{"id":35015,"date":"2024-09-27T10:11:27","date_gmt":"2024-09-27T03:11:27","guid":{"rendered":"http:\/\/jupitek.maudemo.vip\/index.php\/2024\/09\/27\/deploy-secure-linodes-using-cloud-firewalls-and-terraform\/"},"modified":"2024-09-27T10:11:27","modified_gmt":"2024-09-27T03:11:27","slug":"deploy-secure-linodes-using-cloud-firewalls-and-terraform","status":"publish","type":"post","link":"https:\/\/jupitek.maudemo.vip\/index.php\/2024\/09\/27\/deploy-secure-linodes-using-cloud-firewalls-and-terraform\/","title":{"rendered":"Tri\u1ec3n khai Linode b\u1ea3o m\u1eadt v\u1edbi Cloud Firewalls v\u00e0 Terraform"},"content":{"rendered":"<p>C\u00e1c m\u00f4-\u0111un Terraform cho ph\u00e9p b\u1ea1n t\u1ed5 ch\u1ee9c m\u00e3 c\u1ea5u h\u00ecnh c\u1ee7a m\u00ecnh t\u1ed1t h\u01a1n v\u00e0 ph\u00e2n ph\u1ed1i v\u00e0 t\u00e1i s\u1eed d\u1ee5ng m\u00e3 \u0111\u00f3. B\u1ea1n c\u00f3 th\u1ec3 l\u01b0u tr\u1eef c\u00e1c m\u00f4-\u0111un Terraform c\u1ee7a m\u00ecnh tr\u00ean c\u00e1c d\u1ecbch v\u1ee5 ki\u1ec3m so\u00e1t phi\u00ean b\u1ea3n t\u1eeb xa, nh\u01b0 GitHub, \u0111\u1ec3 nh\u1eefng ng\u01b0\u1eddi kh\u00e1c s\u1eed d\u1ee5ng. Terraform Module Registry l\u01b0u tr\u1eef c\u00e1c m\u00f4-\u0111un c\u1ed9ng \u0111\u1ed3ng m\u00e0 b\u1ea1n c\u00f3 th\u1ec3 t\u00e1i s\u1eed d\u1ee5ng cho c\u00e1c c\u1ea5u h\u00ecnh Terraform c\u1ee7a ri\u00eang b\u1ea1n ho\u1eb7c b\u1ea1n c\u00f3 th\u1ec3 xu\u1ea5t b\u1ea3n c\u00e1c m\u00f4-\u0111un c\u1ee7a ri\u00eang m\u00ecnh \u0111\u1ec3 c\u1ed9ng \u0111\u1ed3ng Terraform s\u1eed d\u1ee5ng.<\/p>\n<p>Trong h\u01b0\u1edbng d\u1eabn n\u00e0y, b\u1ea1n s\u1ebd t\u1ea1o m\u1ed9t m\u00f4-\u0111un T\u01b0\u1eddng l\u1eeda Linode khai b\u00e1o c\u00e1c c\u1ea5u h\u00ecnh T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y th\u01b0\u1eddng d\u00f9ng. Sau \u0111\u00f3, b\u1ea1n s\u1ebd s\u1eed d\u1ee5ng m\u00f4-\u0111un \u0111\u1ec3 t\u1ea1o m\u1ed9t phi\u00ean b\u1ea3n Linode v\u00e0 g\u00e1n Linode cho T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y. B\u1ea1n c\u00f3 th\u1ec3 \u00e1p d\u1ee5ng c\u00e1c c\u1ea5u h\u00ecnh v\u00ed d\u1ee5 trong h\u01b0\u1edbng d\u1eabn n\u00e0y \u0111\u1ec3 t\u1ea1o c\u00e1c c\u1ea5u h\u00ecnh T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y c\u00f3 th\u1ec3 t\u00e1i s\u1eed d\u1ee5ng c\u1ee7a ri\u00eang b\u1ea1n. \u0110\u1ec3 bi\u1ebft th\u00eam th\u00f4ng tin v\u1ec1 T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y, h\u00e3y xem t\u00e0i&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/products\/networking\/cloud-firewall\/\">li\u1ec7u T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y<\/a>&nbsp;.<\/p>\n<h2 id=\"before-you-begin\">Tr\u01b0\u1edbc khi b\u1ea1n b\u1eaft \u0111\u1ea7u<a href=\"https:\/\/www.linode.com\/docs\/guides\/how-to-deploy-secure-linodes-using-cloud-firewalls-and-terraform\/#before-you-begin\"><\/a><\/h2>\n<ol>\n<li>N\u1ebfu b\u1ea1n m\u1edbi s\u1eed d\u1ee5ng Terraform, h\u00e3y \u0111\u1ecdc&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/guides\/beginners-guide-to-terraform\/\">h\u01b0\u1edbng d\u1eabn v\u1ec1 Terraform d\u00e0nh cho ng\u01b0\u1eddi m\u1edbi b\u1eaft \u0111\u1ea7u<\/a>&nbsp;c\u1ee7a ch\u00fang t\u00f4i \u0111\u1ec3 l\u00e0m quen v\u1edbi c\u00e1c kh\u00e1i ni\u1ec7m ch\u00ednh.<\/li>\n<li>Xem&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/guides\/create-terraform-module\/\">m\u1ee5c T\u1ea1o m\u00f4-\u0111un Terraform<\/a>&nbsp;\u0111\u1ec3 hi\u1ec3u s\u00e2u h\u01a1n v\u1ec1 c\u1ea5u tr\u00fac m\u00f4-\u0111un chu\u1ea9n c\u1ee7a Terraform v\u00e0 c\u00e1c th\u00f4ng tin chi ti\u1ebft h\u1eefu \u00edch kh\u00e1c.<\/li>\n<li>B\u1ea1n c\u1ea7n m\u00e3 th\u00f4ng b\u00e1o truy c\u1eadp c\u00e1 nh\u00e2n API Linode \u0111\u1ec3 s\u1eed d\u1ee5ng v\u1edbi Terraform. M\u00e3 th\u00f4ng b\u00e1o n\u00e0y s\u1ebd cho ph\u00e9p b\u1ea1n t\u1ea1o, c\u1eadp nh\u1eadt v\u00e0 h\u1ee7y t\u00e0i nguy\u00ean Linode. Xem h\u01b0\u1edbng d\u1eabn&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/products\/platform\/accounts\/guides\/manage-api-tokens\/\">Qu\u1ea3n l\u00fd m\u00e3 th\u00f4ng b\u00e1o truy c\u1eadp c\u00e1 nh\u00e2n<\/a>&nbsp;\u0111\u1ec3 bi\u1ebft c\u00e1c b\u01b0\u1edbc t\u1ea1o m\u00e3 th\u00f4ng b\u00e1o.Ghi ch\u00fa<code>When you create a personal access token ensure that you set **Read\/Write** access permissions for Linode instances and Cloud Firewalls.<\/code><\/li>\n<li><a href=\"https:\/\/www.linode.com\/docs\/guides\/how-to-build-your-infrastructure-using-terraform-and-linode\/#install-terraform\">C\u00e0i \u0111\u1eb7t Terraform<\/a>&nbsp;tr\u00ean m\u00e1y t\u00ednh c\u1ee5c b\u1ed9 c\u1ee7a b\u1ea1n.Ghi ch\u00faH\u01b0\u1edbng d\u1eabn n\u00e0y \u0111\u01b0\u1ee3c vi\u1ebft b\u1eb1ng&nbsp;<a href=\"https:\/\/github.com\/hashicorp\/terraform\/releases\" target=\"_blank\" rel=\"noreferrer noopener\">Terraform phi\u00ean b\u1ea3n 0.13.0<\/a>&nbsp;.<\/li>\n<li>C\u00e0i \u0111\u1eb7t Git tr\u00ean m\u00e1y t\u00ednh c\u1ee7a b\u1ea1n v\u00e0 ho\u00e0n t\u1ea5t c\u00e1c b\u01b0\u1edbc trong ph\u1ea7n&nbsp;<strong>C\u1ea5u h\u00ecnh Git<\/strong>&nbsp;c\u1ee7a&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/guides\/how-to-configure-git\/#configure-git\">h\u01b0\u1edbng d\u1eabn B\u1eaft \u0111\u1ea7u v\u1edbi Git<\/a>&nbsp;.