From 04b989ac1bfc9f2fcd9d585ca00d3496a1b5cd2f Mon Sep 17 00:00:00 2001 From: Irinel Bogdan Date: Tue, 28 Jul 2026 12:51:20 +0300 Subject: [PATCH 1/3] Add virtual machine fqdn setup extension --- docs/modules/azure.md | 1 + .../main.tf | 59 +++++++++++++++++++ .../outputs.tf | 4 ++ .../variables.tf | 33 +++++++++++ .../versions.tf | 10 ++++ 5 files changed, 107 insertions(+) create mode 100644 src/modules/azure-ptn-compute-virtualmachine-fqdn/main.tf create mode 100644 src/modules/azure-ptn-compute-virtualmachine-fqdn/outputs.tf create mode 100644 src/modules/azure-ptn-compute-virtualmachine-fqdn/variables.tf create mode 100644 src/modules/azure-ptn-compute-virtualmachine-fqdn/versions.tf diff --git a/docs/modules/azure.md b/docs/modules/azure.md index fe4e166..98cdf42 100644 --- a/docs/modules/azure.md +++ b/docs/modules/azure.md @@ -25,6 +25,7 @@ lacks. Keep new inputs shaped the AVM way. | Module | What it does | |---|---| | [`azure-ptn-authorization-roledefinition-collection`](../../src/modules/azure-ptn-authorization-roledefinition-collection/) | Many role definitions from one map | +| [`azure-ptn-compute-virtualmachine-fqdn`](../../src/modules/azure-ptn-compute-virtualmachine-fqdn/) | Windows VM in-guest primary DNS suffix set via CustomScriptExtension with a deferred reboot, so the guest FQDN matches its public DNS name | | [`azure-ptn-network-dnszone-records`](../../src/modules/azure-ptn-network-dnszone-records/) | A, AAAA, CAA, CNAME, MX, NS, PTR, SRV and TXT records in an existing public zone | | [`azure-ptn-network-privatednszone-records`](../../src/modules/azure-ptn-network-privatednszone-records/) | A, AAAA, CNAME, MX, PTR, SRV and TXT records in an existing private zone | | [`azure-ptn-network-privatednszone-vnet-links`](../../src/modules/azure-ptn-network-privatednszone-vnet-links/) | Virtual network links across many zones | diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/main.tf b/src/modules/azure-ptn-compute-virtualmachine-fqdn/main.tf new file mode 100644 index 0000000..38b80b1 --- /dev/null +++ b/src/modules/azure-ptn-compute-virtualmachine-fqdn/main.tf @@ -0,0 +1,59 @@ +# ============================================================================= +# WINDOWS VM PRIMARY DNS SUFFIX + REBOOT +# ============================================================================= +# Sets the Windows *primary DNS suffix* via a CustomScriptExtension, then +# reboots, so the machine's own FQDN matches the public DNS name of its IP. +# Without it the guest FQDN stays the bare hostname, and anything that issues a +# ticket for the name you typed (Entra RDP being the motivating case) fails +# because the two names differ. +# +# The public IP and its DNS label are the CALLER's to create and attach - this +# module only touches the guest. provision_after_extensions holds the suffix +# step (and its reboot) until the named extensions finish, so it cannot land +# mid Entra-join. That is a stronger guarantee than depends_on, which only +# orders the ARM calls. +# ============================================================================= + +locals { + # Deferred so the extension reports success to Azure before the box goes down. + reboot_delay_seconds = 60 + + # Written to HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters - the + # same keys the Computer Name dialog writes. SyncDomainWithMembership=0 + # mirrors unticking "Change primary DNS suffix when domain membership + # changes". Idempotent: once the suffix is in place the script exits without + # rebooting. + set_dns_suffix_script = <<-PS + $ErrorActionPreference = 'Stop' + $suffix = '${var.dns_suffix}' + $key = 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' + $current = (Get-ItemProperty -Path $key -Name 'NV Domain' -ErrorAction SilentlyContinue).'NV Domain' + if ($current -eq $suffix) { + Write-Output "Primary DNS suffix already '$suffix' - nothing to do." + exit 0 + } + Set-ItemProperty -Path $key -Name 'Domain' -Value $suffix -Type String + Set-ItemProperty -Path $key -Name 'NV Domain' -Value $suffix -Type String + Set-ItemProperty -Path $key -Name 'SyncDomainWithMembership' -Value 0 -Type DWord + Write-Output "Primary DNS suffix set to '$suffix' (was '$current'). Rebooting in ${local.reboot_delay_seconds}s." + shutdown /r /t ${local.reboot_delay_seconds} /c "Applying primary DNS suffix" + exit 0 + PS +} + +resource "azurerm_virtual_machine_extension" "dns_suffix" { + name = "SetPrimaryDnsSuffix" + virtual_machine_id = var.virtual_machine_id + publisher = "Microsoft.Compute" + type = "CustomScriptExtension" + type_handler_version = "1.10" + auto_upgrade_minor_version = true + provision_after_extensions = var.provision_after_extensions + tags = var.tags + + # No -ExecutionPolicy flag: execution policy governs script *files*, not the + # inline script that -EncodedCommand runs, so it would be a no-op here. + settings = jsonencode({ + commandToExecute = "powershell.exe -NoProfile -EncodedCommand ${textencodebase64(local.set_dns_suffix_script, "UTF-16LE")}" + }) +} diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/outputs.tf b/src/modules/azure-ptn-compute-virtualmachine-fqdn/outputs.tf new file mode 100644 index 0000000..91fa395 --- /dev/null +++ b/src/modules/azure-ptn-compute-virtualmachine-fqdn/outputs.tf @@ -0,0 +1,4 @@ +output "extension_id" { + description = "Resource ID of the CustomScriptExtension that sets the primary DNS suffix." + value = azurerm_virtual_machine_extension.dns_suffix.id +} diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/variables.tf b/src/modules/azure-ptn-compute-virtualmachine-fqdn/variables.tf new file mode 100644 index 0000000..c7c1feb --- /dev/null +++ b/src/modules/azure-ptn-compute-virtualmachine-fqdn/variables.tf @@ -0,0 +1,33 @@ +variable "virtual_machine_id" { + description = "Resource ID of the Windows virtual machine whose in-guest primary DNS suffix this extension sets." + type = string + + validation { + condition = can(regex("/providers/Microsoft.Compute/virtualMachines/", var.virtual_machine_id)) + error_message = "virtual_machine_id must be a Microsoft.Compute/virtualMachines resource ID." + } +} + +variable "dns_suffix" { + description = "Primary DNS suffix to write in-guest, e.g. westeurope.cloudapp.azure.com, so the machine's FQDN matches the public DNS name of its IP. Any lowercase DNS domain is accepted." + type = string + + validation { + condition = can(regex("^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$", var.dns_suffix)) + error_message = "dns_suffix must be a valid lowercase DNS domain (e.g. westeurope.cloudapp.azure.com)." + } +} + +variable "provision_after_extensions" { + description = "Names of same-VM extensions this suffix step must provision after — the guest agent holds it (and its reboot) until they finish. Empty means no ordering constraint. Example: [\"AADLoginForWindows\"], so the reboot cannot land mid Entra-join." + type = list(string) + default = [] + nullable = false +} + +variable "tags" { + description = "Tags applied to the VM extension." + type = map(string) + default = {} + nullable = false +} diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/versions.tf b/src/modules/azure-ptn-compute-virtualmachine-fqdn/versions.tf new file mode 100644 index 0000000..e457b4a --- /dev/null +++ b/src/modules/azure-ptn-compute-virtualmachine-fqdn/versions.tf @@ -0,0 +1,10 @@ +terraform { + required_version = ">= 1.15" + + required_providers { + azurerm = { + source = "hashicorp/azurerm" + version = ">= 4.81, < 5.0" + } + } +} From 9985c6bd80565f675f7d4301d6cf0d1a5d6e1b51 Mon Sep 17 00:00:00 2001 From: Irinel Bogdan Date: Tue, 28 Jul 2026 17:43:50 +0300 Subject: [PATCH 2/3] rename to relate only to windows fqdn --- docs/modules/azure.md | 2 +- .../main.tf | 0 .../outputs.tf | 0 .../variables.tf | 0 .../versions.tf | 0 5 files changed, 1 insertion(+), 1 deletion(-) rename src/modules/{azure-ptn-compute-virtualmachine-fqdn => azure-ptn-compute-virtualmachine-windows-fqdn}/main.tf (100%) rename src/modules/{azure-ptn-compute-virtualmachine-fqdn => azure-ptn-compute-virtualmachine-windows-fqdn}/outputs.tf (100%) rename src/modules/{azure-ptn-compute-virtualmachine-fqdn => azure-ptn-compute-virtualmachine-windows-fqdn}/variables.tf (100%) rename src/modules/{azure-ptn-compute-virtualmachine-fqdn => azure-ptn-compute-virtualmachine-windows-fqdn}/versions.tf (100%) diff --git a/docs/modules/azure.md b/docs/modules/azure.md index 98cdf42..7d11f96 100644 --- a/docs/modules/azure.md +++ b/docs/modules/azure.md @@ -25,7 +25,7 @@ lacks. Keep new inputs shaped the AVM way. | Module | What it does | |---|---| | [`azure-ptn-authorization-roledefinition-collection`](../../src/modules/azure-ptn-authorization-roledefinition-collection/) | Many role definitions from one map | -| [`azure-ptn-compute-virtualmachine-fqdn`](../../src/modules/azure-ptn-compute-virtualmachine-fqdn/) | Windows VM in-guest primary DNS suffix set via CustomScriptExtension with a deferred reboot, so the guest FQDN matches its public DNS name | +| [`azure-ptn-compute-virtualmachine-windows-fqdn`](../../src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/) | Windows