Terraform OCI Free Tier

This repository provides Terraform configurations for deploying resources in the Oracle Cloud Infrastructure (OCI) Free Tier.

Table of Contents

• Terraform OCI Free Tier
  • Table of Contents
  • Prerequisites
  • Setup
  • Usage
  • Files
  • RunTipi Configuration
  • License
  • Requirements
  • Providers
  • Modules
  • Resources
  • Inputs
  • Outputs

Prerequisites

• Terraform or OpenTofu installed on your local machine.
• An Oracle Cloud Infrastructure (OCI) account.
• OCI CLI configured with your credentials.

Setup

1. Clone the repository:

   git clone https://github.com/filippolmt/terraform-oci-free-tier.git
   cd terraform-oci-free-tier

2. Configure your variables: Copy the terraform.tfvars.template to terraform.tfvars and fill in the required variables. By default, the install_runtipi variable is set to true, which will trigger the installation of RunTipi. If you do not wish to install RunTipi, set this variable to false.

   cp terraform.tfvars.template terraform.tfvars

3. Initialize Terraform or OpenTofu: Depending on the tool you are using, run:

   terraform init

   or

   tofu init

Usage

1. Plan the deployment:

   terraform plan

   or

   tofu plan

2. Apply the deployment:

   terraform apply

   or

   tofu apply

3. Destroy the deployment:

   terraform destroy

   or

   tofu destroy

Files

• main.tf: Main Terraform configuration file.
• outputs.tf: Defines the outputs of the Terraform configuration.
• variables.tf: Defines the variables used in the Terraform configuration.
• versions.tf: Specifies the required Terraform version and provider versions.
• terraform.tfvars.template: Template for user-specific variables.
• .github/workflows/: Contains GitHub Actions workflows for CI/CD.
  • documentation.yml: Workflow for generating documentation.
  • tfsec.yml: Workflow for running TFsec security scans.
• scripts/startup.sh: Script for initial setup and configuration. By default, this script installs RunTipi unless the install_runtipi variable is set to false.

RunTipi Configuration

If install_runtipi is set to true, the setup script will install RunTipi and configure the local network for running applications within the local domain. Follow these steps to correctly configure RunTipi:

1. Access RunTipi via Public IP:

   • Install AdGuard from the RunTipi apps.
   • In the "Network Interface" section, add the IP 127.0.0.1 and ensure the system is also reachable from the internet.
   • Add a valid DNS or any DNS by modifying the hosts file if needed.

2. Configure DNS Resolution for VPN Network:

   • Access the RunTipi dashboard and follow this guide for DNS resolution within the VPN network: RunTipi DNS Resolution Guide.
   • Configure the IP to 172.18.0.254, which is the IP set for Traefik.

3. Configure WireGuard:

   • Install and configure WireGuard by adding a public IP or DNS.
   • Set a password and configure the AdGuard IP to 172.18.0.253.
   • Restart RunTipi.

4. Disable Internet Access:

   • Once AdGuard is configured and running, you can disable internet access to ensure that applications are only reachable within the local network.

Once these steps are complete, you will be able to use the local network without the applications being accessible externally.

License

This project is licensed under the MIT License. See the LICENSE file for details.

Requirements

Name	Version
terraform	>=1.3
oci	6.11.0

Providers

Name	Version
oci	6.11.0

Modules

No modules.

Resources

Name	Type
oci_core_default_route_table.default_route_table	resource
oci_core_instance.instance	resource
oci_core_internet_gateway.internet_gateway	resource
oci_core_public_ip.public_ip	resource
oci_core_security_list.security_list	resource
oci_core_subnet.subnet	resource
oci_core_vcn.vcn	resource
oci_core_volume.docker_volume	resource
oci_core_volume_attachment.docker_volume_attachment	resource
oci_core_volume_backup_policy.docker_volume_backup_policy	resource
oci_core_volume_backup_policy_assignment.docker_volume_backup_policy_assignment	resource
oci_core_private_ips.instance_private_ip	data source
oci_core_vnic.instance_vnic	data source
oci_core_vnic_attachments.instance_vnics	data source
oci_identity_availability_domain.ad	data source

