networking.tf•5.1 kB
"""
VPC and Network Configuration for SIP Trunk
Creates VPC, subnets, security groups, and Elastic IP
"""
# VPC
resource "aws_vpc" "main" {
cidr_block = var.vpc_cidr
enable_dns_hostnames = true
enable_dns_support = true
tags = merge(local.common_tags, {
Name = "${var.project_name}-vpc"
})
}
# Internet Gateway
resource "aws_internet_gateway" "main" {
vpc_id = aws_vpc.main.id
tags = merge(local.common_tags, {
Name = "${var.project_name}-igw"
})
}
# Public Subnets
resource "aws_subnet" "public" {
count = length(var.public_subnet_cidrs)
vpc_id = aws_vpc.main.id
cidr_block = var.public_subnet_cidrs[count.index]
availability_zone = data.aws_availability_zones.available.names[count.index]
map_public_ip_on_launch = true
tags = merge(local.common_tags, {
Name = "${var.project_name}-public-subnet-${count.index + 1}"
Tier = "Public"
})
}
# Route Table
resource "aws_route_table" "public" {
vpc_id = aws_vpc.main.id
route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.main.id
}
tags = merge(local.common_tags, {
Name = "${var.project_name}-public-rt"
})
}
# Route Table Associations
resource "aws_route_table_association" "public" {
count = length(aws_subnet.public)
subnet_id = aws_subnet.public[count.index].id
route_table_id = aws_route_table.public.id
}
# Elastic IP for SIP Endpoint
resource "aws_eip" "asterisk" {
domain = "vpc"
tags = merge(local.common_tags, {
Name = "${var.project_name}-eip"
Purpose = "SIP-Endpoint"
})
depends_on = [aws_internet_gateway.main]
}
# Secondary Elastic IP for HA (if enabled)
resource "aws_eip" "asterisk_standby" {
count = var.enable_high_availability ? 1 : 0
domain = "vpc"
tags = merge(local.common_tags, {
Name = "${var.project_name}-eip-standby"
Purpose = "SIP-Endpoint-Standby"
})
depends_on = [aws_internet_gateway.main]
}
# Security Group for Asterisk
resource "aws_security_group" "asterisk" {
name_description = "${var.project_name}-asterisk-sg"
description = "Security group for Asterisk SIP trunk server"
vpc_id = aws_vpc.main.id
tags = merge(local.common_tags, {
Name = "${var.project_name}-asterisk-sg"
})
}
# SSH Access (restricted)
resource "aws_security_group_rule" "ssh" {
count = length(var.allowed_ssh_cidrs) > 0 ? 1 : 0
type = "ingress"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = var.allowed_ssh_cidrs
security_group_id = aws_security_group.asterisk.id
description = "SSH access from allowed CIDRs"
}
# SIP TCP Port
resource "aws_security_group_rule" "sip_tcp" {
type = "ingress"
from_port = local.sip_tcp_port
to_port = local.sip_tcp_port
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
security_group_id = aws_security_group.asterisk.id
description = "SIP TCP signaling from ElevenLabs"
}
# SIP UDP Port (optional, for UDP transport)
resource "aws_security_group_rule" "sip_udp" {
type = "ingress"
from_port = local.sip_tcp_port
to_port = local.sip_tcp_port
protocol = "udp"
cidr_blocks = ["0.0.0.0/0"]
security_group_id = aws_security_group.asterisk.id
description = "SIP UDP signaling (optional)"
}
# RTP Media Ports
resource "aws_security_group_rule" "rtp" {
type = "ingress"
from_port = local.rtp_port_start
to_port = local.rtp_port_end
protocol = "udp"
cidr_blocks = ["0.0.0.0/0"]
security_group_id = aws_security_group.asterisk.id
description = "RTP media streams"
}
# TLS SIP Port (if enabled)
resource "aws_security_group_rule" "sip_tls" {
count = var.enable_tls ? 1 : 0
type = "ingress"
from_port = 5061
to_port = 5061
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
security_group_id = aws_security_group.asterisk.id
description = "SIP TLS signaling"
}
# Egress - Allow all outbound traffic
resource "aws_security_group_rule" "egress_all" {
type = "egress"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
security_group_id = aws_security_group.asterisk.id
description = "Allow all outbound traffic"
}
# Route 53 DNS Configuration (optional)
resource "aws_route53_record" "sip_srv" {
count = var.route53_zone_id != "" && var.domain_name != "" ? 1 : 0
zone_id = var.route53_zone_id
name = "_sip._tcp.${var.domain_name}"
type = "SRV"
ttl = 300
records = [
"10 50 ${local.sip_tcp_port} ${var.domain_name}"
]
}
resource "aws_route53_record" "sip_a" {
count = var.route53_zone_id != "" && var.domain_name != "" ? 1 : 0
zone_id = var.route53_zone_id
name = var.domain_name
type = "A"
ttl = 300
records = [aws_eip.asterisk.public_ip]
}