Terraform - DigitalOcean Docker Remote API firewall rule set

Terraform module to configure a set of firewall rules on DigitalOcean for limiting access to an exposed Docker Remote API. It creates inbound rules and outbound rules.

• Requirements
• Usage
• Firewall rules

Requirements

• Terraform >= v0.11.7
• Digitalocean account / API token with write access

Usage

Basic usage example:

provider "digitalocean" {
}
resource "digitalocean_tag" "docker_api" {
    name = "Docker Remote API"
}
resource "digitalocean_tag" "access_docker_api" {
    name = "Access to docker Remote API"
}
module "default-firewall" {
    source  = "thojkooi/firewall-docker-api/digitalocean"
    version = "0.1.0"
    prefix  = "dev"
    # Droplets exposing the Docker Remote API
    tags    = ["${digitalocean_tag.docker_api.id}"]
    # Droplets allowed to access the exposed Docker Remote API
    api_access_tags = ["${digitalocean_tag.access_docker_api.id}"]
    # Limit access from all addresses to the docker remote api
    api_access_from_adresses = []
    # Specific droplets that can access the api
    api_access_droplet_ids = []
    # load balancer uids that may access the api port
    api_access_load_balancer_uids = []
}

Firewall rules

Inbound firewall rules:

Outbound firewall rules:

The outbound rule is only created if either api_access_tags or api_access_droplet_ids is set to a non-empty value.

Variables