From 8d2fc90a25618f698168d2f9a5c99fe4215267f1 Mon Sep 17 00:00:00 2001
From: Jona Heitzer <jona.heitzer@wa5p.eu>
Date: Sat, 4 Oct 2025 16:57:12 +0200
Subject: [PATCH] Restructure into modules to enable persistent disk

---
 README.md                                     |   4 +-
 main.tf                                       | 132 ++----------------
 modules/ephemeral/main.tf                     |  96 +++++++++++++
 modules/ephemeral/outputs.tf                  |   4 +
 .../scripts}/provision-software.ps1.tpl       |  19 +++
 modules/ephemeral/variables.tf                |  67 +++++++++
 modules/persistent/main.tf                    |  17 +++
 modules/persistent/outputs.tf                 |   3 +
 modules/persistent/variables.tf               |  16 +++
 outputs.tf                                    |   6 +-
 providers.tf                                  |  15 ++
 variables.tf                                  |  68 +--------
 12 files changed, 253 insertions(+), 194 deletions(-)
 create mode 100644 modules/ephemeral/main.tf
 create mode 100644 modules/ephemeral/outputs.tf
 rename {scripts => modules/ephemeral/scripts}/provision-software.ps1.tpl (86%)
 create mode 100644 modules/ephemeral/variables.tf
 create mode 100644 modules/persistent/main.tf
 create mode 100644 modules/persistent/outputs.tf
 create mode 100644 modules/persistent/variables.tf
 create mode 100644 providers.tf

diff --git a/README.md b/README.md
index 96c539e..d4cf04f 100644
--- a/README.md
+++ b/README.md
@@ -4,12 +4,12 @@ This terraform template sets up the infrastructur to enable remote gaming / stre
 
 # TODO
 
-- [ ] Fix missing audio device on vm
+- [x] Fix missing audio device on vm
 - [ ] Remove Tailscale plaintext auth-key from provisioning scripts and registry run entry 
 - [ ] Replace Tailscale by native VPN
 - [ ] Check if public IP is even needed
 - [ ] Persist moonlight configuration between deployments
-- [ ] Install Steam
+- [x] Install Steam
 - [ ] Integrate budget watcher into terraform config
 - [ ] Is there a quicker way to download the installers? Invoke-WebRequest is insanely slow
 - [ ] Skip Windows OOTB tracking bullshit
\ No newline at end of file
diff --git a/main.tf b/main.tf
index 6af76e9..8b10085 100644
--- a/main.tf
+++ b/main.tf
@@ -1,125 +1,17 @@
-terraform {
-  required_providers {
-    azurerm = {
-      source  = "hashicorp/azurerm"
-      version = ">= 4.46"
-    }
-  }
-  required_version = ">= 1.0.0"
+module "ephemeral" {
+  source = "./modules/ephemeral"
+
+  subscription_id   = var.subscription_id
+  prefix            = var.prefix
+  location          = var.location
+  tailscale_authkey = var.tailscale_authkey
+  datadisk_id       = module.persistent.datadisk_id
+  vm_admin_username = var.vm_admin_username
 }
 
-provider "azurerm" {
-  subscription_id = var.subscription_id
+module "persistent" {
+  source = "./modules/persistent"
 
