network.tf

resource "oci_core_vcn" "main" {
  cidr_blocks    = ["192.168.0.0/16"] # RFC 1918 (https://datatracker.ietf.org/doc/html/rfc1918#section-3)
  compartment_id = oci_identity_compartment.main.id
  display_name   = "Main Virtual Cloud Network (VCN)"
  dns_label      = "internal"
  is_ipv6enabled = true
}

resource "oci_core_security_list" "instance" {
  compartment_id = oci_identity_compartment.main.id
  display_name   = "Main Compute Instance Security List"
  vcn_id         = oci_core_vcn.main.id

  dynamic "ingress_security_rules" {
    for_each = tomap({
      ipv4 = "172.88.0.0/14"  # https://whois.arin.net/rest/net/NET-172-88-0-0-1
      ipv6 = "2603:8000::/24" # https://whois.arin.net/rest/net/NET6-2603-8000-1
    })
    content {
      description = "Allow SSH traffic from RRWE (${ingress_security_rules.key})"
      # RRWE, Charter Communications Inc (AS20001)
      source      = ingress_security_rules.value
      source_type = "CIDR_BLOCK"
      protocol    = 6 # TCP
      tcp_options {
        min = 22
        max = 22
      }
    }
  }

  dynamic "ingress_security_rules" {
    for_each = tomap({
      ipv4 = "0.0.0.0/0"
      ipv6 = "::/0"
    })
    content {
      description = "Allow WireGuard traffic (${ingress_security_rules.key})"
      source      = ingress_security_rules.value
      source_type = "CIDR_BLOCK"
      protocol    = 17 # UDP
      udp_options {
        min = 51820
        max = 51820
      }
    }
  }

  ingress_security_rules {
    description = "Allow inbound ICMPv6 (required for IPv6 neighbor discovery / PMTUD)"
    source      = "::/0"
    source_type = "CIDR_BLOCK"
    protocol    = 58 # ICMPv6
  }

  # TODO: Limit egress traffic to only necessary destinations (e.g. Cloudflare,
  # Ubuntu, Docker, Oracle, etc.)
  dynamic "egress_security_rules" {
    for_each = tomap({
      ipv4 = "0.0.0.0/0"
      ipv6 = "::/0"
    })
    content {
      description      = "Allow all other egress traffic (${egress_security_rules.key})"
      destination      = egress_security_rules.value
      destination_type = "CIDR_BLOCK"
      protocol         = "all"
    }
  }
}

resource "oci_core_internet_gateway" "main" {
  compartment_id = oci_identity_compartment.main.id
  display_name   = "Main Internet Gateway"
  vcn_id         = oci_core_vcn.main.id
}

resource "oci_core_route_table" "main" {
  compartment_id = oci_identity_compartment.main.id
  display_name   = "Main Route Table with Internet Gateway"
  dynamic "route_rules" {
    for_each = tomap({
      ipv4 = "0.0.0.0/0"
      ipv6 = "::/0"
    })
    content {
      description       = "Default ${route_rules.key} route for internet gateway"
      destination       = route_rules.value
      destination_type  = "CIDR_BLOCK"
      network_entity_id = oci_core_internet_gateway.main.id
    }
  }
  vcn_id = oci_core_vcn.main.id
}

locals {
  instance_subnet_cidr_blocks      = [for cidr_block in oci_core_vcn.main.cidr_blocks : cidrsubnet(cidr_block, 8, 20)]
  instance_subnet_ipv6_cidr_blocks = [for cidr_block in oci_core_vcn.main.ipv6cidr_blocks : cidrsubnet(cidr_block, 8, 20)]
}

resource "oci_core_subnet" "instance" {
  availability_domain = data.oci_identity_availability_domain.main.name
  cidr_block          = one(local.instance_subnet_cidr_blocks)
  ipv6cidr_blocks     = local.instance_subnet_ipv6_cidr_blocks
  compartment_id      = oci_identity_compartment.main.id
  display_name        = "Main Compute Instance Subnet"
  dns_label           = "instance"
  route_table_id      = oci_core_route_table.main.id
  security_list_ids   = [oci_core_security_list.instance.id]
  vcn_id              = oci_core_vcn.main.id
}

resource "oci_core_security_list" "database" {
  compartment_id = oci_identity_compartment.main.id
  display_name   = "Main Database Security List"
  vcn_id         = oci_core_vcn.main.id

  dynamic "ingress_security_rules" {
    for_each = tomap({
      ipv4 = oci_core_subnet.instance.cidr_block
      ipv6 = try(one(oci_core_subnet.instance.ipv6cidr_blocks), null)
    })
    content {
      description = "Allow MySQL ${ingress_security_rules.key} traffic from the main instance subnet (3306)"
      source      = ingress_security_rules.value
      source_type = "CIDR_BLOCK"
      protocol    = 6 # TCP
      tcp_options {
        min = 3306
        max = 3306
      }
    }
  }

  dynamic "ingress_security_rules" {
    for_each = tomap({
      ipv4 = oci_core_subnet.instance.cidr_block
      ipv6 = try(one(oci_core_subnet.instance.ipv6cidr_blocks), null)
    })
    content {
      description = "Allow MySQL ${ingress_security_rules.key} traffic from the main instance subnet (33060)"
      source      = ingress_security_rules.value
      source_type = "CIDR_BLOCK"
      protocol    = 6 # TCP
      tcp_options {
        min = 33060
        max = 33060
      }
    }
  }

  ingress_security_rules {
    description = "Allow inbound ICMPv6 from the main instance subnet (required for IPv6 neighbor discovery / PMTUD)"
    source      = one(oci_core_subnet.instance.ipv6cidr_blocks)
    source_type = "CIDR_BLOCK"
    protocol    = 58 # ICMPv6
  }
}

locals {
  database_subnet_cidr_blocks      = [for cidr_block in oci_core_vcn.main.cidr_blocks : cidrsubnet(cidr_block, 8, 21)]
  database_subnet_ipv6_cidr_blocks = [for cidr_block in oci_core_vcn.main.ipv6cidr_blocks : cidrsubnet(cidr_block, 8, 21)]
}

resource "oci_core_subnet" "database" {
  availability_domain = data.oci_identity_availability_domain.main.name
  cidr_block          = one(local.database_subnet_cidr_blocks)
  ipv6cidr_blocks     = local.database_subnet_ipv6_cidr_blocks
  compartment_id      = oci_identity_compartment.main.id
  display_name        = "Main MySQL Database System Subnet"
  dns_label           = "database"
  security_list_ids   = [oci_core_security_list.database.id]
  vcn_id              = oci_core_vcn.main.id
}