<\/li>\n<\/ol>\n<h2 id=\"create-your-cloud-firewalls-module\">T\u1ea1o m\u00f4-\u0111un t\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y c\u1ee7a b\u1ea1n<a href=\"https:\/\/www.linode.com\/docs\/guides\/how-to-deploy-secure-linodes-using-cloud-firewalls-and-terraform\/#create-your-cloud-firewalls-module\"><\/a><\/h2>\n<p>C\u00e1c b\u01b0\u1edbc sau \u0111\u00e2y s\u1ebd t\u1ea1o m\u00f4-\u0111un Cloud Firewalls, bao g\u1ed3m m\u1ed9t s\u1ed1 m\u00f4-\u0111un con chia nh\u1ecf c\u00e1c t\u00e0i nguy\u00ean c\u1ea7n thi\u1ebft gi\u1eefa&nbsp;<em>m\u00f4-\u0111un g\u1ed1c<\/em>&nbsp;, m\u1ed9t&nbsp;<code>inbound_ssh<\/code>m\u00f4-\u0111un, m\u1ed9t&nbsp;<code>mysql<\/code>m\u00f4-\u0111un v\u00e0 m\u1ed9t&nbsp;<code>web-server<\/code>m\u00f4-\u0111un. M\u00f4-\u0111un g\u1ed1c l\u00e0 th\u01b0 m\u1ee5c ch\u1ee9a c\u00e1c t\u1ec7p c\u1ea5u h\u00ecnh Terraform \u0111\u01b0\u1ee3c \u00e1p d\u1ee5ng \u0111\u1ec3 x\u00e2y d\u1ef1ng c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng mong mu\u1ed1n c\u1ee7a b\u1ea1n. C\u00e1c t\u1ec7p n\u00e0y cung c\u1ea5p \u0111i\u1ec3m v\u00e0o b\u1ea5t k\u1ef3 m\u00f4-\u0111un con n\u00e0o. M\u1ed7i m\u00f4-\u0111un con s\u1eed d\u1ee5ng t\u00e0i&nbsp;<code>linode_firewall<\/code>nguy\u00ean \u0111\u1ec3 t\u1ea1o c\u00e1c quy t\u1eafc Cloud Firewall c\u00f3 th\u1ec3 t\u00e1i s\u1eed d\u1ee5ng cho c\u00e1c tr\u01b0\u1eddng h\u1ee3p s\u1eed d\u1ee5ng c\u1ee5 th\u1ec3.<\/p>\n<p>Ghi ch\u00fa: B\u1ea1n c\u00f3 th\u1ec3 \u00e1p d\u1ee5ng t\u1ed1i \u0111a ba T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y cho m\u1ed7i phi\u00ean b\u1ea3n Linode.Ghi ch\u00faB\u1ea1n c\u00f3 th\u1ec3 xem c\u00e1c t\u1ec7p \u0111\u01b0\u1ee3c t\u1ea1o trong su\u1ed1t h\u01b0\u1edbng d\u1eabn n\u00e0y trong&nbsp;<a href=\"https:\/\/github.com\/leslitagordita\/main-firewalls\" target=\"_blank\" rel=\"noreferrer noopener\">kho l\u01b0u tr\u1eef GitHub c\u1ee7a t\u00e1c gi\u1ea3<\/a>&nbsp;. B\u1ea1n c\u00f3 th\u1ec3 sao ch\u00e9p kho l\u01b0u tr\u1eef v\u00e0 s\u1eed d\u1ee5ng n\u00f3 l\u00e0m n\u1ec1n t\u1ea3ng \u0111\u1ec3 t\u1ea1o m\u00f4-\u0111un T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y t\u00f9y ch\u1ec9nh c\u1ee7a ri\u00eang b\u1ea1n.<\/p>\n<h3 id=\"create-your-modules-directory-structure\">T\u1ea1o c\u1ea5u tr\u00fac th\u01b0 m\u1ee5c c\u1ee7a m\u00f4-\u0111un c\u1ee7a b\u1ea1n<a href=\"https:\/\/www.linode.com\/docs\/guides\/how-to-deploy-secure-linodes-using-cloud-firewalls-and-terraform\/#create-your-modules-directory-structure\"><\/a><\/h3>\n<p>Trong ph\u1ea7n n\u00e0y, b\u1ea1n s\u1ebd t\u1ea1o c\u1ea5u tr\u00fac th\u01b0 m\u1ee5c \u0111\u01b0\u1ee3c n\u00eau d\u01b0\u1edbi \u0111\u00e2y, ch\u1ee9a c\u00e1c t\u1ec7p c\u1ea5u h\u00ecnh m\u00f4-\u0111un v\u00e0 m\u00f4-\u0111un con m\u00e0 b\u1ea1n s\u1ebd t\u1ea1o \u1edf c\u00e1c b\u01b0\u1edbc sau.<\/p>\n<pre class=\"wp-block-code\"><code>main_firewalls\/\n\u251c\u2500\u2500 main.tf\n\u251c\u2500\u2500 outputs.tf\n\u251c\u2500\u2500 secrets.tfvars\n\u251c\u2500\u2500 terraform\n\u251c\u2500\u2500 terraform.tfvars\n\u251c\u2500\u2500 variables.tf\n\u2514\u2500\u2500 modules\/\n    \u251c\u2500\u2500 inbound_ssh\/\n        \u251c\u2500\u2500 main.tf\n        \u251c\u2500\u2500 variables.tf\n        \u2514\u2500\u2500 outputs.tf\n    \u2514\u2500\u2500 mysql\/\n        \u251c\u2500\u2500 main.tf\n        \u251c\u2500\u2500 variables.tf\n        \u2514\u2500\u2500 outputs.tf\n    \u2514\u2500\u2500 web_server\/\n        \u251c\u2500\u2500 main.tf\n        \u251c\u2500\u2500 variables.tf\n        \u2514\u2500\u2500 outputs.tf<\/code><\/pre>\n<p>1.Di chuy\u1ec3n v\u00e0o&nbsp;<code>terraform<\/code>th\u01b0 m\u1ee5c c\u1ee7a b\u1ea1n.<\/p>\n<pre class=\"wp-block-code\"><code>cd ~\/terraform<\/code><\/pre>\n<p>2.T\u1eeb&nbsp;<code>terraform<\/code>th\u01b0 m\u1ee5c c\u1ee7a b\u1ea1n, h\u00e3y t\u1ea1o c\u1ea5u tr\u00fac th\u01b0 m\u1ee5c \u0111\u01b0\u1ee3c n\u00eau \u1edf tr\u00ean.<\/p>\n<pre class=\"wp-block-code\"><code>mkdir -p main_firewalls\/modules\/{inbound_ssh,mysql,web_server}<\/code><\/pre>\n<p>Ghi ch\u00fa<\/p>\n<pre class=\"wp-block-code\"><code>If you followed our &#91;install Terraform](\/docs\/guides\/how-to-build-your-infrastr<\/code><\/pre>\n<h3 id=\"create-the-inbound-ssh-child-module\">T\u1ea1o M\u00f4-\u0111un Con SSH \u0110\u1ebfn<a href=\"https:\/\/www.linode.com\/docs\/guides\/how-to-deploy-secure-linodes-using-cloud-firewalls-and-terraform\/#create-the-inbound-ssh-child-module\"><\/a><\/h3>\n<p>Khi \u00e1p d\u1ee5ng cho c\u1ea5u h\u00ecnh Terraform,&nbsp;<code>inbound_ssh<\/code>m\u00f4-\u0111un s\u1ebd t\u1ea1o T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y v\u1edbi c\u00e1c quy t\u1eafc \u0111\u1ebfn \u0111\u1ec3 cho ph\u00e9p&nbsp;<code>TCP<\/code>k\u1ebft n\u1ed1i \u0111\u1ebfn c\u1ed5ng&nbsp;<code>22<\/code>t\u1eeb m\u1ecdi ngu\u1ed3n. C\u1ed5ng&nbsp;<code>22<\/code>th\u01b0\u1eddng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng cho k\u1ebft n\u1ed1i shell an to\u00e0n (SSH), \u0111\u0103ng nh\u1eadp an to\u00e0n, truy\u1ec1n t\u1ec7p (scp, sftp) v\u00e0 chuy\u1ec3n ti\u1ebfp c\u1ed5ng.<\/p>\n<p>1.S\u1eed d\u1ee5ng tr\u00ecnh so\u1ea1n th\u1ea3o v\u0103n b\u1ea3n \u01b0a th\u00edch c\u1ee7a b\u1ea1n, t\u1ea1o t\u1ec7p&nbsp;<code>inbound_ssh<\/code>m\u00f4-\u0111un&nbsp;<code>main.tf<\/code>. Sao ch\u00e9p v\u00e0 l\u01b0u n\u1ed9i dung c\u1ee7a v\u00ed d\u1ee5 b\u00ean d\u01b0\u1edbi.