feat(staging): implement micro-segmentation with proxmox firewall rules

terraform/staging-env/main.tf

@@ -53,11 +53,11 @@ resource "proxmox_virtual_environment_vm" "staging_vm" {
 
   network_device {
     bridge   = "vmbr0"
-    # Assign a specific VLAN tag for staging isolation if configured on your switch
+    firewall = true
-    # vlan_id = 50 
   }
 
   # Cloud-Init configuration to inject the staging age key and set up networking
+
   initialization {
     ip_config {
       ipv4 {
@@ -90,6 +90,47 @@ resource "proxmox_virtual_environment_file" "cloud_config" {
   }
 }
 
+resource "proxmox_virtual_environment_firewall_options" "staging_vm_fw_options" {
+  vm_id      = proxmox_virtual_environment_vm.staging_vm.vm_id
+  node_name  = proxmox_virtual_environment_vm.staging_vm.node_name
+  enable     = true
+  policy_in  = "ACCEPT" 
+  policy_out = "DROP"
+}
+
+resource "proxmox_virtual_environment_firewall_rules" "staging_vm_rules" {
+  vm_id     = proxmox_virtual_environment_vm.staging_vm.vm_id
+  node_name = proxmox_virtual_environment_vm.staging_vm.node_name
+
+  rule {
+    action  = "ACCEPT"
+    type    = "out"
+    dest    = "192.168.0.11"
+    comment = "Allow traffic to TrueNAS"
+  }
+
+  rule {
+    action  = "ACCEPT"
+    type    = "out"
+    dest    = "192.168.0.1"
+    comment = "Allow traffic to Gateway/DNS"
+  }
+
+  rule {
+    action  = "DROP"
+    type    = "out"
+    dest    = "192.168.0.0/24"
+    comment = "Drop traffic to local homelab"
+  }
+
+  rule {
+    action  = "ACCEPT"
+    type    = "out"
+    dest    = "0.0.0.0/0"
+    comment = "Allow outbound internet traffic"
+  }
+}
+
 output "staging_vm_ip" {
   value       = proxmox_virtual_environment_vm.staging_vm.ipv4_addresses[1][0] # Adjust index based on actual returned interfaces
   description = "The IP address of the newly spun up staging VM."