-  features {}
-}
-
-resource "azurerm_resource_group" "rg" {
-  name     = "${var.prefix}-rg"
+  prefix   = var.prefix
   location = var.location
 }
-
-resource "azurerm_virtual_network" "vnet" {
-  name                = "${var.prefix}-vnet"
-  resource_group_name = azurerm_resource_group.rg.name
-  location            = azurerm_resource_group.rg.location
-  address_space       = var.vnet_address_space
-}
-
-resource "azurerm_public_ip" "pip" {
-  name                = "${var.prefix}-pip"
-  resource_group_name = azurerm_resource_group.rg.name
-  location            = azurerm_resource_group.rg.location
-  allocation_method   = "Static"
-  sku                 = "Standard"
-}
-
-resource "azurerm_subnet" "workload_subnet" {
-  name                 = "${var.prefix}-workload-subnet"
-  resource_group_name  = azurerm_resource_group.rg.name
-  virtual_network_name = azurerm_virtual_network.vnet.name
-  address_prefixes     = var.workload_subnet_address_prefixes
-}
-
-resource "azurerm_network_interface" "vm_nic" {
-  name                = "${var.prefix}-vm-nic"
-  location            = azurerm_resource_group.rg.location
-  resource_group_name = azurerm_resource_group.rg.name
-
-  ip_configuration {
-    name                          = "internal"
-    subnet_id                     = azurerm_subnet.workload_subnet.id
-    private_ip_address_allocation = "Dynamic"
-    public_ip_address_id          = azurerm_public_ip.pip.id
-  }
-}
-
-resource "azurerm_managed_disk" "data_disk" {
-  name                 = "${var.prefix}-winvm-datadisk"
-  location             = azurerm_resource_group.rg.location
-  resource_group_name  = azurerm_resource_group.rg.name
-  storage_account_type = "Premium_LRS"
-  create_option        = "Empty"
-  disk_size_gb         = var.datadisk_size_gb
-
-  lifecycle {
-    prevent_destroy = true
-  }
-}
-
-resource "random_password" "admin_password" {
-  length  = 16
-  special = false
-}
-
-resource "azurerm_windows_virtual_machine" "vm" {
-  name                = "${var.prefix}-winvm"
-  computer_name       = var.prefix
-  resource_group_name = azurerm_resource_group.rg.name
-  location            = azurerm_resource_group.rg.location
-  size                = var.vm_size
-  priority            = var.vm_priority
-  eviction_policy     = var.vm_priority == "Spot" ? "Deallocate" : null
-
-  admin_username = var.vm_admin_username
-  admin_password = random_password.admin_password.result
-
-  network_interface_ids = [
-    azurerm_network_interface.vm_nic.id
-  ]
-
-  os_disk {
-    caching              = "ReadWrite"
-    storage_account_type = "Premium_LRS"
-  }
-
-  source_image_reference {
-    publisher = "MicrosoftWindowsDesktop"
-    offer     = "Windows-10"
-    sku       = "win10-22h2-pro"
-    version   = "latest"
-  }
-}
-
-resource "azurerm_virtual_machine_data_disk_attachment" "data_disk_attachment" {
-  managed_disk_id    = azurerm_managed_disk.data_disk.id
-  virtual_machine_id = azurerm_windows_virtual_machine.vm.id
-  lun                = var.datadisk_lun
-  caching            = "ReadWrite"
-}
-
-resource "azurerm_virtual_machine_extension" "provision_software" {
-  name                 = "provision-software"
-  virtual_machine_id   = azurerm_windows_virtual_machine.vm.id
-  publisher            = "Microsoft.Compute"
-  type                 = "CustomScriptExtension"
-  type_handler_version = "1.10"
-
-  depends_on = [azurerm_virtual_machine_data_disk_attachment.data_disk_attachment]
-
-  protected_settings = <<SETTINGS
-  {    
-    "commandToExecute": "powershell -command \"[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('${base64encode(templatefile("${path.module}/scripts/provision-software.ps1.tpl", { tailscale_authkey = var.tailscale_authkey, datadisk_lun = var.datadisk_lun, datadisk_drive_letter = var.datadisk_drive_letter }))}')) | Out-File -filepath provision-software.ps1\" && powershell -ExecutionPolicy Unrestricted -File provision-software.ps1"
-  }
-  SETTINGS
-}
diff --git a/modules/ephemeral/main.tf b/modules/ephemeral/main.tf
new file mode 100644
index 0000000..4518cad
--- /dev/null
+++ b/modules/ephemeral/main.tf
@@ -0,0 +1,96 @@
+resource "azurerm_resource_group" "rg" {
+  name     = "${var.prefix}-ephemeral-rg"
+  location = var.location
