First try, fuck vpn gateways

main.tf

@@ -0,0 +1,149 @@
+terraform {
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = ">= 4.46"
+    }
+  }
+  required_version = ">= 1.0.0"
+}
+
+provider "azurerm" {
+  subscription_id = var.subscription_id
+
+  features {}
+}
+
+resource "azurerm_resource_group" "rg" {
+  name     = "${var.prefix}-rg"
+  location = var.location
+}
+
+resource "azurerm_virtual_network" "vnet" {
+  name                = "${var.prefix}-vnet"
+  resource_group_name = azurerm_resource_group.rg.name
+  location            = azurerm_resource_group.rg.location
+  address_space       = var.vnet_address_space
+}
+
+# IMPORTANT: GatewaySubnet must be named "GatewaySubnet"
+resource "azurerm_subnet" "gateway_subnet" {
+  name                 = "GatewaySubnet"
+  resource_group_name  = azurerm_resource_group.rg.name
+  virtual_network_name = azurerm_virtual_network.vnet.name
+  address_prefixes     = var.gateway_subnet_address_prefixes
+}
+
+resource "azurerm_public_ip" "vpn_gateway_pip" {
+  name                = "${var.prefix}-vpn-gw-pip"
+  resource_group_name = azurerm_resource_group.rg.name
+  location            = azurerm_resource_group.rg.location
+  allocation_method   = "Static"
+  sku                 = "Standard"
+}
+
+data "local_sensitive_file" "root_certificate" {
+  filename = "${path.module}/certificates/vpn-root.crt"
+}
+
+resource "azurerm_virtual_network_gateway" "vpn_gw" {
+  name                = "${var.prefix}-vpngw"
+  location            = azurerm_resource_group.rg.location
+  resource_group_name = azurerm_resource_group.rg.name
+
+  type     = "Vpn"
+  vpn_type = "RouteBased"
+
+  sku = var.vpn_gateway_sku
+
+  ip_configuration {
+    name                 = "vpngw-ipcfg"
+    public_ip_address_id = azurerm_public_ip.vpn_gateway_pip.id
+    subnet_id            = azurerm_subnet.gateway_subnet.id
+  }
+
+  # Point-to-site configuration using certificate auth
+  vpn_client_configuration {
+    address_space = var.vpn_client_address_space
+
+    root_certificate {
+      name             = var.root_certificate_name
+      public_cert_data = data.local_sensitive_file.root_certificate.content
+    }
+  }
+}
+
+resource "azurerm_subnet" "workload_subnet" {
+  name                 = "${var.prefix}-workload-subnet"
+  resource_group_name  = azurerm_resource_group.rg.name
+  virtual_network_name = azurerm_virtual_network.vnet.name
+  address_prefixes     = var.workload_subnet_address_prefixes
+}
+
+resource "azurerm_network_security_group" "vm_nsg" {
+  name                = "${var.prefix}-vm-nsg"
+  location            = azurerm_resource_group.rg.location
+  resource_group_name = azurerm_resource_group.rg.name
+
+  # Allow RDP from VPN client address pool
+  security_rule {
+    name                       = "Allow-RDP-From-VPN"
+    priority                   = 100
+    direction                  = "Inbound"
+    access                     = "Allow"
+    protocol                   = "Tcp"
+    source_port_range          = "*"
+    destination_port_range     = "3389"
+    source_address_prefixes    = var.vpn_client_address_space
+    destination_address_prefix = "*"
+  }
+}
+
+resource "azurerm_network_interface" "vm_nic" {
+  name                = "${var.prefix}-vm-nic"
+  location            = azurerm_resource_group.rg.location
+  resource_group_name = azurerm_resource_group.rg.name
+
+  ip_configuration {
+    name                          = "internal"
+    subnet_id                     = azurerm_subnet.workload_subnet.id
+    private_ip_address_allocation = "Dynamic"
+  }
+}
+
+resource "azurerm_network_interface_security_group_association" "vm_nsg_assoc" {
+  network_interface_id      = azurerm_network_interface.vm_nic.id
+  network_security_group_id = azurerm_network_security_group.vm_nsg.id
+}
+
+resource "random_password" "admin_password" {
+  length  = 16
+  special = false
+}
+
+resource "azurerm_windows_virtual_machine" "vm" {
+  name                = "${var.prefix}-winvm"
+  computer_name       = var.prefix
+  resource_group_name = azurerm_resource_group.rg.name
+  location            = azurerm_resource_group.rg.location
+  size                = "Standard_NG8ads_V620_v1"
+
+  admin_username = var.vm_admin_username
+  admin_password = random_password.admin_password.result
+
+  network_interface_ids = [
+    azurerm_network_interface.vm_nic.id
+  ]
+
+  os_disk {
+    caching              = "ReadWrite"
+    storage_account_type = "Premium_LRS"
+  }
+
+  source_image_reference {
+    publisher = "MicrosoftWindowsServer"
+    offer     = "WindowsServer"
+    sku       = "2019-Datacenter"
+    version   = "latest"
+  }
+}