mirrors/nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus synced 2026-05-03 14:25:57 +00:00
Code Issues Releases Wiki Activity

Remove whois networking from the proxy (#2976)

Browse Source
This commit is contained in:
gbrodman
2026-03-04 15:14:42 -05:00
committed by GitHub
parent 50a639937a
commit 9544d70048
7 changed files with 3 additions and 201 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
proxy/terraform/example_config.tf
View File

@@ -12,7 +12,4 @@ module "proxy" {
gcr_project_name = "YOUR_GCR_PROJECT"
proxy_domain_name = "YOUR_PROXY_DOMAIN"
proxy_certificate_bucket = "YOUR_CERTIFICATE_BUCKET"
# Uncomment to disable forwarding of whois HTTP interfaces.
# public_web_whois = 0
}

2
proxy/terraform/modules/networking.tf
View File

@@ -9,7 +9,6 @@ module "proxy_networking" {
proxy_ports = var.proxy_ports
proxy_domain = google_dns_managed_zone.proxy_domain.name
proxy_domain_name = google_dns_managed_zone.proxy_domain.dns_name
public_web_whois = var.public_web_whois
}
module "proxy_networking_canary" {
@@ -19,5 +18,4 @@ module "proxy_networking_canary" {
proxy_ports = var.proxy_ports_canary
proxy_domain = google_dns_managed_zone.proxy_domain.name
proxy_domain_name = google_dns_managed_zone.proxy_domain.dns_name
public_web_whois = var.public_web_whois
}

16
proxy/terraform/modules/networking/dns.tf
View File

@@ -13,19 +13,3 @@ resource "google_dns_record_set" "proxy_epp_aaaa_record" {
managed_zone = var.proxy_domain
rrdatas = [google_compute_global_address.proxy_ipv6_address.address]
}
resource "google_dns_record_set" "proxy_whois_a_record" {
name = "whois${var.suffix}.${var.proxy_domain_name}"
type = "A"
ttl = 300
managed_zone = var.proxy_domain
rrdatas = [google_compute_global_address.proxy_ipv4_address.address]
}
resource "google_dns_record_set" "proxy_whois_aaaa_record" {
name = "whois${var.suffix}.${var.proxy_domain_name}"
type = "AAAA"
ttl = 300
managed_zone = var.proxy_domain
rrdatas = [google_compute_global_address.proxy_ipv6_address.address]
}