+}
+
+resource "azurerm_virtual_network" "vnet" {
+  name                = "${var.prefix}-vnet"
+  resource_group_name = azurerm_resource_group.rg.name
+  location            = azurerm_resource_group.rg.location
+  address_space       = var.vnet_address_space
+}
+
+resource "azurerm_public_ip" "pip" {
+  name                = "${var.prefix}-pip"
+  resource_group_name = azurerm_resource_group.rg.name
+  location            = azurerm_resource_group.rg.location
+  allocation_method   = "Static"
+  sku                 = "Standard"
+}
+
+resource "azurerm_subnet" "workload_subnet" {
+  name                 = "${var.prefix}-workload-subnet"
+  resource_group_name  = azurerm_resource_group.rg.name
+  virtual_network_name = azurerm_virtual_network.vnet.name
+  address_prefixes     = var.workload_subnet_address_prefixes
+}
+
+resource "azurerm_network_interface" "vm_nic" {
+  name                = "${var.prefix}-vm-nic"
+  location            = azurerm_resource_group.rg.location
+  resource_group_name = azurerm_resource_group.rg.name
+
+  ip_configuration {
+    name                          = "internal"
+    subnet_id                     = azurerm_subnet.workload_subnet.id
+    private_ip_address_allocation = "Dynamic"
+    public_ip_address_id          = azurerm_public_ip.pip.id
+  }
+}
+
+resource "random_password" "admin_password" {
+  length  = 16
+  special = false
+}
+
+resource "azurerm_windows_virtual_machine" "vm" {
+  name                = "${var.prefix}-winvm"
+  computer_name       = var.prefix
+  resource_group_name = azurerm_resource_group.rg.name
+  location            = azurerm_resource_group.rg.location
+  size                = var.vm_size
+  priority            = var.vm_priority
+  eviction_policy     = var.vm_priority == "Spot" ? "Deallocate" : null
+
+  admin_username = var.vm_admin_username
+  admin_password = random_password.admin_password.result
+
+  network_interface_ids = [
+    azurerm_network_interface.vm_nic.id
+  ]
+
+  os_disk {
+    caching              = "ReadWrite"
+    storage_account_type = "Premium_LRS"
+  }
+
+  source_image_reference {
+    publisher = "MicrosoftWindowsDesktop"
+    offer     = "Windows-10"
+    sku       = "win10-22h2-pro"
+    version   = "latest"
+  }
+}
+
+resource "azurerm_virtual_machine_data_disk_attachment" "data_disk_attachment" {
+  managed_disk_id    = var.datadisk_id
+  virtual_machine_id = azurerm_windows_virtual_machine.vm.id
+  lun                = var.datadisk_lun
+  caching            = "ReadWrite"
+}
+
+resource "azurerm_virtual_machine_extension" "provision_software" {
+  name                 = "provision-software"
+  virtual_machine_id   = azurerm_windows_virtual_machine.vm.id
+  publisher            = "Microsoft.Compute"
+  type                 = "CustomScriptExtension"
+  type_handler_version = "1.10"
+
+  depends_on = [azurerm_virtual_machine_data_disk_attachment.data_disk_attachment]
+
+  protected_settings = <<SETTINGS
+  {    
+    "commandToExecute": "powershell -command \"[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('${base64encode(templatefile("${path.module}/scripts/provision-software.ps1.tpl", { tailscale_authkey = var.tailscale_authkey, datadisk_lun = var.datadisk_lun, datadisk_drive_letter = var.datadisk_drive_letter }))}')) | Out-File -filepath provision-software.ps1\" && powershell -ExecutionPolicy Unrestricted -File provision-software.ps1"
+  }
+  SETTINGS
+}
diff --git a/modules/ephemeral/outputs.tf b/modules/ephemeral/outputs.tf
new file mode 100644
index 0000000..e192853
--- /dev/null
+++ b/modules/ephemeral/outputs.tf
@@ -0,0 +1,4 @@
+output "vm_admin_password" {
+  sensitive = true
+  value     = random_password.admin_password.result
+}
diff --git a/scripts/provision-software.ps1.tpl b/modules/ephemeral/scripts/provision-software.ps1.tpl
similarity index 86%
rename from scripts/provision-software.ps1.tpl
rename to modules/ephemeral/scripts/provision-software.ps1.tpl
index f9acef1..2a5ff6e 100644
--- a/scripts/provision-software.ps1.tpl
+++ b/modules/ephemeral/scripts/provision-software.ps1.tpl
@@ -14,6 +14,9 @@ $AmdDriverUri = 'https://download.microsoft.com/download/44ee0d6c-74dd-4214-b6d5
 $AmdDriverExe = 'amd-gpu-driver.exe'
 $AmdDriverInstallLog = "$PWD\amd-gpu-driver-install.log"
 