Inputs

Name	Description	Type	Default	Required
additional_ssh_public_key	Additional public key to use for SSH access example: < /home/ubuntu/.ssh/authorized_keys ssh-rsa AAAAB3NzaC1yc2EAA EOF	string	""	no
availability_domain_number	The availability domain number	number	1	no
compartment_ocid	The OCID of the compartment	string	n/a	yes
docker_volume_size_gb	The size of the docker volume in GBs	string	"150"	no
fault_domain	The fault domain to deploy to	string	"FAULT-DOMAIN-2"	no
install_runtipi	Install Homeserver Runtipi refs: https://runtipi.io/	bool	true	no
instance_display_name	The display name of the instance	string	"DockerHost"	no
instance_image_ocids_by_region	The OCID of the image to use for the instance	map(string)	{ "af-johannesburg-1": "ocid1.image.oc1.af-johannesburg-1.aaaaaaaa7xnljvdm5kpk4m7zt7spaqyb3qjikwitnzpoebw7ggamy4exzv7a", "ap-chuncheon-1": "ocid1.image.oc1.ap-chuncheon-1.aaaaaaaaqlcsenyb566zfbppypis3wnpdi5wzgvh6ni4njx6ni3b54h2f46a", "ap-hyderabad-1": "ocid1.image.oc1.ap-hyderabad-1.aaaaaaaauqklehbg4utigurndarajxvpcrlokn7doqm2ctwplxqsni76wkza", "ap-melbourne-1": "ocid1.image.oc1.ap-melbourne-1.aaaaaaaaxttpznd6kgln75wmdtalxmh374dc7vryk6ogxy4odv7ah5oh4coa", "ap-mumbai-1": "ocid1.image.oc1.ap-mumbai-1.aaaaaaaaroeqq2dbas6jtuyszivuul4z2kec2fytvefcx4yn6nmxo2dmgo5a", "ap-osaka-1": "ocid1.image.oc1.ap-osaka-1.aaaaaaaaslgmmzf52mm5i6fnyeudflxyfpdopd34vezjngyac7r4k4zvsxza", "ap-seoul-1": "ocid1.image.oc1.ap-seoul-1.aaaaaaaamflo2tuozxfqsfe2ouyldnliqzzbzdnjgixjchsyl36zhz6ued5q", "ap-singapore-1": "ocid1.image.oc1.ap-singapore-1.aaaaaaaazmtpusw5a62d2ohooa4q3nu3atfpv2hrldek72d3l5ikmghardsq", "ap-sydney-1": "ocid1.image.oc1.ap-sydney-1.aaaaaaaaerkvnleaqrw5ugplx3k2el5l4pz4rr3exfbjna6ryj5fylocmnma", "ap-tokyo-1": "ocid1.image.oc1.ap-tokyo-1.aaaaaaaal3hqdorzbtai6mc4bwggjshnog7u4i3xj7jz3v4xtimlmmkqy7ya", "ca-montreal-1": "ocid1.image.oc1.ca-montreal-1.aaaaaaaaun5fmmveoxeebsdnbs3dp3llsfmf3ol657aa7d3bshvnacxa45eq", "ca-toronto-1": "ocid1.image.oc1.ca-toronto-1.aaaaaaaauzynkrnddymm7346qpdzemhwqfigibq655ufdywbewpv2n4kmhtq", "eu-amsterdam-1": "ocid1.image.oc1.eu-amsterdam-1.aaaaaaaal3y4fa7lj6deamse4m4ukkznfeoywb5h6r2y6qdwdqynh2rkx5tq", "eu-frankfurt-1": "ocid1.image.oc1.eu-frankfurt-1.aaaaaaaaylcz7y7w6uolelzd6ruexuqkufkqqgg2nrr6xnvhtukysuolzv4q", "eu-madrid-1": "ocid1.image.oc1.eu-madrid-1.aaaaaaaaw7wlmoprvzhu5ogyw6zjgdkclgyjidubfh2kzi27ns5tsl4agwcq", "eu-marseille-1": "ocid1.image.oc1.eu-marseille-1.aaaaaaaao7fvqbnna7orz4xnnpv3vlitdnnmesnz4gk5pzgvfcxgmadmoc4q", "eu-milan-1": "ocid1.image.oc1.eu-milan-1.aaaaaaaafofjducrv2pz7kj7thpbty2hyv37dtxce3x6cp5rwf2cngi7flva", "eu-paris-1": "ocid1.image.oc1.eu-paris-1.aaaaaaaaqnoet4akmzpatmorbqio4srukhrd434xh6kg37jp6f4hdlt5mbiq", "eu-stockholm-1": "ocid1.image.oc1.eu-stockholm-1.aaaaaaaavni5omi3qljq5umzlymbzxdczn3cmvgnfwb4tdfsls6qyehlv43q", "eu-zurich-1": "ocid1.image.oc1.eu-zurich-1.aaaaaaaaswipxdoxr6pwu2mjk6lff5r4prkmuhufucw5kjaf7446ksx37d7q", "il-jerusalem-1": "ocid1.image.oc1.il-jerusalem-1.aaaaaaaadzptbcjtrf7tx5sejgc7onb47u5ckrvakivyk6d2lueukm4uumsq", "me-abudhabi-1": "ocid1.image.oc1.me-abudhabi-1.aaaaaaaaocrezb6kjxfj6ksp6xqpq2rvdxujxfk7sjrvcyjtavjs4eyzy4na", "me-dubai-1": "ocid1.image.oc1.me-dubai-1.aaaaaaaaiiykp2iuznxgzrcrm2ln6o5nhfpfwuzlmwkvnmwgrzv747wfhowq", "me-jeddah-1": "ocid1.image.oc1.me-jeddah-1.aaaaaaaaaicrqlmq7qfk7gh2dnw5ett3z5qqwzof7kzt7mwij6fmwzqhi22a", "mx-monterrey-1": "ocid1.image.oc1.mx-monterrey-1.aaaaaaaaxqkk6akz7d2d356dk742kxq53kkfemewtlun6gj5jceeaddu2tkq", "mx-queretaro-1": "ocid1.image.oc1.mx-queretaro-1.aaaaaaaakty7iicnprrzzdv7mr