added azure stuffs

.github/workflows/apply.yml

@@ -63,6 +63,10 @@ jobs:
         with:
           name: plan
 
+      - uses: azure/login@v1
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
       - name: Unlock encrypted files
         run: |
           export SECRET_PASS="${{ secrets.SECRET_PASS }}"

azure_ad_applications.tf

@@ -0,0 +1,28 @@
+data "azuread_client_config" "current" {}
+
+resource "azuread_application" "cloudflare_access" {
+  display_name = "Cloudflare Access"
+
+  required_resource_access {
+    resource_app_id = "00000003-0000-0000-c000-000000000000"
+    resource_access {
+      id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
+      type = "Scope"
+    }
+  }
+
+  web {
+    redirect_uris = [ 
+      "https://pezsh.cloudflareaccess.com/cdn-cgi/access/callback"
+    ]
+
+    implicit_grant {
+      access_token_issuance_enabled = false
+      id_token_issuance_enabled = false
+    }
+  }
+}
+
+resource "azuread_application_password" "cloudflare_access" {
+  application_object_id = azuread_application.cloudflare_access.object_id
+}

azure_ad_users.tf

@@ -0,0 +1,9 @@
+resource "azuread_user" "rasmus" {
+  display_name = "Rasmus Wejlgaard"
+  user_principal_name = "[email protected]"
+}
+
+resource "azuread_user" "khanh" {
+  display_name = "Khanh Dang"
+  user_principal_name = "[email protected]"
+}

access.tf → cloudflare_access.tf

@@ -3,6 +3,11 @@ resource "cloudflare_access_identity_provider" "azure_ad" {
   account_id = cloudflare_account.this.id
   name = "Azure AD"
   type = "azureAD"
+  config {
+    client_id = azuread_application.cloudflare_access.application_id
+    client_secret = azuread_application_password.cloudflare_access.value
+    directory_id = data.azuread_client_config.current.tenant_id
+  }
 }
 
 resource "cloudflare_access_application" "alertmanager" {

providers.tf

@@ -3,11 +3,18 @@ terraform {
     cloudflare = {
       source  = "cloudflare/cloudflare"
     }
+    azuread = {
+      source  = "hashicorp/azuread"
+    }
   }
   backend "s3" { }
 }
 
 provider "cloudflare" {
     email = local.secrets["cloudflare_email"]
     api_key = local.secrets["cloudflare_api_key"]
+}
+
+provider "azuread" {
+  tenant_id = local.secrets["azure_tenant_id"]
 }