terrafying-components 1.11.15 → 1.11.16

data/lib/terrafying/components/vpn.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 
 require 'digest'
 require 'netaddr'
@@ -5,7 +6,6 @@ require 'netaddr'
 require 'terrafying/components/ignition'
 require 'terrafying/generator'
 
-
 IN4MASK = 0xffffffff
 
 def cidr_to_split_address(raw_cidr)
@@ -14,34 +14,30 @@ def cidr_to_split_address(raw_cidr)
   masklen = 32 - cidr.bits
   maskaddr = ((IN4MASK >> masklen) << masklen)
 
-  maskip = (0..3).map { |i|
+  maskip = (0..3).map do |i|
     (maskaddr >> (24 - 8 * i)) & 0xff
-  }.join('.')
+  end.join('.')
 
-  return "#{cidr.first} #{maskip}"
+  "#{cidr.first} #{maskip}"
 end
 
-
 module Terrafying
-
   module Components
-
     class VPN < Terrafying::Context
-
       attr_reader :name, :cidr, :service, :ip_address
 
-      def self.create_in(vpc, name, provider, options={})
+      def self.create_in(vpc, name, provider, options = {})
         VPN.new.create_in vpc, name, provider, options
       end
 
-      def initialize()
+      def initialize
         super
       end
 
-      def create_in(vpc, name, oauth2_provider, options={})
+      def create_in(vpc, name, oauth2_provider, options = {})
         options = {
-          group: "uSwitch Developers",
-          cidr: "10.8.0.0/24",
+          group: 'uSwitch Developers',
+          cidr: '10.8.0.0/24',
           public: true,
           subnets: vpc.subnets.fetch(:public, []),
           static: false,
@@ -49,7 +45,7 @@ module Terrafying
           route_dns_entries: [],
           units: [],
           tags: {},
-          service: {},
+          service: {}
         }.merge(options)
 
         @name = name
@@ -57,14 +53,14 @@ module Terrafying
         @cidr = options[:cidr]
         @fqdn = vpc.zone.qualify(name)
 
-        if ! oauth2_provider.is_a?(Hash)
-          raise "You need to give a provider hash containing a type, client_id and client_secret"
+        unless oauth2_provider.is_a?(Hash)
+          raise 'You need to give a provider hash containing a type, client_id and client_secret'
         end
 
-        has_provider = oauth2_provider[:type] != "none"
+        has_provider = oauth2_provider[:type] != 'none'
 
-        if has_provider and ! [:type, :client_id, :client_secret].all? {|k| oauth2_provider.has_key?(k) }
-          raise "You need to set type, client_id and client_secret"
+        if has_provider && !%i[type client_id client_secret].all? { |k| oauth2_provider.key?(k) }
+          raise 'You need to set type, client_id and client_secret'
         end
 
         units = [
@@ -88,7 +84,7 @@ module Terrafying
           units.push(oauth2_proxy_service(oauth2_provider))
         end
 
-        if options.has_key?(:ca)
+        if options.key?(:ca)
           keypairs.push(options[:ca].create_keypair_in(self, @fqdn))
         end
 
@@ -101,36 +97,36 @@ module Terrafying
 
         @is_public = options[:public]
         @service = add! Service.create_in(
-                          vpc, name,
-                          {
-                            public: @is_public,
-                            ports: [22, 443, { number: 1194, type: "udp" }],
-                            tags: options[:tags],
-                            units: units + options[:units],
-                            files: files,
-                            keypairs: keypairs,
-                            subnets: options[:subnets],
-                            instances: instances,
-                            iam_policy_statements: [
-                              {
-                                Effect: "Allow",
-                                Action: [
-                                  "ec2:DescribeRouteTables",
-                                ],
-                                Resource: [
-                                  "*"
-                                ]
-                              }
-                            ],
-                          }.merge(options[:service])
-                        )
+          vpc, name,
+          {
+            public: @is_public,
+            ports: [22, 443, { number: 1194, type: 'udp' }],
+            tags: options[:tags],
+            units: units + options[:units],
+            files: files,
+            keypairs: keypairs,
+            subnets: options[:subnets],
+            instances: instances,
+            iam_policy_statements: [
+              {
+                Effect: 'Allow',
+                Action: [
+                  'ec2:DescribeRouteTables'
+                ],
+                Resource: [
+                  '*'
+                ]
+              }
+            ]
+          }.merge(options[:service])
+        )
 
