From 7fd1d95501235b9a9c2fcc19d8b313a840db89d9 Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Mon, 18 Dec 2023 22:12:24 +0200
Subject: add vaultwarden

---
 org-buetow-ecs/audiobookshelfservice.tf |   2 +-
 org-buetow-ecs/nginxservice.tf          |   2 +-
 org-buetow-ecs/vaultwarden.tf           | 111 ++++++++++++++++++++++++++++++++
 org-buetow-ecs/wallabagservice.tf       |   2 +-
 4 files changed, 114 insertions(+), 3 deletions(-)
 create mode 100644 org-buetow-ecs/vaultwarden.tf

diff --git a/org-buetow-ecs/audiobookshelfservice.tf b/org-buetow-ecs/audiobookshelfservice.tf
index 50290df..50358f0 100644
--- a/org-buetow-ecs/audiobookshelfservice.tf
+++ b/org-buetow-ecs/audiobookshelfservice.tf
@@ -91,7 +91,7 @@ resource "aws_ecs_task_definition" "audiobookshelf_task" {
 }
 
 resource "aws_ecs_service" "audiobookshelf_service" {
-  name            = "audiobookshelf-service"
+  name            = "audiobookshelf"
   cluster         = aws_ecs_cluster.my_ecs_cluster.id
   task_definition = aws_ecs_task_definition.audiobookshelf_task.arn
   launch_type     = "FARGATE"
diff --git a/org-buetow-ecs/nginxservice.tf b/org-buetow-ecs/nginxservice.tf
index 0477da1..1ea519b 100644
--- a/org-buetow-ecs/nginxservice.tf
+++ b/org-buetow-ecs/nginxservice.tf
@@ -37,7 +37,7 @@ resource "aws_ecs_task_definition" "nginx_task" {
 }
 
 resource "aws_ecs_service" "nginx_service" {
-  name            = "nginx-service"
+  name            = "nginx"
   cluster         = aws_ecs_cluster.my_ecs_cluster.id
   task_definition = aws_ecs_task_definition.nginx_task.arn
   launch_type     = "FARGATE"
diff --git a/org-buetow-ecs/vaultwarden.tf b/org-buetow-ecs/vaultwarden.tf
new file mode 100644
index 0000000..4346218
--- /dev/null
+++ b/org-buetow-ecs/vaultwarden.tf
@@ -0,0 +1,111 @@
+resource "aws_route53_record" "my_a_record_vaultwarden" {
+  zone_id = data.aws_route53_zone.my_zone.zone_id
+  name    = "vaultwarden.aws.buetow.org."
+  type    = "A"
+
+  alias {
+    name                   = aws_lb.my_alb.dns_name
+    zone_id                = aws_lb.my_alb.zone_id
+    evaluate_target_health = true
+  }
+}
+
+resource "aws_ecs_task_definition" "vaultwarden_task" {
+  family                   = "vaultwarden"
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  cpu                      = "256"
+  memory                   = "512"
+  execution_role_arn       = aws_iam_role.ecs_execution_role.arn
+
+  volume {
+    name = "vaultwarden-data-efs-volume"
+    efs_volume_configuration {
+      file_system_id = data.terraform_remote_state.base.outputs.my_self_hosted_services_efs_id
+      root_directory = "/ecs/vaultwarden/data"
+    }
+  }
+
+  container_definitions = jsonencode([{
+    name  = "vaultwarden",
+    image = "vaultwarden/server:latest",
+    portMappings = [{
+      containerPort = 80,
+      hostPort      = 80
+    }],
+    mountPoints = [
+      {
+        sourceVolume  = "vaultwarden-data-efs-volume"
+        containerPath = "/data"
+        readOnly      = false
+      }
+    ],
+    "logConfiguration" : {
+      "logDriver" : "awslogs",
+      "options" : {
+        "awslogs-group" : "/ecs/containers",
+        "awslogs-region" : "eu-central-1",
+        "awslogs-stream-prefix" : "vaultwarden"
+      }
+    }
+  }])
+}
+
+resource "aws_ecs_service" "vaultwarden_service" {
+  name            = "vaultwarden"
+  cluster         = aws_ecs_cluster.my_ecs_cluster.id
+  task_definition = aws_ecs_task_definition.vaultwarden_task.arn
+  launch_type     = "FARGATE"
+  desired_count   = 0
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.my_vaultwarden_tg.arn
+    container_name   = "vaultwarden" # Must match the name in your container definition
+    container_port   = 80            # The port your container is listening on
+  }
+
+  network_configuration {
+    subnets = [
+      data.terraform_remote_state.base.outputs.my_public_subnet_a_id,
+      data.terraform_remote_state.base.outputs.my_public_subnet_b_id,
+      data.terraform_remote_state.base.outputs.my_public_subnet_c_id,
+    ]
+    security_groups  = [data.terraform_remote_state.base.outputs.allow_web_sg_id]
+    assign_public_ip = true
+  }
+}
+
+resource "aws_lb_target_group" "my_vaultwarden_tg" {
+  name        = "my-vaultwarden-tg"
+  port        = 80
+  protocol    = "HTTP"
+  vpc_id      = data.terraform_remote_state.base.outputs.my_vpc_id
+  target_type = "ip"
+
+  health_check {
+    enabled             = true
+    healthy_threshold   = 2
+    unhealthy_threshold = 2
+    interval            = 30
+    path                = "/"
+    protocol            = "HTTP"
+    timeout             = 3
+    matcher             = "200-299"
+  }
+}
+
+resource "aws_lb_listener_rule" "my_vaultwarden_https_listener_rule" {
+  listener_arn = aws_lb_listener.my_https_listener.arn
+  priority     = 103
+
+  action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.my_vaultwarden_tg.arn
+  }
+
+  condition {
+    host_header {
+      values = ["vaultwarden.aws.buetow.org"]
+    }
+  }
+}
diff --git a/org-buetow-ecs/wallabagservice.tf b/org-buetow-ecs/wallabagservice.tf
index 90f9626..e8cb8ac 100644
--- a/org-buetow-ecs/wallabagservice.tf
+++ b/org-buetow-ecs/wallabagservice.tf
@@ -74,7 +74,7 @@ resource "aws_ecs_task_definition" "wallabag_task" {
 }
 
 resource "aws_ecs_service" "wallabag_service" {
-  name            = "wallabag-service"
+  name            = "wallabag"
   cluster         = aws_ecs_cluster.my_ecs_cluster.id
   task_definition = aws_ecs_task_definition.wallabag_task.arn
   launch_type     = "FARGATE"
-- 
cgit v1.2.3