### locals.tf
locals {
  project      = "sunrise" # Project A
  peer_project = "sunset"  # Project B
  region       = "asia-east1"
  name         = "cloud-vpn-playground"
  subnet_ip    = "10.0.0.0/24"

  gateway_count = ["0", "1"]
  tunnel_ip_ranges = {
    "0" = "169.254.1.1/30" # IP range: 169.254.1.0-3
    "1" = "169.254.1.5/30" # IP range: 169.254.1.4-7
  }
  peer_bgp_ips = {
    "0" = "169.254.1.2"
    "1" = "169.254.1.6"
  }
  router_asn      = 65001
  peer_router_asn = 65002
}

### locals.tf
locals {
  project      = "sunset"  # Project B
  peer_project = "sunrise" # Project A
  region       = "asia-east1"
  name         = "cloud-vpn-playground"
  subnet_ip    = "10.0.1.0/24"

  gateway_count = ["0", "1"]
  tunnel_ip_ranges = {
    "0" = "169.254.1.2/30" # IP range: 169.254.1.0-3
    "1" = "169.254.1.6/30" # IP range: 169.254.1.4-7
  }
  peer_bgp_ips = {
    "0" = "169.254.1.1"
    "1" = "169.254.1.5"
  }
  router_asn      = 65002
  peer_router_asn = 65001
}

### vpc.tf
module "vpc" {
  source  = "terraform-google-modules/network/google"
  version = "11.0.0"

  project_id   = local.project
  network_name = "${local.name}-vpc"
  routing_mode = "GLOBAL"

  subnets = [
    {
      subnet_name           = "${local.name}-${local.region}-01"
      subnet_ip             = local.subnet_ip
      subnet_region         = local.region
      description           = "VPC subnet for Project A"
      subnet_private_access = "true"
      subnet_flow_logs      = "true"
    },
  ]

  firewall_rules = [
    {
      name        = "${module.vpc.network_name}-allow-internal"
      description = "Allow internal traffic"
      direction   = "INGRESS"
      allow = [
        {
          protocol = "icmp"
        },
        {
          protocol = "tcp"
          ports    = ["1-65535"]
        },
        {
          protocol = "udp"
          ports    = ["1-65535"]
        }
      ]
      ranges = module.vpc.subnets_ips
    },
    {
      name        = "${module.vpc.network_name}-allow-iap-ssh"
      description = "Allow IAP SSH traffic"
      direction   = "INGRESS"
      allow = [
        {
          protocol = "tcp"
          ports    = ["22", "3389"]
        },
        {
          protocol = "icmp"
        }
      ]
      ranges = ["35.235.240.0/20"] # https://cloud.google.com/iap/docs/using-tcp-forwarding#create-firewall-rule
    }
  ]
}

### vpn_gateway.tf
resource "google_compute_ha_vpn_gateway" "vpn_gateway" {
  name        = "${local.project}-to-${local.peer_project}-vpn-gateway"
  project     = local.project
  description = "HA VPC VPN Gateway for ${local.project} to ${local.peer_project}"
  network     = "${local.name}-vpc"
  region      = local.region
}

resource "google_compute_router" "router" {
  name        = "${local.project}-to-${local.peer_project}-router"
  project     = local.project
  description = "HA VPC VPN Router for ${local.project} to ${local.peer_project}"
  region      = local.region
  network     = "${local.name}-vpc"

  bgp {
    asn = local.router_asn
  }
}

### secret_manager.tf
resource "google_secret_manager_secret" "vpn_shared_secret" {
  secret_id = "${local.project}-to-${local.peer_project}-vpn-ike-shared_secret"
  replication {
    auto {}
  }

  labels = {
    resource-name = "${local.project}-to-${local.peer_project}-vpn-ike-shared_secret"
  }
}

data "google_secret_manager_secret_version" "vpn_shared_secret_version" {
  secret  = google_secret_manager_secret.vpn_shared_secret.id
  version = "latest"
}

data "google_secret_manager_secret_version_access" "vpn_shared_secret_access" {
  secret  = data.google_secret_manager_secret_version.vpn_shared_secret_version.secret
  version = data.google_secret_manager_secret_version.vpn_shared_secret_version.version
}

