Terraform modules that configure and maintain the infrastructure needed to run GitHub-Hosted Action Runners in a private network.
- Before running, review pre-requisites from the documentation to ensure your environment is properly configured.
- The Azure CLI must be installed and on the system path, logged in with the identity that you want these resources created under, and Azure Subscription configured.
- The
GitHub.Networkresource provider must be registered in the Azure Subscription. The Terraform modules contain HCL to register this provider, but it is commented out since you may not want this managed by Terraform. See the above GitHub documentation for a sample AZ CLI command to register the provider.
This repo contains two Terraform modules:
- nsg module: Uses a Network Security Group (NSG) to manage the network security of the VNet.
module "github_runner_vnet" {
# Use the nsg version
source = "github.com/garnertb/github-runner-vnet/nsg"
# The resources use this base_name as a name prefix, e.g. ${base_name}-rg for the resource group
base_name = "vnet-test"
# Retrieve through the GitHub API (see GitHub docs for instructions)
github_enterprise_id = "12345"
}- firewall module: Uses an Azure Firewall to manage the network security of the VNet.
Terraform config for the firewall
Provision and configure the infrastructure in Terraform by calling this module:
module "github_runner_vnet" {
# Use the firewall version
source = "github.com/garnertb/github-runner-vnet/firewall"
# The resources use this base_name as a name prefix, e.g. ${base_name}-rg for the resource group
base_name = "vnet-test"
# Retrieve through the GitHub API (see GitHub docs for instructions)
github_enterprise_id = "12345"
}The output of these modules is the Resource ID for the GitHub.Network/networkSettings resource. Paste this ID into the github.com UI for configuring the Azure Virtual Network.
