Terraform Provider

The Terraform provider for coreX Manager lets you manage coreX Platform resources as Terraform infrastructure-as-code. It covers HAProxy routing, SSL/TLS, security lists, security rules, WAF, traffic management, observability, MCP gateway, risk scoring, and HA configuration — everything exposed by the coreX REST API (/api/v1) that represents declarative desired state.

Why Use Terraform with coreX?

Terraform is ideal when you want your coreX configuration to live alongside your other infrastructure code (cloud resources, DNS, Kubernetes manifests) in a single versioned repository. Every terraform apply produces an audit trail via coreX’s audit system, and terraform plan shows exactly what will change before you commit.

Installation

From source

git clone https://github.com/ne4u/terraform-provider-corex.git
cd terraform-provider-corex
make install

This builds the provider and installs it to ~/.terraform.d/plugins/registry.terraform.io/ne4u/corex/dev/<os>_<arch>/.

Local development overrides

For local development (using a locally-built provider instead of the registry), add to ~/.terraformrc:

provider_installation {
  dev_overrides {
    "registry.terraform.io/ne4u/corex" = "~/.terraform.d/plugins/registry.terraform.io/ne4u/corex/dev/darwin_arm64"
  }
  direct {
    exclude = ["registry.terraform.io/ne4u/*"]
  }
}

Provider Configuration

terraform {
  required_providers {
    corex = {
      source  = "registry.terraform.io/ne4u/corex"
      version = "~> 0.1"
    }
  }
}

provider "corex" {
  host     = "https://corex.example.com"
  username = "admin"
  password = var.corex_password

  # Skip TLS verification (not recommended for production):
  # insecure = true
}

Provider Attributes

Authentication

The provider supports two authentication modes:

Username + password (OAuth2 password flow):

provider "corex" {
  host     = "https://corex.example.com"
  username = "admin"
  password = var.corex_password
}

Static token (pre-issued JWT — useful for CI/CD):

provider "corex" {
  host   = "https://corex.example.com"
  token  = var.corex_token
}

For CI/CD pipelines, prefer the token method — it avoids storing passwords and supports long-lived service tokens. For 2FA-protected accounts, provide totp_code alongside username/password (note: TOTP codes expire every 30 seconds, so this is only practical for interactive use).

Auto-Apply Behavior

After every Create/Update/Delete on HAProxy control-plane resources (backends, listeners, WAF rules, security rules, etc.), the provider automatically calls POST /config/apply and polls the async task until completion. This means your changes are immediately active in HAProxy after terraform apply — you don’t need to manually click “Apply Changes” in the UI.

MCP Gateway resources do not trigger config apply — they auto-regenerate the gateway config bundle server-side instead.

Resources

The provider manages 50+ resource types across all coreX Platform feature areas.

Core Routing

SSL/TLS

Security Lists

Security Rules & WAF

Traffic

Cache

Observability

Management

Page Protect

API Armor

Risk Scoring

High Availability

Singleton Settings

MCP Gateway

Data Sources

Data sources let you read coreX Platform state without managing it — useful for wiring outputs into other Terraform resources or for drift detection.

Excluded API Endpoints

The following imperative/action endpoints are not managed by Terraform because they don’t represent declarative desired state. Use the coreX API or UI directly:

Examples

Backend with Servers and Listener

resource "corex_backend" "web" {
  name      = "web-pool"
  mode      = "http"
  protocol  = "http"
  algorithm = "roundrobin"

  health_check_enabled  = true
  health_check_interval = 5000
  health_check_uri      = "/health"
  health_check_method   = "GET"

  retries    = 3
  redispatch = true
}

resource "corex_server" "web1" {
  backend_id = corex_backend.web.id
  name       = "web-server-1"
  address    = "10.0.0.1"
  port       = 8080
  weight     = 100
  check      = true
}

resource "corex_server" "web2" {
  backend_id = corex_backend.web.id
  name       = "web-server-2"
  address    = "10.0.0.2"
  port       = 8080
  weight     = 100
  check      = true
}

resource "corex_listener" "https" {
  name               = "https-listener"
  bind_address       = "0.0.0.0"
  bind_port          = 443
  mode               = "http"
  protocol           = "https"
  ssl_enabled        = true
  http2              = true
  default_backend_id = corex_backend.web.id
}