         @ip_address = @service.instance_set.instances[0].ip_address
 
         self
       end
 
-      def allow_security_group_in(vpc, name: "")
+      def allow_security_group_in(vpc, name: '')
         name = "allow-#{@vpc.name}-vpn".downcase if name.empty?
 
         ingress_rules = [
@@ -138,8 +134,8 @@ module Terrafying
             from_port: 0,
             to_port: 0,
             protocol: -1,
-            security_groups: [ @service.egress_security_group ],
-          },
+            security_groups: [@service.egress_security_group]
+          }
         ]
 
         if @is_public
@@ -147,113 +143,100 @@ module Terrafying
             from_port: 0,
             to_port: 0,
             protocol: -1,
-            cidr_blocks: [ "#{@ip_address}/32" ],
+            cidr_blocks: ["#{@ip_address}/32"]
           }
         end
 
-        resource :aws_security_group, tf_safe("#{name}-#{vpc.name}"), {
-               name: name,
-               vpc_id: vpc.id,
-               ingress: ingress_rules,
-             }
+        resource :aws_security_group, tf_safe("#{name}-#{vpc.name}"),
+                 name: name,
+                 vpc_id: vpc.id,
+                 ingress: ingress_rules
       end
 
       def openvpn_service
         Ignition.container_unit(
-          "openvpn", "kylemanna/openvpn",
-          {
-            host_networking: true,
-            privileged: true,
-            volumes: [
-              "/etc/ssl/openvpn:/etc/ssl/openvpn:ro",
-              "/etc/openvpn:/etc/openvpn",
-            ],
-            required_units: [ "docker.service", "network-online.target", "openvpn-authz.service" ],
-          }
+          'openvpn', 'kylemanna/openvpn',
+          host_networking: true,
+          privileged: true,
+          volumes: [
+            '/etc/ssl/openvpn:/etc/ssl/openvpn:ro',
+            '/etc/openvpn:/etc/openvpn'
+          ],
+          required_units: ['docker.service', 'network-online.target', 'openvpn-authz.service']
         )
       end
 
       def openvpn_authz_service(route_all_traffic, route_dns_entry)
         optional_arguments = []
 
-        if route_all_traffic
-          optional_arguments << "--route-all"
-        end
+        optional_arguments << '--route-all' if route_all_traffic
 
         if route_dns_entry.count > 0
-          optional_arguments = optional_arguments + route_dns_entry.map { |entry| "--route-dns-entries #{entry}" }
+          optional_arguments += route_dns_entry.map { |entry| "--route-dns-entries #{entry}" }
         end
 
         Ignition.container_unit(
-          "openvpn-authz", "quay.io/uswitch/openvpn-authz:1.2",
-          {
-            host_networking: true,
-            volumes: [
-              "/etc/ssl/openvpn:/etc/ssl/openvpn",
-              "/var/openvpn-authz:/var/openvpn-authz",
-            ],
-            environment_variables: [
-              "AWS_REGION=#{aws.region}",
-            ],
-            arguments: optional_arguments + [
-              "--fqdn #{@fqdn}",
-              "--cache /var/openvpn-authz",
-              '--user-header "X-Forwarded-Email"',
-              "/etc/ssl/openvpn",
-            ],
-          }
+          'openvpn-authz', 'quay.io/uswitch/openvpn-authz:1.2',
+          host_networking: true,
+          volumes: [
+            '/etc/ssl/openvpn:/etc/ssl/openvpn',
+            '/var/openvpn-authz:/var/openvpn-authz'
+          ],
+          environment_variables: [
+            "AWS_REGION=#{aws.region}"
+          ],
+          arguments: optional_arguments + [
+            "--fqdn #{@fqdn}",
+            '--cache /var/openvpn-authz',
+            '--user-header "X-Forwarded-Email"',
+            '/etc/ssl/openvpn'
+          ]
         )
       end
 
