terraform-aws-lightsail-tailscale-exit-node

Terraform module for deploying a Tailscale exit node on AWS Lightsail.

Warning

This module requires a tag defined in Tailscale access controls.

Usage

Single exit node

terraform {
  required_version = "~> 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    tailscale = {
      source  = "tailscale/tailscale"
      version = "~> 0.0"
    }
    time = {
      source  = "hashicorp/time"
      version = "~> 0.0"
    }
  }
}

provider "aws" {
  region = "eu-central-1"
}

provider "tailscale" {}

module "exit_node" {
  source = "github.com/bendwyer/terraform-aws-lightsail-tailscale-exit-node"
}

Multiple exit nodes

terraform {
  required_version = "~> 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    tailscale = {
      source  = "tailscale/tailscale"
      version = "~> 0.0"
    }
    time = {
      source  = "hashicorp/time"
      version = "~> 0.0"
    }
  }
}

provider "aws" {
  region = "eu-central-1"
}

provider "aws" {
  alias  = "jp"
  region = "ap-northeast-1"
}

provider "aws" {
  alias  = "us"
  region = "us-east-1"
}

provider "tailscale" {}

module "de_exit_node" {
  source = "github.com/bendwyer/terraform-aws-lightsail-tailscale-exit-node"
}

module "jp_exit_node" {
  source = "github.com/bendwyer/terraform-aws-lightsail-tailscale-exit-node"
  providers = {
    aws = aws.jp
  }
  lightsail_region = "ap-northeast-1"
}

module "us_exit_node" {
  source = "github.com/bendwyer/terraform-aws-lightsail-tailscale-exit-node"

  providers = {
    aws = aws.us
  }
  lightsail_region = "us-east-1"
}

ACL with multiple exit nodes

terraform {
  required_version = "~> 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    tailscale = {
      source  = "tailscale/tailscale"
      version = "~> 0.0"
    }
    time = {
      source  = "hashicorp/time"
      version = "~> 0.0"
    }
  }
}

provider "aws" {
  region = "eu-central-1"
}

provider "aws" {
  alias  = "jp"
  region = "ap-northeast-1"
}

provider "aws" {
  alias  = "us"
  region = "us-east-1"
}

provider "tailscale" {}

resource "tailscale_acl" "this" {
  acl = templatefile("${path.root}/acl.json.tftpl", {
    tailscale_exit_node_tag_name = "exit"
  })
}

module "de_exit_node" {
  source = "github.com/bendwyer/terraform-aws-lightsail-tailscale-exit-node"
}

module "jp_exit_node" {
  source = "github.com/bendwyer/terraform-aws-lightsail-tailscale-exit-node"

  providers = {
    aws = aws.jp
  }
  lightsail_region = "ap-northeast-1"
}

module "us_exit_node" {
  source = "github.com/bendwyer/terraform-aws-lightsail-tailscale-exit-node"

  providers = {
    aws = aws.us
  }
  lightsail_region = "us-east-1"
}

Requirements

Name	Version
terraform	>= 1.1.0
aws	>=5.37.0
tailscale	>=0.13.13
time	>= 0.10.0

Providers

Name	Version
aws	>=5.37.0
tailscale	>=0.13.13
time	>= 0.10.0

Resources

Name	Type
aws_lightsail_instance.this	resource
aws_lightsail_instance_public_ports.this	resource
tailscale_tailnet_key.this	resource
time_static.this	resource

Inputs

Name	Description	Type	Default	Required
lightsail_availability_zone	AWS Lightsail availability zone for the AWS Lightsail region.	string	"a"	no
lightsail_region	AWS Lightsail region to deploy to.	string	"eu-central-1"	no
tailscale_exit_node_tag_names	Tailscale exit node tag names to associate with ephemeral key. Tag names must be be prefixed with 'tag:'	set(string)	[ "tag:exit" ]	no

Outputs

Name	Description
public_ip_address	AWS Lightsail instance public IP address.