From 38124d610973e486494272c0c28166bee6eb72f5 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Wed, 20 Dec 2023 09:53:14 +0200 Subject: factor out elb to separate project --- README.md | 4 ++ org-buetow-ecs/audiobookshelfservice.tf | 6 +- org-buetow-ecs/data.tf | 3 + org-buetow-ecs/ecs.tf | 24 ------- org-buetow-ecs/elb.tf | 72 --------------------- org-buetow-ecs/nginxservice.tf | 6 +- org-buetow-ecs/remotestate.tf | 9 +++ org-buetow-ecs/vaultwarden.tf | 111 -------------------------------- org-buetow-ecs/vaultwardenservice.tf | 111 ++++++++++++++++++++++++++++++++ org-buetow-ecs/wallabagservice.tf | 6 +- org-buetow-elb/alb.tf | 77 ++++++++++++++++++++++ org-buetow-elb/data.tf | 3 + org-buetow-elb/main.tf | 13 ++++ org-buetow-elb/outputs.tf | 11 ++++ org-buetow-elb/remotestate.tf | 8 +++ 15 files changed, 248 insertions(+), 216 deletions(-) create mode 100644 org-buetow-ecs/data.tf delete mode 100644 org-buetow-ecs/elb.tf delete mode 100644 org-buetow-ecs/vaultwarden.tf create mode 100644 org-buetow-ecs/vaultwardenservice.tf create mode 100644 org-buetow-elb/alb.tf create mode 100644 org-buetow-elb/data.tf create mode 100644 org-buetow-elb/main.tf create mode 100644 org-buetow-elb/outputs.tf create mode 100644 org-buetow-elb/remotestate.tf diff --git a/README.md b/README.md index bde5ddf..aaad5a0 100644 --- a/README.md +++ b/README.md @@ -23,6 +23,10 @@ Then, create subdirectories in EFS, using `org-buetow-helper`. E.g., have someth /mnt/efs/ecs/audiobookshelf ``` +## Set up Application loadbalancer + +In `org-buetow-elb` + ## Now set up Fargate/ECS In `org-buetow-ecs` diff --git a/org-buetow-ecs/audiobookshelfservice.tf b/org-buetow-ecs/audiobookshelfservice.tf index 50358f0..dec7668 100644 --- a/org-buetow-ecs/audiobookshelfservice.tf +++ b/org-buetow-ecs/audiobookshelfservice.tf @@ -4,8 +4,8 @@ resource "aws_route53_record" "my_a_record_audiobookshelf" { type = "A" alias { - name = aws_lb.my_alb.dns_name - zone_id = aws_lb.my_alb.zone_id + name = data.terraform_remote_state.elb.outputs.alb_dns_name + zone_id = data.terraform_remote_state.elb.outputs.alb_zone_id evaluate_target_health = true } } @@ -134,7 +134,7 @@ resource "aws_lb_target_group" "my_audiobookshelf_tg" { } resource "aws_lb_listener_rule" "my_audiobookshelf_https_listener_rule" { - listener_arn = aws_lb_listener.my_https_listener.arn + listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn priority = 102 action { diff --git a/org-buetow-ecs/data.tf b/org-buetow-ecs/data.tf new file mode 100644 index 0000000..91583b3 --- /dev/null +++ b/org-buetow-ecs/data.tf @@ -0,0 +1,3 @@ +data "aws_route53_zone" "my_zone" { + name = "aws.buetow.org." +} diff --git a/org-buetow-ecs/ecs.tf b/org-buetow-ecs/ecs.tf index 7c678d4..b31a46b 100644 --- a/org-buetow-ecs/ecs.tf +++ b/org-buetow-ecs/ecs.tf @@ -21,27 +21,3 @@ resource "aws_iam_role_policy_attachment" "ecs_execution_role_policy_attach" { role = aws_iam_role.ecs_execution_role.name policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy" } - -# For EFS mounts -#resource "aws_iam_role" "ecs_task_execution_role" { -# name = "ecs_task_execution_role" -# -# assume_role_policy = jsonencode({ -# Version = "2012-10-17", -# Statement = [ -# { -# Action = "sts:AssumeRole", -# Effect = "Allow", -# Principal = { -# Service = "ecs-tasks.amazonaws.com" -# }, -# }, -# ], -# }) -#} -# -## For EFS mounts -#resource "aws_iam_role_policy_attachment" "ecs_efs_access" { -# role = aws_iam_role.ecs_task_execution_role.name -# policy_arn = "arn:aws:iam::aws:policy/AmazonElasticFileSystemFullAccess" -#} diff --git a/org-buetow-ecs/elb.tf b/org-buetow-ecs/elb.tf deleted file mode 100644 index 5ba57ca..0000000 --- a/org-buetow-ecs/elb.tf +++ /dev/null @@ -1,72 +0,0 @@ -resource "aws_lb" "my_alb" { - name = "my-alb" - internal = false - load_balancer_type = "application" - security_groups = [aws_security_group.alb_sg.id] - subnets = [ - data.terraform_remote_state.base.outputs.my_public_subnet_a_id, - data.terraform_remote_state.base.outputs.my_public_subnet_b_id, - data.terraform_remote_state.base.outputs.my_public_subnet_c_id, - ] - enable_deletion_protection = false -} - -resource "aws_security_group" "alb_sg" { - vpc_id = data.terraform_remote_state.base.outputs.my_vpc_id - - ingress { - from_port = 80 - to_port = 80 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - ingress { - from_port = 443 - to_port = 443 - protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] - } - - egress { - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - } -} - -resource "aws_lb_listener" "my_http_listener" { - load_balancer_arn = aws_lb.my_alb.arn - port = "80" - protocol = "HTTP" - - default_action { - type = "redirect" - - redirect { - protocol = "HTTPS" - port = "443" - status_code = "HTTP_301" - path = "/#{path}" - query = "#{query}" - } - } -} - -data "aws_route53_zone" "my_zone" { - name = "aws.buetow.org." -} - -resource "aws_lb_listener" "my_https_listener" { - load_balancer_arn = aws_lb.my_alb.arn - port = "443" - protocol = "HTTPS" - ssl_policy = "ELBSecurityPolicy-2016-08" - certificate_arn = data.terraform_remote_state.base.outputs.aws_buetow_org_certificate_arn - - default_action { - type = "forward" - target_group_arn = aws_lb_target_group.my_nginx_tg.arn - } -} diff --git a/org-buetow-ecs/nginxservice.tf b/org-buetow-ecs/nginxservice.tf index 1ea519b..f5fd40e 100644 --- a/org-buetow-ecs/nginxservice.tf +++ b/org-buetow-ecs/nginxservice.tf @@ -4,8 +4,8 @@ resource "aws_route53_record" "my_a_record" { type = "A" alias { - name = aws_lb.my_alb.dns_name - zone_id = aws_lb.my_alb.zone_id + name = data.terraform_remote_state.elb.outputs.alb_dns_name + zone_id = data.terraform_remote_state.elb.outputs.alb_zone_id evaluate_target_health = true } } @@ -80,7 +80,7 @@ resource "aws_lb_target_group" "my_nginx_tg" { } resource "aws_lb_listener_rule" "my_nginx_https_listener_rule" { - listener_arn = aws_lb_listener.my_https_listener.arn + listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn priority = 100 action { diff --git a/org-buetow-ecs/remotestate.tf b/org-buetow-ecs/remotestate.tf index b66c16f..db9b321 100644 --- a/org-buetow-ecs/remotestate.tf +++ b/org-buetow-ecs/remotestate.tf @@ -6,3 +6,12 @@ data "terraform_remote_state" "base" { region = "eu-central-1" } } + +data "terraform_remote_state" "elb" { + backend = "s3" + config = { + bucket = "org-buetow-tfstate" + key = "org-buetow-elb/terraform.tfstate" + region = "eu-central-1" + } +} diff --git a/org-buetow-ecs/vaultwarden.tf b/org-buetow-ecs/vaultwarden.tf deleted file mode 100644 index 4346218..0000000 --- a/org-buetow-ecs/vaultwarden.tf +++ /dev/null @@ -1,111 +0,0 @@ -resource "aws_route53_record" "my_a_record_vaultwarden" { - zone_id = data.aws_route53_zone.my_zone.zone_id - name = "vaultwarden.aws.buetow.org." - type = "A" - - alias { - name = aws_lb.my_alb.dns_name - zone_id = aws_lb.my_alb.zone_id - evaluate_target_health = true - } -} - -resource "aws_ecs_task_definition" "vaultwarden_task" { - family = "vaultwarden" - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - cpu = "256" - memory = "512" - execution_role_arn = aws_iam_role.ecs_execution_role.arn - - volume { - name = "vaultwarden-data-efs-volume" - efs_volume_configuration { - file_system_id = data.terraform_remote_state.base.outputs.my_self_hosted_services_efs_id - root_directory = "/ecs/vaultwarden/data" - } - } - - container_definitions = jsonencode([{ - name = "vaultwarden", - image = "vaultwarden/server:latest", - portMappings = [{ - containerPort = 80, - hostPort = 80 - }], - mountPoints = [ - { - sourceVolume = "vaultwarden-data-efs-volume" - containerPath = "/data" - readOnly = false - } - ], - "logConfiguration" : { - "logDriver" : "awslogs", - "options" : { - "awslogs-group" : "/ecs/containers", - "awslogs-region" : "eu-central-1", - "awslogs-stream-prefix" : "vaultwarden" - } - } - }]) -} - -resource "aws_ecs_service" "vaultwarden_service" { - name = "vaultwarden" - cluster = aws_ecs_cluster.my_ecs_cluster.id - task_definition = aws_ecs_task_definition.vaultwarden_task.arn - launch_type = "FARGATE" - desired_count = 0 - - load_balancer { - target_group_arn = aws_lb_target_group.my_vaultwarden_tg.arn - container_name = "vaultwarden" # Must match the name in your container definition - container_port = 80 # The port your container is listening on - } - - network_configuration { - subnets = [ - data.terraform_remote_state.base.outputs.my_public_subnet_a_id, - data.terraform_remote_state.base.outputs.my_public_subnet_b_id, - data.terraform_remote_state.base.outputs.my_public_subnet_c_id, - ] - security_groups = [data.terraform_remote_state.base.outputs.allow_web_sg_id] - assign_public_ip = true - } -} - -resource "aws_lb_target_group" "my_vaultwarden_tg" { - name = "my-vaultwarden-tg" - port = 80 - protocol = "HTTP" - vpc_id = data.terraform_remote_state.base.outputs.my_vpc_id - target_type = "ip" - - health_check { - enabled = true - healthy_threshold = 2 - unhealthy_threshold = 2 - interval = 30 - path = "/" - protocol = "HTTP" - timeout = 3 - matcher = "200-299" - } -} - -resource "aws_lb_listener_rule" "my_vaultwarden_https_listener_rule" { - listener_arn = aws_lb_listener.my_https_listener.arn - priority = 103 - - action { - type = "forward" - target_group_arn = aws_lb_target_group.my_vaultwarden_tg.arn - } - - condition { - host_header { - values = ["vaultwarden.aws.buetow.org"] - } - } -} diff --git a/org-buetow-ecs/vaultwardenservice.tf b/org-buetow-ecs/vaultwardenservice.tf new file mode 100644 index 0000000..b8db54a --- /dev/null +++ b/org-buetow-ecs/vaultwardenservice.tf @@ -0,0 +1,111 @@ +resource "aws_route53_record" "my_a_record_vaultwarden" { + zone_id = data.aws_route53_zone.my_zone.zone_id + name = "vaultwarden.aws.buetow.org." + type = "A" + + alias { + name = data.terraform_remote_state.elb.outputs.alb_dns_name + zone_id = data.terraform_remote_state.elb.outputs.alb_zone_id + evaluate_target_health = true + } +} + +resource "aws_ecs_task_definition" "vaultwarden_task" { + family = "vaultwarden" + network_mode = "awsvpc" + requires_compatibilities = ["FARGATE"] + cpu = "256" + memory = "512" + execution_role_arn = aws_iam_role.ecs_execution_role.arn + + volume { + name = "vaultwarden-data-efs-volume" + efs_volume_configuration { + file_system_id = data.terraform_remote_state.base.outputs.my_self_hosted_services_efs_id + root_directory = "/ecs/vaultwarden/data" + } + } + + container_definitions = jsonencode([{ + name = "vaultwarden", + image = "vaultwarden/server:latest", + portMappings = [{ + containerPort = 80, + hostPort = 80 + }], + mountPoints = [ + { + sourceVolume = "vaultwarden-data-efs-volume" + containerPath = "/data" + readOnly = false + } + ], + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/containers", + "awslogs-region" : "eu-central-1", + "awslogs-stream-prefix" : "vaultwarden" + } + } + }]) +} + +resource "aws_ecs_service" "vaultwarden_service" { + name = "vaultwarden" + cluster = aws_ecs_cluster.my_ecs_cluster.id + task_definition = aws_ecs_task_definition.vaultwarden_task.arn + launch_type = "FARGATE" + desired_count = 0 + + load_balancer { + target_group_arn = aws_lb_target_group.my_vaultwarden_tg.arn + container_name = "vaultwarden" # Must match the name in your container definition + container_port = 80 # The port your container is listening on + } + + network_configuration { + subnets = [ + data.terraform_remote_state.base.outputs.my_public_subnet_a_id, + data.terraform_remote_state.base.outputs.my_public_subnet_b_id, + data.terraform_remote_state.base.outputs.my_public_subnet_c_id, + ] + security_groups = [data.terraform_remote_state.base.outputs.allow_web_sg_id] + assign_public_ip = true + } +} + +resource "aws_lb_target_group" "my_vaultwarden_tg" { + name = "my-vaultwarden-tg" + port = 80 + protocol = "HTTP" + vpc_id = data.terraform_remote_state.base.outputs.my_vpc_id + target_type = "ip" + + health_check { + enabled = true + healthy_threshold = 2 + unhealthy_threshold = 2 + interval = 30 + path = "/" + protocol = "HTTP" + timeout = 3 + matcher = "200-299" + } +} + +resource "aws_lb_listener_rule" "my_vaultwarden_https_listener_rule" { + listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn + priority = 103 + + action { + type = "forward" + target_group_arn = aws_lb_target_group.my_vaultwarden_tg.arn + } + + condition { + host_header { + values = ["vaultwarden.aws.buetow.org"] + } + } +} diff --git a/org-buetow-ecs/wallabagservice.tf b/org-buetow-ecs/wallabagservice.tf index 715c777..9c0e1b8 100644 --- a/org-buetow-ecs/wallabagservice.tf +++ b/org-buetow-ecs/wallabagservice.tf @@ -4,8 +4,8 @@ resource "aws_route53_record" "my_a_record_wallabag" { type = "A" alias { - name = aws_lb.my_alb.dns_name - zone_id = aws_lb.my_alb.zone_id + name = data.terraform_remote_state.elb.outputs.alb_dns_name + zone_id = data.terraform_remote_state.elb.outputs.alb_zone_id evaluate_target_health = true } } @@ -117,7 +117,7 @@ resource "aws_lb_target_group" "my_wallabag_tg" { } resource "aws_lb_listener_rule" "my_wallabag_https_listener_rule" { - listener_arn = aws_lb_listener.my_https_listener.arn + listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn priority = 101 action { diff --git a/org-buetow-elb/alb.tf b/org-buetow-elb/alb.tf new file mode 100644 index 0000000..cf9d5a2 --- /dev/null +++ b/org-buetow-elb/alb.tf @@ -0,0 +1,77 @@ +resource "aws_lb" "my_alb" { + name = "my-alb" + internal = false + load_balancer_type = "application" + security_groups = [aws_security_group.alb_sg.id] + subnets = [ + data.terraform_remote_state.base.outputs.my_public_subnet_a_id, + data.terraform_remote_state.base.outputs.my_public_subnet_b_id, + data.terraform_remote_state.base.outputs.my_public_subnet_c_id, + ] + enable_deletion_protection = false +} + +resource "aws_security_group" "alb_sg" { + vpc_id = data.terraform_remote_state.base.outputs.my_vpc_id + + ingress { + from_port = 80 + to_port = 80 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] + } + + ingress { + from_port = 443 + to_port = 443 + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] + } + + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } +} + +resource "aws_lb_listener" "my_http_listener" { + load_balancer_arn = aws_lb.my_alb.arn + port = "80" + protocol = "HTTP" + + default_action { + type = "redirect" + + redirect { + protocol = "HTTPS" + port = "443" + status_code = "HTTP_301" + path = "/#{path}" + query = "#{query}" + } + } +} + +resource "aws_lb_listener" "my_https_listener" { + load_balancer_arn = aws_lb.my_alb.arn + port = "443" + protocol = "HTTPS" + ssl_policy = "ELBSecurityPolicy-2016-08" + certificate_arn = data.terraform_remote_state.base.outputs.aws_buetow_org_certificate_arn + + default_action { + type = "forward" + target_group_arn = aws_lb_target_group.default_tg.arn + } +} + +resource "aws_lb_target_group" "default_tg" { + name = "my-default-tg" + port = 80 + protocol = "HTTP" + vpc_id = data.terraform_remote_state.base.outputs.my_vpc_id + target_type = "ip" +} + diff --git a/org-buetow-elb/data.tf b/org-buetow-elb/data.tf new file mode 100644 index 0000000..91583b3 --- /dev/null +++ b/org-buetow-elb/data.tf @@ -0,0 +1,3 @@ +data "aws_route53_zone" "my_zone" { + name = "aws.buetow.org." +} diff --git a/org-buetow-elb/main.tf b/org-buetow-elb/main.tf new file mode 100644 index 0000000..b83c53f --- /dev/null +++ b/org-buetow-elb/main.tf @@ -0,0 +1,13 @@ +terraform { + backend "s3" { + bucket = "org-buetow-tfstate" + key = "org-buetow-elb/terraform.tfstate" + region = "eu-central-1" + # Optional, if you enabled server-side encryption + encrypt = true + } +} + +provider "aws" { + region = "eu-central-1" # or your preferred AWS region +} diff --git a/org-buetow-elb/outputs.tf b/org-buetow-elb/outputs.tf new file mode 100644 index 0000000..39925a2 --- /dev/null +++ b/org-buetow-elb/outputs.tf @@ -0,0 +1,11 @@ +output "alb_dns_name" { + value = aws_lb.my_alb.dns_name +} + +output "alb_zone_id" { + value = aws_lb.my_alb.zone_id +} + +output "alb_https_listener_arn" { + value = aws_lb_listener.my_https_listener.arn +} diff --git a/org-buetow-elb/remotestate.tf b/org-buetow-elb/remotestate.tf new file mode 100644 index 0000000..b66c16f --- /dev/null +++ b/org-buetow-elb/remotestate.tf @@ -0,0 +1,8 @@ +data "terraform_remote_state" "base" { + backend = "s3" + config = { + bucket = "org-buetow-tfstate" + key = "org-buetow-base/terraform.tfstate" + region = "eu-central-1" + } +} -- cgit v1.2.3