是否有使用 terraform 的应用程序网关的 Web 重定向方法或示例？

Question

我正在尝试使用 terraform 通过应用程序网关创建 Web 重定向服务。

我想用 Azure 应用程序服务计划的免费认证 (azurm_app_service_managed_certified) 验证应用程序网关 sl，有例子吗？

目前构思如下。不过azurem_application_gateway要求ssl认证，不知道怎么操作

请告诉我是否有办法以这种方式或其他方式解决问题。

下面这个脚本的问题是，如果你想在应用程序网关中使用https，你必须使用证书，而我想在服务计划中制作和使用免费证书。

resource "azurerm_application_gateway" "app_gateway" {
  provider = azurerm.generic
    
  name                = "${local.service_name}-app-gateway"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  enable_http2        = true
    
  sku {
     name     = "Standard_Small"
     tier     = "Standard" # v1
     capacity = 2
  }
    
  gateway_ip_configuration {
     name      = "${local.service_name}-ip-config"
     subnet_id = azurerm_subnet.front_subnet.id
  }
    
  frontend_port {
     name = local.frontend_port_name
     port = 80
  }
    
  frontend_port {
     name = local.backend_port_name
     port = 443
  }
    
  frontend_ip_configuration {
     name                 = local.frontend_ip_configuration_name
     public_ip_address_id = azurerm_public_ip.pub_ip.id
  }
    
  backend_address_pool {
     name  = "${azurerm_virtual_network.vn.name}-beap"
     fqdns = [local.host_name]
  }
    
  backend_http_settings {
     name                  = local.http_setting_name
     cookie_based_affinity = "Disabled"
     port                  = 443
     protocol              = "Https"
     request_timeout       = 60
     host_name             = local.host_name
  }
    
  http_listener {
     name                           = "${local.listener_name}-http"
     frontend_ip_configuration_name = local.frontend_ip_configuration_name
     frontend_port_name             = local.frontend_port_name
     protocol                       = "Http"
  }
    
  http_listener {
     name                           = "${local.listener_name}-https"
     frontend_ip_configuration_name = local.frontend_ip_configuration_name
     frontend_port_name             = local.backend_port_name
     protocol                       = "Https"
  }
    
  request_routing_rule {
     name                       = "${local.request_routing_rule_name}-http"
     rule_type                  = "Basic"
     http_listener_name         = "${local.listener_name}-http"
     backend_address_pool_name  = local.backend_address_pool_name
     backend_http_settings_name = local.http_setting_name
  }
    
  redirect_configuration {
     name                 = local.redirect_configuration_name
     redirect_type        = "Permanent"
     include_path         = false
     include_query_string = false
     target_listener_name = "${local.listener_name}-https"
  }
    
  request_routing_rule {
     name                        = "${local.request_routing_rule_name}-https"
     rule_type                   = "Basic"
     http_listener_name          = "${local.listener_name}-https"
     redirect_configuration_name = local.redirect_configuration_name
  }
    
  lifecycle {
     ignore_changes = [
       backend_address_pool,
       backend_http_settings,
       frontend_port,
       http_listener,
       request_routing_rule,
       ssl_certificate,
       redirect_configuration
     ]
  }
}

resource "azurerm_dns_zone" "zone" {
   provider = azurerm.generic
    
   for_each            = toset(local.dns_zone_names)
   name                = each.key
   resource_group_name = azurerm_resource_group.rg.name
}
    
resource "azurerm_app_service_plan" "service_plan" {
   provider = azurerm.generic
    
   name                = "${local.service_name}-service-plan"
   location            = azurerm_resource_group.rg.location
   resource_group_name = azurerm_resource_group.rg.name
    
   sku {
     tier = "Basic"
     size = "B1"
   }
}
    
resource "azurerm_app_service" "service" {
   provider = azurerm.generic
    
   name                = "${local.service_name}-service"
   app_service_plan_id = azurerm_app_service_plan.service_plan.id
   location            = azurerm_resource_group.rg.location
   resource_group_name = azurerm_resource_group.rg.name
}
    
resource "azurerm_app_service_custom_hostname_binding" "service_host_bind" {
   provider = azurerm.generic
    
   count               = length(local.dns_zone_names)
   hostname            = "${local.dns_zone_names[count.index]}"
   app_service_name    = azurerm_app_service.service.name
   resource_group_name = azurerm_resource_group.rg.name
    
   lifecycle {
     ignore_changes = [ssl_state, thumbprint]
   }
    
   depends_on                      = [
     azurerm_app_service.service,
     azurerm_resource_group.rg
   ]
}
    
resource "azurerm_app_service_managed_certificate" "service_manage_cert" {
   provider = azurerm.generic
    
   count                       = length(local.dns_zone_names)
   custom_hostname_binding_id  = azurerm_app_service_custom_hostname_binding.service_host_bind[count.index].id
}
    
resource "azurerm_app_service_certificate_binding" "service_certi_bind" {
   provider = azurerm.generic
    
   count               = length(local.dns_zone_names)
   hostname_binding_id = azurerm_app_service_custom_hostname_binding.service_host_bind[count.index].id
   certificate_id      = azurerm_app_service_managed_certificate.service_manage_cert[count.index].id
    
   ssl_state = "SniEnabled"
}

我想要一个使用 terraform 通过 dns 直接指向另一个网站的服务，如果有任何其他方式，请告诉我们。（包括 http 到 https）

为了保护和防止网站滥用，我们希望将多个域重定向到一个网站。例如：(adomain.net -> www.target.com, adomain.tv -> www.target.com, bdomain.net -> www.target.com)

Answer 1

最重要的是，截至目前，应用程序网关不支持应用服务托管证书。

是的，您可以使用 应用程序服务 web.config 文件或应用程序网关中的 system.webserver 重写规则从多个域重定向到一个域 重写规则.

是否有使用 terraform 的应用程序网关的 Web 重定向方法或示例？

Is there a web redirect method or example using an application gateway using terraform?

redirect

terraform

azure-app-service-plans

azure-web-app-service

azure-application-gateway