<\/p>\n<pre class=\"wp-block-code\"><code>terraform {\n  required_providers {\n    linode = {\n      source = \"linode\/linode\"\n      version = \"1.16.0\"\n    }\n  }\n}\nresource \"linode_firewall\" \"ssh_inbound\" {\n  label = var.firewall_label\n  tags  = var.tags\n\n  inbound {\n    protocol = \"TCP\"\n    ports = &#91;\"22\"]\n    addresses = &#91;\"0.0.0.0\/0\"]\n  }\n\n  linodes = var.linodes\n}<\/code><\/pre>\n<ul>\n<li>T\u1ec7p n\u00e0y s\u1eed d\u1ee5ng t\u00e0i nguy\u00ean c\u1ee7a Nh\u00e0 cung c\u1ea5p Terraform Linode&nbsp;<code>linode_firewall<\/code>\u0111\u1ec3 t\u1ea1o T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y v\u1edbi c\u00e1c quy t\u1eafc \u0111\u1ebfn \u0111\u01b0\u1ee3c m\u00f4 t\u1ea3 \u1edf tr\u00ean.<\/li>\n<li>\u0110\u1ed1i&nbsp;<code>linodes<\/code>s\u1ed1 mong \u0111\u1ee3i m\u1ed9t danh s\u00e1ch ID Linode. Khi ID Linode \u0111\u01b0\u1ee3c truy\u1ec1n cho&nbsp;<code>linodes<\/code>\u0111\u1ed1i s\u1ed1,&nbsp;<code>inbound_ssh<\/code>t\u01b0\u1eddng l\u1eeda s\u1ebd \u0111\u01b0\u1ee3c g\u00e1n cho ID \u0111\u00f3.<\/li>\n<li>C\u00e1c \u0111\u1ed1i s\u1ed1&nbsp;<code>label<\/code>,&nbsp;<code>tags<\/code>, v\u00e0&nbsp;<code>linodes<\/code>s\u1eed d\u1ee5ng&nbsp;<a href=\"https:\/\/www.terraform.io\/docs\/configuration\/variables.html\" target=\"_blank\" rel=\"noreferrer noopener\">c\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o<\/a>&nbsp;, cho ph\u00e9p t\u00f9y ch\u1ec9nh c\u00e1c gi\u00e1 tr\u1ecb n\u00e0y khi s\u1eed d\u1ee5ng m\u00f4-\u0111un cho c\u1ea5u h\u00ecnh t\u00e0i nguy\u00ean c\u1ee7a b\u1ea1n.<\/li>\n<\/ul>\n<p>2.T\u1ea1o&nbsp;<code>variables.tf<\/code>t\u1ec7p \u0111\u1ec3 khai b\u00e1o&nbsp;<code>inbound_ssh<\/code>c\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o c\u1ee7a m\u00f4-\u0111un. Sao ch\u00e9p v\u00e0 l\u01b0u n\u1ed9i dung c\u1ee7a v\u00ed d\u1ee5 b\u00ean d\u01b0\u1edbi.<\/p>\n<pre class=\"wp-block-code\"><code>variable \"linodes\" {\n  description = \"List of Linode ids to which the rule sets will be applied\"\n  type        = list(string)\n  default     = &#91;]\n}\n\nvariable \"firewall_label\" {\n  description = \"This firewall's human-readable firewall_label\"\n  type = string\n  default = \"my-firewall\"\n}\n\nvariable \"tags\" {\n  description = \"List of tags to apply to this Firewall\"\n  type        = list(string)\n  default     = &#91;]\n}<\/code><\/pre>\n<p>C\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o \u0111\u01b0\u1ee3c khai b\u00e1o trong t\u1ec7p n\u00e0y t\u01b0\u01a1ng \u1ee9ng v\u1edbi&nbsp;<code>linode_firewalls<\/code>c\u00e1c \u0111\u1ed1i s\u1ed1 t\u00e0i nguy\u00ean m\u00e0&nbsp;<code>inbound_ssh<\/code>m\u00f4-\u0111un \u0111\u01b0a ra \u0111\u1ec3 t\u00f9y ch\u1ec9nh. T\u01b0\u01a1ng t\u1ef1 nh\u01b0 v\u1eady, b\u1ea1n c\u00f3 th\u1ec3 \u0111\u01b0a ra c\u00e1c \u0111\u1ed1i s\u1ed1 kh\u00e1c nhau cho c\u00e1c m\u00f4-\u0111un con Cloud Firewall c\u1ee7a m\u00ecnh khi c\u1ea7n.<\/p>\n<h3 id=\"create-the-mysql-child-module\">T\u1ea1o m\u00f4-\u0111un con MySQL<a href=\"https:\/\/www.linode.com\/docs\/guides\/how-to-deploy-secure-linodes-using-cloud-firewalls-and-terraform\/#create-the-mysql-child-module\"><\/a><\/h3>\n<p>M\u00f4&nbsp;<code>mysql<\/code>-\u0111un con t\u1ea1o ra m\u1ed9t T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y v\u1edbi m\u1ed9t quy t\u1eafc g\u1eedi \u0111\u1ebfn th\u01b0\u1eddng ph\u00f9 h\u1ee3p v\u1edbi c\u00e1c k\u1ebft n\u1ed1i m\u00e1y kh\u00e1ch \u0111\u1ebfn m\u00e1y ch\u1ee7 c\u01a1 s\u1edf d\u1eef li\u1ec7u MySQL. Quy t\u1eafc g\u1eedi \u0111\u1ebfn cho ph\u00e9p&nbsp;<code>TCP<\/code>k\u1ebft n\u1ed1i \u0111\u1ebfn c\u1ed5ng&nbsp;<code>3306<\/code>.&nbsp;<code>addressses<\/code>\u0110\u1ed1i s\u1ed1 ch\u1ea5p nh\u1eadn m\u1ed9t bi\u1ebfn \u0111\u1ea7u v\u00e0o \u0111\u1ec3 c\u00f3 th\u1ec3 t\u00f9y ch\u1ec9nh nh\u1eb1m h\u1ea1n ch\u1ebf quy\u1ec1n truy c\u1eadp v\u00e0o m\u1ed9t \u0111\u1ecba ch\u1ec9 IP c\u1ee5 th\u1ec3 ho\u1eb7c kh\u1ed1i CIDR.<\/p>\n<p>1.S\u1eed d\u1ee5ng tr\u00ecnh so\u1ea1n th\u1ea3o v\u0103n b\u1ea3n \u01b0a th\u00edch c\u1ee7a b\u1ea1n, t\u1ea1o t\u1ec7p&nbsp;<code>inbound_ssh<\/code>m\u00f4-\u0111un&nbsp;<code>main.tf<\/code>. Sao ch\u00e9p v\u00e0 l\u01b0u n\u1ed9i dung c\u1ee7a v\u00ed d\u1ee5 b\u00ean d\u01b0\u1edbi.<\/p>\n<pre class=\"wp-block-code\"><code>terraform {\n  required_providers {\n    linode = {\n      source = \"linode\/linode\"\n      version = \"1.16.0\"\n    }\n  }\n}\n\nresource \"linode_firewall\" \"mysql\" {\n  label = var.firewall_label\n  tags  = var.tags\n\n  inbound {\n    protocol = \"TCP\"\n    ports = &#91;\"3306\"]\n    addresses = var.addresses\n  }\n  linodes = var.linodes\n}<\/code><\/pre>\n<ul>\n<li>T\u1ec7p n\u00e0y s\u1eed d\u1ee5ng t\u00e0i nguy\u00ean c\u1ee7a Nh\u00e0 cung c\u1ea5p Terraform Linode&nbsp;<code>linode_firewall<\/code>\u0111\u1ec3 t\u1ea1o T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y v\u1edbi c\u00e1c quy t\u1eafc \u0111\u1ebfn \u0111\u01b0\u1ee3c m\u00f4 t\u1ea3 \u1edf tr\u00ean.<\/li>\n<li>\u0110\u1ed1i&nbsp;<code>linodes<\/code>s\u1ed1 mong \u0111\u1ee3i m\u1ed9t danh s\u00e1ch ID Linode. Khi ID Linode \u0111\u01b0\u1ee3c truy\u1ec1n cho&nbsp;<code>linodes<\/code>\u0111\u1ed1i s\u1ed1,&nbsp;<code>mysql<\/code>t\u01b0\u1eddng l\u1eeda s\u1ebd \u0111\u01b0\u1ee3c g\u00e1n cho ID \u0111\u00f3.<\/li>\n<li>C\u00e1c \u0111\u1ed1i s\u1ed1&nbsp;<code>label<\/code>,&nbsp;<code>tags<\/code>,&nbsp;<code>linodes<\/code>, v\u00e0&nbsp;<code>addresses<\/code>s\u1eed d\u1ee5ng&nbsp;<a href=\"https:\/\/www.terraform.io\/docs\/configuration\/variables.html\" target=\"_blank\" rel=\"noreferrer noopener\">c\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o<\/a>&nbsp;, cho ph\u00e9p t\u00f9y ch\u1ec9nh c\u00e1c gi\u00e1 tr\u1ecb n\u00e0y khi s\u1eed d\u1ee5ng m\u00f4-\u0111un cho c\u1ea5u h\u00ecnh t\u00e0i nguy\u00ean c\u1ee7a b\u1ea1n.