Deploy Tunnels with Ansible and Terraform

Ansible is a software tool that enables at scale management of infrastructure. Ansible is agentless — all it needs to function is the ability to SSH to the target and Python installed on the target.

Ansible works alongside Terraform to streamline the Cloudflare Tunnel setup process. In this guide, you will use Terraform to deploy an SSH server on Google Cloud and create a locally-managed tunnel that makes the server available over the Internet. Terraform will automatically run an Ansible playbook that installs and configures cloudflared on the server.

​​ Prerequisites

To complete the steps in this guide, you will need:

• A Google Cloud Project Open external link and GCP CLI installed and authenticated Open external link .
• Basic knowledge of Terraform and Terraform installed Open external link .
• A zone on Cloudflare.
• A Cloudflare API token with Cloudflare Tunnel and DNS permissions.

​​ 1. Install Ansible

Refer to the Ansible installation instructions Open external link .

​​ 2. (Optional) Create an SSH key pair

Terraform and Ansible require an unencrypted SSH key to connect to the GCP server. If you do not already have a key, you can generate one as follows:

1. Open a terminal and type the following command:

2. When prompted for a passphrase, press Enter twice to leave it blank. Terraform cannot decode encrypted private keys.

Two files will be generated: gcp_ssh which contains the private key, and gcp_ssh.pub which contains the public key.

​​ 3. Create a configuration directory

1. Create a folder for your Terraform and Ansible configuration files:

2. Change to the new directory:

​​ 4. Create Terraform configuration files

​​ Define input variables

The following variables will be passed into your GCP and Cloudflare configuration.

1. In your configuration directory, create a .tf file:

2. Open the file in a text editor and copy and paste the following:

​​ Assign values to the variables

1. In your configuration directory, create a .tfvars file:

   Terraform will automatically use these variables if the file is named terraform.tfvars, otherwise the variable file will need to be manually passed in.

2. Add the following variables to terraform.tfvars. Be sure to modify the example with your own values.

​​ Configure Terraform providers

You will need to declare the providers Open external link used to provision the infrastructure.

1. In your configuration directory, create a .tf file:

2. Add the following providers to providers.tf. The random provider is used to generate a tunnel secret.

​​ Configure Cloudflare resources

The following configuration will modify settings in your Cloudflare account.

1. In your configuration directory, create a .tf file:

2. Add the following resources to Cloudflare-config.tf:

​​ Configure GCP resources

The following configuration defines the specifications for the GCP virtual machine and installs Python3 on the machine. Python3 allows Ansible to configure the GCP instance instead of having to run a startup script on boot.

1. In your configuration directory, create a .tf file:

2. Open the file in a text editor and copy and paste the following example. Be sure to insert your own GCP username and SSH key pair.

​​ Export variables to Ansible

The following Terraform resource exports the tunnel ID and other variables to tf_ansible_vars_file.yml. Ansible will use this data to configure and run cloudflared on the server.

1. In your configuration directory, create a new tf file:

2. Copy and paste the following content into export.tf:

​​ 5. Create the Ansible playbook

Ansible playbooks are YAML files that declare the configuration Ansible will deploy.

1. Create a new .yml file:

2. Open the file in a text editor and copy and paste the following content:

Keywords Open external link define how Ansible will execute the configuration. In the example above, the vars_files keyword specifies where variable definitions are stored, and the tasks keyword specifies the actions Ansible will perform.

Modules Open external link specify what tasks to complete. In this example, the copy module creates a file and populates it with content.

​​ 6. Deploy the configuration

Once you have created the configuration files, you can deploy them through Terraform. The Ansible deployment happens within the Terraform deployment when the ansible-playbook command is run.

1. Initialize your configuration directory:

2. (Optional) Preview everything that will be created:

3. Deploy the configuration:

It may take several minutes for the GCP instance and tunnel to come online. You can view your new tunnel in Zero Trust Open external link under Networks > Tunnels.

​​ 7. Test the connection

You can now SSH to the GCP server through the new ssh_app.<zone> hostname. For instructions on how to connect, refer to our SSH guide.