github.com/hernad/nomad@v1.6.112/e2e/terraform/tls_client.tf (about)

     1  # Copyright (c) HashiCorp, Inc.
     2  # SPDX-License-Identifier: MPL-2.0
     3  
     4  # tls_client.tf defines the mTLS certs that'll be used by the E2E test
     5  # runner
     6  
     7  resource "tls_private_key" "api_client" {
     8    algorithm   = "ECDSA"
     9    ecdsa_curve = "P384"
    10  }
    11  
    12  resource "tls_cert_request" "api_client" {
    13    private_key_pem = tls_private_key.api_client.private_key_pem
    14  
    15    subject {
    16      common_name = "${local.random_name} api client"
    17    }
    18  }
    19  
    20  resource "tls_locally_signed_cert" "api_client" {
    21    cert_request_pem   = tls_cert_request.api_client.cert_request_pem
    22    ca_private_key_pem = tls_private_key.ca.private_key_pem
    23    ca_cert_pem        = tls_self_signed_cert.ca.cert_pem
    24  
    25    validity_period_hours = 720
    26  
    27    # Reasonable set of uses for a server SSL certificate.
    28    allowed_uses = [
    29      "key_encipherment",
    30      "digital_signature",
    31      "client_auth",
    32    ]
    33  }
    34  
    35  resource "local_sensitive_file" "api_client_key" {
    36    content  = tls_private_key.api_client.private_key_pem
    37    filename = "keys/tls_api_client.key"
    38  }
    39  
    40  resource "local_sensitive_file" "api_client_cert" {
    41    content  = tls_locally_signed_cert.api_client.cert_pem
    42    filename = "keys/tls_api_client.crt"
    43  }
    44  
    45  # Self signed cert for reverse proxy
    46  
    47  resource "tls_private_key" "self_signed" {
    48    algorithm   = "ECDSA"
    49    ecdsa_curve = "P384"
    50  }
    51  
    52  resource "tls_self_signed_cert" "self_signed" {
    53    private_key_pem = tls_private_key.self_signed.private_key_pem
    54    subject {
    55      common_name  = "${local.random_name}.local"
    56      organization = "HashiCorp, Inc."
    57    }
    58  
    59    ip_addresses = toset(aws_instance.client_ubuntu_jammy_amd64.*.public_ip)
    60  
    61    validity_period_hours = 720
    62    allowed_uses = [
    63      "server_auth"
    64    ]
    65  }
    66  
    67  resource "local_sensitive_file" "self_signed_key" {
    68    content  = tls_private_key.self_signed.private_key_pem
    69    filename = "keys/self_signed.key"
    70  }
    71  
    72  resource "local_sensitive_file" "self_signed_cert" {
    73    content  = tls_self_signed_cert.self_signed.cert_pem
    74    filename = "keys/self_signed.crt"
    75  }