       def oauth2_proxy_service(oauth2_provider)
         Ignition.container_unit(
           'authnz', 'quay.io/uswitch/authnz-http-proxy:0.1',
-          {
-            host_networking: true,
-            arguments: [
-              '--addr=0.0.0.0:4180',
-              '--backend-url=http://localhost:8080',
-              "--oauth-client-id='#{oauth2_provider[:client_id]}'",
-              "--oauth-client-secret='#{oauth2_provider[:client_secret]}'",
-              "--cookie-hash-key='#{oauth2_provider[:cookie_hash_key]}'",
-              "--cookie-block-key='#{oauth2_provider[:cookie_block_key]}'"
-            ],
-            volumes: [
-              '/usr/share/ca-certificates:/etc/ssl/certs:ro'
-            ]
-          }
+          host_networking: true,
+          arguments: [
+            '--addr=0.0.0.0:4180',
+            '--backend-url=http://localhost:8080',
+            "--oauth-client-id='#{oauth2_provider[:client_id]}'",
+            "--oauth-client-secret='#{oauth2_provider[:client_secret]}'",
+            "--cookie-hash-key='#{oauth2_provider[:cookie_hash_key]}'",
+            "--cookie-block-key='#{oauth2_provider[:cookie_block_key]}'"
+          ],
+          volumes: [
+            '/usr/share/ca-certificates:/etc/ssl/certs:ro'
+          ]
         )
       end
 
       def caddy_service(ca)
         optional_volumes = []
 
-        if ca
-          optional_volumes << "/etc/ssl/#{ca.name}:/etc/ssl/#{ca.name}:ro"
-        end
+        optional_volumes << "/etc/ssl/#{ca.name}:/etc/ssl/#{ca.name}:ro" if ca
 
         Ignition.container_unit(
-          "caddy", "abiosoft/caddy:0.10.10",
-          {
-            host_networking: true,
-            volumes: [
-              "/etc/ssl/certs:/etc/ssl/cert:ro",
-              "/etc/caddy/Caddyfile:/etc/Caddyfile",
-              "/etc/caddy/certs:/etc/caddy/certs",
-            ] + optional_volumes,
-            environment_variables: [
-              "CADDYPATH=/etc/caddy/certs",
-            ],
-          }
+          'caddy', 'abiosoft/caddy:0.10.10',
+          host_networking: true,
+          volumes: [
+            '/etc/ssl/certs:/etc/ssl/cert:ro',
+            '/etc/caddy/Caddyfile:/etc/Caddyfile',
+            '/etc/caddy/certs:/etc/caddy/certs'
+          ] + optional_volumes,
+          environment_variables: [
+            'CADDYPATH=/etc/caddy/certs'
+          ]
         )
       end
 
       def caddy_conf(ca, has_provider)
-        port = has_provider ? "4180" : "8080"
-        tls = ca ? "/etc/ssl/#{ca.name}/#{@fqdn}/cert /etc/ssl/#{ca.name}/#{@fqdn}/key" : "cloud@uswitch.com"
+        port = has_provider ? '4180' : '8080'
+        tls = ca ? "/etc/ssl/#{ca.name}/#{@fqdn}/cert /etc/ssl/#{ca.name}/#{@fqdn}/key" : 'cloud@uswitch.com'
         {
-          path: "/etc/caddy/Caddyfile",
-          mode: "0644",
+          path: '/etc/caddy/Caddyfile',
+          mode: '0644',
           contents: <<~CADDYFILE
             #{@fqdn}:443
             tls #{tls}
@@ -266,48 +249,48 @@ module Terrafying
 