5onnbigbq6i4vaudobx3x6ya34uryrrmqa", "sa-bogota-1": "ocid1.image.oc1.sa-bogota-1.aaaaaaaagpfqtybbtm5pikjd6qivrjd6d7p7y556rystirdayle6n3nxdzoa", "sa-santiago-1": "ocid1.image.oc1.sa-santiago-1.aaaaaaaan4ex5fu662bmizpkpu3vxalty7j6waowogwmebiyijhiomin2yja", "sa-saopaulo-1": "ocid1.image.oc1.sa-saopaulo-1.aaaaaaaaeor33zqzryd3smqgyg2arr4whsuobbtlwzxazovoto5vjnckaacq", "sa-valparaiso-1": "ocid1.image.oc1.sa-valparaiso-1.aaaaaaaafj5y2dbizrqlr44ytyxukkejp3heuork3whgdec7h5sw3ckw7whq", "sa-vinhedo-1": "ocid1.image.oc1.sa-vinhedo-1.aaaaaaaahwildebomq43h7xaufnbkgx6n2qvn5kihndcvkzmjy3vhwaqx5ka", "uk-cardiff-1": "ocid1.image.oc1.uk-cardiff-1.aaaaaaaak55bg7dku2z3smbb3nczyj6jwmhlashfazcc3iemqmbwyjthic5a", "uk-london-1": "ocid1.image.oc1.uk-london-1.aaaaaaaantzj7ujtr5wcojxtgc76oveoq5xcz7egczd56x67wivib3hfak3q", "us-ashburn-1": "ocid1.image.oc1.iad.aaaaaaaai42i6avvfxqawj3bjl5uzhlyq5lqkqhbeg4lpo5corvwqgnvrloq", "us-chicago-1": "ocid1.image.oc1.us-chicago-1.aaaaaaaazcw4u4fboyq5t33t7dj3jbwqvgy4jbkgxfmtxs2xxdnczshdhusa", "us-phoenix-1": "ocid1.image.oc1.phx.aaaaaaaativnqm7keyzvvmetzp5cxlavfk5xyylt6w2epbjjjwmkv6xijnbq", "us-sanjose-1": "ocid1.image.oc1.us-sanjose-1.aaaaaaaaouu2iwsejzxx3mqrczvmcx3az4jcnztjoysn3whf2oxamob22jqq" }	no
instance_shape	The shape of the instance	string	"VM.Standard.A1.Flex"	no
instance_shape_boot_volume_size_gb	The size of the boot volume in GBs	string	"50"	no
instance_shape_config_memory_gb	The amount of memory in GBs for the instance	string	"24"	no
instance_shape_config_ocpus	The number of OCPUs for the instance	string	"4"	no
oracle_api_key_fingerprint	The fingerprint of the public key	string	n/a	yes
oracle_api_private_key_path	The path to the private key	string	"~/.oci/oci_api_key.pem"	no
region	The region to deploy to	string	"eu-milan-1"	no
runtipi_adguard_ip	The IP of the AdGuard for Runtipi, WARNING: this IP should be in the subnet of the main network and different from the reverse proxy IP	string	"172.18.0.253"	no
runtipi_main_network_subnet	The subnet of the main network for Runtipi	string	"172.18.0.0/16"	no
runtipi_reverse_proxy_ip	The IP of the reverse proxy for Runtipi, WARNING: this IP should be in the subnet of the main network	string	"172.18.0.254"	no
security_list_rules	The security list rules	list(object({ protocol = string source = string stateless = bool tcp_options = object({ source_port_range = object({ min = number max = number }) min = number max = number }) udp_options = object({ source_port_range = object({ min = number max = number }) min = number max = number }) icmp_options = object({ type = number code = number }) }))	[ { "icmp_options": null, "protocol": "6", "source": "0.0.0.0/0", "stateless": false, "tcp_options": { "max": 22, "min": 22, "source_port_range": { "max": 65535, "min": 1 } }, "udp_options": null }, { "icmp_options": null, "protocol": "17", "source": "0.0.0.0/0", "stateless": false, "tcp_options": null, "udp_options": { "max": 51820, "min": 51820, "source_port_range": { "max": 65535, "min": 1 } } }, { "icmp_options": { "code": 4, "type": 3 }, "protocol": "1", "source": "0.0.0.0/0", "stateless": false, "tcp_options": null, "udp_options": null } ]	no
ssh_public_key	The public key to use for SSH access	string	n/a	yes
tenancy_ocid	The OCID of the tenancy	string	n/a	yes
user_ocid	The OCID of the user to use for authentication	string	n/a	yes
vcn_cidr_block	The CIDR block for the VCN	string	"10.1.0.0/16"	no

Outputs

Name	Description
instance_id	The OCID of the instance
private_ip	The private IP of the instance
public_ip	The public IP of the instance