Skip to content

Commit eec2eac

Browse files
author
Adrian Johnson
authored
Merge pull request #2 from adrian207/feat/dynamic-ip-solutions
feat: Implement solutions for dynamic IP management
2 parents b753fde + 4c75b41 commit eec2eac

File tree

4 files changed

+208
-203
lines changed

4 files changed

+208
-203
lines changed

‎EJBCA---Automated-Lab-Docker/docs/DYNAMIC-IP-MANAGEMENT.MD‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# 🌐 Dynamic IP Management Guide
2+
3+
This guide provides two solutions for securely accessing your Azure resources when your local computer has a dynamic (changing) IP address.
4+
5+
---
6+
7+
## 🏆 Solution 1: Azure Bastion (Recommended for All Environments)
8+
9+
Azure Bastion is the most secure and convenient method. It allows you to connect to your VMs from anywhere, without needing to whitelist your IP address.
10+
11+
**How It Works**: Bastion provides a secure connection to your VMs directly from the Azure Portal over an encrypted SSL channel. Your VMs no longer need public IP addresses for SSH or RDP access, drastically reducing their exposure to the internet.
12+
13+
**Cost**: ~$144/month
14+
15+
### How to Use It:
16+
1. **Enable in Terraform**: Set `enable_bastion = true` in your `terraform.tfvars` file. This is the default.
17+
2. **Deploy**: Run `terraform apply`.
18+
3. **Connect**:
19+
* Go to your Virtual Machine in the Azure Portal.
20+
* Click **Connect** > **Bastion**.
21+
* Enter your VM credentials to start a secure session in your browser.
22+
23+
**When Bastion is enabled, the security rules for direct SSH and RDP access are automatically removed, enforcing a secure-by-default architecture.**
24+
25+
---
26+
27+
## 💻 Solution 2: IP Update Script (For Development Only)
28+
29+
If you choose not to use Azure Bastion (e.g., to save costs in a temporary development environment), you can use the `update-my-ip.sh` script.
30+
31+
**How It Works**: This script automatically detects your current public IP and updates the necessary Terraform configuration files to grant you access.
32+
33+
### How to Use It:
34+
1. **Disable Bastion**: Set `enable_bastion = false` in your `terraform.tfvars` file.
35+
2. **Run the Script**: Execute the script from the project root whenever your IP changes.
36+
```bash
37+
./scripts/update-my-ip.sh
38+
```
39+
3. The script will find your new IP, update the files, and run `terraform apply` to update the firewall rules in Azure.
40+
41+
**Security Note**: This method is less secure than Bastion because it requires opening administrative ports to your IP address over the internet. It should only be used for temporary development work.

‎EJBCA---Automated-Lab-Docker/scripts/update-my-ip.sh‎

Lines changed: 46 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
#!/bin/bash
22
###############################################################################
33
# Dynamic IP Address Update Script
4-
# Automatically updates your IP in Terraform configuration and applies changes
4+
# Automatically updates your IP in Terraform variables and applies changes.
5+
# This script should only be used for development if Azure Bastion is disabled.
56
###############################################################################
67

78
set -e
@@ -16,173 +17,85 @@ NC='\033[0m'
1617
print_success() { echo -e "${GREEN}✓ $1${NC}"; }
1718
print_error() { echo -e "${RED}✗ $1${NC}"; }
1819
print_info() { echo -e "${YELLOW}ℹ $1${NC}"; }
19-
print_header() { echo -e "${BLUE}$1${NC}"; }
20+
print_header() { echo -e "\n${BLUE}### $1 ###${NC}"; }
2021

21-
echo ""
22-
print_header "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
23-
print_header " Dynamic IP Address Update for PKI Platform"
24-
print_header "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
25-
echo ""
22+
echo -e "${BLUE}EJBCA PKI Platform - Dynamic IP Updater${NC}"
23+
echo "=========================================="
2624

27-
# Get script directory
28-
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
29-
PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
30-
31-
cd "$PROJECT_ROOT/terraform"
25+
# Check for terraform.tfvars
26+
TFVARS_FILE="terraform/terraform.tfvars"
27+
if [ ! -f "$TFVARS_FILE" ]; then
28+
print_error "$TFVARS_FILE not found."
29+
print_info "Please copy terraform/terraform.tfvars.example to $TFVARS_FILE and configure it first."
30+
exit 1
31+
fi
3232