       def openvpn_conf
         {
-          path: "/etc/openvpn/openvpn.conf",
-          mode: "0644",
-          contents: <<EOF
-server #{cidr_to_split_address(@cidr)}
-verb 3
-
-iproute /etc/openvpn/ovpn_ip.sh
-
-key /etc/ssl/openvpn/server/key
-ca /etc/ssl/openvpn/ca/cert
-cert /etc/ssl/openvpn/server/cert
-dh /etc/ssl/openvpn/dh.pem
-tls-auth /etc/ssl/openvpn/ta.key
-
-cipher AES-256-CBC
-auth SHA512
-tls-version-min 1.2
-
-key-direction 0
-keepalive 10 60
-persist-key
-persist-tun
-
-proto udp
-# Rely on Docker to do port mapping, internally always 1194
-port 1194
-dev tun0
-status /tmp/openvpn-status.log
-
-user nobody
-group nogroup
-EOF
+          path: '/etc/openvpn/openvpn.conf',
+          mode: '0644',
+          contents: <<~EOF
+            server #{cidr_to_split_address(@cidr)}
+            verb 3
+
+            iproute /etc/openvpn/ovpn_ip.sh
+
+            key /etc/ssl/openvpn/server/key
+            ca /etc/ssl/openvpn/ca/cert
+            cert /etc/ssl/openvpn/server/cert
+            dh /etc/ssl/openvpn/dh.pem
+            tls-auth /etc/ssl/openvpn/ta.key
+
+            cipher AES-256-CBC
+            auth SHA512
+            tls-version-min 1.2
+
+            key-direction 0
+            keepalive 10 60
+            persist-key
+            persist-tun
+
+            proto udp
+            # Rely on Docker to do port mapping, internally always 1194
+            port 1194
+            dev tun0
+            status /tmp/openvpn-status.log
+
+            user nobody
+            group nogroup
+          EOF
         }
       end
 
       def openvpn_env
         {
-          path: "/etc/openvpn/ovpn_env.sh",
-          mode: "0644",
-          contents: <<EOF
-declare -x OVPN_SERVER=#{@cidr}
-EOF
+          path: '/etc/openvpn/ovpn_env.sh',
+          mode: '0644',
+          contents: <<~EOF
+            declare -x OVPN_SERVER=#{@cidr}
+          EOF
         }
       end
 
@@ -356,9 +339,6 @@ EOF
       def used_by_cidr(*cidrs)
         @service.used_by_cidr(*cidrs)
       end
-
     end
-
   end
-
 end

data/lib/terrafying/components/zone.rb

@@ -1,11 +1,10 @@
+# frozen_string_literal: true
+
 require 'terrafying/generator'
 
 module Terrafying
-
   module Components
-
     class Zone < Terrafying::Context
-
       attr_reader :id, :fqdn
 
       def self.find(fqdn)
@@ -16,15 +15,14 @@ module Terrafying
         Zone.new.find_by_tag tag
       end
 
-      def self.create(fqdn, options={})
+      def self.create(fqdn, options = {})
         Zone.new.create fqdn, options
       end
 
-      def initialize()
+      def initialize
         super
       end
 
-
       def find(fqdn)
         zone = aws.hosted_zone(fqdn)
 
@@ -37,21 +35,21 @@ module Terrafying
       def find_by_tag(tag)
         zone = aws.hosted_zone_by_tag(tag)
         @id = zone.id
-        @fqdn = zone.name.chomp(".")
+        @fqdn = zone.name.chomp('.')
 
