From b7245ffd231183d1ada76f1909ea915d694dcb83 Mon Sep 17 00:00:00 2001
From: Veronika Gnilitska <veronika.gnilitska@gmail.com>
Date: Mon, 24 Apr 2023 17:26:20 +0300
Subject: [PATCH] feat: add the first component

---
 .pre-commit-config.yaml               |   8 +
 .terraform-docs.yml                   |  11 +
 components/tailscale/README.md        |  83 ++++++++
 components/tailscale/context.tf       | 279 ++++++++++++++++++++++++++
 components/tailscale/data.tf          |  23 +++
 components/tailscale/main.tf          |  25 +++
 components/tailscale/outputs.tf       |   4 +
 components/tailscale/providers.tf     |  53 +++++
 components/tailscale/secrets.mixin.tf |  75 +++++++
 components/tailscale/terraform.tf     |  18 ++
 components/tailscale/variables.tf     |  22 ++
 11 files changed, 601 insertions(+)
 create mode 100644 .pre-commit-config.yaml
 create mode 100644 .terraform-docs.yml
 create mode 100644 components/tailscale/README.md
 create mode 100644 components/tailscale/context.tf
 create mode 100644 components/tailscale/data.tf
 create mode 100644 components/tailscale/main.tf
 create mode 100644 components/tailscale/outputs.tf
 create mode 100644 components/tailscale/providers.tf
 create mode 100644 components/tailscale/secrets.mixin.tf
 create mode 100644 components/tailscale/terraform.tf
 create mode 100644 components/tailscale/variables.tf

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..2d3c8c9
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,8 @@
+repos:
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.77.3 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
+    hooks:
+      - id: terraform_fmt
+      - id: terraform_docs
+        args:
+          - --args=--config=.terraform-docs.yml
diff --git a/.terraform-docs.yml b/.terraform-docs.yml
new file mode 100644
index 0000000..04d7d77
--- /dev/null
+++ b/.terraform-docs.yml
@@ -0,0 +1,11 @@
+# https://terraform-docs.io/user-guide/configuration/
+
+formatter: md
+
+output:
+  file: "" # Outputs to stdout which is then consumed by pre-commit-terraform.
+
+settings:
+  anchor: false
+  html: false
+  lockfile: false
diff --git a/components/tailscale/README.md b/components/tailscale/README.md
new file mode 100644
index 0000000..73b1217
--- /dev/null
+++ b/components/tailscale/README.md
@@ -0,0 +1,83 @@
+# Component: `tailscale`
+
+This component is responsible for provisioning [Tailscale](https://tailscale.com/) subnet routers in our AWS Accounts along with Tailscale resources required for this setup. This is to provide access to private services in AWS environment, e.g. RDS clusters.
+
+## Usage
+
+**Level**: Regional
+
+Example: _TBD_
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| terraform | ~> 1.3 |
+| aws | ~> 4.0 |
+| sops | ~> 0.5 |
+| tailscale | ~> 0.13.7 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| aws | ~> 4.0 |
+| sops | ~> 0.5 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| account | cloudposse/stack-config/yaml//modules/remote-state | 0.22.3 |
+| ssh\_key\_pair | cloudposse/key-pair/aws | 0.18.3 |
+| tailscale\_subnet\_router | git::https://github.com/masterpointio/terraform-aws-tailscale.git | tags/0.1.0 |
+| this | cloudposse/label/null | 0.25.0 |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_ssm_parameter.ssm_secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
+| [aws_subnets.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnets) | data source |
+| [aws_vpc.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
+| [sops_file.sops_secrets](https://registry.terraform.io/providers/carlpett/sops/latest/docs/data-sources/file) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| additional\_tag\_map | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. This is for some rare cases where resources want additional configuration of tags and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no |
+| assume\_role\_override | Overrides the assumed role for the AWS provider. Useful for local testing and imports. | `string` | `null` | no |
+| attributes | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, in the order they appear in the list. New attributes are appended to the end of the list. The elements of the list are joined by the `delimiter` and treated as a single ID element. | `list(string)` | `[]` | no |
+| context | Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as `null` to use default value. Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | ```{ "additional_tag_map": {}, "attributes": [], "delimiter": null, "descriptor_formats": {}, "enabled": true, "environment": null, "id_length_limit": null, "label_key_case": null, "label_order": [], "label_value_case": null, "labels_as_tags": [ "unset" ], "name": null, "namespace": null, "regex_replace_chars": null, "stage": null, "tags": {}, "tenant": null }``` | no |