VM in-guest primary DNS suffix set via CustomScriptExtension with a deferred reboot, so the guest FQDN matches its public DNS name | | [`azure-ptn-network-dnszone-records`](../../src/modules/azure-ptn-network-dnszone-records/) | A, AAAA, CAA, CNAME, MX, NS, PTR, SRV and TXT records in an existing public zone | | [`azure-ptn-network-privatednszone-records`](../../src/modules/azure-ptn-network-privatednszone-records/) | A, AAAA, CNAME, MX, PTR, SRV and TXT records in an existing private zone | | [`azure-ptn-network-privatednszone-vnet-links`](../../src/modules/azure-ptn-network-privatednszone-vnet-links/) | Virtual network links across many zones | diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/main.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf similarity index 100% rename from src/modules/azure-ptn-compute-virtualmachine-fqdn/main.tf rename to src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/outputs.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/outputs.tf similarity index 100% rename from src/modules/azure-ptn-compute-virtualmachine-fqdn/outputs.tf rename to src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/outputs.tf diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/variables.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf similarity index 100% rename from src/modules/azure-ptn-compute-virtualmachine-fqdn/variables.tf rename to src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/versions.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf similarity index 100% rename from src/modules/azure-ptn-compute-virtualmachine-fqdn/versions.tf rename to src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf From e1a7f3c4a7377a8ebbfe003bcd2b6095451eaca3 Mon Sep 17 00:00:00 2001 From: Irinel Bogdan Date: Wed, 29 Jul 2026 16:27:07 +0300 Subject: [PATCH 3/3] Reboot machine using azapi_resource_action --- docs/modules/azure.md | 2 +- .../main.tf | 64 ++++++++++--------- .../variables.tf | 7 ++ .../versions.tf | 4 ++ 4 files changed, 47 insertions(+), 30 deletions(-) diff --git a/docs/modules/azure.md b/docs/modules/azure.md index 7d11f96..9ddc591 100644 --- a/docs/modules/azure.md +++ b/docs/modules/azure.md @@ -25,7 +25,7 @@ lacks. Keep new inputs shaped the AVM way. | Module | What it does | |---|---| | [`azure-ptn-authorization-roledefinition-collection`](../../src/modules/azure-ptn-authorization-roledefinition-collection/) | Many role definitions from one map | -| [`azure-ptn-compute-virtualmachine-windows-fqdn`](../../src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/) | Windows VM in-guest primary DNS suffix set via CustomScriptExtension with a deferred reboot, so the guest FQDN matches its public DNS name | +| [`azure-ptn-compute-virtualmachine-windows-fqdn`](../../src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/) | Windows VM in-guest primary DNS suffix set via CustomScriptExtension (so the guest FQDN matches its public DNS name), then applied by an ARM restart the apply blocks on until the VM is running again | | [`azure-ptn-network-dnszone-records`](../../src/modules/azure-ptn-network-dnszone-records/) | A, AAAA, CAA, CNAME, MX, NS, PTR, SRV and TXT records in an existing public zone | | [`azure-ptn-network-privatednszone-records`](../../src/modules/azure-ptn-network-privatednszone-records/) | A, AAAA, CNAME, MX, PTR, SRV and TXT records in an existing private zone | | [`azure-ptn-network-privatednszone-vnet-links`](../../src/modules/azure-ptn-network-privatednszone-vnet-links/) | Virtual network links across many zones | diff --git a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf index 38b80b1..e4f8884 100644 --- a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf +++ b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf @@ -1,42 +1,23 @@ # ============================================================================= -# WINDOWS VM PRIMARY DNS SUFFIX + REBOOT +# WINDOWS VM PRIMARY DNS SUFFIX (Microsoft.Compute/virtualMachines/extensions) # ============================================================================= -# Sets the Windows *primary DNS suffix* via a CustomScriptExtension, then -# reboots, so the machine's own FQDN matches the public DNS name of its IP. -# Without it the guest FQDN stays the bare hostname, and anything that issues a -# ticket for the name you typed (Entra RDP being the motivating case) fails -# because the two names differ. -# -# The public IP and its DNS label are the CALLER's to create and attach - this -# module