Compute instances are not exposed to the internet

# Terraform: deploy instance without public IP (private network only)

resource "openstack_compute_instance_v2" "private_instance" {
  name            = "private-instance"
  image_id        = var.image_id
  flavor_id       = var.flavor_id
  key_pair        = var.key_pair_name
  security_groups = ["internal-sg"]

  # Attach to private network ONLY (no floating IP)
  network {
    name = "private-network"
  }

  # Do NOT create floating IP association
}

# Bastion host for SSH access (only instance with public IP)
resource "openstack_compute_instance_v2" "bastion" {
  name            = "bastion-host"
  image_id        = var.bastion_image_id
  flavor_id       = "small"
  key_pair        = var.bastion_keypair
  security_groups = ["bastion-sg"]  # Restrict SSH to corporate IPs only

  network {
    name = "dmz-network"
  }
}

resource "openstack_networking_floatingip_v2" "bastion_fip" {
  pool = "public"
}

resource "openstack_compute_floatingip_associate_v2" "bastion_fip_assoc" {
  floating_ip = openstack_networking_floatingip_v2.bastion_fip.address
  instance_id = openstack_compute_instance_v2.bastion.id
}

# Security group for bastion (least privilege)
resource "openstack_networking_secgroup_v2" "bastion_sg" {
  name        = "bastion-sg"
  description = "Allow SSH from corporate IPs only"
}

resource "openstack_networking_secgroup_rule_v2" "bastion_ssh" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = var.corporate_cidr  # e.g., 203.0.113.0/24
  security_group_id = openstack_networking_secgroup_v2.bastion_sg.id
}