+$VBCableUri = 'https://download.vb-audio.com/Download_CABLE/VBCABLE_Driver_Pack45.zip'
+$VBCableZip = 'vbcable.zip'
+
 $SunshineInstallerUri = 'https://github.com/LizardByte/Sunshine/releases/latest/download/Sunshine-Windows-AMD64-installer.exe'
 $SunshineInstallerExe = 'sunshine-installer.exe'
 
@@ -71,6 +74,22 @@ Start-Process $AmdDriverExe -ArgumentList '-install', '-log', $AmdDriverInstallL
 
 Write-Host 'Done installing AMD GPU driver'
 
+##
+# Virtual Cable audio device driver
+Write-Host 'Installing Virtual Cable audio device driver'
+
+Write-Host "Downloading VBCable from $VBCableUri to $VBCableZip"
+Invoke-WebRequest -UseDefaultCredentials -Uri $VBCableUri -OutFile $VBCableZip
+
+$VBCableExtracted = 'vbcable'
+Write-Host "Extracting $VBCableZip to $VBCableExtracted"
+Expand-Archive $VBCableZip -DestinationPath 'vbcable'
+
+Write-Host 'Installing VBCable from installer'
+Start-Process "vbcable\VBCABLE_Setup_x64.exe" -ArgumentList '-i', '-h' -Wait -NoNewWindow -PassThru
+
+Write-Host 'Done installing Virtual Cable audio device driver'
+
 ##
 # Sunshine
 Write-Host "Installing Sunshine"
diff --git a/modules/ephemeral/variables.tf b/modules/ephemeral/variables.tf
new file mode 100644
index 0000000..52a00aa
--- /dev/null
+++ b/modules/ephemeral/variables.tf
@@ -0,0 +1,67 @@
+variable "subscription_id" {
+  description = "Subscription ID of the subscription for gaming related stuff"
+  type        = string
+}
+
+# The prefix must not be changed, sice the budget watcher deletes the resource group wa5p-gaming-rg when budget is exceeded
+variable "prefix" {
+  description = "Prefix for gaming related ressources"
+  type        = string
+}
+
+variable "location" {
+  description = "Location for gaming related ressources, should be as close as possible for low latency"
+  type        = string
+}
+
+variable "vnet_address_space" {
+  description = "List of IP nets for gaming vnet"
+  type        = list(string)
+  default     = ["10.0.1.0/24"]
+}
+
+variable "workload_subnet_address_prefixes" {
+  description = "IP subnet address prefixes for workload subnet"
+  type        = list(string)
+  default     = ["10.0.1.128/25"]
+}
+
+variable "vm_size" {
+  description = "SKU of the vm to be deployed, should be a GPU optimized vm"
+  type        = string
+  default     = "Standard_NG16ads_V620_v1"
+}
+
+variable "vm_priority" {
+  description = "Priority of the VM, can be Regular or Spot. Spot is cheaper, but can be evicted at any time"
+  type        = string
+  default     = "Regular"
+}
+
+variable "vm_admin_username" {
+  description = "VM admin username, password will be generated randomly"
+  type        = string
+}
+
+variable "datadisk_id" {
+  description = "ID of the persistent datadisk"
+  type        = string
+}
+
+variable "datadisk_lun" {
+  description = "Location identifier, this is used to identify the disk within the VM"
+  type        = string
+  default     = "10"
+}
+
+variable "datadisk_drive_letter" {
+  description = "Drive letter to mount the datadisk to"
+  type        = string
+  default     = "Z"
+}
+
+variable "tailscale_authkey" {
+  description = "Tailscale auth key for unattended login"
+  type        = string
+  sensitive   = true
+}
diff --git a/modules/persistent/main.tf b/modules/persistent/main.tf
new file mode 100644
index 0000000..cb38eaa
--- /dev/null
+++ b/modules/persistent/main.tf
@@ -0,0 +1,17 @@
+resource "azurerm_resource_group" "rg" {
+  name     = "${var.prefix}-persistent-rg"
+  location = var.location
+}
+
+resource "azurerm_managed_disk" "data_disk" {
+  name                 = "${var.prefix}-winvm-datadisk"
+  location             = var.location
+  resource_group_name  = azurerm_resource_group.rg.name
+  storage_account_type = "Premium_LRS"
+  create_option        = "Empty"
+  disk_size_gb         = var.datadisk_size_gb
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
diff --git a/modules/persistent/outputs.tf b/modules/persistent/outputs.tf
new file mode 100644
index 0000000..5d6e8f2
--- /dev/null
+++ b/modules/persistent/outputs.tf
@@ -0,0 +1,3 @@
+output "datadisk_id" {
+  value = azurerm_managed_disk.data_disk.id
+}
\ No newline at end of file
diff --git a/modules/persistent/variables.tf b/modules/persistent/variables.tf
new file mode 100644
index 0000000..d8bca0a
--- /dev/null
+++ b/modules/persistent/variables.tf
@@ -0,0 +1,16 @@
+# The prefix must not be changed, sice the budget watcher deletes the resource group wa5p-gaming-rg when budget is exceeded
+variable "prefix" {
+  description = "Prefix for gaming related ressources"
+  type        = string
+}
+
+variable "location" {
+  description = "Location of the deployments"
+  type        = string
+}
+
+variable "datadisk_size_gb" {
+  description = "Size of the persisted datadisk in gb"
+  type        = number
+  default     = 1024
+}
diff --git a/outputs.tf b/outputs.tf
index 271f99d..b915749 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -1,8 +1,4 @@
-output "windows_vm_private_ip" {
-  value = azurerm_network_interface.vm_nic.private_ip_address
-}
-
 output "vm_admin_password" {
   sensitive = true
-  value     = random_password.admin_password.result
+  value     = module.ephemeral.vm_admin_password
 }
diff --git a/providers.tf b/providers.tf
new file mode 100644
index 0000000..d28beb7
--- /dev/null
+++ b/providers.tf
@@ -0,0 +1,15 @@
+terraform {
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = ">= 4.46"
+    }
+  }
+  required_version = ">= 1.0.0"
+}
+
+provider "azurerm" {
+  subscription_id = var.subscription_id
+
+  features {}
+}
diff --git a/variables.tf b/variables.tf
index de3ab6c..3a1ce50 100644
--- a/variables.tf
+++ b/variables.tf
@@ -4,6 +4,7 @@ variable "subscription_id" {
   default     = "90aed1cc-9b7f-4d3d-b2b9-b3654b49835e"
 }
 
