Firewall controls

[Msabljic]

Would it be possible to add firewall creation or controls as either a resource or within the VM configuration?

[bpg]

Hey @Msabljic 👋🏻! There is already a ticket for this: #113, which includes some implementation details.
I'm not using PVE firewall in my homelab setup at the moment, hence this is a low priority item. But PRs are always welcome! :)

[Msabljic]

Hey Pavel, funny enough I can help with that if you can create the resource I could do testing against a working environment and give feed back. Let me know if that helps!

…

On Tue, Feb 7, 2023 at 16:58 Pavel Boldyrev ***@***.***> wrote: Hey @Msabljic <https://github.com/Msabljic> 👋🏻! There is already a ticket for this: #113 <#113>, which includes some implementation details. I'm not using PVE firewall in my homelab setup at the moment, hence this is a low priority item. But PRs are always welcome! :) — Reply to this email directly, view it on GitHub <#234 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AXTCW2HNW6B6ZPK44NFBCPDWWLAQJANCNFSM6AAAAAAUUMYANY> . You are receiving this because you were mentioned.Message ID: <bpg/terraform-provider-proxmox/repo-discussions/234/comments/4898489@ github.com>

[bpg]

Thanks for the offer, but I don't think it would be easy to setup. I don't have a PVE instance in a cloud, and can't open external access to my homelab, sorry.

[Msabljic]

Sorry maybe I wasn’t clear, I currently have a running environment of my own. I have been tinkering with your resources and created a few modules with identity management and container creation. I would be interested in helping you develop the fw resource and test the resource against my own environment. Let me know what you think!

…

On Wed, Feb 8, 2023 at 23:31 Pavel Boldyrev ***@***.***> wrote: Thanks for the offer, but I don't think it would be easy to setup. I don't have a PVE instance in a cloud, and can't open external access to my homelab, sorry. — Reply to this email directly, view it on GitHub <#234 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AXTCW2FQLAUGHWYP3RYUPVLWWRXJHANCNFSM6AAAAAAUUMYANY> . You are receiving this because you were mentioned.Message ID: <bpg/terraform-provider-proxmox/repo-discussions/234/comments/4914170@ github.com>

[bpg]

Ah, yes, sounds good! I'll try to come up with something over the weekend, and let you know when there will be something to test.
Thanks!

[Msabljic]

Cool, I’ll keep working on trying to understand the go side of it, I don’t have a huge exposure to go lang but it seems relatively simple.

…

On Fri, Feb 10, 2023 at 01:17 Pavel Boldyrev ***@***.***> wrote: Ah, yes, sounds good! I'll try to come up with something over the weekend, and let you know when there will be something to test. Thanks! — Reply to this email directly, view it on GitHub <#234 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AXTCW2FPHEC5QUJDPEPXSNLWWXMQBANCNFSM6AAAAAAUUMYANY> . You are receiving this because you were mentioned.Message ID: <bpg/terraform-provider-proxmox/repo-discussions/234/comments/4928637@ github.com>

[bpg]

Here is some prelim code: #246
I have security group and security group rules, along with aliases and ip sets. No in-place rule updates yet, and no binding to node / vm / lxc.
This feature is quite big tho. I may need to take a step back to figure out how it may fit better in the terraform configs...

[bpg]

Hey @Msabljic, could you give v0.17.0-rc1 a try?

[Msabljic]

Some issues I have found.

Major
Error: Invalid resource type
│
│ on main.tf line 16, in resource "proxmox_virtual_environment_cluster_firewall_alias" "local_network":
│ 16: resource "proxmox_virtual_environment_cluster_firewall_alias" "local_network" {
│
│ The provider bpg/proxmox does not support resource type
│ "proxmox_virtual_environment_cluster_firewall_alias".

Seems that the firewall alias module doesnt work for 0.17.0-rc1

Minor
Firewall-SG module

• ports should be numbers, however when passing a macro, port becomes blanked out meaning if any number is passed deploy fails
• passing number on protocol works but when entering gui it wants the value changed to name value.

Firewall-options

• node_name required but not given in example

Firewall rules

• doesnt allow direct insertion of security groups, this would be an awesome thing to have so you can generate the sg's on the cluster level and pass them down to the individual resource by just giving sg-name, if it is enabled, interface and comment

I still have testing to do on other components but this is what I have found so far.

[bpg]

Thanks for the feedback!

I think for alias it should be "proxmox_virtual_environment_firewall_alias" as the resource name. I must've left the old name there by accident.

I'll take a look at other comments later this week.

[bpg]

• ports should be numbers, however when passing a macro, port becomes blanked out meaning if any number is passed deploy fails

API supports range (8080:8088) or list (80,443) for ports, can't think of any alternative for handling that rather than strings.

• passing number on protocol works but when entering gui it wants the value changed to name value.

copied that from the API docs, I think it will be better to stick with names then.

• node_name required but not given in example

updated docs

• doesnt allow direct insertion of security groups, this would be an awesome thing to have so you can generate the sg's on the cluster level and pass them down to the individual resource by just giving sg-name, if it is enabled, interface and comment

really good point, I totally missed this use case!

Thanks for testing!

[bpg]

0.17.0-rc2 is on the way

[Msabljic]

Yup, working on it now.

…

On Sun, Apr 2, 2023 at 18:07 Pavel Boldyrev ***@***.***> wrote: Hey @Msabljic <https://github.com/Msabljic>, could you give v0.17.0-rc1 <https://github.com/bpg/terraform-provider-proxmox/releases/tag/v0.17.0-rc1> a try? — Reply to this email directly, view it on GitHub <#234 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AXTCW2C73YKCCOMY6V62ZIDW7H2AJANCNFSM6AAAAAAUUMYANY> . You are receiving this because you were mentioned.Message ID: <bpg/terraform-provider-proxmox/repo-discussions/234/comments/5504182@ github.com>

[bpg]

The feature has been released in 0.17.0