comment = "petdoor"
+      pvid    = 101
+    }
+    ether13 = {
+      comment = "pve0"
+      pvid    = 10
+    }
+    ether14 = {
+      comment = "pve0-ipmi"
+      pvid    = 99
+    }
+    ether15 = {
+      comment = "pve1-ipmi"
+      pvid    = 99
+    }
+    ether16 = {
+      commment = "mgmt"
+      pvid     = 99
+    }
+  }
+
+  ignore_interfaces = ["ether17"]
+}
+
+module "crs320_management_config" {
+  providers = {
+    routeros = routeros.by_device["crs320"]
+  }
+
+  source = "../../modules/ros-management-config"
+
+  bridge_name      = module.crs320_bridge.bridge_name
+  mgmt_vlan_id     = 99
+  oob_mgmt_address = "192.168.88.1/24"
+  oob_mgmt_port    = "ether17"
+}
+
+output "debug" {
+  value = var.debug ? module.crs320_bridge.debug : null
+}
diff --git a/terraform/stacks/network-new/providers.tf b/terraform/stacks/network-new/providers.tf
@@ -0,0 +1,20 @@
+provider "sops" {}
+
+locals {
+  ros_devices = {
+    crs320 = {
+      hosturl = "http://10.99.0.2"
+    }
+  }
+}
+
+provider "routeros" {
+  alias    = "by_device"
+  for_each = local.ros_devices
+
+  # hosturl  = data.sops_file.routeros.data.routeros_endpoint
+  hosturl  = each.value.hosturl
+  username = data.sops_file.routeros.data.routeros_username
+  password = data.sops_file.routeros.data.routeros_password
+  insecure = data.sops_file.routeros.data.routeros_insecure
+}
diff --git a/terraform/stacks/network-new/tfc.tf b/terraform/stacks/network-new/tfc.tf
diff --git a/terraform/stacks/network-new/versions.tf b/terraform/stacks/network-new/versions.tf
diff --git a/terraform/stacks/network/routeros.tf b/terraform/stacks/network/routeros.tf

Original file line number	Diff line number	Diff line change
`@@ -4,6 +4,11 @@`
`4`	`4`	`"sdk": {`
`5`	`5`	`"source": "go"`
`6`	`6`	`},`
	`7`	`+ "include": [`
	`8`	`+ "!**/.devenv",`
	`9`	`+ "!**/.direnv",`
	`10`	`+ "!**/.terraform"`
	`11`	`+ ],`
`7`	`12`	`"dependencies": [`
`8`	`13`	`{`
`9`	`14`	`"name": "containers",`
`@@ -19,6 +24,5 @@`
`19`	`24`	`"pin": "789200f43579a799b237c660e2faa79a83404104"`
`20`	`25`	`}`
`21`	`26`	`],`
`22`		`- "include": ["!/.devenv", "!/.direnv", "!**/.terraform"],`
`23`	`27`	`"source": ".dagger"`
`24`	`28`	`}`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+output "bridge_name" {`
	`2`	`+ value = routeros_interface_bridge.self.name`
	`3`	`+}`