config validation failure when SSL required on plan nginxproxymanager_proxy_host

[michelnaud59ff]

I think I found a bug when using variables (locals or module variables) on nginxproxymanager_proxy_host.certificate_id parameter when SSL is forced.

Error Case

When I try to create a new host ressource:

main.tf:

locals {
  domain = "mydomain.com"
  certificate_id = 4
}

resource "nginxproxymanager_proxy_host" "app" {
  domain_names = [local.domain]

  forward_scheme = "http"
  forward_host   = "192.168.0.1"
  forward_port   = 8080

  caching_enabled         = false
  allow_websocket_upgrade = false
  block_exploits          = false

  access_list_id = 0 # Publicly Accessible

  certificate_id = local.certificate_id

  ssl_forced      = true
  hsts_enabled    = true
  hsts_subdomains = true
  http2_support   = true

  advanced_config = ""

}

terraform plan

│   on main.tf line 28, in resource "nginxproxymanager_proxy_host" "app":
│   28:     ssl_forced      = true
│ 
│ Certificate ID is required when SSL is forced

First workaround: don't use variables for certificate_id

Replace dynamic variable:

  certificate_id = local.certificate_id

by a direct value:

  certificate_id = 4

  # module.app.nginxproxymanager_proxy_host.app will be created
  + resource "nginxproxymanager_proxy_host" "app" {
      + access_list_id          = 0
      + allow_websocket_upgrade = false
      + block_exploits          = false
      + caching_enabled         = false
      + certificate_id          = "4"
      + created_on              = (known after apply)
      + domain_names            = [
          + "mydomain.com",
        ]
      + enabled                 = (known after apply)
      + forward_host            = "192.168.0.1"
      + forward_port            = 8080
      + forward_scheme          = "http"
      + hsts_enabled            = true
      + hsts_subdomains         = true
      + http2_support           = true
      + id                      = (known after apply)
      + meta                    = (known after apply)
      + modified_on             = (known after apply)
      + owner_user_id           = (known after apply)
      + ssl_forced              = true
        # (1 unchanged attribute hidden)
    }

Second workaround: disable SSL, create, then enable SSL and update

You can first disable SSL, and then use variables for certiticate_id:

resource "nginxproxymanager_proxy_host" "app" {
  domain_names = [local.domain]

  forward_scheme = "http"
  forward_host   = "192.168.0.1"
  forward_port   = 8080

  caching_enabled         = false
  allow_websocket_upgrade = false
  block_exploits          = false

  access_list_id = 0 # Publicly Accessible

  certificate_id = local.certificate_id

  # ssl_forced      = true
  # hsts_enabled    = true
  # hsts_subdomains = true
  # http2_support   = true

  advanced_config = ""

}

terraform plan

  # module.app.nginxproxymanager_proxy_host.app will be created
  + resource "nginxproxymanager_proxy_host" "app" {
      + access_list_id          = 0
      + allow_websocket_upgrade = false
      + block_exploits          = false
      + caching_enabled         = false
      + certificate_id          = "4"
      + created_on              = (known after apply)
      + domain_names            = [
          + "mydomain.com",
        ]
      + enabled                 = (known after apply)
      + forward_host            = "192.168.0.1"
      + forward_port            = 8080
      + forward_scheme          = "http"
      + hsts_enabled            = false
      + hsts_subdomains         = false
      + http2_support           = false
      + id                      = (known after apply)
      + meta                    = (known after apply)
      + modified_on             = (known after apply)
      + owner_user_id           = (known after apply)
      + ssl_forced              = false
        # (1 unchanged attribute hidden)
    }

And, once the resource is already created, enable SSL and update:

main.tf:

resource "nginxproxymanager_proxy_host" "app" {
  domain_names = [local.domain]

  forward_scheme = "http"
  forward_host   = "192.168.0.1"
  forward_port   = 8080

  caching_enabled         = false
  allow_websocket_upgrade = false
  block_exploits          = false

  access_list_id = 0 # Publicly Accessible

  certificate_id = local.certificate_id

  ssl_forced      = true
  hsts_enabled    = true
  hsts_subdomains = true
  http2_support   = true

  advanced_config = ""

}

terraform plan

  # nginxproxymanager_proxy_host.app will be updated in-place
  ~ resource "nginxproxymanager_proxy_host" "app" {
      ~ hsts_enabled            = false -> true
      ~ hsts_subdomains         = false -> true
      ~ http2_support           = false -> true
        id                      = 17
      ~ meta                    = {
          - "nginx_err"    = "null"
          - "nginx_online" = "true"
        } -> (known after apply)
      ~ modified_on             = "2024-08-07 12:23:12" -> (known after apply)
      ~ ssl_forced              = false -> true
        # (13 unchanged attributes hidden)
    }

Impossible to create a terraform module with this bug

The second workaround is working only with "locals" values. For a terraform module, variables are not working, with this kind of usage:

variable "certificate_id" {
  type = string
}