cloudflare.tf

cloudflare.tf

data "cloudflare_zone" "domain" {
  count   = var.enable_cloudflare_tunnel ? 1 : 0
  zone_id = var.cloudflare_zone_id
}

data "http" "my_ip" {
  count              = var.enable_cloudflare_tunnel ? 1 : 0
  url                = "https://ipinfo.io/ip"
  request_timeout_ms = 10000
}

resource "random_id" "tunnel_secret" {
  count       = var.enable_cloudflare_tunnel ? 1 : 0
  byte_length = 35
}

resource "cloudflare_zero_trust_tunnel_cloudflared" "vllm" {
  count         = var.enable_cloudflare_tunnel ? 1 : 0
  account_id    = var.cloudflare_account_id
  name          = "${var.service_name}-tunnel"
  tunnel_secret = trimspace(random_id.tunnel_secret[0].b64_std)
  config_src    = "cloudflare"
}

data "cloudflare_zero_trust_tunnel_cloudflared_token" "vllm" {
  count      = var.enable_cloudflare_tunnel ? 1 : 0
  account_id = var.cloudflare_account_id
  tunnel_id  = cloudflare_zero_trust_tunnel_cloudflared.vllm[0].id

  depends_on = [cloudflare_zero_trust_tunnel_cloudflared.vllm]
}

resource "cloudflare_zero_trust_tunnel_cloudflared_config" "vllm" {
  count      = var.enable_cloudflare_tunnel ? 1 : 0
  account_id = var.cloudflare_account_id
  tunnel_id  = cloudflare_zero_trust_tunnel_cloudflared.vllm[0].id
  source     = "cloudflare"

  depends_on = [cloudflare_zero_trust_tunnel_cloudflared.vllm]

  config = {
    ingress = [
      {
        hostname = "${var.service_name}.${data.cloudflare_zone.domain[0].name}"
        service  = "http://localhost:8000"
      },
      {
        service = "http_status:404"
      }
    ]
  }
}

resource "cloudflare_dns_record" "vllm_tunnel" {
  count   = var.enable_cloudflare_tunnel ? 1 : 0
  zone_id = var.cloudflare_zone_id
  name    = var.service_name
  type    = "CNAME"
  content = "${cloudflare_zero_trust_tunnel_cloudflared.vllm[0].id}.cfargotunnel.com"
  ttl     = 300
  proxied = true
}

resource "cloudflare_zero_trust_access_policy" "allowlist" {
  count      = var.enable_cloudflare_tunnel ? 1 : 0
  account_id = var.cloudflare_account_id
  name       = "${var.service_name} allowlist"
  decision   = "bypass"
  include = flatten([
    [{ ip = { ip = "${trimspace(data.http.my_ip[0].response_body)}/32" } }],
    [for cidr in var.cloudflare_allowed_cidrs : { ip = { ip = cidr } }]
  ])
}

resource "cloudflare_zero_trust_access_application" "vllm" {
  count            = var.enable_cloudflare_tunnel ? 1 : 0
  account_id       = var.cloudflare_account_id
  name             = var.service_name
  domain           = "${var.service_name}.${data.cloudflare_zone.domain[0].name}"
  type             = "self_hosted"
  session_duration = "24h"

  policies = [{
    id         = cloudflare_zero_trust_access_policy.allowlist[0].id
    precedence = 1
  }]
}

resource "google_secret_manager_secret" "cloudflare_api_token" {
  count     = var.enable_cloudflare_tunnel ? 1 : 0
  secret_id = "${var.service_name}-cloudflare-api-token"
  project   = var.project_id

  replication {
    auto {}
  }

  depends_on = [google_project_service.apis["secretmanager.googleapis.com"]]
}

resource "google_secret_manager_secret_version" "cloudflare_api_token" {
  count       = var.enable_cloudflare_tunnel ? 1 : 0
  secret      = google_secret_manager_secret.cloudflare_api_token[0].id
  secret_data = var.cloudflare_token
}

resource "google_secret_manager_secret" "cloudflare_tunnel_token" {
  count     = var.enable_cloudflare_tunnel ? 1 : 0
  secret_id = "${var.service_name}-cloudflare-tunnel-token"
  project   = var.project_id

  replication {
    auto {}
  }

  depends_on = [google_project_service.apis["secretmanager.googleapis.com"]]
}

resource "google_secret_manager_secret_version" "cloudflare_tunnel_token" {
  count       = var.enable_cloudflare_tunnel ? 1 : 0
  secret      = google_secret_manager_secret.cloudflare_tunnel_token[0].id
  secret_data = data.cloudflare_zero_trust_tunnel_cloudflared_token.vllm[0].token
}