3333
# Get current public IP
34-
print_info "Detecting your current public IP address..."
35-
CURRENT_IP=$(curl -4 -s --max-time 10 ifconfig.me)
36-
37-
if [ -z "$CURRENT_IP" ]; then
38-
print_error "Failed to detect public IP address"
39-
print_info "Trying alternative service..."
40-
CURRENT_IP=$(curl -4 -s --max-time 10 icanhazip.com)
41-
fi
34+
print_info "Detecting your current public IP..."
35+
CURRENT_IP=$(curl -4 -s --max-time 10 ifconfig.me) || CURRENT_IP=$(curl -4 -s --max-time 10 icanhazip.com)
4236

4337
if [ -z "$CURRENT_IP" ]; then
44-
print_error "Could not detect public IP. Check internet connection."
38+
print_error "Could not detect your public IP. Please check your internet connection."
4539
exit 1
4640
fi
41+
print_success "Detected IP: $CURRENT_IP"
4742

48-
print_success "Current IP: $CURRENT_IP"
49-
50-
# Find old IP in files
51-
print_info "Finding old IP address in configuration..."
52-
OLD_IP=$(grep -oP '\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?=/32|")' keyvault.tf 2>/dev/null | head -1 || \
53-
grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' keyvault.tf | head -1)
43+
# Find old IP in tfvars file
44+
print_info "Reading current admin_ip_address from $TFVARS_FILE..."
45+
OLD_IP=$(grep -E '^\s*admin_ip_address\s*=' "$TFVARS_FILE" | awk -F'"' '{print $2}')
5446

5547
if [ -z "$OLD_IP" ]; then
56-
print_error "Could not find old IP in configuration"
48+
print_error "Could not find 'admin_ip_address' in $TFVARS_FILE."
49+
print_info "Please add 'admin_ip_address = \"$CURRENT_IP\"' to your tfvars file."
5750
exit 1
5851
fi
59-
60-
print_success "Old IP: $OLD_IP"
52+
print_success "Current configured IP: $OLD_IP"
6153

6254
# Check if IP has changed
6355
if [ "$CURRENT_IP" == "$OLD_IP" ]; then
64-
print_success "Your IP hasn't changed. No update needed!"
56+
print_success "Your IP has not changed. No update needed!"
6557
exit 0
6658
fi
6759

68-
echo ""
6960
print_header "IP Address Change Detected!"
70-
echo " Old IP: $OLD_IP"
71-
echo " New IP: $CURRENT_IP"
72-
echo ""
61+
echo -e " ${RED}Old IP: $OLD_IP${NC}"
62+
echo -e " ${GREEN}New IP: $CURRENT_IP${NC}"
7363

7464
# Confirm update
7565
read -p "Update configuration and apply changes? (yes/no): " CONFIRM
7666
if [ "$CONFIRM" != "yes" ]; then
77-
print_error "Update cancelled by user"
67+
print_error "Update cancelled by user."
7868
exit 0
7969
fi
8070