only touches the guest. provision_after_extensions holds the suffix -# step (and its reboot) until the named extensions finish, so it cannot land -# mid Entra-join. That is a stronger guarantee than depends_on, which only -# orders the ARM calls. +# Sets the guest primary DNS suffix via a CustomScriptExtension, then applies it +# with an ARM restart. The restart (not an in-guest `shutdown`) is deliberate: an +# in-guest reboot is invisible to ARM, so Terraform can't wait on it; azapi blocks +# on the restart LRO until the VM is running again. # ============================================================================= locals { - # Deferred so the extension reports success to Azure before the box goes down. - reboot_delay_seconds = 60 - - # Written to HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters - the - # same keys the Computer Name dialog writes. SyncDomainWithMembership=0 - # mirrors unticking "Change primary DNS suffix when domain membership - # changes". Idempotent: once the suffix is in place the script exits without - # rebooting. + # HKLM\...\Tcpip\Parameters - the keys the Computer Name dialog writes. The + # restart below applies them (the value is read at boot, however triggered). set_dns_suffix_script = <<-PS $ErrorActionPreference = 'Stop' $suffix = '${var.dns_suffix}' $key = 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' - $current = (Get-ItemProperty -Path $key -Name 'NV Domain' -ErrorAction SilentlyContinue).'NV Domain' - if ($current -eq $suffix) { - Write-Output "Primary DNS suffix already '$suffix' - nothing to do." - exit 0 - } Set-ItemProperty -Path $key -Name 'Domain' -Value $suffix -Type String Set-ItemProperty -Path $key -Name 'NV Domain' -Value $suffix -Type String Set-ItemProperty -Path $key -Name 'SyncDomainWithMembership' -Value 0 -Type DWord - Write-Output "Primary DNS suffix set to '$suffix' (was '$current'). Rebooting in ${local.reboot_delay_seconds}s." - shutdown /r /t ${local.reboot_delay_seconds} /c "Applying primary DNS suffix" + Write-Output "Primary DNS suffix set to '$suffix'. Reboot required to take effect." exit 0 PS } @@ -51,9 +32,34 @@ resource "azurerm_virtual_machine_extension" "dns_suffix" { provision_after_extensions = var.provision_after_extensions tags = var.tags - # No -ExecutionPolicy flag: execution policy governs script *files*, not the - # inline script that -EncodedCommand runs, so it would be a no-op here. + # -ExecutionPolicy is omitted: it governs script files, not the inline + # -EncodedCommand, so it would be a no-op here. settings = jsonencode({ commandToExecute = "powershell.exe -NoProfile -EncodedCommand ${textencodebase64(local.set_dns_suffix_script, "UTF-16LE")}" }) } + +# ----------------------------------------------------------------------------- +# Apply the suffix with an ARM restart (blocks until the VM is running again) +# ----------------------------------------------------------------------------- +# replace_triggered_by keys on .settings so the restart re-fires only when the +# suffix changes - not on tags/handler changes; the action is otherwise inert. + +resource "azapi_resource_action" "reboot" { + count = var.reboot ? 1 : 0 + + type = "Microsoft.Compute/virtualMachines@2024-07-01" + resource_id = var.virtual_machine_id + action = "restart" + method = "POST" + + timeouts { + create = "15m" + } + + lifecycle { + replace_triggered_by = [azurerm_virtual_machine_extension.dns_suffix.settings] + } + + depends_on = [azurerm_virtual_machine_extension.dns_suffix] +} diff --git a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf index c7c1feb..66bbd99 100644 --- a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf +++ b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf @@ -31,3 +31,10 @@ variable "tags" { default = {} nullable = false } + +variable "reboot" { + description = "Reboot the VM (via an ARM restart) after writing the suffix so it takes effect, and block the apply until the restart completes and the VM is running again. When it's false the module only writes the registry and the suffix stays inactive until the VM is rebooted by other means." + type = bool + default = true + nullable = false +} diff --git a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf index e457b4a..952ca6d 100644 --- a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf +++ b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf @@ -6,5 +6,9 @@ terraform { source = "hashicorp/azurerm" version = ">= 4.81, < 5.0" } + azapi = { + source = "Azure/azapi" + version = ">= 2.0, < 3.0" + } } }