<\/li>\n<\/ul>\n<p>2.T\u1ea1o&nbsp;<code>variables.tf<\/code>t\u1ec7p \u0111\u1ec3 khai b\u00e1o&nbsp;<code>inbound_ssh<\/code>c\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o c\u1ee7a m\u00f4-\u0111un. Sao ch\u00e9p v\u00e0 l\u01b0u n\u1ed9i dung c\u1ee7a v\u00ed d\u1ee5 b\u00ean d\u01b0\u1edbi.<\/p>\n<pre class=\"wp-block-code\"><code>variable \"linodes\" {\n  description = \"List of Linode ids to which the rule sets will be applied\"\n  type        = list(string)\n  default     = &#91;]\n}\n\nvariable \"firewall_label\" {\n  description = \"This firewall's human-readable firewall_label\"\n  type = string\n  default = \"my-firewall\"\n}\n\nvariable \"tags\" {\n  description = \"List of tags to apply to this Firewall\"\n  type        = list(string)\n  default     = &#91;]\n}\n\nvariable \"addresses\" {\n  description = \"A list of IP addresses, CIDR blocks, or 0.0.0.0\/0 (to allow all) this rule applies to.\"\n  type        = list(string)\n  default     = &#91;\"0.0.0.0\/0\"]\n}<\/code><\/pre>\n<p>C\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o \u0111\u01b0\u1ee3c khai b\u00e1o trong t\u1ec7p n\u00e0y t\u01b0\u01a1ng \u1ee9ng v\u1edbi&nbsp;<code>linode_firewalls<\/code>c\u00e1c \u0111\u1ed1i s\u1ed1 t\u00e0i nguy\u00ean m\u00e0&nbsp;<code>mysql<\/code>m\u00f4-\u0111un \u0111\u01b0a ra \u0111\u1ec3 t\u00f9y ch\u1ec9nh.<\/p>\n<h3 id=\"create-the-web-server-child-module\">T\u1ea1o M\u00f4-\u0111un con c\u1ee7a M\u00e1y ch\u1ee7 Web<a href=\"https:\/\/www.linode.com\/docs\/guides\/how-to-deploy-secure-linodes-using-cloud-firewalls-and-terraform\/#create-the-web-server-child-module\"><\/a><\/h3>\n<p>Khi \u0111\u01b0\u1ee3c \u00e1p d\u1ee5ng, m\u00f4&nbsp;<code>web_server<\/code>-\u0111un con s\u1ebd t\u1ea1o ra T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y v\u1edbi c\u00e1c quy t\u1eafc v\u00e0o v\u00e0 ra cho ph\u00e9p c\u00e1c k\u1ebft n\u1ed1i v\u00e0o v\u00e0 ra t\u1eeb m\u1ecdi ngu\u1ed3n v\u00e0 \u0111\u00edch \u0111\u1ebfn \u0111\u1ebfn c\u00e1c c\u1ed5ng&nbsp;<code>80<\/code>v\u00e0&nbsp;<code>443<\/code>qua&nbsp;<code>TCP<\/code>. C\u00e1c c\u1ed5ng n\u00e0y th\u01b0\u1eddng \u0111\u01b0\u1ee3c li\u00ean k\u1ebft v\u1edbi&nbsp;<a href=\"https:\/\/en.wikipedia.org\/wiki\/Hypertext_Transfer_Protocol\" target=\"_blank\" rel=\"noreferrer noopener\">HTTP<\/a>&nbsp;v\u00e0&nbsp;<a href=\"https:\/\/en.wikipedia.org\/wiki\/HTTPS\" target=\"_blank\" rel=\"noreferrer noopener\">HTTPS<\/a>&nbsp;.<\/p>\n<p>1.S\u1eed d\u1ee5ng tr\u00ecnh so\u1ea1n th\u1ea3o v\u0103n b\u1ea3n \u01b0a th\u00edch c\u1ee7a b\u1ea1n, t\u1ea1o t\u1ec7p&nbsp;<code>web_server<\/code>m\u00f4-\u0111un&nbsp;<code>main.tf<\/code>. Sao ch\u00e9p v\u00e0 l\u01b0u n\u1ed9i dung c\u1ee7a v\u00ed d\u1ee5 b\u00ean d\u01b0\u1edbi.<\/p>\n<pre class=\"wp-block-code\"><code>terraform {\n  required_providers {\n    linode = {\n      source = \"linode\/linode\"\n      version = \"1.16.0\"\n    }\n  }\n}\n\nresource \"linode_firewall\" \"web_server\" {\n  label = var.firewall_label\n  tags  = var.tags\n\n  inbound {\n    protocol = \"TCP\"\n    ports = &#91;\"80\"]\n    addresses = &#91;\"0.0.0.0\/0\"]\n  }\n\n  outbound {\n    protocol  = \"TCP\"\n    ports     = &#91;\"80\"]\n    addresses = &#91;\"0.0.0.0\/0\"]\n  }\n\n  inbound {\n    protocol = \"TCP\"\n    ports = &#91;\"443\"]\n    addresses = &#91;\"0.0.0.0\/0\"]\n  }\n\n  outbound {\n    protocol  = \"TCP\"\n    ports     = &#91;\"443\"]\n    addresses = &#91;\"0.0.0.0\/0\"]\n  }\n\n  linodes = var.linodes\n}<\/code><\/pre>\n<ul>\n<li>T\u1ec7p n\u00e0y s\u1eed d\u1ee5ng t\u00e0i nguy\u00ean c\u1ee7a Nh\u00e0 cung c\u1ea5p Terraform Linode&nbsp;<code>linode_firewall<\/code>\u0111\u1ec3 t\u1ea1o T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y v\u1edbi c\u00e1c quy t\u1eafc \u0111\u1ebfn v\u00e0 \u0111i \u0111\u01b0\u1ee3c m\u00f4 t\u1ea3 \u1edf tr\u00ean.<\/li>\n<li>\u0110\u1ed1i&nbsp;<code>linodes<\/code>s\u1ed1 mong \u0111\u1ee3i m\u1ed9t danh s\u00e1ch ID Linode. Khi ID Linode \u0111\u01b0\u1ee3c truy\u1ec1n cho&nbsp;<code>linodes<\/code>\u0111\u1ed1i s\u1ed1,&nbsp;<code>web_server<\/code>t\u01b0\u1eddng l\u1eeda s\u1ebd \u0111\u01b0\u1ee3c g\u00e1n cho ID \u0111\u00f3.<\/li>\n<li>C\u00e1c \u0111\u1ed1i s\u1ed1&nbsp;<code>label<\/code>,&nbsp;<code>tags<\/code>, v\u00e0&nbsp;<code>linodes<\/code>s\u1eed d\u1ee5ng&nbsp;<a href=\"https:\/\/www.terraform.io\/docs\/configuration\/variables.html\" target=\"_blank\" rel=\"noreferrer noopener\">c\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o<\/a>&nbsp;, cho ph\u00e9p t\u00f9y ch\u1ec9nh c\u00e1c gi\u00e1 tr\u1ecb n\u00e0y khi s\u1eed d\u1ee5ng m\u00f4-\u0111un cho c\u1ea5u h\u00ecnh t\u00e0i nguy\u00ean c\u1ee7a b\u1ea1n.<\/li>\n<\/ul>\n<p>2.T\u1ea1o&nbsp;<code>variables.tf<\/code>t\u1ec7p \u0111\u1ec3 khai b\u00e1o&nbsp;<code>web_server<\/code>c\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o c\u1ee7a m\u00f4-\u0111un. Sao ch\u00e9p v\u00e0 l\u01b0u n\u1ed9i dung c\u1ee7a v\u00ed d\u1ee5 b\u00ean d\u01b0\u1edbi.