def firewall(stem, fw_sn_id, fwm_sn_id, private_ranges, depends_on=None):
fw_pip = network.PublicIPAddress(
f'{stem}{s}fw{s}pip',
public_ip_address_name=f'{stem}{s}fw{s}pip{s}{suffix}',
resource_group_name=resource_group_name,
location=location,
sku=network.PublicIPAddressSkuArgs(name='Standard', ),
public_ip_allocation_method='Static',
tags=tags,
opts=ResourceOptions(parent=self, depends_on=depends_on),
)
fwm_pip = network.PublicIPAddress(
f'{stem}{s}fwm{s}pip',
public_ip_address_name=f'{stem}{s}fwm{s}pip{s}{suffix}',
resource_group_name=resource_group_name,
location=location,
sku=network.PublicIPAddressSkuArgs(name='Standard', ),
public_ip_allocation_method='Static',
tags=tags,
opts=ResourceOptions(parent=self, depends_on=depends_on),
)
fw = network.AzureFirewall(
f'{stem}{s}fw',
azure_firewall_name=f'{stem}{s}fw{s}{suffix}',
resource_group_name=resource_group_name,
location=location,
additional_properties={
"Network.SNAT.PrivateRanges": private_ranges,
},
sku=network.AzureFirewallSkuArgs(
name='AZFW_VNet',
tier='Standard',
),
ip_configurations=[
network.AzureFirewallIPConfigurationArgs(
name=f'{stem}{s}fw{s}ipconf{s}{suffix}',
public_ip_address=network.PublicIPAddressArgs(id=fw_pip.id, ),
subnet=network.SubnetArgs(id=fw_sn_id, ),
)
],
management_ip_configuration=network.AzureFirewallIPConfigurationArgs(
name=f'{stem}{s}fwm{s}ipconf{s}{suffix}',
public_ip_address=network.PublicIPAddressArgs(id=fwm_pip.id, ),
subnet=network.SubnetArgs(id=fwm_sn_id, ),
),
tags=tags,
opts=ResourceOptions(
parent=self,
depends_on=depends_on,
custom_timeouts=CustomTimeouts(
create='1h',
update='1h',
delete='1h',
),
),
)
return fw
def expressroute_gateway(stem, subnet_id, depends_on=None):
er_gw_pip = network.PublicIPAddress(
f'{stem}{s}er{s}gw{s}pip',
public_ip_address_name=f'{stem}{s}er{s}gw{s}pip{s}{suffix}',
resource_group_name=resource_group_name,
location=location,
public_ip_allocation_method='Dynamic',
tags=tags,
opts=ResourceOptions(parent=self, depends_on=depends_on),
)
er_gw = network.VirtualNetworkGateway(
f'{stem}{s}er{s}gw',
virtual_network_gateway_name=f'{stem}{s}er{s}gw{s}{suffix}',
resource_group_name=resource_group_name,
location=location,
sku=network.VirtualNetworkGatewaySkuArgs(
name='Standard',
tier='Standard',
),
gateway_type='ExpressRoute',
vpn_type='RouteBased',
enable_bgp=True,
ip_configurations=[
network.VirtualNetworkGatewayIPConfigurationArgs(
name=f'{stem}{s}er{s}gw{s}ipconf{s}{suffix}',
public_ip_address=network.PublicIPAddressArgs(
id=er_gw_pip.id, ),
subnet=network.SubnetArgs(id=subnet_id, ),
)
],
tags=tags,
opts=ResourceOptions(
parent=self,
depends_on=depends_on,
custom_timeouts=CustomTimeouts(
create='1h',
update='1h',
delete='1h',
),
),
)
return er_gw
def bastion_host(stem, virtual_network_name, address_prefix, depends_on=None):
ab_sn = network.Subnet(
f'{stem}{s}ab{s}sn',
subnet_name='AzureBastionSubnet', # name required
resource_group_name=resource_group_name,
virtual_network_name=virtual_network_name,
address_prefix=address_prefix,
opts=ResourceOptions(
parent=self,
delete_before_replace=True,
depends_on=depends_on,
),
)
ab_pip = network.PublicIPAddress(
f'{stem}{s}ab{s}pip',
public_ip_address_name=f'{stem}{s}ab{s}pip{s}{suffix}',
resource_group_name=resource_group_name,
location=location,
sku=network.PublicIPAddressSkuArgs(name='Standard', ),
public_ip_allocation_method='Static',
tags=tags,
opts=ResourceOptions(parent=self, depends_on=depends_on),
)
ab = network.BastionHost(
f'{stem}{s}ab',
bastion_host_name=f'{stem}{s}ab{s}{suffix}',
resource_group_name=resource_group_name,
location=location,
ip_configurations=[
network.BastionHostIPConfigurationArgs(
name=f'{stem}{s}ab{s}ipconf{s}{suffix}',
public_ip_address=network.PublicIPAddressArgs(id=ab_pip.id, ),
subnet=network.SubnetArgs(id=ab_sn.id, ),
)
],
tags=tags,
opts=ResourceOptions(parent=self, depends_on=depends_on),
)
return ab
# Create a resource group to hold project resources.
resource_group = resources.ResourceGroup("server-rg",
resource_group_name="minecraft",
location=location)
# Create a virtual network resource.
net = network.VirtualNetwork("server-network",
resource_group_name=resource_group.name,
location=location,
virtual_network_name="server-network",
address_space=network.AddressSpaceArgs(
address_prefixes=["10.0.0.0/16"], ),
subnets=[
network.SubnetArgs(
name="default",
address_prefix="10.0.0.0/24",
)
])
# Create a public IP to enable access on the Internet.
public_ip = network.PublicIPAddress("server-ip",
resource_group_name=resource_group.name,
location=location,
public_ip_address_name="server-ip",
public_ip_allocation_method="Dynamic")
# Create the network interface for the server.
network_iface = network.NetworkInterface(
"server-nic",
resource_group_name=resource_group.name,
location=resource_group.location,
destination_port_range='8443',
source_address_prefix='*',
destination_address_prefix='*',
priority=1002),
])
network_interface = network.NetworkInterface(
resource_name='nic-nc',
resource_group_name=resource_group.name,
network_interface_name='nic-nc-{0}'.format(installation_id),
location=location,
ip_configurations=[
network.NetworkInterfaceIPConfigurationArgs(
name='pipcfg-nc',
primary=True,
subnet=network.SubnetArgs(id=subnet.id),
private_ip_allocation_method='Dynamic',
public_ip_address=network.PublicIPAddressArgs(id=public_ip.id))
],
network_security_group=network.NetworkSecurityGroupArgs(
id=network_security_group.id))
# Build NGINX Controller VM
controller_fqdn = Output.all(public_ip.dns_settings).apply(lambda lst: lst[0])
custom_data = scripts.platform_setup_script({
'TLS_HOSTNAME':
scripts.build_vm_domain(config),
'LETS_ENCRYPT_EMAIL':
admin_email
})