Terraform provider reference / resources / server_firewall

fiberax_server_firewall (Resource)

Firewall of a server. ONE resource per server, and the rule set is a field of it.

The rules are replaced as a whole; you cannot add or remove a single one. The reason lies in the nature of the thing: inside the platform a rule is addressed by its number in the list, and that number shifts when a neighbouring rule is deleted - such an identifier can be neither stored nor imported. Replacing the whole set also gives what cannot be expressed otherwise: ORDER. The rules are read from top to bottom, and the first matching rule wins.

Filtering applies to the server's public card only. That is why a rule names no card at all, and a server with no public card cannot enable it - the rules can still be stored while it is off.

The resource has no create and no delete: a server always has a firewall. Destroying the resource DOES NOT TOUCH the platform - the details are in the destroy behaviour described below.

Example Usage

# The server firewall. ONE resource per server; rules are its field, replaced as a whole.
#
# Rule order MATTERS: the first matching rule wins.
resource "fiberax_server_firewall" "app" {
  server_id = fiberax_server.app.id
  enabled   = true

  policy_in  = "drop"   # anything not allowed below is dropped
  policy_out = "accept" # outbound traffic is not restricted

  rules = [
    {
      direction   = "in"
      action      = "accept"
      macro       = "ssh"
      source      = "203.0.113.0/24" # from the office only
      description = "management"
    },
    {
      direction        = "in"
      action           = "accept"
      protocol         = "tcp"
      destination_port = "80,443"
      description      = "web"
    },
    {
      # A rule can stay in the set switched off: it does nothing,
      # but it is not lost either.
      direction        = "in"
      action           = "accept"
      protocol         = "tcp"
      destination_port = "5432"
      enabled          = false
      description      = "database, closed for now"
    },
  ]
}

Schema

Required

enabled (Boolean) Whether the traffic of the server's public card is filtered.

The flag belongs to the SERVER, not to the cards. When you switch it on, the platform also marks the public cards that exist AT THAT MOMENT. A public card added later gets no mark and stays UNFILTERED - while the flag goes on saying it is on and shows no drift.

So after you add a public card to a server, apply the policy again: a change to any field of this resource marks that card too. The simplest way is to hold enabled switched off for one run and then switch it back on.

rules (Attributes List) The complete rule set, IN THE ORDER IT IS CHECKED: the first matching rule wins. No more than fifty.

The list is REQUIRED, and that is a safeguard: a request with no rules means remove them all, and a forgotten field would cost far too much. To have no rules at all, write an empty list explicitly. (see below for nested schema)

server_id (Number) The server whose firewall this describes. It is also the resource identifier: changing this field means a different server, that is, the resource is recreated.

Optional

log_level_in (String) How much inbound filtering is logged. The default is nolog.

This API does not hand out the log itself: a log line carries the platform's internal interface names. It is read in the client area, and the level is declared here because the state of the firewall has to be described as a whole. An omitted field means nolog.

log_level_out (String) The same for outbound filtering. An omitted field means nolog.
policy_in (String) What happens to inbound traffic no rule matched.

An omitted field means drop; it does not mean leave it as it is. That is how the operation itself works: it sets the WHOLE state of the firewall, and a field that does not arrive is taken by the platform from its own defaults. So the default is declared here - then the value is visible in the plan BEFORE you approve it, instead of being substituted silently.

policy_out (String) The same for outbound traffic. An omitted field means accept.

Nested Schema for `rules`

Required:

action (String) What to do with the traffic that matched.
direction (String) in - inbound traffic, out - outbound.

Optional:

description (String) A note on the rule.

Control characters are refused, and that is not cosmetic: the note travels into the firewall configuration AS TEXT, so a line break inside it turns into a separate REAL rule. A leading hash is refused separately - it hides the rule from the listing.

destination (String) Address or range the traffic goes to. Not set means anywhere.
destination_port (String) Destination port, in the same form.
enabled (Boolean) A disabled rule stays in the set and does nothing. Enabled by default.
macro (String) Named service shorthand for a protocol and its ports, in lower case (ssh, http). The hypervisor writes these names capitalised (SSH), and that form is rejected here: the platform stores them lower case, so keeping SSH in the configuration would propose a change on every run. The names are checked by the platform itself: the set depends on its version, so they are not listed in the contract.
protocol (String) Protocol, in lower case: tcp, udp, icmp. The platform refuses a port without a protocol.
source (String) Address or range the traffic comes from. Empty means any.
source_port (String) Source port AS TEXT: both a list and a range are accepted (80,443, 1000:2000).

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# The import ID is the server ID: a server has exactly one firewall.
terraform import fiberax_server_firewall.app 10867

Generated from the provider schema for version 0.3.0. How to install the provider: Terraform provider.