<commit_before># Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

locals {
  all_hosts = toset(concat(var.server_hosts, var.apiserver_hosts, var.adminapi_hosts))
  enable_lb = length(local.all_hosts) > 0
}

resource "google_compute_ssl_policy" "one-two-ssl-policy" {
  name            = "one-two-ssl-policy"
  profile         = "MODERN"
  min_tls_version = "TLS_1_2"

  depends_on = [
    google_project_service.services["compute.googleapis.com"],
  ]
}

resource "google_compute_global_address" "verification-server" {
  count = local.enable_lb ? 1 : 0

  name    = "verification-server-address"
  project = var.project

  depends_on = [
    google_project_service.services["compute.googleapis.com"],
  ]
}

# Redirects all requests to https
resource "google_compute_url_map" "urlmap-http" {
  count = local.enable_lb ? 1 : 0

  name     = "https-redirect"
  provider = google-beta
  project  = var.project

  default_url_redirect {
    strip_query    = false
    https_redirect = true
  }

  depends_on = [
    google_project_service.services["compute.googleapis.com"],
  ]
}

resource "google_compute_url_map" "urlmap-https" {
  count = local.enable_lb ? 1 : 0

  name            = "verification-server"
  provider        = google-beta
  project         = var.project
  default_service = google_compute_backend_service.server[0].id

  // server
  dynamic "host_rule" {
    for_each = length(var.server_hosts) > 0 ? [1] : []

    content {
      path_matcher = "server"
      hosts        = var.server_hosts
    }
  }

  dynamic "path_matcher" {
    for_each = length(var.server_hosts) > 0 ? [1] : []

    content {
      name            = "server"
      default_service = google_compute_backend_service.server[0].id
    }
  }

  // apiserver
  dynamic "host_rule" {
    for_each = length(var.apiserver_hosts) > 0 ? [1] : []

    content {
      path_matcher = "apiserver"
      hosts        = var.apiserver_hosts
    }
  }

  dynamic "path_matcher" {
    for_each = length(var.apiserver_hosts) > 0 ? [1] : []

    content {
      name            = "apiserver"
      default_service = google_compute_backend_service.apiserver[0].id
    }
  }

  // adminapi
  dynamic "host_rule" {
    for_each = length(var.adminapi_hosts) > 0 ? [1] : []

    content {
      path_matcher = "adminapi"
      hosts        = var.adminapi_hosts
    }
  }

  dynamic "path_matcher" {
    for_each = length(var.adminapi_hosts) > 0 ? [1] : []

    content {
      name            = "adminapi"
      default_service = google_compute_backend_service.adminapi[0].id
    }
  }

  depends_on = [
    google_project_service.services["compute.googleapis.com"],
  ]
}

resource "google_compute_target_http_proxy" "http" {
  count = local.enable_lb ? 1 : 0

  provider = google-beta
  name     = "verification-server"
  project  = var.project

  url_map = google_compute_url_map.urlmap-http[0].id
}

resource "google_compute_target_https_proxy" "https" {
  count = local.enable_lb ? 1 : 0

  name    = "verification-server"
  project = var.project

  url_map          = google_compute_url_map.urlmap-https[0].id
  ssl_certificates = [google_compute_managed_ssl_certificate.default[0].id]
  ssl_policy       = google_compute_ssl_policy.one-two-ssl-policy.id
}

resource "google_compute_global_forwarding_rule" "http" {
  count = local.enable_lb ? 1 : 0

  provider = google-beta
  name     = "verification-server-http"
  project  = var.project

  ip_protocol           = "TCP"
  ip_address            = google_compute_global_address.verification-server[0].address
  load_balancing_scheme = "EXTERNAL"
  port_range            = "80"
  target                = google_compute_target_http_proxy.http[0].id
}

resource "google_compute_global_forwarding_rule" "https" {
  count = local.enable_lb ? 1 : 0

  provider = google-beta
  name     = "verification-server-https"
  project  = var.project

