This template allows you to deploy an Azure Gateway, that routes traffic to a Linux VM running NGNIX. The Linux VM does not have a public IP address, since it gets its IP from the private subnet behind the Application Gateway.

In order to access the private subnet, we have deployed a Bastion Host (Jumpbox) in the solution to use as an intermediary. The Bastion host is also used to execute remote scripts in a VM which does not have a public IP. The connection block in the "vm" resource demonstrates this functionality. The connection block shows the use of a Bastion host as an intermediary between the target "host" and the Terraform executor.

    connection {
        type                = "ssh"
        bastion_host        = "${azurerm_public_ip.bastion_pip.fqdn}"
        bastion_user        = "${var.username}"
        bastion_private_key = "${file(var.private_key_path)}"
        host                = "${element(azurerm_network_interface.nic.*.private_ip_address, count.index)}"
        user                = "${var.username}"
        private_key         = "${file(var.private_key_path)}"
    }

Note: The Azure Application Gateway may take up to 17 minutes to be completely deployed and configured.

The following diagram shows the high level deployment architecture:

In order to use this sample, we recommend creating SSH keys to secure both the Linux VM and the Bastion Host. The SSH keys need to be located in the same machine where Terraform is executed. Run ssh-keygen to generate the keys and point the variables: public_key_path and private_key_path to the appropriate public and private key files.

$ terraform init && terraform apply
# Enter deployment variables in the prompt

Create a file ~/.ssh/config and paste the following config. Run the command ssh vm1 from the Terraform executor machine to ssh into the private network machine. The machine must have the same private and public key pair used to create the machines.

Host bastion
  Hostname ${var.hostname}-bastion.${var.location}.cloudapp.azure.com
  User ubuntu
  PasswordAuthentication no
  PubkeyAuthentication yes

Host vm1
  Hostname 10.254.1.4
  User ubuntu
  PasswordAuthentication no
  PubkeyAuthentication yes
  ProxyCommand ssh ubuntu@bastion nc %h %p

The main.tf file contains the actual resources that will be deployed. It also contains the Azure Resource Group definition and any defined variables.

The variables.tf file contains all of the input parameters that the user can specify when deploying this Terraform template.

Terraform requires the parameters client_id, client_secret, subscription_id, and tenant_id in order to deploy to Azure. The service account must be created in Azure Active Directory to generate the client_id, client_secret, and tenant_id. The subscription_id can be recovered from your Azure account details.

Please go here for full instructions on how to create this to populate your provider block.

This data is outputted when terraform apply is called, and can be queried using the terraform output command.

If a terraform.tfvars or any .auto.tfvars files are present in the current directory, Terraform automatically loads them to populate variables. We don't recommend saving usernames and password to version control, but you can create a local secret variables file and use the -var-file flag or the .auto.tfvars extension to load it.