<\/p>\n<pre class=\"wp-block-code\"><code>variable \"linodes\" {\n  description = \"List of Linode ids to which the rule sets will be applied\"\n  type        = list(string)\n  default     = &#91;]\n}\n\nvariable \"firewall_label\" {\n  description = \"This firewall's human-readable firewall_label\"\n  type = string\n  default = \"my-firewall\"\n}\n\nvariable \"tags\" {\n  description = \"List of tags to apply to this Firewall\"\n  type        = list(string)\n  default     = &#91;]\n}<\/code><\/pre>\n<ol>\n<li>C\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o \u0111\u01b0\u1ee3c khai b\u00e1o trong t\u1ec7p n\u00e0y t\u01b0\u01a1ng \u1ee9ng v\u1edbi&nbsp;<code>linode_firewalls<\/code>c\u00e1c \u0111\u1ed1i s\u1ed1 t\u00e0i nguy\u00ean m\u00e0&nbsp;<code>web_server<\/code>m\u00f4-\u0111un \u0111\u01b0a ra \u0111\u1ec3 t\u00f9y ch\u1ec9nh.<\/li>\n<\/ol>\n<h3 id=\"create-the-root-module\">T\u1ea1o m\u00f4-\u0111un g\u1ed1c<a href=\"https:\/\/www.linode.com\/docs\/guides\/how-to-deploy-secure-linodes-using-cloud-firewalls-and-terraform\/#create-the-root-module\"><\/a><\/h3>\n<p>B\u00e2y gi\u1edd t\u1ea5t c\u1ea3 c\u00e1c m\u00f4-\u0111un con c\u1ee7a Cloud Firewall \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea1o, b\u1ea1n c\u00f3 th\u1ec3 t\u1ea1o m\u00f4-\u0111un g\u1ed1c c\u1ee7a m\u00ecnh. M\u00f4-\u0111un g\u1ed1c ch\u1ecbu tr\u00e1ch nhi\u1ec7m x\u00e1c \u0111\u1ecbnh c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng s\u1ebd \u0111\u01b0\u1ee3c Terraform x\u00e2y d\u1ef1ng. M\u00f4-\u0111un g\u1ed1c c\u00f3 quy\u1ec1n truy c\u1eadp v\u00e0o t\u1ea5t c\u1ea3 c\u00e1c m\u00f4-\u0111un con v\u00e0 c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng t\u1ea5t c\u1ea3 ho\u1eb7c kh\u00f4ng s\u1eed d\u1ee5ng m\u00f4-\u0111un n\u00e0o trong s\u1ed1 ch\u00fang. Trong ph\u1ea7n n\u00e0y, b\u1ea1n s\u1ebd t\u1ea1o m\u1ed9t m\u00f4-\u0111un g\u1ed1c c\u00f3 th\u1ec3 t\u1ea1o Cloud Firewall b\u1eb1ng c\u00e1c quy t\u1eafc \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh trong&nbsp;<code>web_server<\/code>m\u00f4-\u0111un con. N\u00f3 c\u0169ng t\u1ea1o hai phi\u00ean b\u1ea3n Linode v\u00e0 ch\u1ec9 \u0111\u1ecbnh Cloud Firewall cho c\u1ea3 hai phi\u00ean b\u1ea3n Linode.<\/p>\n<p>1.S\u1eed d\u1ee5ng tr\u00ecnh so\u1ea1n th\u1ea3o v\u0103n b\u1ea3n \u01b0a th\u00edch c\u1ee7a b\u1ea1n, t\u1ea1o t\u1ec7p m\u00f4-\u0111un g\u1ed1c&nbsp;<code>main.tf<\/code>. Sao ch\u00e9p v\u00e0 l\u01b0u n\u1ed9i dung c\u1ee7a v\u00ed d\u1ee5 b\u00ean d\u01b0\u1edbi.<\/p>\n<pre class=\"wp-block-code\"><code>terraform {\n  required_providers {\n    linode = {\n      source = \"linode\/linode\"\n      version = \"1.16.0\"\n    }\n  }\n}\n\nprovider \"linode\" {\n    api_version = \"v4beta\"\n    token = var.token\n}\n\nlocals {\n    key = var.key\n    linode_ids = linode_instance.linode_base&#91;*].id\n}\n\nmodule \"firewalls_web\" {\n    source = \".\/modules\/web_server\"\n    firewall_label = var.firewall_label_map&#91;\"web\"]\n    tags = var.tags\n    linodes = local.linode_ids\n}\n\nresource \"linode_sshkey\" \"main_key\" {\n    label = var.key_label\n    ssh_key = chomp(file(local.key))\n}\n\nresource \"linode_instance\" \"linode_base\" {\n    count = var.linode_count\n    image = var.image\n    label = \"${var.label}_${count.index}\"\n    region = var.region\n    type = var.type\n    authorized_keys = &#91; linode_sshkey.main_key.ssh_key ]\n    root_pass = var.root_pass\n}<\/code><\/pre>\n<ul>\n<li>Kh\u1ed1i n\u00e0y&nbsp;<code>provider<\/code>l\u00e0 y\u00eau c\u1ea7u b\u1eaft bu\u1ed9c \u0111\u1ec3 s\u1eed d\u1ee5ng nh\u00e0 cung c\u1ea5p Linode. V\u00ec Cloud Firewall hi\u1ec7n \u0111ang trong giai \u0111o\u1ea1n beta m\u1edf, b\u1ea1n ph\u1ea3i s\u1eed d\u1ee5ng&nbsp;<code>api_version<\/code>\u0111\u1ed1i s\u1ed1 \u0111\u1ec3 y\u00eau c\u1ea7u Terraform s\u1eed d\u1ee5ng&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/api\/\">\u0111i\u1ec3m cu\u1ed1i API beta v4<\/a>&nbsp;c\u1ee7a Linode .<\/li>\n<li>Kh\u1ed1i n\u00e0y&nbsp;<code>locals<\/code>khai b\u00e1o m\u1ed9t bi\u1ebfn c\u1ee5c b\u1ed9&nbsp;<code>key<\/code>c\u00f3 gi\u00e1 tr\u1ecb s\u1ebd \u0111\u01b0\u1ee3c cung c\u1ea5p b\u1edfi m\u1ed9t bi\u1ebfn \u0111\u1ea7u v\u00e0o.&nbsp;<code>linode_ids<\/code>Bi\u1ebfn c\u1ee5c b\u1ed9 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng b\u1edfi&nbsp;<code>web_server<\/code>phi\u00ean b\u1ea3n m\u00f4-\u0111un trong kh\u1ed1i ti\u1ebfp theo \u0111\u1ec3 l\u1ea5y ID Linode cho c\u00e1c Linode \u0111\u01b0\u1ee3c ch\u1ec9 \u0111\u1ecbnh cho Cloud Firewall s\u1ebd \u0111\u01b0\u1ee3c t\u1ea1o.<\/li>\n<li>Kh\u1ed1i n\u00e0y&nbsp;<code>module \"firewalls_web\"<\/code>t\u1ea1o ra m\u1ed9t phi\u00ean b\u1ea3n c\u1ee7a&nbsp;<code>web_server<\/code>m\u00f4-\u0111un con, khi \u00e1p d\u1ee5ng s\u1ebd t\u1ea1o ra m\u1ed9t Cloud Firewall m\u1edbi v\u1edbi c\u00e1c c\u1ea5u h\u00ecnh do m\u00f4-\u0111un con cung c\u1ea5p v\u00e0 c\u00e1c gi\u00e1 tr\u1ecb bi\u1ebfn \u0111\u1ea7u v\u00e0o m\u00e0 b\u1ea1n s\u1ebd cung c\u1ea5p \u1edf b\u01b0\u1edbc sau.<\/li>\n<li>\u0110\u1ed1i s\u1ed1 n\u00e0y&nbsp;<code>source<\/code>cung c\u1ea5p v\u1ecb tr\u00ed c\u1ee7a m\u00e3 ngu\u1ed3n m\u00f4-\u0111un con v\u00e0 l\u00e0 b\u1eaft bu\u1ed9c b\u1ea5t c\u1ee9 khi n\u00e0o b\u1ea1n t\u1ea1o m\u1ed9t phi\u00ean b\u1ea3n c\u1ee7a m\u00f4-\u0111un.<\/li>\n<li>T\u1ea5t c\u1ea3 c\u00e1c \u0111\u1ed1i s\u1ed1 kh\u00e1c \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh b\u1edfi m\u00f4-\u0111un con. V\u00ec&nbsp;<code>web_server<\/code>m\u00f4-\u0111un con hi\u1ec3n th\u1ecb c\u00e1c gi\u00e1 tr\u1ecb&nbsp;<code>firewall_label<\/code>,&nbsp;<code>tags<\/code>, v\u00e0&nbsp;<code>linodes<\/code>, ph\u1ea3i \u0111\u01b0\u1ee3c cung c\u1ea5p cho ch\u00fang. C\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng trong m\u00f4-\u0111un g\u1ed1c \u0111\u1ec3 l\u00e0m cho n\u00f3 c\u00f3 th\u1ec3 t\u00e1i s\u1eed d\u1ee5ng. T\u00f9y thu\u1ed9c v\u00e0o m\u00f4-\u0111un con m\u00e0 b\u1ea1n \u0111ang s\u1eed d\u1ee5ng v\u00e0 nh\u00e3n b\u1ea1n mu\u1ed1n g\u00e1n cho Cloud Firewall, b\u1ea1n n\u00ean thay th\u1ebf gi\u00e1 tr\u1ecb kh\u00f3a cho&nbsp;<code>var.firewall_label_map[\"web\"]<\/code>. Tham kh\u1ea3o t\u1ec7p&nbsp;<code>variables.tf<\/code>\u0111\u1ec3 bi\u1ebft chi ti\u1ebft.