+| delimiter | Delimiter to be used between ID elements. Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
+| descriptor\_formats | Describe additional descriptors to be output in the `descriptors` output map. Map of maps. Keys are names of descriptors. Values are maps of the form `{    format = string    labels = list(string) }` (Type is `any` so the map values can later be enhanced to provide additional options.) `format` is a Terraform format string to be passed to the `format()` function. `labels` is a list of labels, in order, to pass to `format()` function. Label values will be normalized before being passed to `format()` so they will be identical to how they appear in `id`. Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
+| enabled | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
+| environment | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
+| id\_length\_limit | Limit `id` to this many characters (minimum 6). Set to `0` for unlimited length. Set to `null` for keep the existing setting, which defaults to `0`. Does not affect `id_full`. | `number` | `null` | no |
+| label\_key\_case | Controls the letter case of the `tags` keys (label names) for tags generated by this module. Does not affect keys of tags passed in via the `tags` input. Possible values: `lower`, `title`, `upper`. Default value: `title`. | `string` | `null` | no |
+| label\_order | The order in which the labels (ID elements) appear in the `id`. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no |
+| label\_value\_case | Controls the letter case of ID elements (labels) as included in `id`, set as tag values, and output by this module individually. Does not affect values of tags passed in via the `tags` input. Possible values: `lower`, `title`, `upper` and `none` (no transformation). Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. Default value: `lower`. | `string` | `null` | no |
+| labels\_as\_tags | Set of labels (ID elements) to include as tags in the `tags` output. Default is to include all labels. Tags with empty values will not be included in the `tags` output. Set to `[]` to suppress all generated tags. **Notes:**   The value of the `name` tag, if included, will be the `id`, not the `name`.   Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be   changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | ```[ "default" ]``` | no |
+| name | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. This is the only ID element not also included as a `tag`. The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
+| namespace | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
+| regex\_replace\_chars | Terraform regular expression (regex) string. Characters matching the regex will be removed from the ID elements. If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |
+| region | AWS region. | `string` | n/a | yes |
+| run\_in\_cicd | If run in CI/CD platform, use terraform delegated role, otherwise use admin. | `bool` | `true` | no |
+| secret\_mapping | The list of secret mappings the application will need. This creates secret values for the component to consume at `local.secrets[name]`. | ```list(object({ name = string type = string path = string file = string }))``` | `[]` | no |
+| ssh\_public\_key\_file | Name of existing SSH public key file (e.g. `id_rsa.pub`) | `string` | `null` | no |
+| ssh\_public\_key\_path | Path to SSH public key directory (e.g. `/secrets`) | `string` | n/a | yes |
+| stage | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
+| tags | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
+| tailnet | The Tailnet to perform actions in. | `string` | n/a | yes |
+| tailscale\_existing\_ssh\_key\_name | Use an existing EC2 key pair with this name, rather than importing a key pair. | `string` | `null` | no |
+| tailscale\_session\_logging\_enabled | Tailscale Subnet Router session logging to S3. | `bool` | `true` | no |
+| tenant | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| tailscale\_subnet\_route\_instance\_name | The name tag value of the Tailscale Subnet Router EC2 instance. |
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/components/tailscale/context.tf b/components/tailscale/context.tf
new file mode 100644
index 0000000..5e0ef88
--- /dev/null
+++ b/components/tailscale/context.tf
@@ -0,0 +1,279 @@
+#
+# ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label
+# All other instances of this file should be a copy of that one
+#
+#
+# Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf
+# and then place it in your Terraform module to automatically get
+# Cloud Posse's standard configuration inputs suitable for passing
+# to Cloud Posse modules.
