Skip to content

fix(terraform2.0/gateway): restart the service so it applies the written config; expose core_disconnect_grace_period #173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
valentinvilar-conexa wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(terraform2.0/gateway): restart the service so it applies the written config; expose core_disconnect_grace_period #173

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions terraform2.0/modules/gateway/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,11 @@ resource "aws_instance" "defguard_gateway" {
key_name = var.key_name

user_data = templatefile("${path.module}/setup.sh", {
grpc_port = var.grpc_port
nat = var.nat
package_version = var.package_version
log_level = var.log_level
grpc_port = var.grpc_port
nat = var.nat
package_version = var.package_version
log_level = var.log_level
core_disconnect_grace_period = var.core_disconnect_grace_period
})
user_data_replace_on_change = true

Expand Down
11 changes: 9 additions & 2 deletions terraform2.0/modules/gateway/setup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,9 @@ userspace = false
cert_dir = "/etc/defguard/certs"
# Enable automatic masquerading of traffic by the firewall
masquerade = ${nat}
# Seconds to wait after losing the Core connection before tearing down the WireGuard
# interface and purging the adoption certificates
core_disconnect_grace_period = ${core_disconnect_grace_period}
log_level = "${log_level}"

# Optional: HTTP port exposing gateway health status (200 connected, 503 not connected)
Expand All @@ -75,8 +78,12 @@ systemctl daemon-reload
log "Enabling defguard-gateway service..."
systemctl enable defguard-gateway

log "Starting defguard-gateway service..."
systemctl start defguard-gateway
# The package postinst already started the service, using the gateway.toml shipped with
# the .deb -- long before this script wrote the configuration above. `systemctl start` on
# an already-active unit is a no-op, so the service would keep running with the packaged
# defaults (notably `masquerade = false`) for the life of the instance. Restart instead.
log "Restarting defguard-gateway service to apply the configuration written above..."
systemctl restart defguard-gateway

log "Setup completed."
) 2>&1 | tee -a "$LOG_FILE"
6 changes: 6 additions & 0 deletions terraform2.0/modules/gateway/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,3 +43,9 @@ variable "log_level" {
type = string
default = "info"
}

variable "core_disconnect_grace_period" {
description = "Seconds the Gateway waits after losing the Core connection before tearing down the WireGuard interface and purging its adoption certificates. The binary defaults to 30, which is short enough that an ordinary Core restart triggers it."
type = number
default = 300
}