ec2 instance with openvpn

resource "aws_instance" "openvpn" {

  subnet_id = aws_subnet.main_vpc_public_subnet_1.id

  ami           = data.aws_ami.al2023.id
  instance_type = local.openvpn.instance.type
  key_name      = local.aws_account.keypair_name
  security_groups = [aws_security_group.openvpn.id]

  user_data = <<-EOF
    #!/bin/bash

    sudo su -

    yum update -y && yum install -y openvpn

    # Setup Easy-RSA for OpenVPN
    mkdir -p /etc/openvpn/easy-rsa
    curl -L -o /etc/openvpn/easy-rsa.tar.gz https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.5/EasyRSA-3.1.5.tgz
    tar -xzvf /etc/openvpn/easy-rsa.tar.gz -C /etc/openvpn/easy-rsa --strip-components=1

    ln -nfs /etc/openvpn/easy-rsa/easyrsa /usr/local/bin/easyrsa

    # Initialize PKI
    cd /etc/openvpn/easy-rsa
    easyrsa init-pki

    # Build CA (Certificate Authority)
    echo -e "\n\n" | easyrsa build-ca nopass

    # Generate Server Certificate and Key
    echo -e "\n\n" | easyrsa gen-req server nopass
    easyrsa sign-req server server <<< "yes"

    # Generate Diffie-Hellman Parameters
    easyrsa gen-dh

    # Copy generated files to OpenVPN directory
    cp pki/ca.crt /etc/openvpn/ && cp pki/issued/server.crt /etc/openvpn/ && cp pki/private/server.key /etc/openvpn/ && cp pki/dh.pem /etc/openvpn/
    mkdir -p /etc/openvpn/client-configs && chmod 777 /etc/openvpn/client-configs

    # Configure OpenVPN
    cat <<EOT > /etc/openvpn/server/server.conf
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem
server 10.8.0.0 255.255.255.0
push "route 3.14.17.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
persist-key
persist-tun
#use telnet localhost 7505 to check logs & run "status"
management 127.0.0.1 7505
verb 3
EOT

    # Enable and start OpenVPN service
    sysctl -w net.ipv4.ip_forward=1 && sysctl -p
    systemctl enable openvpn-server@server && systemctl start openvpn-server@server

    #Add a NAT rule to enable routing between the VPN and private subnet.
    iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
    iptables-save > /etc/iptables.rules

  EOF

  tags = {
    Name = local.openvpn.instance.name
  }
}

output "openvpn_endpoint" {
  value = aws_instance.openvpn.public_ip
}

resource "aws_route53_record" "openvpn" {
  zone_id = data.aws_route53_zone.main.zone_id
  name    = format("%s.%s", local.openvpn.endpoint, local.aws_account.platform_main_domain)
  type    = "CNAME"
  ttl     = 300
  records = [aws_instance.openvpn.public_dns]
}