<\/li>\n<li>\u0110\u1ed1i&nbsp;<code>linodes<\/code>s\u1ed1 l\u1ea5y gi\u00e1 tr\u1ecb c\u1ee7a n\u00f3 t\u1eeb bi\u1ebfn c\u1ee5c b\u1ed9 \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh trong kh\u1ed1i tr\u01b0\u1edbc \u0111\u00f3.<\/li>\n<li>T\u00e0i&nbsp;<code>linode_sshkey<\/code>nguy\u00ean s\u1ebd t\u1ea1o Linode SSH Keys \u0111\u01b0\u1ee3c li\u00ean k\u1ebft v\u1edbi t\u00e0i kho\u1ea3n Linode c\u1ee7a b\u1ea1n. C\u00e1c kh\u00f3a n\u00e0y c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng l\u1ea1i cho c\u00e1c l\u1ea7n tri\u1ec3n khai Linode trong t\u01b0\u01a1ng lai sau khi t\u00e0i nguy\u00ean \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea1o.<\/li>\n<li><code>ssh_key = chomp(file(local.key))<\/code>s\u1eed d\u1ee5ng h\u00e0m t\u00edch h\u1ee3p c\u1ee7a Terraform&nbsp;<code>file()<\/code>\u0111\u1ec3 cung c\u1ea5p \u0111\u01b0\u1eddng d\u1eabn t\u1ec7p c\u1ee5c b\u1ed9 \u0111\u1ebfn v\u1ecb tr\u00ed kh\u00f3a SSH c\u00f4ng khai c\u1ee7a b\u1ea1n. V\u1ecb tr\u00ed c\u1ee7a \u0111\u01b0\u1eddng d\u1eabn t\u1ec7p l\u00e0 gi\u00e1 tr\u1ecb c\u1ee7a bi\u1ebfn c\u1ee5c b\u1ed9&nbsp;<code>key<\/code>.&nbsp;<code>chomp()<\/code>H\u00e0m t\u00edch h\u1ee3p x\u00f3a c\u00e1c d\u00f2ng m\u1edbi theo sau kh\u1ecfi kh\u00f3a SSH.<\/li>\n<li>T\u00e0i nguy\u00ean n\u00e0y&nbsp;<code>linode_instance<\/code>t\u1ea1o ra hai phi\u00ean b\u1ea3n Linode v\u1edbi c\u00e1c c\u1ea5u h\u00ecnh \u0111\u01b0\u1ee3c cung c\u1ea5p b\u1edfi c\u00e1c \u0111\u1ed1i s\u1ed1 c\u1ee7a n\u00f3.<\/li>\n<li>\u0110\u1ed1i s\u1ed1 n\u00e0y&nbsp;<code>count<\/code>ki\u1ec3m so\u00e1t s\u1ed1 l\u01b0\u1ee3ng phi\u00ean b\u1ea3n Linode s\u1ebd \u0111\u01b0\u1ee3c t\u1ea1o b\u1eb1ng c\u00e1c c\u1ea5u h\u00ecnh \u0111\u01b0\u1ee3c cung c\u1ea5p trong c\u00e1c \u0111\u1ed1i s\u1ed1 c\u1ee7a kh\u1ed1i t\u00e0i nguy\u00ean.<\/li>\n<li>V\u00ec nh\u00e3n Linode ph\u1ea3i l\u00e0 duy nh\u1ea5t n\u00ean&nbsp;<code>label<\/code>\u0111\u1ed1i s\u1ed1 s\u1ebd t\u1ea1o nh\u00e3n d\u1ef1a tr\u00ean gi\u00e1 tr\u1ecb \u0111\u01b0\u1ee3c cung c\u1ea5p cho&nbsp;<code>var.label<\/code>bi\u1ebfn \u0111\u1ea7u v\u00e0o v\u00e0 s\u1ed1 ch\u1ec9 m\u1ee5c bi\u1ec3u th\u1ecb phi\u00ean b\u1ea3n Linode \u0111\u01b0\u1ee3c t\u1ea1o.<\/li>\n<li>\u0110\u1ed1i&nbsp;<code>authorized_keys<\/code>s\u1ed1 s\u1eed d\u1ee5ng kh\u00f3a c\u00f4ng khai SSH do&nbsp;<code>linode_sshkey<\/code>t\u00e0i nguy\u00ean trong kh\u1ed1i t\u00e0i nguy\u00ean tr\u01b0\u1edbc \u0111\u00f3 cung c\u1ea5p.<\/li>\n<\/ul>\n<p>2.T\u1ea1o&nbsp;<code>variables.tf<\/code>t\u1ec7p \u0111\u1ec3 khai b\u00e1o c\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o c\u1ee7a m\u00f4-\u0111un g\u1ed1c. C\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o n\u00e0y l\u00e0 s\u1ef1 k\u1ebft h\u1ee3p c\u1ee7a t\u1ea5t c\u1ea3 c\u00e1c gi\u00e1 tr\u1ecb \u0111\u01b0\u1ee3c y\u00eau c\u1ea7u b\u1edfi c\u00e1c t\u00e0i nguy\u00ean kh\u00e1c nhau \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng trong t\u1ec7p&nbsp;<code>main.tf<\/code>. B\u1ea1n c\u00f3 th\u1ec3 c\u1eadp nh\u1eadt c\u00e1c gi\u00e1 tr\u1ecb m\u1eb7c \u0111\u1ecbnh theo s\u1edf th\u00edch c\u1ee7a ri\u00eang b\u1ea1n.<\/p>\n<pre class=\"wp-block-code\"><code>variable \"token\" {\n  description = \" Linode API token\"\n}\n\nvariable \"key\" {\n  description = \"Public SSH Key's path.\"\n}\n\nvariable \"key_label\" {\n  description = \"New SSH key label.\"\n}\n\nvariable \"linode_count\" {\n  description = \"The number of Linode instances to deploy.\"\n  type = number\n  default = 1\n}\n\nvariable \"image\" {\n  description = \"Image to use for Linode instance.\"\n  default = \"linode\/ubuntu18.04\"\n}\n\nvariable \"label\" {\n  description = \"The Linode's label is for display purposes only, but must be unique.\"\n  default = \"default-linode\"\n}\n\nvariable \"region\" {\n  description = \"The region where your Linode will be located.\"\n  default = \"us-east\"\n}\n\nvariable \"type\" {\n  description = \"Your Linode's plan type.\"\n  default = \"g6-standard-1\"\n}\n\nvariable \"root_pass\" {\n  description = \"Your Linode's root user's password.\"\n}\n\nvariable \"linodes\" {\n  description = \"List of Linode ids to which the rule sets will be applied\"\n  type        = list(string)\n  default     = &#91;]\n}\n\nvariable \"firewall_label_map\" {\n  type = \"map\"\n  default = {\n    \"web\" = \"firewall_web_server\"\n    \"mysql\" = \"firewall_mysql\"\n    \"ssh\" = \"firewall_ssh\"\n  }\n}\n\nvariable \"tags\" {\n  description = \"List of tags to apply to this Firewall\"\n  type        = list(string)\n  default     = &#91;]\n}<\/code><\/pre>\n<p>Khai b\u00e1o bi\u1ebfn cho&nbsp;<code>firewall_label_map<\/code>, theo m\u1eb7c \u0111\u1ecbnh, t\u1ea1o m\u1ed9t b\u1ea3n \u0111\u1ed3 v\u1edbi c\u00e1c kh\u00f3a m\u1eb7c \u0111\u1ecbnh&nbsp;<code>web<\/code>l\u00e0 ,&nbsp;<code>mysql<\/code>, v\u00e0&nbsp;<code>ssh<\/code>. B\u1ea1n c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng c\u00e1c kh\u00f3a n\u00e0y \u0111\u1ec3 cung c\u1ea5p c\u00e1c gi\u00e1 tr\u1ecb m\u1eb7c \u0111\u1ecbnh c\u1ee7a b\u1ea3n \u0111\u1ed3 cho&nbsp;<code>firewall_label<\/code>\u0111\u1ed1i s\u1ed1. Ngo\u00e0i ra, b\u1ea1n c\u00f3 th\u1ec3 ghi \u0111\u00e8 c\u00e1c gi\u00e1 tr\u1ecb m\u1eb7c \u0111\u1ecbnh trong t\u1ec7p&nbsp;<code>terraform.tfvars<\/code>m\u00e0 b\u1ea1n s\u1ebd t\u1ea1o \u1edf b\u01b0\u1edbc sau.