+#
+# curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf
+#
+# Modules should access the whole context as `module.this.context`
+# to get the input variables with nulls for defaults,
+# for example `context = module.this.context`,
+# and access individual variables as `module.this.<var>`,
+# with final values filled in.
+#
+# For example, when using defaults, `module.this.context.delimiter`
+# will be null, and `module.this.delimiter` will be `-` (hyphen).
+#
+
+module "this" {
+  source  = "cloudposse/label/null"
+  version = "0.25.0" # requires Terraform >= 0.13.0
+
+  enabled             = var.enabled
+  namespace           = var.namespace
+  tenant              = var.tenant
+  environment         = var.environment
+  stage               = var.stage
+  name                = var.name
+  delimiter           = var.delimiter
+  attributes          = var.attributes
+  tags                = var.tags
+  additional_tag_map  = var.additional_tag_map
+  label_order         = var.label_order
+  regex_replace_chars = var.regex_replace_chars
+  id_length_limit     = var.id_length_limit
+  label_key_case      = var.label_key_case
+  label_value_case    = var.label_value_case
+  descriptor_formats  = var.descriptor_formats
+  labels_as_tags      = var.labels_as_tags
+
+  context = var.context
+}
+
+# Copy contents of cloudposse/terraform-null-label/variables.tf here
+
+variable "context" {
+  type = any
+  default = {
+    enabled             = true
+    namespace           = null
+    tenant              = null
+    environment         = null
+    stage               = null
+    name                = null
+    delimiter           = null
+    attributes          = []
+    tags                = {}
+    additional_tag_map  = {}
+    regex_replace_chars = null
+    label_order         = []
+    id_length_limit     = null
+    label_key_case      = null
+    label_value_case    = null
+    descriptor_formats  = {}
+    # Note: we have to use [] instead of null for unset lists due to
+    # https://github.com/hashicorp/terraform/issues/28137
+    # which was not fixed until Terraform 1.0.0,
+    # but we want the default to be all the labels in `label_order`
+    # and we want users to be able to prevent all tag generation
+    # by setting `labels_as_tags` to `[]`, so we need
+    # a different sentinel to indicate "default"
+    labels_as_tags = ["unset"]
+  }
+  description = <<-EOT
+    Single object for setting entire context at once.
+    See description of individual variables for details.
+    Leave string and numeric variables as `null` to use default value.
+    Individual variable settings (non-null) override settings in context object,
+    except for attributes, tags, and additional_tag_map, which are merged.
+  EOT
+
+  validation {
+    condition     = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"])
+    error_message = "Allowed values: `lower`, `title`, `upper`."
+  }
+
+  validation {
+    condition     = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"])
+    error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
+  }
+}
+
+variable "enabled" {
+  type        = bool
+  default     = null
+  description = "Set to false to prevent the module from creating any resources"
+}
+
+variable "namespace" {
+  type        = string
+  default     = null
+  description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique"
+}
+
+variable "tenant" {
+  type        = string
+  default     = null
+  description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for"
+}
+
+variable "environment" {
+  type        = string
+  default     = null
+  description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'"
+}
+
+variable "stage" {
+  type        = string
+  default     = null
+  description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'"
+}
+
+variable "name" {
+  type        = string
+  default     = null
+  description = <<-EOT
+    ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
+    This is the only ID element not also included as a `tag`.
+    The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.
+    EOT
+}
+
+variable "delimiter" {
+  type        = string
+  default     = null
+  description = <<-EOT
+    Delimiter to be used between ID elements.
+    Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.
+  EOT
+}
+
+variable "attributes" {
+  type        = list(string)
+  default     = []
+  description = <<-EOT
+    ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
+    in the order they appear in the list. New attributes are appended to the
+    end of the list. The elements of the list are joined by the `delimiter`
+    and treated as a single ID element.
+    EOT
+}
+
+variable "labels_as_tags" {
+  type        = set(string)
+  default     = ["default"]
+  description = <<-EOT
+    Set of labels (ID elements) to include as tags in the `tags` output.
+    Default is to include all labels.
