Claude
|
369f459203
|
Add AWS Client VPN support for secure private access to code-server
This commit adds comprehensive VPN infrastructure to enable secure,
certificate-based access to code-server deployments. VPN provides an
additional security layer by requiring network-level authentication
before accessing internal resources.
Features:
- AWS Client VPN endpoint with certificate-based authentication
- Split tunnel support (route only VPC traffic through VPN)
- CloudWatch logging for all VPN connections
- Multi-platform client support (Windows, macOS, Linux, iOS, Android)
- Automatic certificate generation and ACM upload
- Client configuration export scripts
- Integration with both EC2 and EKS deployments
New Terraform Module:
- modules/vpn: Complete AWS Client VPN infrastructure
- VPN endpoint with configurable authentication
- Network associations for HA across multiple AZs
- Authorization rules for VPC access
- Security groups for VPN traffic
- CloudWatch log groups and streams
- Support for SAML/federated authentication
Scripts:
- scripts/generate-vpn-certificates.sh: Generate and upload VPN certificates
- Creates CA, server, and client certificates
- Automatically uploads to AWS Certificate Manager
- Outputs certificate ARNs for Terraform configuration
- scripts/export-vpn-config.sh: Export client VPN configuration
- Downloads VPN config from AWS
- Embeds client certificates
- Creates platform-ready .ovpn files
Deployment Updates:
- EC2 and EKS deployments now support optional VPN
- New variables for VPN configuration
- Updated outputs to include VPN endpoint information
- Example configurations with VPN settings
Documentation:
- VPN-SETUP-GUIDE.md: Comprehensive VPN setup guide
- Certificate generation process
- Terraform configuration
- Client setup for all major platforms
- Testing and troubleshooting
- Advanced configuration options
- Cost considerations and optimization
Configuration Options:
- Certificate-based or SAML/SSO authentication
- Split tunnel (recommended) or full tunnel
- UDP (faster) or TCP (more reliable) transport
- Configurable session timeout (8-24 hours)
- Custom DNS servers
- Client login banner
- Multiple authorization rules
Security Features:
- X.509 certificate authentication
- Private subnet associations
- Network-level access control
- Session logging and audit trail
- Support for multi-factor (VPN cert + OAuth2/SAML)
Cost: ~$216/month base + ~$0.40/user/day for active connections
|
2025-11-15 17:40:23 +00:00 |
|