### vpn_gateway.tf
resource "google_compute_vpn_tunnel" "vpn_tunnel" {
  for_each = toset(local.gateway_count)

  name        = "${local.project}-to-${local.peer_project}-vpn-tunnel-${format("%02d", tonumber(each.key))}"
  project     = local.project
  description = "HA VPC VPN Tunnel for ${local.project} to ${local.peer_project}"
  region      = local.region

  vpn_gateway           = google_compute_ha_vpn_gateway.vpn_gateway.id
  vpn_gateway_interface = tonumber(each.key)
  peer_gcp_gateway      = "${local.project}-to-${local.peer_project}-vpn-gateway"
  shared_secret         = data.google_secret_manager_secret_version_access.vpn_shared_secret_access.secret_data ## プロジェクトA-B で共通の値を設定する（Secret Manager から取得）
  ike_version           = 2
  router                = google_compute_router.router.name

  labels = {
    resource-name = "${local.project}-to-${local.peer_project}-vpn-tunnel-${format("%02d", tonumber(each.key))}",
  }

  depends_on = [
    google_compute_ha_vpn_gateway.vpn_gateway,
    google_compute_router.router,
    google_secret_manager_secret.vpn_shared_secret
  ]
}

### vpn_gateway.tf
resource "google_compute_router_interface" "router_interface" {
  for_each = google_compute_vpn_tunnel.vpn_tunnel

  name       = "${local.project}-router-interface-${format("%02d", tonumber(each.key))}"
  project    = local.project
  router     = google_compute_router.router.name
  region     = local.region
  ip_range   = local.tunnel_ip_ranges[each.key]
  vpn_tunnel = each.value.name

  depends_on = [
    google_compute_vpn_tunnel.vpn_tunnel,
    google_compute_router.router
  ]
}

resource "google_compute_router_peer" "bgp_peer" {
  for_each = google_compute_router_interface.router_interface

  name                      = "${local.project}-to-${local.peer_project}-bgp-session-${format("%02d", tonumber(each.key))}"
  project                   = local.project
  router                    = google_compute_router.router.name
  region                    = local.region
  peer_asn                  = local.peer_router_asn
  interface                 = each.value.name
  peer_ip_address           = local.peer_bgp_ips[each.key]
  advertised_route_priority = 100

  depends_on = [
    google_compute_router_interface.router_interface,
    google_compute_router.router
  ]
}

$ gcloud compute vpn-tunnels describe surise-to-sunset-vpn-tunnel-00 \
  --region=asia-east1 \
  --project=surise

$ gcloud compute vpn-tunnels describe surise-to-sunset-vpn-tunnel-01 \
  --region=asia-east1 \
  --project=surise

$ gcloud compute vpn-tunnels describe sunset-to-surise-vpn-tunnel-00 \
  --region=asia-east1 \
  --project=sunset

$ gcloud compute vpn-tunnels describe sunset-to-surise-vpn-tunnel-01 \
  --region=asia-east1 \
  --project=sunset

$ gcloud compute routers describe surise-to-sunset-router \
  --region=asia-east1 \
  --project=surise

$ gcloud compute routers describe sunset-to-surise-router \
  --region=asia-east1 \
  --project=sunset

$ gcloud compute routers get-status surise-to-sunset-router \
  --region=asia-east1 \
  --project=surise

$ gcloud compute routers get-status sunset-to-surise-router \
  --region=asia-east1 \
  --project=sunset

### compute_engine.tf
resource "google_service_account" "default" {
  account_id   = "${local.name}-gce"
  display_name = "${local.name}-gce"
  description  = "GCE Service Account for ${local.name}"
}

resource "google_compute_instance" "default" {
  name         = "${local.name}-instance-01"
  description  = "Cloud VPN Playground Instance 01"
  machine_type = "e2-micro"
  zone         = "asia-east1-a"
  tags = [
    "${local.name}-instance-01",
    "allow-icmp", ## ICMP を許可するためのタグ
  ]
  can_ip_forward = false

  boot_disk {
    auto_delete = true

    initialize_params {
      image = "debian-cloud/debian-12"
      size  = 10
      type  = "pd-balanced"
    }
  }

  network_interface {
    network    = "${local.name}-vpc"
    subnetwork = "${local.name}-${local.region}-01"
    network_ip = local.instance_ip

    access_config {
      nat_ip                 = ""
      public_ptr_domain_name = ""
      network_tier           = "PREMIUM"
    }
  }

  service_account {
    email = google_service_account.default.email
    scopes = [
      "https://www.googleapis.com/auth/devstorage.read_only",
      "https://www.googleapis.com/auth/logging.write",
      "https://www.googleapis.com/auth/monitoring.write",
      "https://www.googleapis.com/auth/service.management.readonly",
      "https://www.googleapis.com/auth/servicecontrol",
      "https://www.googleapis.com/auth/trace.append"
    ]
  }

  labels = {
    resource-name = "${local.name}-instance-01"
  })

  depends_on = [
    google_service_account.default
  ]
}

$ gcloud compute instances describe cloud-vpn-playground-instance-01 \
  --zone=asia-east1-a \
  --project=sunrise

