Creates openvpn server in prod

prod/aws-us-gov/mdr-prod-c2/010-vpc-access/terragrunt.hcl

@@ -38,4 +38,5 @@ inputs = {
   tags = {
     Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
   }
+  enable_nat_gateway = true # Needed for outbound LDAP access
 }

prod/aws-us-gov/mdr-prod-c2/090-instance-openvpn/README.md

@@ -0,0 +1,10 @@
+Following installation:
+
+* Run `sudo /usr/local/bin/openvpn_restore.sh`
+* Run `sudo passwd openvpn` and set the password for the admin user
+* Log into the web ui:
+  * Test: https://openvpn.xdrtest.accenturefederalcyber.com/admin
+  * Prod: https://openvpn.xdr.accenturefederalcyber.com/admin
+* Set:
+  * Configuration/Network Settings: Update server name
+  * Configuration->DNS Resolution Zones: set to `xdrtest.accenturefederalcyber.com` (or `xdr.accenturefederalcyber.com` in prod)

prod/aws-us-gov/mdr-prod-c2/090-instance-openvpn/terragrunt.hcl

@@ -0,0 +1,43 @@
+locals {
+  # If you want to use any of the variables in _this_ file, you have to load them here.
+  # However, they will all be available as inputs to the module loaded in terraform.source
+  # below.
+  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
+  partition_vars = read_terragrunt_config(find_in_parent_folders("partition.hcl"))
+  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
+  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
+  global_vars = read_terragrunt_config(find_in_parent_folders("globals.hcl"))
+}
+
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
+terraform {
+  # Double slash is intentional and required to show root of modules
+  source = "git@github.mdr.defpoint.com:mdr-engineering/xdr-terraform-modules.git//base/openvpn?ref=v0.9.6"
+}
+
+dependency "vpc-access" {
+  config_path = "../010-vpc-access"
+}
+
+# Include all settings from the root terragrunt.hcl file
+include {
+  path = find_in_parent_folders()
+}
+
+# These are the variables we have to pass in to use the module specified in the terragrunt source above
+inputs = {
+  # All of the inputs from the inherited hcl files are available automatically
+  # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
+  # will be more flexible if you specify particular input values.
+  tags = {
+    Purpose = "OpenVPN - Employee Access"
+    Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
+  }
+  instance_name = "openvpn" # TODO: Fix this when actual swap is taking place.
+  instance_type = local.account_vars.locals.openvpn_instance_type
+  vpc_id = dependency.vpc-access.outputs.vpc_id
+  azs = dependency.vpc-access.outputs.azs
+  subnets = dependency.vpc-access.outputs.private_subnets
+  public_subnets = dependency.vpc-access.outputs.public_subnets
+}

prod/aws-us-gov/mdr-prod-c2/account.hcl

@@ -72,6 +72,9 @@ locals {
   # mailrelay
   mailrelay_instance_type = "t3a.micro"
 
+  # Proxy
+  openvpn_instance_type = "t3a.medium"
+  
   # Proxy
   proxy_server_instance_type = "t3a.medium"