Skip to content

add 8081 to Terraform security group for cms #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ongeziwe17 merged 3 commits into from
Nov 14, 2025
Merged

add 8081 to Terraform security group for cms #14

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1f3e204
add 8081 to Terraform security group for cms
ongeziwe17 Nov 14, 2025
e3574ec
add 8081 to Terraform security group for cms V2
ongeziwe17 Nov 14, 2025
8111e52
add 8081 to Terraform security group for cms V3
ongeziwe17 Nov 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/terraform-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,7 @@ jobs:
env:
TF_VAR_allowed_ssh_cidrs: ${{ secrets.ALLOWED_SSH_CIDRS }}
TF_VAR_allowed_api_cidrs: ${{ secrets.ALLOWED_API_CIDRS }}
TF_VAR_allowed_cms_cidrs: ${{ secrets.ALLOWED_CMS_CIDRS }}
TF_VAR_ghcr_token: ${{ secrets.GHCR_PAT }}
TF_VAR_admin_key: ${{ matrix.stack == 'backend' && secrets.ADMIN_KEY_DEV || '' }}
TF_VAR_sa_password: ${{ matrix.stack == 'backend' && secrets.SA_PASSWORD_DEV || '' }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/terraform-validate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,7 @@ jobs:
TF_VAR_ghcr_token: ${{ secrets.GHCR_PAT }}
TF_VAR_allowed_ssh_cidrs: ${{ secrets.ALLOWED_SSH_CIDRS }}
TF_VAR_allowed_api_cidrs: ${{ secrets.ALLOWED_API_CIDRS }}
TF_VAR_allowed_cms_cidrs: ${{ secrets.ALLOWED_CMS_CIDRS }}
TF_LOG: DEBUG
run: terraform plan -no-color -out=tfplan

Expand Down
1 change: 1 addition & 0 deletions environments/development/backend/network.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,4 +14,5 @@ module "network" {
az_b = "af-south-1b"
allowed_api_cidrs = var.allowed_api_cidrs
allowed_ssh_cidrs = var.allowed_ssh_cidrs
allowed_cms_cidrs = var.allowed_cms_cidrs
}
16 changes: 5 additions & 11 deletions environments/development/backend/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,6 @@ variable "aws_region" {
default = "af-south-1"
}

# variable "backend_environment" {
# description = "The environment (backend) to deploy resources"
# type = string
# }

variable "sa_password" {
description = "SQL SA password for development"
type = string
Expand All @@ -37,12 +32,6 @@ variable "ghcr_token" {
sensitive = true
}

# variable "key_name" {
# description = "EC2 key pair name for SSH access (optional)"
# type = string
# default = null
# }

variable "allowed_ssh_cidrs" {
description = "List of CIDR blocks allowed to SSH into EC2 (22)"
type = list(string)
Expand All @@ -52,3 +41,8 @@ variable "allowed_api_cidrs" {
description = "List of CIDR blocks allowed to reach API (8080)"
type = list(string)
}

variable "allowed_cms_cidrs" {
description = "CIDR blocks allowed to access CMS (8081)"
type = list(string)
}
29 changes: 0 additions & 29 deletions environments/development/frontend/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,41 +8,12 @@ variable "aws_region" {
default = "af-south-1"
}

# variable "backend_environment" {
# description = "The environment (frontend) to deploy resources"
# type = string
# }

# variable "sa_password" {
# description = "SQL SA password for development"
# type = string
# sensitive = true
# }

# variable "redis_password" {
# description = "Redis password for development"
# type = string
# sensitive = true
# }

# variable "admin_key" {
# description = "Admin API key for development"
# type = string
# sensitive = true
# }

variable "ghcr_token" {
description = "GHCR token"
type = string
sensitive = true
}

# variable "key_name" {
# description = "EC2 key pair name for SSH access (optional)"
# type = string
# default = null
# }

variable "allowed_ssh_cidrs" {
description = "List of CIDR blocks allowed to SSH into EC2 (22)"
type = list(string)
Expand Down
9 changes: 9 additions & 0 deletions modules/network/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,15 @@ resource "aws_security_group" "host" {
description = "API (restricted to team or open during dev)"
}

# CMS Access (restricted)
ingress {
from_port = 8081
to_port = 8081
protocol = "tcp"
cidr_blocks = var.allowed_cms_cidrs
description = "CMS Access (restricted)"
}

# Egress - Allow all outbound
egress {
from_port = 0
Expand Down
6 changes: 6 additions & 0 deletions modules/network/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,3 +22,9 @@ variable "allowed_api_cidrs" {
description = "List of CIDR blocks allowed to reach API (8080)"
default = ["0.0.0.0/0"]
}

variable "allowed_cms_cidrs" {
type = list(string)
description = "CIDR blocks allowed to access CMS (8081)"
default = ["0.0.0.0/0"]
}