         self
       end
 
-      def create(fqdn, options={})
+      def create(fqdn, options = {})
         options = {
-          tags: {},
+          tags: {}
         }.merge(options)
 
         ident = tf_safe(fqdn)
 
         zone_config = {
           name: fqdn,
-          tags: options[:tags],
+          tags: options[:tags]
         }
 
         if options[:vpc]
@@ -66,35 +64,34 @@ module Terrafying
         @id = resource :aws_route53_zone, ident, zone_config
 
         if options[:parent_zone]
-          ns = (0..3).map{ |i| output_of(:aws_route53_zone, ident, "name_servers.#{i}") }
+          ns = (0..3).map { |i| output_of(:aws_route53_zone, ident, "name_servers.#{i}") }
 
-          resource :aws_route53_record, "#{ident}-ns", {
-                     zone_id: options[:parent_zone].id,
-                     name: fqdn,
-                     type: "NS",
-                     ttl: "30",
-                     records: ns,
-                   }
+          resource :aws_route53_record, "#{ident}-ns",
+                   zone_id: options[:parent_zone].id,
+                   name: fqdn,
+                   type: 'NS',
+                   ttl: '30',
+                   records: ns
         end
 
         self
       end
 
-      def add_record(name, records, options={})
+      def add_record(name, records, options = {})
         add_record_in(self, name, records, options)
       end
 
-      def add_record_in(ctx, name, records, options={})
+      def add_record_in(ctx, name, records, options = {})
         options = {
-          type: "A",
+          type: 'A',
           ttl: 300,
-          name: qualify(name),
+          name: qualify(name)
         }.merge(options)
 
         ctx.resource :aws_route53_record, options[:resource_name] || tf_safe(options[:name]), {
-                   zone_id: @id,
-                   records: records,
-                 }.merge(options.slice(:type, :ttl, :name, :records, :zone_id, :weight))
+          zone_id: @id,
+          records: records
+        }.merge(options.slice(:type, :ttl, :name, :records, :zone_id, :weight))
       end
 
       def add_alias(name, config)
@@ -103,12 +100,11 @@ module Terrafying
 
       def add_alias_in(ctx, name, config)
         fqdn = qualify(name)
-        ctx.resource :aws_route53_record, tf_safe(fqdn), {
-                   zone_id: @id,
-                   name: fqdn,
-                   type: "A",
-                   alias: config,
-                 }
+        ctx.resource :aws_route53_record, tf_safe(fqdn),
+                     zone_id: @id,
+                     name: fqdn,
+                     type: 'A',
+                     alias: config
       end
 
       def add_srv(name, service_name, port, type, hosts)
@@ -119,13 +115,12 @@ module Terrafying
         fqdn = qualify(name)
         ident = tf_safe(fqdn)
 
-        ctx.resource :aws_route53_record, "srv-#{ident}-#{service_name}", {
-                       zone_id: @id,
-                       name: "_#{service_name}._#{type}.#{fqdn}",
-                       type: "SRV",
-                       ttl: "60",
-                       records: hosts.map { |host| "0 0 #{port} #{host}" }
-                     }
+        ctx.resource :aws_route53_record, "srv-#{ident}-#{service_name}",
+                     zone_id: @id,
+                     name: "_#{service_name}._#{type}.#{fqdn}",
+                     type: 'SRV',
+                     ttl: '60',
+                     records: hosts.map { |host| "0 0 #{port} #{host}" }
       end
 
       def add_cname(name, *records)
@@ -136,21 +131,16 @@ module Terrafying
         fqdn = qualify(name)
         ident = fqdn.tr('.', '-')
         ctx.resource :aws_route53_record, ident,
-          {
-            zone_id: @id,
-            name: fqdn,
-            type: 'CNAME',
-            ttl:  300,
-            records: records
-          }
+                     zone_id: @id,
+                     name: fqdn,
+                     type: 'CNAME',
+                     ttl: 300,
+                     records: records
       end
 
       def qualify(name)
         "#{name}.#{@fqdn}"
       end
-
     end
-
   end
-
 end