149
proxy/terraform/modules/networking/loadbalancer.tf
View File

@@ -17,10 +17,7 @@ resource "google_compute_firewall" "proxy_firewall" {
ports = [
var.proxy_ports["epp"],
var.proxy_ports["whois"],
var.proxy_ports["health_check"],
var.proxy_ports["http-whois"],
var.proxy_ports["https-whois"],
]
}
@@ -44,21 +41,6 @@ resource "google_compute_health_check" "proxy_health_check" {
}
}
resource "google_compute_health_check" "proxy_http_health_check" {
name = "proxy-http-health-check${var.suffix}"
http_health_check {
host = "health-check.invalid"
port = var.proxy_ports["http-whois"]
request_path = "/"
}
}
resource "google_compute_url_map" "proxy_url_map" {
name = "proxy-url-map${var.suffix}"
default_service = google_compute_backend_service.http_whois_backend_service.self_link
}
resource "google_compute_backend_service" "epp_backend_service" {
name = "epp-backend-service${var.suffix}"
protocol = "TCP"
@@ -82,97 +64,12 @@ resource "google_compute_backend_service" "epp_backend_service" {
]
}
resource "google_compute_backend_service" "whois_backend_service" {
name = "whois-backend-service${var.suffix}"
protocol = "TCP"
timeout_sec = 60
port_name = "whois${var.suffix}"
backend {
group = var.proxy_instance_groups["americas"]
}
backend {
group = var.proxy_instance_groups["emea"]
}
backend {
group = var.proxy_instance_groups["apac"]
}
health_checks = [
google_compute_health_check.proxy_health_check.self_link,
]
}
resource "google_compute_backend_service" "https_whois_backend_service" {
name = "https-whois-backend-service${var.suffix}"
protocol = "TCP"
timeout_sec = 60
port_name = "https-whois${var.suffix}"
backend {
group = var.proxy_instance_groups["americas"]
}
backend {
group = var.proxy_instance_groups["emea"]
}
backend {
group = var.proxy_instance_groups["apac"]
}
health_checks = [
google_compute_health_check.proxy_health_check.self_link,
]
}
resource "google_compute_backend_service" "http_whois_backend_service" {
name = "http-whois-backend-service${var.suffix}"
protocol = "HTTP"
timeout_sec = 60
port_name = "http-whois${var.suffix}"
backend {
group = var.proxy_instance_groups["americas"]
}
backend {
group = var.proxy_instance_groups["emea"]
}
backend {
group = var.proxy_instance_groups["apac"]
}
health_checks = [
google_compute_health_check.proxy_http_health_check.self_link,
]
}
resource "google_compute_target_tcp_proxy" "epp_tcp_proxy" {
name = "epp-tcp-proxy${var.suffix}"
proxy_header = "PROXY_V1"
backend_service = google_compute_backend_service.epp_backend_service.self_link
}
resource "google_compute_target_tcp_proxy" "whois_tcp_proxy" {
name = "whois-tcp-proxy${var.suffix}"
proxy_header = "PROXY_V1"
backend_service = google_compute_backend_service.whois_backend_service.self_link
}
resource "google_compute_target_tcp_proxy" "https_whois_tcp_proxy" {
name = "https-whois-tcp-proxy${var.suffix}"
backend_service = google_compute_backend_service.https_whois_backend_service.self_link
}
resource "google_compute_target_http_proxy" "http_whois_http_proxy" {
name = "http-whois-tcp-proxy${var.suffix}"
url_map = google_compute_url_map.proxy_url_map.self_link
}
resource "google_compute_global_forwarding_rule" "epp_ipv4_forwarding_rule" {
name = "epp-ipv4-forwarding-rule${var.suffix}"
ip_address = google_compute_global_address.proxy_ipv4_address.address
@@ -186,49 +83,3 @@ resource "google_compute_global_forwarding_rule" "epp_ipv6_forwarding_rule" {
target = google_compute_target_tcp_proxy.epp_tcp_proxy.self_link
port_range = "700"
}
resource "google_compute_global_forwarding_rule" "whois_ipv4_forwarding_rule" {
name = "whois-ipv4-forwarding-rule${var.suffix}"
ip_address = google_compute_global_address.proxy_ipv4_address.address
target = google_compute_target_tcp_proxy.whois_tcp_proxy.self_link
port_range = "43"
}
resource "google_compute_global_forwarding_rule" "whois_ipv6_forwarding_rule" {
name = "whois-ipv6-forwarding-rule${var.suffix}"
ip_address = google_compute_global_address.proxy_ipv6_address.address
target = google_compute_target_tcp_proxy.whois_tcp_proxy.self_link
port_range = "43"
}
resource "google_compute_global_forwarding_rule" "https_whois_ipv4_forwarding_rule" {
name = "https-whois-ipv4-forwarding-rule${var.suffix}"
ip_address = google_compute_global_address.proxy_ipv4_address.address
target = google_compute_target_tcp_proxy.https_whois_tcp_proxy.self_link
port_range = "443"
count = var.public_web_whois
}
resource "google_compute_global_forwarding_rule" "https_whois_ipv6_forwarding_rule" {
name = "https-whois-ipv6-forwarding-rule${var.suffix}"
ip_address = google_compute_global_address.proxy_ipv6_address.address
target = google_compute_target_tcp_proxy.https_whois_tcp_proxy.self_link
port_range = "443"
count = var.public_web_whois
}
resource "google_compute_global_forwarding_rule" "http_whois_ipv4_forwarding_rule" {
name = "http-whois-ipv4-forwarding-rule${var.suffix}"
ip_address = google_compute_global_address.proxy_ipv4_address.address
target = google_compute_target_http_proxy.http_whois_http_proxy.self_link
port_range = "80"
count = var.public_web_whois
}
resource "google_compute_global_forwarding_rule" "http_whois_ipv6_forwarding_rule" {
name = "http-whois-ipv6-forwarding-rule${var.suffix}"
ip_address = google_compute_global_address.proxy_ipv6_address.address
target = google_compute_target_http_proxy.http_whois_http_proxy.self_link
port_range = "80"
count = var.public_web_whois
}

10
proxy/terraform/modules/networking/variables.tf
View File

@@ -20,13 +20,3 @@ variable "proxy_domain" {
variable "proxy_domain_name" {
description = "Domain name of the zone."
}
variable "public_web_whois" {
type = number
description = <<EOF
Set to 1 if the whois HTTP ports are external, 0 if not. This is necessary
because our test projects are configured with
constraints/compute.restrictLoadBalancerCreationForTypes, which prohibits
forwarding external HTTP(s) connections.
EOF
}

19
proxy/terraform/modules/variables.tf
View File

@@ -8,7 +8,7 @@ variable "gcr_project_name" {
variable "proxy_domain_name" {
description = <<EOF
The base domain name of the proxy, without the whois. or epp. part.
The base domain name of the proxy, without the epp. part.
EOF
}
@@ -35,10 +35,7 @@ variable "proxy_ports" {
default = {
health_check = 30000
whois = 30001
epp = 30002
http-whois = 30010
https-whois = 30011
}
}
@@ -48,20 +45,6 @@ variable "proxy_ports_canary" {
default = {
health_check = 31000
whois = 31001
epp = 31002
http-whois = 31010
https-whois = 31011
}
}
variable "public_web_whois" {
type = number
default = 1
description = <<EOF
Set to 1 if the whois HTTP ports are external, 0 if not. This is necessary
because our test projects are configured with
constraints/compute.restrictLoadBalancerCreationForTypes, which prohibits
forwarding external HTTP(s) connections.
EOF
}

5
proxy/terraform/update_named_ports.sh
View File

@@ -18,9 +18,8 @@
# the project, zone and instance group names, and then call gcloud to add the
# named ports.
PROD_PORTS="whois:30001,epp:30002,http-whois:30010,https-whois:30011"
CANARY_PORTS="whois-canary:31001,epp-canary:31002,"\
"http-whois-canary:31010,https-whois-canary:31011"
PROD_PORTS="epp:30002"
CANARY_PORTS="epp-canary:31002"
while read line
do