+    Tags with empty values will not be included in the `tags` output.
+    Set to `[]` to suppress all generated tags.
+    **Notes:**
+      The value of the `name` tag, if included, will be the `id`, not the `name`.
+      Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
+      changed in later chained modules. Attempts to change it will be silently ignored.
+    EOT
+}
+
+variable "tags" {
+  type        = map(string)
+  default     = {}
+  description = <<-EOT
+    Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
+    Neither the tag keys nor the tag values will be modified by this module.
+    EOT
+}
+
+variable "additional_tag_map" {
+  type        = map(string)
+  default     = {}
+  description = <<-EOT
+    Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
+    This is for some rare cases where resources want additional configuration of tags
+    and therefore take a list of maps with tag key, value, and additional configuration.
+    EOT
+}
+
+variable "label_order" {
+  type        = list(string)
+  default     = null
+  description = <<-EOT
+    The order in which the labels (ID elements) appear in the `id`.
+    Defaults to ["namespace", "environment", "stage", "name", "attributes"].
+    You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
+    EOT
+}
+
+variable "regex_replace_chars" {
+  type        = string
+  default     = null
+  description = <<-EOT
+    Terraform regular expression (regex) string.
+    Characters matching the regex will be removed from the ID elements.
+    If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.
+  EOT
+}
+
+variable "id_length_limit" {
+  type        = number
+  default     = null
+  description = <<-EOT
+    Limit `id` to this many characters (minimum 6).
+    Set to `0` for unlimited length.
+    Set to `null` for keep the existing setting, which defaults to `0`.
+    Does not affect `id_full`.
+  EOT
+  validation {
+    condition     = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0
+    error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length."
+  }
+}
+
+variable "label_key_case" {
+  type        = string
+  default     = null
+  description = <<-EOT
+    Controls the letter case of the `tags` keys (label names) for tags generated by this module.
+    Does not affect keys of tags passed in via the `tags` input.
+    Possible values: `lower`, `title`, `upper`.
+    Default value: `title`.
+  EOT
+
+  validation {
+    condition     = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case)
+    error_message = "Allowed values: `lower`, `title`, `upper`."
+  }
+}
+
+variable "label_value_case" {
+  type        = string
+  default     = null
+  description = <<-EOT
+    Controls the letter case of ID elements (labels) as included in `id`,
+    set as tag values, and output by this module individually.
+    Does not affect values of tags passed in via the `tags` input.
+    Possible values: `lower`, `title`, `upper` and `none` (no transformation).
+    Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
+    Default value: `lower`.
+  EOT
+
+  validation {
+    condition     = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case)
+    error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
+  }
+}
+
+variable "descriptor_formats" {
+  type        = any
+  default     = {}
+  description = <<-EOT
+    Describe additional descriptors to be output in the `descriptors` output map.
+    Map of maps. Keys are names of descriptors. Values are maps of the form
+    `{
+       format = string
+       labels = list(string)
+    }`
+    (Type is `any` so the map values can later be enhanced to provide additional options.)
+    `format` is a Terraform format string to be passed to the `format()` function.
+    `labels` is a list of labels, in order, to pass to `format()` function.
+    Label values will be normalized before being passed to `format()` so they will be
+    identical to how they appear in `id`.
+    Default is `{}` (`descriptors` output will be empty).
