[Feature] Optional VPN to connect to container

[Cameronsplaze]

Is your feature request related to a problem? Please describe.

Two main problems:

• When I was looking at Jellyfin, I noticed https might be a lot of work. However, wrapping http in a vpn tunnel might be a fast/secure workaround to make sure it's encrypted. (And other similar situations).
• If the leaf-stack contains all of your family's photos growing up, the leaf-stack is on the open internet. You'd want a second layer of security between the two. I.e the VPN will block connections without exposing the container, which may have security flaws.

Describe the solution you'd like

Needs to support most clients, like OpenVPN / WireGuard / etc.

Possible paths (If associate_client_vpn_target_network/disassociate_client_vpn_target_network works out, that's my favorite so far):

• AWS VPN (Client, NOT site-to-site):
  • Very expensive (for the scope of this project). $0.10/hr => $72/month (AWS Client VPN endpoint association) regardless of if it's in use.
  • If you can manage AWS Client VPN endpoint association in boto3, could maybe be apart of the start/stop system stack? We need to minimize the 24/7 cost as much as we can. Maybe these two are enough? Then we wouldn't even have to re-define the VPN constantly:
    • associate_client_vpn_target_network
    • disassociate_client_vpn_target_network
  • Could tie to the BaseStack, so cost would only be once. Would want to re-design maturities, and/or add a second "key" that describes the base-stack-id you're adding a leaf-stack to.
• Maybe there's something we can install into the Ec2 instead? This way, it's only active when the container is up and some one is connected? The host/container port CAN be different in the CDK (so we can separate them in the config if we need), I just don't know if there's an easy way to intercept the connection or not.

Describe alternatives you've considered

N/A

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

[Cameronsplaze]

https://docs.aws.amazon.com/vpn/latest/clientvpn-user/linux.html

[Cameronsplaze]

These AWS VPN Docs show all the different VPN types AWS supports. Of note, I'm hopping you can use the VPN Client for this ticket, to allow any OpenVPN client to connect and use private resources. Of note though, the last block in that VPN list is Third party software VPN appliance, and it links to OpenVPN Access Server in the AWS Market Place. I'm not sure what the core difference is. Maybe it's the other way, and that OpenVPN in the market place lets you connect to a server somewhere else?

[Cameronsplaze]

Seems like there's a couple of routes to look at:

• AWS Client VPN endpoint association:
  • Double-check there's no charge by deploying one for 24 hours, this path depends heavly on that.
  • (Base Stack): If it's free when idle, We shouldn't have to create a new "maturity" type for it (though if we did, maturity.PROD|DEVEL to enviornment.DEFAULT|VPN|DEVEL makes the most sense to me). BUT it looks like there's no "access control list" if you want different containers for different friends.
  • (Leaf Stack): If it's free when idle anyways, putting everything here would solve the access-control-list problem. It mainly depends on 1) how long does associate_client_vpn_target_network actually take
• Install wireguard to the Ec2 With user-data: Another way to solve the "access-control-list" problem. You wouldn't pay extra for data-transfer/endpoint-per-hour usage with this. But it'd consume Ec2 resources, and increase it's startup-time. If it's not pre-installed (and/or not easily in dnf), you could look at a side-car container in HOST mode maybe?