  ip_protocol           = "TCP"
  ip_address            = google_compute_global_address.verification-server[0].address
  load_balancing_scheme = "EXTERNAL"
  port_range            = "443"
  target                = google_compute_target_https_proxy.https[0].id
}

resource "random_id" "certs" {
  count = local.enable_lb ? 1 : 0

  byte_length = 4

  keepers = {
    domains = join(",", local.all_hosts)
  }
}

resource "google_compute_managed_ssl_certificate" "default" {
  count = local.enable_lb ? 1 : 0

  provider = google-beta
  name     = "verification-certificates-${random_id.certs[0].hex}"
  project  = var.project

  managed {
    domains = local.all_hosts
  }

  # This is to prevent destroying the cert while it's still attached to the load
  # balancer.
  lifecycle {
    create_before_destroy = true
  }

  depends_on = [
    google_project_service.services["compute.googleapis.com"],
  ]
}

output "lb_ip" {
  value = local.enable_lb ? google_compute_global_address.verification-server.*.address : null
}
<commit_msg>only redirect for known host headers (#1982)<commit_after># Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

locals {
  all_hosts = toset(concat(var.server_hosts, var.apiserver_hosts, var.adminapi_hosts))
  enable_lb = length(local.all_hosts) > 0
}

resource "google_compute_ssl_policy" "one-two-ssl-policy" {
  name            = "one-two-ssl-policy"
  profile         = "MODERN"
  min_tls_version = "TLS_1_2"

  depends_on = [
    google_project_service.services["compute.googleapis.com"],
  ]
}

resource "google_compute_global_address" "verification-server" {
  count = local.enable_lb ? 1 : 0

  name    = "verification-server-address"
  project = var.project

  depends_on = [
    google_project_service.services["compute.googleapis.com"],
  ]
}

# Redirects all requests to https
resource "google_compute_url_map" "urlmap-http" {
  count = local.enable_lb ? 1 : 0

  name     = "https-redirect"
  provider = google-beta
  project  = var.project

  // server redirect
  dynamic "host_rule" {
    for_each = length(var.server_hosts) > 0 ? [1] : []

    content {
      path_matcher = "server"
      hosts        = var.server_hosts
    }
  }

  dynamic "path_matcher" {
    for_each = length(var.server_hosts) > 0 ? [1] : []

    content {
      name = "server"
      default_url_redirect {
        host_redirect  = var.server_hosts[0]
        https_redirect = true
        strip_query    = false
      }
    }
  }

  // apiserver redirect
  dynamic "host_rule" {
    for_each = length(var.apiserver_hosts) > 0 ? [1] : []

    content {
      path_matcher = "apiserver"
      hosts        = var.apiserver_hosts
    }
  }

  dynamic "path_matcher" {
    for_each = length(var.apiserver_hosts) > 0 ? [1] : []

    content {
      name = "apiserver"
      default_url_redirect {
        host_redirect  = var.apiserver_hosts[0]
        https_redirect = true
        strip_query    = false
      }
    }
  }

  // adminapi redirect
  dynamic "host_rule" {
    for_each = length(var.adminapi_hosts) > 0 ? [1] : []

    content {
      path_matcher = "adminapi"
      hosts        = var.adminapi_hosts
    }
  }

  dynamic "path_matcher" {
    for_each = length(var.adminapi_hosts) > 0 ? [1] : []

    content {
      name = "adminapi"
      default_url_redirect {
        host_redirect  = var.adminapi_hosts[0]
        https_redirect = true
        strip_query    = false
      }
    }
  }

  // any other hosts, just get redirected to the UI server
  default_url_redirect {
    host_redirect  = var.server_hosts[0]
    https_redirect = true
    path_redirect  = "/"
    strip_query    = true
  }

  depends_on = [
    google_project_service.services["compute.googleapis.com"],
  ]
}

resource "google_compute_url_map" "urlmap-https" {
  count = local.enable_lb ? 1 : 0

  name            = "verification-server"
  provider        = google-beta
  project         = var.project
  default_service = google_compute_backend_service.server[0].id