Security Lists

resource "corex_network_list" "blocked_ips" {
  name        = "blocked-ips"
  description = "Known malicious IP addresses"
}

resource "corex_network_list_entry" "bad_ip_1" {
  list_id = corex_network_list.blocked_ips.id
  value   = "10.0.0.0/24"
  note    = "Internal test range"
}

resource "corex_asn_list" "blocked_asns" {
  name        = "blocked-asns"
  description = "Blocked autonomous systems"
}

resource "corex_asn_list_entry" "bad_asn" {
  list_id = corex_asn_list.blocked_asns.id
  value   = "AS12345"
  note    = "Abuse provider"
}

resource "corex_geo_list" "blocked_countries" {
  name        = "blocked-countries"
  description = "Blocked countries"
}

resource "corex_geo_list_entry" "blocked_country" {
  list_id = corex_geo_list.blocked_countries.id
  value   = "CN"
  note    = "Geo-blocking"
}

MCP Gateway

resource "corex_mcp_team" "engineering" {
  name        = "Engineering"
  slug        = "engineering"
  description = "Engineering team MCP gateway"
}

resource "corex_mcp_server" "github" {
  team_id      = corex_mcp_team.engineering.id
  name         = "github-mcp"
  display_name = "GitHub MCP Server"
  description  = "GitHub tools via MCP"
  url          = "https://mcp.github.example.com/mcp"
  enabled      = true
  verify_tls   = true
  auth_type    = "bearer"
  auth_secret  = var.github_mcp_token
  timeout_ms   = 30000
}

resource "corex_mcp_policy" "allow_engineering" {
  team_id    = corex_mcp_team.engineering.id
  name       = "allow-engineering-tools"
  enabled    = true
  expression = "team.name == \"engineering\""
  action     = "allow"
  log        = true
}

resource "corex_mcp_dlp_rule" "block_secrets" {
  team_id   = corex_mcp_team.engineering.id
  name      = "block-aws-keys"
  enabled   = true
  direction = "both"
  detector  = "aws_key"
  action    = "block"
}

resource "corex_mcp_guardrail" "jailbreak" {
  team_id   = corex_mcp_team.engineering.id
  name      = "jailbreak-protection"
  enabled   = true
  direction = "request"
  pack      = "builtin:jailbreak_v1"
  action    = "block"
}

Reading State with Data Sources

# Check if there are unapplied config changes
data "corex_config_status" "current" {}

output "has_pending_changes" {
  value = data.corex_config_status.current.has_pending
}

# Get the generated HAProxy config for review
data "corex_config_preview" "current" {}

output "haproxy_config" {
  value     = data.corex_config_preview.current.config_text
  sensitive = true
}

# Look up a backend by name to reference its ID
data "corex_backend" "web" {
  name = "web-pool"
}

# Check system health before deploying
data "corex_health" "status" {}

output "system_healthy" {
  value = data.corex_health.status.healthy
}

Importing Existing Resources

If you have an existing coreX deployment configured via the UI, you can adopt those resources into Terraform using terraform import:

# Import a backend by its coreX ID
terraform import corex_backend.web 5

# Import a listener
terraform import corex_listener.https 12

# Import a security rule
terraform import corex_security_rule.block_bots 8

After import, run terraform plan — Terraform will show the current state as the desired state. Add the corresponding resource blocks to your .tf files to match, then subsequent plans will show no changes.

CI/CD Integration

For pipeline-based deployments, use a service token and environment variables:

# GitHub Actions example
- name: Terraform Apply
  run: terraform apply -auto-approve
  env:
    COREX_HOST: ${{ secrets.COREX_HOST }}
    COREX_TOKEN: ${{ secrets.COREX_TOKEN }}

# main.tf — no credentials in the file
provider "corex" {
  # host and token come from COREX_HOST / COREX_TOKEN env vars
}

Development

The provider is written in Go and uses the Terraform Plugin Framework.

# Build the provider binary
make build

# Run the test suite
make test

# Format and lint
make fmt
make vet

# Install to the local Terraform plugin directory
make install

The source code is available at github.com/ne4u/terraform-provider-corex.

Next Steps

• Listeners & Backends — The resources the provider manages
• Security Rules — Expression-based rules you can define in Terraform
• MCP Gateway — MCP resources available via the provider
• Audit & Snapshots — Every Terraform apply is audited