+
 # The prefix must not be changed, sice the budget watcher deletes the resource group wa5p-gaming-rg when budget is exceeded
 variable "prefix" {
   description = "Prefix for gaming related ressources"
@@ -17,78 +18,11 @@ variable "location" {
   default     = "westeurope"
 }
 
-variable "vnet_address_space" {
-  description = "List of IP nets for gaming vnet"
-  type        = list(string)
-  default     = ["10.0.1.0/24"]
-}
-
-variable "gateway_subnet_address_prefixes" {
-  description = "IP prexixes for vpn gateway subnet (currently only one allowed)"
-  type        = list(string)
-  default     = ["10.0.1.0/25"]
-}
-
-variable "vpn_gateway_sku" {
-  description = "SKU of VPN gateway"
-  type        = string
-  default     = "VpnGw1"
-}
-
-variable "vpn_client_address_space" {
-  description = "Private IP addresses to be assigned to the connecting clients, must not overlap with any other assignment (in cloud or on premise)"
-  type        = list(string)
-  default     = ["10.123.1.0/24"]
-}
-
-variable "root_certificate_name" {
-  description = "Name of the root certificate used for vpn authentication (CN in generation command)"
-  type        = string
-  default     = "p2s-root-01"
-}
-
-variable "workload_subnet_address_prefixes" {
-  description = "IP subnet address prefixes for workload subnet, must be in same vnet as gateway subnet"
-  type        = list(string)
-  default     = ["10.0.1.128/25"]
-}
-
-variable "vm_size" {
-  description = "SKU of the vm to be deployed, should be a GPU optimized vm"
-  type        = string
-  default     = "Standard_NG16ads_V620_v1"
-}
-
-variable "vm_priority" {
-  description = "Priority of the VM, can be Regular or Spot. Spot is cheaper, but can be evicted at any time"
-  type        = string
-  default     = "Regular"
-}
-
 variable "vm_admin_username" {
   description = "VM admin username, password will be generated randomly"
   type        = string
   default     = "jona"
 }
-
-variable "datadisk_size_gb" {
-  description = "Size of the persisted datadisk in gb"
-  type        = number
-  default     = 1024
-}
-
-variable "datadisk_lun" {
-  description = "Location identifier, this is used to identify the disk within the VM"
-  type        = string
-  default     = "10"
-}
-
-variable "datadisk_drive_letter" {
-  description = "Drive letter to mount the datadisk to"
-  type        = string
-  default     = "Z"
-}
-
 variable "tailscale_authkey" {
   description = "Tailscale auth key for unattended login"
   type        = string