Terraform modules that configure and maintain the infrastructure needed to run GitHub-Hosted Action Runners in a private network.

1. Before running, review pre-requisites from the documentation to ensure your environment is properly configured.
2. The Azure CLI must be installed and on the system path, logged in with the identity that you want these resources created under, and Azure Subscription configured.
3. The GitHub.Network resource provider must be registered in the Azure Subscription. The Terraform modules contain HCL to register this provider, but it is commented out since you may not want this managed by Terraform. See the above GitHub documentation for a sample AZ CLI command to register the provider.

This repo contains two Terraform modules:

• nsg module: Uses a Network Security Group (NSG) to manage the network security of the VNet.

module "github_runner_vnet" {
  # Use the nsg version
  source = "github.com/garnertb/github-runner-vnet/nsg"

  # The resources use this base_name as a name prefix, e.g. ${base_name}-rg for the resource group
  base_name = "vnet-test"
  
  # Retrieve through the GitHub API (see GitHub docs for instructions)
  github_enterprise_id = "12345"
}

• firewall module: Uses an Azure Firewall to manage the network security of the VNet.

module "github_runner_vnet" {
  # Use the firewall version
  source = "github.com/garnertb/github-runner-vnet/firewall"

  # The resources use this base_name as a name prefix, e.g. ${base_name}-rg for the resource group
  base_name = "vnet-test"
  
  # Retrieve through the GitHub API (see GitHub docs for instructions)
  github_enterprise_id = "12345"
}

The output of these modules is the Resource ID for the GitHub.Network/networkSettings resource. Paste this ID into the github.com UI for configuring the Azure Virtual Network.

This project is licensed under the terms of the MIT open source license. Please refer to MIT for the full terms.

Please refer to CODEOWNERS for a list of maintainers.