<\/p>\n<p>3.T\u1ea1o&nbsp;<code>outputs.tf<\/code>t\u1ec7p. T\u1ec7p n\u00e0y hi\u1ec3n th\u1ecb ID c\u1ee7a c\u00e1c phi\u00ean b\u1ea3n Linode \u0111\u01b0\u1ee3c t\u1ea1o b\u1edfi&nbsp;<code>linode_instance<\/code>kh\u1ed1i t\u00e0i nguy\u00ean v\u00e0 s\u1ebd \u0111\u01b0\u1ee3c in ra b\u1ea3ng \u0111i\u1ec1u khi\u1ec3n c\u1ee7a b\u1ea1n khi c\u1ea5u h\u00ecnh c\u1ee7a m\u00f4-\u0111un g\u1ed1c \u0111\u01b0\u1ee3c \u00e1p d\u1ee5ng.<\/p>\n<pre class=\"wp-block-code\"><code>output \"linode_id\" {\n    value = linode_instance.linode_base&#91;*].id\n}<\/code><\/pre>\n<p>4.T\u1ea1o&nbsp;<code>terraform.tfvars<\/code>t\u1ec7p \u0111\u1ec3 cung c\u1ea5p gi\u00e1 tr\u1ecb cho t\u1ea5t c\u1ea3 c\u00e1c bi\u1ebfn \u0111\u1ea7u v\u00e0o \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh trong&nbsp;<code>variables.tf<\/code>t\u1ec7p. T\u1ec7p n\u00e0y s\u1ebd lo\u1ea1i tr\u1eeb b\u1ea5t k\u1ef3 gi\u00e1 tr\u1ecb n\u00e0o cung c\u1ea5p d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m, nh\u01b0 m\u1eadt kh\u1ea9u v\u00e0 m\u00e3 th\u00f4ng b\u00e1o API. M\u1ed9t t\u1ec7p ch\u1ee9a c\u00e1c gi\u00e1 tr\u1ecb nh\u1ea1y c\u1ea3m s\u1ebd \u0111\u01b0\u1ee3c t\u1ea1o \u1edf b\u01b0\u1edbc ti\u1ebfp theo. B\u1ea1n c\u00f3 th\u1ec3 thay th\u1ebf b\u1ea5t k\u1ef3 gi\u00e1 tr\u1ecb n\u00e0o trong s\u1ed1 n\u00e0y b\u1eb1ng gi\u00e1 tr\u1ecb c\u1ee7a ri\u00eang b\u1ea1n.<\/p>\n<pre class=\"wp-block-code\"><code>key = \"~\/.ssh\/id_rsa.pub\"\nlinode_count = 3\nkey_label = \"my-ssh-key\"\nlabel = \"linode\"\ntags = &#91;\"my-example-tag\"]\nfirewall_label_map = {\n    \"web\" = \"firewall_webserver_http_https\"\n}<\/code><\/pre>\n<p>5.T\u1ea1o m\u1ed9t t\u1ec7p c\u00f3 t\u00ean&nbsp;<code>secrets.tfvars<\/code>\u0111\u1ec3 l\u01b0u tr\u1eef b\u1ea5t k\u1ef3 gi\u00e1 tr\u1ecb nh\u1ea1y c\u1ea3m n\u00e0o. Thay th\u1ebf c\u00e1c gi\u00e1 tr\u1ecb v\u00ed d\u1ee5 b\u1eb1ng gi\u00e1 tr\u1ecb c\u1ee7a ri\u00eang b\u1ea1n.<\/p>\n<pre class=\"wp-block-code\"><code>token = \"my-api-v4-token\"\nroot_pass = \"my-super-strong-root-password\"<\/code><\/pre>\n<p class=\"has-background\" style=\"background-color:#74f78c33\">Ghi ch\u00fa: T\u1ec7p n\u00e0y kh\u00f4ng bao gi\u1edd \u0111\u01b0\u1ee3c theo d\u00f5i trong ph\u1ea7n m\u1ec1m ki\u1ec3m so\u00e1t phi\u00ean b\u1ea3n v\u00e0 ph\u1ea3i \u0111\u01b0\u1ee3c li\u1ec7t k\u00ea trong&nbsp;<code>.gitignore<\/code>t\u1ec7p c\u1ee7a b\u1ea1n n\u1ebfu s\u1eed d\u1ee5ng GitHub.<\/p>\n<p>B\u00e2y gi\u1edd b\u1ea1n \u0111\u00e3 s\u1eb5n s\u00e0ng \u00e1p d\u1ee5ng&nbsp;<code>main_firewalls<\/code>c\u1ea5u h\u00ecnh Terraform c\u1ee7a m\u00f4-\u0111un. C\u00e1c b\u01b0\u1edbc n\u00e0y s\u1ebd \u0111\u01b0\u1ee3c ho\u00e0n t\u1ea5t trong ph\u1ea7n ti\u1ebfp theo.<\/p>\n<h2 id=\"initialize-plan-and-apply-the-terraform-configuration\">Kh\u1edfi t\u1ea1o, l\u1eadp k\u1ebf ho\u1ea1ch v\u00e0 \u00e1p d\u1ee5ng c\u1ea5u h\u00ecnh Terraform<a href=\"https:\/\/www.linode.com\/docs\/guides\/how-to-deploy-secure-linodes-using-cloud-firewalls-and-terraform\/#initialize-plan-and-apply-the-terraform-configuration\"><\/a><\/h2>\n<p>B\u1ea5t c\u1ee9 khi n\u00e0o m\u1ed9t nh\u00e0 cung c\u1ea5p m\u1edbi \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng trong c\u1ea5u h\u00ecnh Terraform, tr\u01b0\u1edbc ti\u00ean n\u00f3 ph\u1ea3i \u0111\u01b0\u1ee3c kh\u1edfi t\u1ea1o. Qu\u00e1 tr\u00ecnh kh\u1edfi t\u1ea1o s\u1ebd t\u1ea3i xu\u1ed1ng v\u00e0 c\u00e0i \u0111\u1eb7t plugin c\u1ee7a nh\u00e0 cung c\u1ea5p v\u00e0 th\u1ef1c hi\u1ec7n b\u1ea5t k\u1ef3 b\u01b0\u1edbc n\u00e0o kh\u00e1c c\u1ea7n thi\u1ebft \u0111\u1ec3 s\u1eed d\u1ee5ng plugin \u0111\u00f3. Tr\u01b0\u1edbc khi \u00e1p d\u1ee5ng c\u1ea5u h\u00ecnh c\u1ee7a b\u1ea1n, vi\u1ec7c xem k\u1ebf ho\u1ea1ch th\u1ef1c hi\u1ec7n c\u1ea5u h\u00ecnh c\u1ee7a b\u1ea1n tr\u01b0\u1edbc khi th\u1ef1c hi\u1ec7n b\u1ea5t k\u1ef3 thay \u0111\u1ed5i th\u1ef1c t\u1ebf n\u00e0o \u0111\u1ed1i v\u1edbi c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng c\u1ee7a b\u1ea1n c\u0169ng r\u1ea5t h\u1eefu \u00edch. Trong ph\u1ea7n n\u00e0y, b\u1ea1n s\u1ebd ho\u00e0n th\u00e0nh t\u1ea5t c\u1ea3 c\u00e1c b\u01b0\u1edbc n\u00e0y.<\/p>\n<p>1.Kh\u1edfi t\u1ea1o nh\u00e0 cung c\u1ea5p Linode. \u0110\u1ea3m b\u1ea3o b\u1ea1n \u0111ang \u1edf trong&nbsp;<code>linode_stackscripts<\/code>th\u01b0 m\u1ee5c tr\u01b0\u1edbc khi ch\u1ea1y l\u1ec7nh n\u00e0y:<\/p>\n<pre class=\"wp-block-code\"><code>terraform init<\/code><\/pre>\n<p>B\u1ea1n s\u1ebd th\u1ea5y m\u1ed9t th\u00f4ng b\u00e1o x\u00e1c nh\u1eadn r\u1eb1ng plugin c\u1ee7a nh\u00e0 cung c\u1ea5p \u0111\u00e3 \u0111\u01b0\u1ee3c kh\u1edfi t\u1ea1o th\u00e0nh c\u00f4ng.<\/p>\n<p>2.Ch\u1ea1y l\u1ec7nh Terraform plan:<\/p>\n<pre class=\"wp-block-code\"><code>terraform plan -var-file=\"secrets.tfvars\" -var-file=\"terraform.tfvars\"<\/code><\/pre>\n<p>K\u1ebf ho\u1ea1ch Terraform s\u1ebd kh\u00f4ng th\u1ef1c hi\u1ec7n b\u1ea5t k\u1ef3 h\u00e0nh \u0111\u1ed9ng n\u00e0o ho\u1eb7c th\u1ef1c hi\u1ec7n b\u1ea5t k\u1ef3 thay \u0111\u1ed5i n\u00e0o tr\u00ean t\u00e0i kho\u1ea3n Linode c\u1ee7a b\u1ea1n. Thay v\u00e0o \u0111\u00f3, m\u1ed9t ph\u00e2n t\u00edch \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh h\u00e0nh \u0111\u1ed9ng n\u00e0o (t\u1ee9c l\u00e0 t\u1ea1o, x\u00f3a ho\u1eb7c s\u1eeda \u0111\u1ed5i phi\u00ean b\u1ea3n Linode) l\u00e0 c\u1ea7n thi\u1ebft \u0111\u1ec3 \u0111\u1ea1t \u0111\u01b0\u1ee3c tr\u1ea1ng th\u00e1i \u0111\u01b0\u1ee3c m\u00f4 t\u1ea3 trong c\u1ea5u h\u00ecnh c\u1ee7a b\u1ea1n.