Add firewall rule.

Tag our rsync nodes and add a firewall rule to allow tcp/873.

Signed-off-by: Alec Warner <antarus@gentoo.org>

1 files changed, 10 insertions, 1 deletions

diff --git a/src/infra.gentoo.org/rsync.tf b/src/infra.gentoo.org/rsync.tf
index 85eaec9..2e278ac 100644
--- a/src/infra.gentoo.org/rsync.tf
+++ b/src/infra.gentoo.org/rsync.tf
@@ -2,7 +2,7 @@ resource "google_compute_instance_template" "rsync-node-template" {
   name        = "rsync-node-template"
   description = "This template is used to create rsync node instances."
 
-  tags = []
+  tags = ["rsync"]
 
   labels = {
 		container-vm = "cos-stable-71-11151-60-0"
@@ -70,3 +70,12 @@ resource "google_compute_region_autoscaler" "rsync-autoscaler" {
 		}
 	}
 }
+
+resource "google_compute_firewall" "rsync-in" {
+	name = "rsync-in"
+	allow {
+		protocol = "tcp"
+		ports = ["873"]
+	}
+	target_tags = ["rsync"]
+}