  // server
  dynamic "host_rule" {
    for_each = length(var.server_hosts) > 0 ? [1] : []

    content {
      path_matcher = "server"
      hosts        = var.server_hosts
    }
  }

  dynamic "path_matcher" {
    for_each = length(var.server_hosts) > 0 ? [1] : []

    content {
      name            = "server"
      default_service = google_compute_backend_service.server[0].id
    }
  }

  // apiserver
  dynamic "host_rule" {
    for_each = length(var.apiserver_hosts) > 0 ? [1] : []

    content {
      path_matcher = "apiserver"
      hosts        = var.apiserver_hosts
    }
  }

  dynamic "path_matcher" {
    for_each = length(var.apiserver_hosts) > 0 ? [1] : []

    content {
      name            = "apiserver"
      default_service = google_compute_backend_service.apiserver[0].id
    }
  }

  // adminapi
  dynamic "host_rule" {
    for_each = length(var.adminapi_hosts) > 0 ? [1] : []

    content {
      path_matcher = "adminapi"
      hosts        = var.adminapi_hosts
    }
  }

  dynamic "path_matcher" {
    for_each = length(var.adminapi_hosts) > 0 ? [1] : []

    content {
      name            = "adminapi"
      default_service = google_compute_backend_service.adminapi[0].id
    }
  }

  depends_on = [
    google_project_service.services["compute.googleapis.com"],
  ]
}

resource "google_compute_target_http_proxy" "http" {
  count = local.enable_lb ? 1 : 0

  provider = google-beta
  name     = "verification-server"
  project  = var.project

  url_map = google_compute_url_map.urlmap-http[0].id
}

resource "google_compute_target_https_proxy" "https" {
  count = local.enable_lb ? 1 : 0

  name    = "verification-server"
  project = var.project

  url_map          = google_compute_url_map.urlmap-https[0].id
  ssl_certificates = [google_compute_managed_ssl_certificate.default[0].id]
  ssl_policy       = google_compute_ssl_policy.one-two-ssl-policy.id
}

resource "google_compute_global_forwarding_rule" "http" {
  count = local.enable_lb ? 1 : 0

  provider = google-beta
  name     = "verification-server-http"
  project  = var.project

  ip_protocol           = "TCP"
  ip_address            = google_compute_global_address.verification-server[0].address
  load_balancing_scheme = "EXTERNAL"
  port_range            = "80"
  target                = google_compute_target_http_proxy.http[0].id
}

resource "google_compute_global_forwarding_rule" "https" {
  count = local.enable_lb ? 1 : 0

  provider = google-beta
  name     = "verification-server-https"
  project  = var.project

  ip_protocol           = "TCP"
  ip_address            = google_compute_global_address.verification-server[0].address
  load_balancing_scheme = "EXTERNAL"
  port_range            = "443"
  target                = google_compute_target_https_proxy.https[0].id
}

resource "random_id" "certs" {
  count = local.enable_lb ? 1 : 0

  byte_length = 4

  keepers = {
    domains = join(",", local.all_hosts)
  }
}

resource "google_compute_managed_ssl_certificate" "default" {
  count = local.enable_lb ? 1 : 0

  provider = google-beta
  name     = "verification-certificates-${random_id.certs[0].hex}"
  project  = var.project

  managed {
    domains = local.all_hosts
  }

  # This is to prevent destroying the cert while it's still attached to the load
  # balancer.
  lifecycle {
    create_before_destroy = true
  }

  depends_on = [
    google_project_service.services["compute.googleapis.com"],
  ]
}

output "lb_ip" {
  value = local.enable_lb ? google_compute_global_address.verification-server.*.address : null
}

{'fraction_non_alphanumeric': 0.10301810865191147, 'fraction_numerical': 0.011106639839034205, 'mean_word_length': 2.8316373728029602, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 23, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3075413', 'n_tokens_mistral': 4256, 'n_tokens_neox': 4045, 'n_words': 824}