81-
# Backup files
82-
print_info "Creating backup of configuration files..."
83-
mkdir -p ../backups
84-
BACKUP_DIR="../backups/ip-update-$(date +%Y%m%d-%H%M%S)"
85-
mkdir -p "$BACKUP_DIR"
86-
cp networking.tf keyvault.tf storage.tf "$BACKUP_DIR/"
87-
print_success "Backup created: $BACKUP_DIR"
88-
89-
# Update files
90-
print_info "Updating IP address in configuration files..."
91-
92-
# Update networking.tf
93-
sed -i.tmp "s/$OLD_IP/$CURRENT_IP/g" networking.tf && rm networking.tf.tmp
94-
print_success "Updated: networking.tf"
95-
96-
# Update keyvault.tf
97-
sed -i.tmp "s/$OLD_IP/$CURRENT_IP/g" keyvault.tf && rm keyvault.tf.tmp
98-
print_success "Updated: keyvault.tf"
99-
100-
# Update storage.tf
101-
sed -i.tmp "s/$OLD_IP/$CURRENT_IP/g" storage.tf && rm storage.tf.tmp
102-
print_success "Updated: storage.tf"
103-
104-
# Verify changes
105-
echo ""
106-
print_info "Verifying changes..."
107-
if grep -q "$CURRENT_IP" networking.tf && \
108-
grep -q "$CURRENT_IP" keyvault.tf && \
109-
grep -q "$CURRENT_IP" storage.tf; then
110-
print_success "All files updated successfully"
111-
else
112-
print_error "Verification failed. Restoring from backup..."
113-
cp "$BACKUP_DIR"/* .
114-
exit 1
115-
fi
71+
# Update tfvars file
72+
print_info "Updating $TFVARS_FILE..."
73+
sed -i.bak "s/admin_ip_address\s*=\s*\"$OLD_IP\"/admin_ip_address = \"$CURRENT_IP\"/" "$TFVARS_FILE"
74+
rm "${TFVARS_FILE}.bak"
75+
print_success "$TFVARS_FILE updated successfully."
11676

117-
# Format and validate
118-
print_info "Formatting and validating Terraform configuration..."
119-
terraform fmt -recursive > /dev/null 2>&1
120-
if terraform validate > /dev/null 2>&1; then
121-
print_success "Configuration is valid"
122-
else
123-
print_error "Configuration validation failed"
124-
print_info "Restoring from backup..."
125-
cp "$BACKUP_DIR"/* .
126-
exit 1
127-
fi
77+
# Run Terraform
78+
cd terraform
12879

129-
# Create plan
130-
echo ""
131-
print_info "Creating Terraform execution plan..."
132-
terraform plan -out=ip-update.tfplan
80+
print_header "Running Terraform"
13381

134-
if [ $? -ne 0 ]; then
135-
print_error "Terraform plan failed"
136-
exit 1
137-
fi
82+
print_info "Initializing Terraform..."
83+
terraform init -upgrade > /dev/null
13884

139-
echo ""
140-
print_header "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
141-
print_header " Review the plan above"
142-
print_header "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
143-
echo ""
144-
145-
# Apply changes
146-
read -p "Apply these changes? (yes/no): " APPLY_CONFIRM
147-
if [ "$APPLY_CONFIRM" != "yes" ]; then
148-
print_error "Apply cancelled by user"
149-
rm -f ip-update.tfplan
150-
exit 0
151-
fi
85+
print_info "Creating Terraform execution plan..."
86+
terraform plan -out=ip-update.tfplan
15287

15388
print_info "Applying changes..."
154-
terraform apply ip-update.tfplan
155-
156-
if [ $? -eq 0 ]; then
157-
echo ""
158-
print_success "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
159-
print_success " IP Address Updated Successfully!"
160-
print_success "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
161-
echo ""
162-
echo " Old IP: $OLD_IP"
163-
echo " New IP: $CURRENT_IP"
164-
echo ""
165-
echo " Updated resources:"
166-
echo " ✓ Network Security Groups"
167-
echo " ✓ Azure Key Vault network rules"
168-
echo " ✓ Storage Account network rules"
169-
echo ""
170-
print_success "You can now access your resources from the new IP!"
171-
echo ""
172-
173-
# Clean up
174-
rm -f ip-update.tfplan
89+
if terraform apply -auto-approve ip-update.tfplan; then
90+
print_success "Terraform apply completed successfully!"
91+
print_info "Your Azure firewall rules have been updated with your new IP."
17592
else
176-
print_error "Apply failed!"
177-
print_info "Your backup is available at: $BACKUP_DIR"
93+
print_error "Terraform apply failed. Please review the output above."
17894
exit 1
17995
fi
18096

181-
# Optional: Clean up old backups (keep last 10)
182-
print_info "Cleaning up old backups (keeping last 10)..."
183-
cd ../backups
184-
ls -t | tail -n +11 | xargs rm -rf 2>/dev/null || true
185-
cd ../terraform
186-
187-
print_success "Done!"
97+
# Clean up
98+
rm -f ip-update.tfplan
18899

100+
echo "=========================================="
101+
print_success "Dynamic IP update complete!"

0 commit comments

Comments
 (0)