+    EOT
+}
+
+#### End of copy of cloudposse/terraform-null-label/variables.tf
diff --git a/components/tailscale/data.tf b/components/tailscale/data.tf
new file mode 100644
index 0000000..9a57a4f
--- /dev/null
+++ b/components/tailscale/data.tf
@@ -0,0 +1,23 @@
+locals {
+  vpc_id             = data.aws_vpc.default.id
+  vpc_cidr_block     = data.aws_vpc.default.cidr_block
+  private_subnet_ids = toset(data.aws_subnets.private.ids)
+}
+
+data "aws_vpc" "default" {
+  filter {
+    name   = "tag:Name"
+    values = ["${module.this.id}-default"]
+  }
+}
+
+data "aws_subnets" "private" {
+  filter {
+    name   = "vpc-id"
+    values = [local.vpc_id]
+  }
+  filter {
+    name   = "tag:Attributes"
+    values = ["private"]
+  }
+}
diff --git a/components/tailscale/main.tf b/components/tailscale/main.tf
new file mode 100644
index 0000000..74d7681
--- /dev/null
+++ b/components/tailscale/main.tf
@@ -0,0 +1,25 @@
+module "tailscale_subnet_router" {
+  source  = "git::https://github.com/masterpointio/terraform-aws-tailscale.git?ref=tags/0.1.0"
+  context = module.this.context
+
+  name = "tailscale-subnet-router"
+
+  vpc_id                  = local.vpc_id
+  advertise_routes        = [local.vpc_cidr_block]
+  subnet_ids              = local.private_subnet_ids
+  key_pair_name           = coalesce(var.tailscale_existing_ssh_key_name, module.ssh_key_pair.key_name)
+  session_logging_enabled = var.tailscale_session_logging_enabled
+}
+
+module "ssh_key_pair" {
+  source  = "cloudposse/key-pair/aws"
+  version = "0.18.3"
+  context = module.this.context
+  enabled = var.tailscale_existing_ssh_key_name == null
+
+  name = "tailscale-subnet-router"
+
+  ssh_public_key_path = var.ssh_public_key_path
+  ssh_public_key_file = var.ssh_public_key_file
+  generate_ssh_key    = var.generate_ssh_key
+}
diff --git a/components/tailscale/outputs.tf b/components/tailscale/outputs.tf
new file mode 100644
index 0000000..3d8b51d
--- /dev/null
+++ b/components/tailscale/outputs.tf
@@ -0,0 +1,4 @@
+output "tailscale_subnet_route_instance_name" {
+  value       = module.tailscale_subnet_router.instance_name
+  description = "The name tag value of the Tailscale Subnet Router EC2 instance."
+}
diff --git a/components/tailscale/providers.tf b/components/tailscale/providers.tf
new file mode 100644
index 0000000..aacc390
--- /dev/null
+++ b/components/tailscale/providers.tf
@@ -0,0 +1,53 @@
+locals {
+  aws_account_id = module.account.outputs.full_account_map[var.stage]
+  assume_role    = format("arn:aws:iam::${local.aws_account_id}:role/${var.namespace}-${var.stage}-%s", var.run_in_cicd ? "terraform" : "admin")
+}
+
+variable "run_in_cicd" {
+  type        = bool
+  description = "If run in CI/CD platform, use terraform delegated role, otherwise use admin."
+  default     = true
+}
+
+variable "assume_role_override" {
+  type        = string
+  description = "Overrides the assumed role for the AWS provider. Useful for local testing and imports."
+  default     = null
+}
+
+variable "region" {
+  type        = string
+  description = "AWS region."
+}
+
+variable "tailnet" {
+  type        = string
+  description = "The Tailnet to perform actions in."
+}
+
+module "account" {
+  source  = "cloudposse/stack-config/yaml//modules/remote-state"
+  version = "0.22.3"
+
+  component = "account-map"
+  stage     = "root"
+
+  context = module.this.context
+}
+
+
+provider "aws" {
+  region = var.region
+
+  assume_role {
+    role_arn     = coalesce(var.assume_role_override, local.assume_role)
+    session_name = var.run_in_cicd ? "cicd-terraform" : "local-admin"
+    external_id  = "terraform"
+  }
+}
+
+provider "tailscale" {
+  tailnet             = var.tailnet
+  oauth_client_id     = local.secrets.tailscale_oauth_client_id
+  oauth_client_secret = local.secrets.tailscale_oauth_client_secret
+}
diff --git a/components/tailscale/secrets.mixin.tf b/components/tailscale/secrets.mixin.tf
new file mode 100644
index 0000000..4961e55
--- /dev/null
+++ b/components/tailscale/secrets.mixin.tf
@@ -0,0 +1,75 @@
+# secrets.mixin.tf provides an abstract way for components to consume secret values from external sources
+# Right now, this includes SOPS files or SSM Parameter, but it could be expanded to include more like AWS Secrets Manager + Hashi Vault
+# This enables component users to bring their own secrets and allows component authors to not have to concern their code with where secrets will live
+# The secret_mapping variable provides the input to map where a secret at a particular name should be pulled from.