$ gcloud compute instances describe cloud-vpn-playground-instance-01 \
  --zone=asia-east1-a \
  --project=sunset

### firewall.tf
resource "google_compute_firewall" "allow_icmp_from_vpn_peer" {
  name    = "${local.name}-vpc-allow-internal-tagbased-icmp"
  network = "${local.name}-vpc"

  direction = "INGRESS"
  priority  = 1000

  allow {
    protocol = "icmp"
  }

  # NOTE: Project A は 10.0.1.0/24（Project B）からの通信を許可
  # NOTE: Project B は 10.0.0.0/24（Project A）からの通信を許可
  source_ranges = ["10.0.1.0/24"]
  target_tags   = ["allow-icmp"]

  description = "Allow ICMP (ping) from peer VPC over VPN"
}

$ gcloud compute firewall-rules describe cloud-vpn-playground-vpc-allow-internal-tagbased-icmp \
  --project=sunrise

$ gcloud compute firewall-rules describe cloud-vpn-playground-vpc-allow-internal-tagbased-icmp \
  --project=sunset

$ ping -c 5 10.0.1.100
PING 10.0.1.100 (10.0.1.100) 56(84) bytes of data.
64 bytes from 10.0.1.100: icmp_seq=1 ttl=62 time=2.64 ms
64 bytes from 10.0.1.100: icmp_seq=2 ttl=62 time=0.927 ms
64 bytes from 10.0.1.100: icmp_seq=3 ttl=62 time=0.988 ms
64 bytes from 10.0.1.100: icmp_seq=4 ttl=62 time=0.906 ms
64 bytes from 10.0.1.100: icmp_seq=5 ttl=62 time=0.901 ms

--- 10.0.1.100 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4004ms
rtt min/avg/max/mdev = 0.901/1.272/2.638/0.683 ms

$ sudo tcpdump -n icmp and src host 10.0.0.100
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on ens4, link-type EN10MB (Ethernet), snapshot length 262144 bytes
08:33:38.787757 IP 10.0.0.100 > 10.0.1.100: ICMP echo request, id 1249, seq 1, length 64
08:33:39.788648 IP 10.0.0.100 > 10.0.1.100: ICMP echo request, id 1249, seq 2, length 64
08:33:40.789807 IP 10.0.0.100 > 10.0.1.100: ICMP echo request, id 1249, seq 3, length 64
08:33:41.790852 IP 10.0.0.100 > 10.0.1.100: ICMP echo request, id 1249, seq 4, length 64
08:33:42.791438 IP 10.0.0.100 > 10.0.1.100: ICMP echo request, id 1249, seq 5, length 64

$ ping -c 5 10.0.0.100
PING 10.0.0.100 (10.0.0.100) 56(84) bytes of data.
64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=2.96 ms
64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=0.915 ms
64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=0.920 ms
64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=0.957 ms
64 bytes from 10.0.0.100: icmp_seq=5 ttl=62 time=0.913 ms

--- 10.0.0.100 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4046ms
rtt min/avg/max/mdev = 0.913/1.332/2.957/0.812 ms

$ sudo tcpdump -n icmp and src host 10.0.1.100
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on ens4, link-type EN10MB (Ethernet), snapshot length 262144 bytes
08:34:13.498877 IP 10.0.1.100 > 10.0.0.100: ICMP echo request, id 917, seq 1, length 64
08:34:14.499081 IP 10.0.1.100 > 10.0.0.100: ICMP echo request, id 917, seq 2, length 64
08:34:15.518945 IP 10.0.1.100 > 10.0.0.100: ICMP echo request, id 917, seq 3, length 64
08:34:16.543027 IP 10.0.1.100 > 10.0.0.100: ICMP echo request, id 917, seq 4, length 64
08:34:17.544119 IP 10.0.1.100 > 10.0.0.100: ICMP echo request, id 917, seq 5, length 64