resource "linode_firewall_device" "site-firewall-vms" {
    count = length(var.app_servers)
    firewall_id = linode_firewall.site-firewall.id
    entity_id = "${element(linode_instance.site-vm.*.id, count.index)}"
}

resource "linode_firewall" "site-firewall" {
    label = "site-firewall"
    tags = [
        "${var.site}-firewall"
    ]

    inbound_policy = "DROP"
    outbound_policy = "ACCEPT"

    inbound {
        label = "inbound-http"
        protocol = "TCP"
        action   = "ACCEPT"
        ports = "80"
        ipv4 = ["0.0.0.0/0"]
    }

    outbound {
        label = "outbound-http"
        protocol = "TCP"
        action   = "ACCEPT"
        ports = "80"
        ipv4 = ["0.0.0.0/0"]
    }

    inbound {
        label = "inbound-https"
        protocol = "TCP"
        action   = "ACCEPT"
        ports = "443"
        ipv4 = ["0.0.0.0/0"]
    }

    outbound {
        label = "outbound-https"
        protocol = "TCP"
        action   = "ACCEPT"
        ports = "443"
        ipv4 = ["0.0.0.0/0"]
    }

    inbound {
        label = "inbound-ssh-22"
        protocol = "TCP"
        action   = "ACCEPT"
        ports = "22"
        ipv4 = ["0.0.0.0/0"]
    }

    inbound {
        label = "inbound-ssh-8822"
        protocol = "TCP"
        action   = "ACCEPT"
        ports = "8822"
        ipv4 = ["0.0.0.0/0"]
    }
}