How to deploy a multi-tier application with Terraform

Deploy a public edge proxy, private application instances, and a private database instance with OpenTofu or Terraform. The edge proxy owns the floating IP and routes requests to the application tier over the private network.

Plan the topology#

Use three network roles:

1. Edge: A Caddy, Nginx, HAProxy, or API gateway instance with one floating IP. Its security group accepts ports 80 and 443.
2. Application: One or more private instances. Their security group accepts application traffic from the edge instance's private address.
3. Database: A private instance with an attached data volume. Its security group accepts the database port from the application subnet.

Choose a starting template#

Use the Full-Stack Application template when the deployment needs web, application, and database roles on one private network. Configure its public web instance as the edge proxy and route it to the app_private_ip output.

Use the Three-Tier Application template when each tier needs a separate subnet. Configure the public web tier as the reverse proxy and keep the application and database tiers private.

Use the Edge Reverse Proxy template when the private application network already exists. Adapt its network data sources and upstream_host value to reference that existing network and the application's private port. This avoids creating a second, disconnected private network.

Keep the backend address explicit so the edge configuration depends on a stable private port rather than an instance name lookup. If the application configuration exposes several private addresses, render those addresses into the proxy configuration with templatefile().

Restrict network access#

Attach security groups to ports by ID. The edge port accepts public HTTP and HTTPS traffic. Application ports accept traffic from the edge proxy's fixed private address or security group. Database ports accept traffic from the application subnet only.

resource "openstack_networking_secgroup_rule_v2" "edge_https" {
  security_group_id = openstack_networking_secgroup_v2.edge.id
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 443
  port_range_max    = 443
  remote_ip_prefix  = "0.0.0.0/0"
}

resource "openstack_networking_secgroup_rule_v2" "app_from_edge" {
  security_group_id = openstack_networking_secgroup_v2.app.id
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = var.application_port
  port_range_max    = var.application_port
  remote_ip_prefix  = "${openstack_networking_port_v2.edge.all_fixed_ips[0]}/32"
}

Do not expose application or database ports to 0.0.0.0/0. Keep SSH access behind a bastion, VPN, or source-restricted rule.

Configure TLS and routing#

The edge instance terminates TLS and stores certificate state on its attached volume. Point the domain's DNS A record at the edge floating IP before Caddy requests the certificate.

For several private backends, generate a Caddy upstream list:

app.example.com {
  reverse_proxy 10.42.0.20:8080 10.42.0.21:8080 {
    health_uri /health
  }
}

Use the Edge WAF template when the public origin needs request filtering. Use an external CDN or WAF when your architecture already depends on one, and configure its origin to use the edge floating IP.

Plan and apply#

Initialize the root module and review the dependency graph:

tofu init
tofu plan -out=multi-tier.tfplan
tofu apply multi-tier.tfplan

Review replacements, quota usage, and security group changes in the plan before you apply it.

Verify the deployment#

Read the edge address and private tier addresses from the outputs:

tofu output

Confirm the public endpoint responds:

curl --fail --show-error --head "https://YOUR_DOMAIN"

Confirm the application and database instances have no floating IPs:

openstack server list -c Name -c Networks

From the edge instance, request the application health endpoint over its private address. From an application instance, connect to the database port over the private network. These checks verify each permitted path without opening private tiers to the internet.

See also#

• Full-Stack Application template
• Edge Reverse Proxy template
• API Gateway template
• Edge WAF template
• How to parameterize a template with tfvars
• How to manage OpenTofu state