+# All secrets that are pulled are provided to the component via `local.secrets`
+# NOTE: This does require the carlpett/sops provider regardless if sops is used or not.
+# NOTE: This could be expanded in the future to pull non-secret values as well if that is ever of use.
+
+variable "secret_mapping" {
+  type = list(object({
+    name = string
+    type = string
+    path = string
+    file = string
+  }))
+  default     = []
+  description = "The list of secret mappings the application will need. This creates secret values for the component to consume at `local.secrets[name]`."
+}
+
+locals {
+  # Filter out our sops mappings
+  sops_secret_mapping = [
+    for mapping in var.secret_mapping :
+    mapping if mapping.type == "sops"
+  ]
+
+  # Filter the unique set of sops files we need to pull
+  sops_files = toset(distinct([
+    for mapping in local.sops_secret_mapping :
+    mapping.file
+  ]))
+
+  # Collect our sops file values as a map of "sops file path => map of values"
+  sops_yamls = {
+    for sops_file in local.sops_files :
+    sops_file => yamldecode(data.sops_file.sops_secrets[sops_file].raw)
+  }
+
+  # Create our sops secret name to value map
+  sops_secrets = {
+    for mapping in local.sops_secret_mapping :
+    mapping.name => lookup(local.sops_yamls[mapping.file], mapping.path, null)
+  }
+
+  # Filter out our ssm mappings
+  ssm_secret_mapping = [
+    for mapping in var.secret_mapping :
+    mapping if mapping.type == "ssm"
+  ]
+
+  # Collect the ssm paths we need to pull
+  ssm_paths = toset(distinct([
+    for mapping in local.ssm_secret_mapping :
+    mapping.path
+  ]))
+
+  # Create our ssm secret name to value map
+  ssm_secrets = {
+    for mapping in local.ssm_secret_mapping :
+    mapping.name => data.aws_ssm_parameter.ssm_secrets[mapping.path].value
+  }
+
+  # Merge the final ssm secrets + sops secrets for generic consumption in the component.
+  secrets = merge(local.sops_secrets, local.ssm_secrets)
+}
+
+data "sops_file" "sops_secrets" {
+  for_each    = local.sops_files
+  source_file = "${path.root}/${each.value}"
+}
+
+data "aws_ssm_parameter" "ssm_secrets" {
+  for_each = local.ssm_paths
+  name     = each.value
+}
diff --git a/components/tailscale/terraform.tf b/components/tailscale/terraform.tf
new file mode 100644
index 0000000..5336ad0
--- /dev/null
+++ b/components/tailscale/terraform.tf
@@ -0,0 +1,18 @@
+terraform {
+  required_version = "~> 1.3"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 4.0"
+    }
+    sops = {
+      source  = "carlpett/sops"
+      version = "~> 0.5"
+    }
+    tailscale = {
+      source  = "tailscale/tailscale"
+      version = "~> 0.13.7"
+    }
+  }
+}
diff --git a/components/tailscale/variables.tf b/components/tailscale/variables.tf
new file mode 100644
index 0000000..28a74a1
--- /dev/null
+++ b/components/tailscale/variables.tf
@@ -0,0 +1,22 @@
+variable "tailscale_existing_ssh_key_name" {
+  type        = string
+  description = "Use an existing EC2 key pair with this name, rather than importing a key pair."
+  default     = null
+}
+
+variable "tailscale_session_logging_enabled" {
+  type        = bool
+  description = "Tailscale Subnet Router session logging to S3."
+  default     = true
+}
+
+variable "ssh_public_key_file" {
+  type        = string
+  description = "Name of existing SSH public key file (e.g. `id_rsa.pub`)"
+  default     = null
+}
+
+variable "ssh_public_key_path" {
+  type        = string
+  description = "Path to SSH public key directory (e.g. `/secrets`)"
+}
\ No newline at end of file