<\/p>\n<p>2.B\u00e2y gi\u1edd b\u1ea1n \u0111\u00e3 s\u1eb5n s\u00e0ng \u0111\u1ec3 t\u1ea1o c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh trong t\u1ec7p c\u1ea5u h\u00ecnh m\u00f4-\u0111un g\u1ed1c c\u1ee7a m\u00ecnh&nbsp;<code>main.tf<\/code>:<\/p>\n<pre class=\"wp-block-code\"><code>terraform apply -var-file=\"secrets.tfvars\" -var-file=\"terraform.tfvars\"<\/code><\/pre>\n<p>V\u00ec b\u1ea1n \u0111ang s\u1eed d\u1ee5ng nhi\u1ec1u t\u1ec7p gi\u00e1 tr\u1ecb bi\u1ebfn, b\u1ea1n ph\u1ea3i g\u1ecdi t\u1eebng t\u1ec7p ri\u00eang l\u1ebb b\u1eb1ng&nbsp;<code>var-file<\/code>\u0111\u1ed1i s\u1ed1. B\u1ea1n s\u1ebd \u0111\u01b0\u1ee3c nh\u1eafc x\u00e1c nh\u1eadn h\u00e0nh&nbsp;<code>apply<\/code>\u0111\u1ed9ng. Nh\u1eadp&nbsp;<em>yes<\/em>&nbsp;v\u00e0 nh\u1ea5n&nbsp;<strong>enter<\/strong>&nbsp;. Terraform s\u1ebd b\u1eaft \u0111\u1ea7u t\u1ea1o c\u00e1c t\u00e0i nguy\u00ean b\u1ea1n \u0111\u00e3 x\u00e1c \u0111\u1ecbnh trong su\u1ed1t h\u01b0\u1edbng d\u1eabn n\u00e0y. Qu\u00e1 tr\u00ecnh n\u00e0y s\u1ebd m\u1ea5t v\u00e0i ph\u00fat \u0111\u1ec3 ho\u00e0n t\u1ea5t. Sau khi c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng \u0111\u01b0\u1ee3c x\u00e2y d\u1ef1ng th\u00e0nh c\u00f4ng, b\u1ea1n s\u1ebd th\u1ea5y \u0111\u1ea7u ra t\u01b0\u01a1ng t\u1ef1:<\/p>\n<pre class=\"wp-block-code\"><code>Apply complete! Resources: 3 added, 0 changed, 0 destroyed.<\/code><\/pre>\n<p>4.B\u1ea1n c\u00f3 th\u1ec3 x\u00e1c minh T\u01b0\u1eddng l\u1eeda \u0111\u00e1m m\u00e2y c\u1ee7a m\u00ecnh \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea1o v\u00e0 \u00e1p d\u1ee5ng cho phi\u00ean b\u1ea3n Linode m\u1edbi hay ch\u01b0a b\u1eb1ng c\u00e1ch \u0111\u0103ng nh\u1eadp v\u00e0o Tr\u00ecnh&nbsp;<a href=\"https:\/\/cloud.linode.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">qu\u1ea3n l\u00fd \u0111\u00e1m m\u00e2y Linode<\/a>&nbsp;v\u00e0 \u0111i\u1ec1u h\u01b0\u1edbng \u0111\u1ebfn ph\u1ea7n&nbsp;<strong>T\u01b0\u1eddng l\u1eeda<\/strong>&nbsp;c\u1ee7a tr\u00ecnh qu\u1ea3n l\u00fd.<\/p>\n<h2 id=\"next-steps\">C\u00e1c b\u01b0\u1edbc ti\u1ebfp theo<a href=\"https:\/\/www.linode.com\/docs\/guides\/how-to-deploy-secure-linodes-using-cloud-firewalls-and-terraform\/#next-steps\"><\/a><\/h2>\n<p>\u0110\u1ec3 t\u00ecm hi\u1ec3u c\u00e1ch&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/guides\/create-terraform-module\/#version-control-your-terraform-module\">ki\u1ec3m so\u00e1t phi\u00ean b\u1ea3n<\/a>&nbsp;m\u00f4&nbsp;<code>main-firewalls<\/code>-\u0111un m\u00e0 b\u1ea1n \u0111\u00e3 t\u1ea1o trong h\u01b0\u1edbng d\u1eabn n\u00e0y, h\u00e3y xem h\u01b0\u1edbng d\u1eabn&nbsp;<a href=\"https:\/\/www.linode.com\/docs\/guides\/create-terraform-module\/\">T\u1ea1o m\u00f4-\u0111un Terraform<\/a>&nbsp;.<\/p>\n<h2 id=\"more-information\">Th\u00f4ng tin th\u00eam<\/h2>\n<p>B\u1ea1n c\u00f3 th\u1ec3 mu\u1ed1n tham kh\u1ea3o c\u00e1c ngu\u1ed3n sau \u0111\u1ec3 bi\u1ebft th\u00eam th\u00f4ng tin v\u1ec1 ch\u1ee7 \u0111\u1ec1 n\u00e0y. M\u1eb7c d\u00f9 ch\u00fang t\u00f4i cung c\u1ea5p v\u1edbi hy v\u1ecdng r\u1eb1ng ch\u00fang s\u1ebd h\u1eefu \u00edch, nh\u01b0ng xin l\u01b0u \u00fd r\u1eb1ng ch\u00fang t\u00f4i kh\u00f4ng th\u1ec3 \u0111\u1ea3m b\u1ea3o t\u00ednh ch\u00ednh x\u00e1c ho\u1eb7c t\u00ednh k\u1ecbp th\u1eddi c\u1ee7a c\u00e1c t\u00e0i li\u1ec7u \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef b\u00ean ngo\u00e0i.<\/p>\n<ul>\n<li><a href=\"https:\/\/registry.terraform.io\/providers\/linode\/linode\/latest\/docs\" target=\"_blank\" rel=\"noreferrer noopener\">T\u00e0i li\u1ec7u ch\u00ednh th\u1ee9c c\u1ee7a Terraform Linode Provider<\/a><\/li>\n<\/ul>\n<p>Ngu\u1ed3n: https:\/\/www.linode.com\/docs\/guides\/how-to-deploy-secure-linodes-using-cloud-firewalls-and-terraform\/<\/p>\n","protected":false},"excerpt":{"rendered":"<p>C\u00e1c m\u00f4-\u0111un Terraform cho ph\u00e9p b\u1ea1n t\u1ed5 ch\u1ee9c m\u00e3 c\u1ea5u h\u00ecnh c\u1ee7a m\u00ecnh t\u1ed1t h\u01a1n v\u00e0 ph\u00e2n ph\u1ed1i v\u00e0 t\u00e1i s\u1eed d\u1ee5ng m\u00e3 \u0111\u00f3. B\u1ea1n c\u00f3 th\u1ec3 l\u01b0u tr\u1eef c\u00e1c m\u00f4-\u0111un Terraform c\u1ee7a m\u00ecnh tr\u00ean c\u00e1c d\u1ecbch v\u1ee5 ki\u1ec3m so\u00e1t phi\u00ean b\u1ea3n t\u1eeb xa, nh\u01b0 GitHub, \u0111\u1ec3 nh\u1eefng ng\u01b0\u1eddi kh\u00e1c s\u1eed d\u1ee5ng. Terraform Module Registry<\/p>\n","protected":false},"author":1,"featured_media":36202,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[126],"tags":[],"class_list":["post-35015","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-terraform"],"_links":{"self":[{"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/posts\/35015","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/comments?post=35015"}],"version-history":[{"count":0,"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/posts\/35015\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/media\/36202"}],"wp:attachment":[{"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/media?parent=35015"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/categories?post=35015"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jupitek.maudemo.vip\/index.php\/wp-json\/wp\/v2\/tags?post=35015"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}