mirror of
https://github.com/fleetdm/fleet
synced 2026-05-24 09:28:54 +00:00
43 lines
2.2 KiB
Markdown
43 lines
2.2 KiB
Markdown
# Fleet Terraform Module Example
|
|
This code provides some example usage of the Fleet Terraform module, including how some addons can be used to extend functionality. Prior to applying, edit the locals in `main.tf` to match the settings you want for your Fleet instance including:
|
|
|
|
- domain name
|
|
- route53 zone name (may match the domain name)
|
|
- license key (if premium)
|
|
- uncommenting the mdm module if mdm is desired
|
|
- any extra settings to be passed to Fleet via ENV var.
|
|
|
|
Due to Terraform issues, this code requires 3 applies "from scratch":
|
|
1. `terraform apply -target module.fleet.module.vpc`
|
|
2. `terraform apply -target module.osquery-carve -target module.firehose-logging`
|
|
3. If using a new route53 zone:
|
|
- `terraform apply -target aws_route53_zone.main`
|
|
- From the output, obtain the NS records created for the zone and add them to the parent DNS zone
|
|
4. If enabling mdm: `terraform apply -target module.mdm`. It will need to be uncommented as well as the KMS section below it.
|
|
5. `terraform apply -target module.fleet`
|
|
6. `terraform apply`
|
|
7. If enabling mdm do the following:
|
|
- Record the KMS key from step 5 output.
|
|
- Use `fleetctl` to obtain all of the mdm certs. Use https://fleetdm.com/docs/using-fleet/mdm-setup#apple-push-notification-service-apns and https://fleetdm.com/docs/using-fleet/mdm-setup#apple-business-manager-abm for reference.
|
|
- Place the certificates in the `resources` folder with the following names based upon their function:
|
|
```
|
|
scep.crt
|
|
scep.key
|
|
apns.crt
|
|
apns.key
|
|
abm.crt
|
|
abm.key
|
|
abm_token.p7m
|
|
```
|
|
- Using the `encrypt.sh` script, KMS encrypt all of these secrets as follows:
|
|
```
|
|
cd resources
|
|
for i in *; do ../scripts/encrypt.sh <kms-key-id-from-terraform-output> $i $i.encrypted; done
|
|
for i in *.encrypted; do rm ${i/.encrypted/}; done
|
|
```
|
|
This will encrypt all of the mdm secrets and add the .encrypted extension to them. It will also remove the non-encrypted version of the secrets so that they are encrypted at rest even locally.
|
|
|
|
- Uncomment all of the resources and data sources in `mdm-secrets.tf`.
|
|
- Re-run `terraform apply` to populate the Secrets Manager secrets.
|
|
- Uncomment the sections in the `fleet_config` portion of `main.tf` for mdm and run a final `terraform apply`. Services will restart with mdm enabled.
|
|
|