From 1f3e2041fa61c9b0d479ad8b064367a8cae5f326 Mon Sep 17 00:00:00 2001 From: ongeziwe17 Date: Fri, 14 Nov 2025 02:37:48 +0200 Subject: [PATCH 1/3] add 8081 to Terraform security group for cms --- environments/development/backend/variables.tf | 16 ++++------ .../development/frontend/variables.tf | 29 ------------------- modules/network/main.tf | 9 ++++++ modules/network/variables.tf | 6 ++++ 4 files changed, 20 insertions(+), 40 deletions(-) diff --git a/environments/development/backend/variables.tf b/environments/development/backend/variables.tf index 1a96b8c..670da0f 100644 --- a/environments/development/backend/variables.tf +++ b/environments/development/backend/variables.tf @@ -8,11 +8,6 @@ variable "aws_region" { default = "af-south-1" } -# variable "backend_environment" { -# description = "The environment (backend) to deploy resources" -# type = string -# } - variable "sa_password" { description = "SQL SA password for development" type = string @@ -37,12 +32,6 @@ variable "ghcr_token" { sensitive = true } -# variable "key_name" { -# description = "EC2 key pair name for SSH access (optional)" -# type = string -# default = null -# } - variable "allowed_ssh_cidrs" { description = "List of CIDR blocks allowed to SSH into EC2 (22)" type = list(string) @@ -52,3 +41,8 @@ variable "allowed_api_cidrs" { description = "List of CIDR blocks allowed to reach API (8080)" type = list(string) } + +variable "allowed_cms_cidrs" { + description = "CIDR blocks allowed to access CMS (8081)" + type = list(string) +} diff --git a/environments/development/frontend/variables.tf b/environments/development/frontend/variables.tf index eeb60fa..be8c03c 100644 --- a/environments/development/frontend/variables.tf +++ b/environments/development/frontend/variables.tf @@ -8,41 +8,12 @@ variable "aws_region" { default = "af-south-1" } -# variable "backend_environment" { -# description = "The environment (frontend) to deploy resources" -# type = string -# } - -# variable "sa_password" { -# description = "SQL SA password for development" -# type = string -# sensitive = true -# } - -# variable "redis_password" { -# description = "Redis password for development" -# type = string -# sensitive = true -# } - -# variable "admin_key" { -# description = "Admin API key for development" -# type = string -# sensitive = true -# } - variable "ghcr_token" { description = "GHCR token" type = string sensitive = true } -# variable "key_name" { -# description = "EC2 key pair name for SSH access (optional)" -# type = string -# default = null -# } - variable "allowed_ssh_cidrs" { description = "List of CIDR blocks allowed to SSH into EC2 (22)" type = list(string) diff --git a/modules/network/main.tf b/modules/network/main.tf index 42e13cb..07c0918 100644 --- a/modules/network/main.tf +++ b/modules/network/main.tf @@ -108,6 +108,15 @@ resource "aws_security_group" "host" { description = "API (restricted to team or open during dev)" } + # CMS Access (restricted) + ingress { + from_port = 8081 + to_port = 8081 + protocol = "tcp" + cidr_blocks = var.allowed_cms_cidrs + description = "CMS Access (restricted)" + } + # Egress - Allow all outbound egress { from_port = 0 diff --git a/modules/network/variables.tf b/modules/network/variables.tf index 8f54524..3502379 100644 --- a/modules/network/variables.tf +++ b/modules/network/variables.tf @@ -22,3 +22,9 @@ variable "allowed_api_cidrs" { description = "List of CIDR blocks allowed to reach API (8080)" default = ["0.0.0.0/0"] } + +variable "allowed_cms_cidrs" { + type = list(string) + description = "CIDR blocks allowed to access CMS (8081)" + default = ["0.0.0.0/0"] +} From e3574ec1943395c37f19bddc8945d7f3168524a6 Mon Sep 17 00:00:00 2001 From: ongeziwe17 Date: Fri, 14 Nov 2025 02:46:06 +0200 Subject: [PATCH 2/3] add 8081 to Terraform security group for cms V2 --- .github/workflows/terraform-deploy.yml | 1 + .github/workflows/terraform-validate.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/terraform-deploy.yml b/.github/workflows/terraform-deploy.yml index f9608f6..06e5952 100644 --- a/.github/workflows/terraform-deploy.yml +++ b/.github/workflows/terraform-deploy.yml @@ -69,6 +69,7 @@ jobs: env: TF_VAR_allowed_ssh_cidrs: ${{ secrets.ALLOWED_SSH_CIDRS }} TF_VAR_allowed_api_cidrs: ${{ secrets.ALLOWED_API_CIDRS }} + TF_VAR_allowed_cms_cidrs: ${{ secrets.ALLOWED_CMS_CIDRS }} TF_VAR_ghcr_token: ${{ secrets.GHCR_PAT }} TF_VAR_admin_key: ${{ matrix.stack == 'backend' && secrets.ADMIN_KEY_DEV || '' }} TF_VAR_sa_password: ${{ matrix.stack == 'backend' && secrets.SA_PASSWORD_DEV || '' }} diff --git a/.github/workflows/terraform-validate.yml b/.github/workflows/terraform-validate.yml index 8897065..aead7d1 100644 --- a/.github/workflows/terraform-validate.yml +++ b/.github/workflows/terraform-validate.yml @@ -87,6 +87,7 @@ jobs: TF_VAR_ghcr_token: ${{ secrets.GHCR_PAT }} TF_VAR_allowed_ssh_cidrs: ${{ secrets.ALLOWED_SSH_CIDRS }} TF_VAR_allowed_api_cidrs: ${{ secrets.ALLOWED_API_CIDRS }} + TF_VAR_allowed_cms_cidrs: ${{ secrets.ALLOWED_CMS_CIDRS }} TF_LOG: DEBUG run: terraform plan -no-color -out=tfplan From 8111e52a6b83dd114190cb2927178b5304c3dd3c Mon Sep 17 00:00:00 2001 From: ongeziwe17 Date: Fri, 14 Nov 2025 02:53:44 +0200 Subject: [PATCH 3/3] add 8081 to Terraform security group for cms V3 --- environments/development/backend/network.tf | 1 + 1 file changed, 1 insertion(+) diff --git a/environments/development/backend/network.tf b/environments/development/backend/network.tf index 6416f1e..027e863 100644 --- a/environments/development/backend/network.tf +++ b/environments/development/backend/network.tf @@ -14,4 +14,5 @@ module "network" { az_b = "af-south-1b" allowed_api_cidrs = var.allowed_api_cidrs allowed_ssh_cidrs = var.allowed_ssh_cidrs + allowed_cms_cidrs = var.allowed_cms_cidrs }