{"id":24291730,"url":"https://github.com/mirceanton/mikrotik-terraform","last_synced_at":"2025-03-06T04:20:28.390Z","repository":{"id":271564243,"uuid":"913849077","full_name":"mirceanton/mikrotik-terraform","owner":"mirceanton","description":"`terraform apply` my internet goodbye","archived":false,"fork":false,"pushed_at":"2025-02-28T07:05:10.000Z","size":9420,"stargazers_count":3,"open_issues_count":7,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-02-28T07:06:14.764Z","etag":null,"topics":["mikrotik","mikrotik-api","routeros","routeros-api","terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mirceanton.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/funding.yml","license":"LICENSE.md","code_of_conduct":".github/Code_of_Conduct.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["mircea-pavel-anton"]}},"created_at":"2025-01-08T13:23:09.000Z","updated_at":"2025-02-24T11:05:28.000Z","dependencies_parsed_at":"2025-01-25T03:19:42.256Z","dependency_job_id":"c0bfc65e-834a-4e38-9358-9059062d7e3f","html_url":"https://github.com/mirceanton/mikrotik-terraform","commit_stats":null,"previous_names":["mirceanton/mikrotik-terraform"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mirceanton%2Fmikrotik-terraform","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mirceanton%2Fmikrotik-terraform/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mirceanton%2Fmikrotik-terraform/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mirceanton%2Fmikrotik-terraform/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mirceanton","download_url":"https://codeload.github.com/mirceanton/mikrotik-terraform/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":242145211,"owners_count":20079095,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["mikrotik","mikrotik-api","routeros","routeros-api","terraform"],"created_at":"2025-01-16T14:58:30.384Z","updated_at":"2025-03-06T04:20:28.382Z","avatar_url":"https://github.com/mirceanton.png","language":"HCL","funding_links":["https://github.com/sponsors/mircea-pavel-anton"],"categories":[],"sub_categories":[],"readme":"# Mikrotik - Terraform\n\n![Thumbnail](./docs/img/thumbnail.png)\n\nThis repository contains Terraform automation for my entire Mikrotik-powered home network. The purpose of this repository is to provide a structured and repeatable way to manage and automate the setup of my MikroTik devices using Infrastructure as Code (IaC) principles.\n\n## Why Terraform for Network Infrastructure?\n\nFundamentally speaking, there is nothing that sets this approach apart from, say, a configuration script or just backing up and importing the configuration on the device. Yet, I still decided to use Terraform for this. Why?\n\n1. **I'm weird like that**: As someone who works in DevOps as my main gig, manual configurations (or ClickOps, as we also call it 😉), makes me cringe and I avoid it like the plague. I like defining configuration as code whenever possible since it makes it easy to reproduce and tweak this system.\n\n2. **Skill ~~Issue~~Development**: Working on this project provides a practical, hands-on opportunity to explore advanced Terraform features and patterns. Not to mention that breaking something takes my entire internet away until I fix it, and fixing it without internet may be tricker than you think. This forces me to think more carefully about the configuration before applying.\n\n3. **Because I can**: Not everything in life has to have a good reason. Sometimes reinventing the wheel just to learn or doing things for the heck of it are valid reasons.\n\n## Network Overview\n\n![Network Diagram](./docs/img/network-diagram.drawio.png)\n\nThis project provides automated deployment and management for the following devices in my infrastructure:\n\n- **RB5009 router** -\u003e main router + firewall + CAPSMAN server\n- **cAP AX Access Point** -\u003e provisioned via CAPSMAN\n- **CRS326 switch** -\u003e Main Rack Switch\n- **Hex switch** -\u003e Living Room Switch (no AP functionality used here)\n\nI was initially planning to also add some more details about my network, like VLAN setup and wireless networks and whatnot, but then I realised I can't really be bothered to also update those whenever I change something, so if you're curious, feel free to look at the code!\n\n## Project Structure\n\n```bash\n├── .github/   # GitHub workflow configurations and automation\n├── modules\n│   ├── base        # Base configuration for all devices\n│   └── dhcp-server # DHCP server configuration\n├── .sops.yaml      # SOPS configuration\n├── credentials.auto.tfvars.sops # SOPS encrypted tfvars file\n├── mise.toml       # tool configuration + dev tasks\n├── main.tf         # Provider configuration + Local variables\n├── router-*.tf               # RB5009 router configurations\n├── switch-*.tf               # Switch device configuration\n├── terraform.tfstate.sops    # SOPS-encrypted TF state file\n└── variables.tf              # Terraform input variables\n```\n\n## Getting Started\n\n### Requirements\n\n- [Terraform](https://www.terraform.io/) (duh!)\n- [mise](https://mise.jdx.dev/) for managing dependencies and running tasks\n- [SOPS](https://github.com/getsops/sops) for secrets management\n- [age](https://github.com/FiloSottile/age) for encryption\n\n### Initial Device Setup\n\nBefore applying Terraform configurations, new Mikrotik devices need minimal setup to enable Terraform management. I will not go into details here, but I did write a [blog post](https://mirceanton.com/posts/mikrotik-terraform-getting-started/) about it in which you can learn more.\n\n### Secrets Management\n\nThis project uses SOPS with age for encryption of sensitive data:\n\n1. **Setup environment**:\n\n   ```bash\n   mise install\n   ```\n\n2. **Decrypt secrets** (requires access to the age key):\n\n   ```bash\n   mise run decrypt\n   ```\n\n3. **After making changes, encrypt secrets**:\n\n   ```bash\n   mise run encrypt\n   ```\n\n### Applying Terraform Configuration\n\n1. **Initialize Terraform**: `terraform init`\n2. **Decrypt secrets**: `mise run decrypt`\n3. **Plan** (and review) **changes**: `mise run plan`\n4. **Apply changes**: `terraform apply`\n5. **Re-encrypt secrets** (state file, mainly): `mise run encrypt`\n\n## Limitations\n\nWhile this project aims to provide comprehensive automation for Mikrotik devices, there are some limitations:\n\n- Initial setup still requires manual configuration before Terraform can be applied\n- Complex configurations sometimes require a multi-step approach rather than a single `apply`\n- The risk of cutting yourself off of the internet may be low... but it's never zero. Ask me how I know! 😉\n- Prepare to get close and intimate with `terraform state mv` if you plan to rename or move objects around. Very few things are stateless, so they can't be deleted and recreated generally.\n\n## Sharing \u0026 Risks\n\nBy publishing this repository, I accept the risk of exposing aspects of my home network topology. Storing the state and tfvars in git, albeit encrypted, doesn't help much in this regard either! 😅  \nWhile I've taken **some** steps to ensure sensitive information is managed securely, sharing this code inherently comes with certain risks.\n\nAll that being said, I ultimately decided to open-source this code and publish it for 2 main reasons:\n\n1. I believe that sharing knowledge is valuable to the community. As I have learned from others, so shall others be able to learn from me. Such is the cycle.\n2. I truly believe this was an interesting project. I hope that seeing this will inspire others to attempt similar projects and in turn also share their experiences.\n\n## License\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmirceanton%2Fmikrotik-terraform","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmirceanton%2Fmikrotik-terraform","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmirceanton%2Fmikrotik-terraform/lists"}