frostmoln_lb_listener (Resource)

Manages a listener on a Frostmoln load balancer.

Authoritative scope — who owns what on this resource, declared in internal/scopedecl and machine-checked against the schema.

Enacted and reconciled — every configurable attribute not listed below: the platform applies it, and a refresh reads the truth back.

Create-immutable — load_balancer_id, protocol, protocol_port: the listener's identity is its load balancer, protocol and port; changing one is a different listener.

Example Usage

# An HTTPS listener on a load balancer.
#
# allowed_cidrs is deny-by-default and required: at least one CIDR must be set.
# To accept connections from anywhere you must opt in explicitly with
# ["0.0.0.0/0"].
# On an l4 load balancer ["0.0.0.0/0"] is the only accepted value; restrict
# sources in the backend members' security group (the client IP is preserved).
#
# Note: the listener<->pool link is declared on the POOL via its listener_id
# attribute (see frostmoln_lb_pool), NOT here via default_pool_id. Setting both
# directions would create an HCL dependency cycle (listener -> pool -> listener).
resource "frostmoln_lb_listener" "https" {
  load_balancer_id = frostmoln_load_balancer.web.id
  name             = "https"
  protocol         = "https"
  protocol_port    = 443

  allowed_cidrs = ["0.0.0.0/0"]

  insert_headers = {
    "X-Forwarded-For" = "true"
  }
}

Schema

Required

• allowed_cidrs (List of String) The CIDRs allowed to connect to this listener. This is deny-by-default: at least one CIDR is required. To allow all, set this explicitly to ["0.0.0.0/0"]. On an l4 load balancer only ["0.0.0.0/0"] (or ["::/0"]) is accepted: it cannot restrict sources at the listener, and the client IP is preserved, so restrict sources in the backend members' security group instead.
• load_balancer_id (String) The ID of the load balancer this listener belongs to. Changing this forces a new resource.
• name (String) The name of the listener.
• protocol (String) The listener protocol: tcp, udp, sctp, http, https, or terminated_https.
• protocol_port (Number) The port the listener accepts connections on. Changing this forces a new resource.

Optional

• connection_limit (Number) The maximum number of concurrent connections allowed. If omitted, the backend default is used and reflected here.
• default_pool_id (String) The default pool ID requests are forwarded to.
• insert_headers (Map of String) Headers to insert into requests forwarded to backend members (HTTP/terminated_https listeners).
• timeouts (Block, Optional) (see below for nested schema)
• tls_certificate_id (String) The TLS certificate (secret) ID for terminated_https listeners.

Read-Only

• admin_state_up (Boolean) Whether the listener is administratively enabled.
• created_at (String) The creation timestamp.
• id (String) The unique identifier of the listener.
• updated_at (String) The last update timestamp.

Nested Schema for timeouts

Optional:

• create (String) How long the provider waits for the create operation to converge before giving up (e.g. "45m", "2h").
• delete (String) How long the provider waits for the delete to complete before giving up (e.g. "30m").
• update (String) How long the provider waits for an update (resize, in-place change) to converge before giving up (e.g. "30m").