From e0405c3e480cff4c40ca868cafd7f88e21f8a76e Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Tue, 2 Jan 2024 22:53:09 +0200 Subject: add more variables controlling what to install and what not --- org-buetow-ecs/audiobookshelfservice.tf | 12 +- org-buetow-ecs/bagservice.tf | 12 +- org-buetow-ecs/fluxpostgreservice.tf | 18 +- org-buetow-ecs/fluxservice.tf | 14 +- org-buetow-ecs/nginxservice.tf | 254 ++++++++++++++-------------- org-buetow-ecs/radicaleservice.tf | 12 +- org-buetow-ecs/syncthingservice.tf | 36 ++-- org-buetow-ecs/variables.tf | 42 +++++ org-buetow-ecs/vaultservice.tf | 288 ++++++++++++++++---------------- 9 files changed, 392 insertions(+), 296 deletions(-) diff --git a/org-buetow-ecs/audiobookshelfservice.tf b/org-buetow-ecs/audiobookshelfservice.tf index 1cb662c..97ba7ba 100644 --- a/org-buetow-ecs/audiobookshelfservice.tf +++ b/org-buetow-ecs/audiobookshelfservice.tf @@ -1,4 +1,5 @@ resource "aws_route53_record" "a_record_audiobookshelf" { + count = var.deploy_audiobookshelf ? 1 : 0 zone_id = data.terraform_remote_state.base.outputs.zone_id name = "audiobookshelf.${data.terraform_remote_state.base.outputs.zone_name}." type = "A" @@ -11,6 +12,7 @@ resource "aws_route53_record" "a_record_audiobookshelf" { } resource "aws_route53_record" "aaaa_record_audiobookshelf" { + count = var.deploy_audiobookshelf ? 1 : 0 zone_id = data.terraform_remote_state.base.outputs.zone_id name = "audiobookshelf.${data.terraform_remote_state.base.outputs.zone_name}." type = "AAAA" @@ -23,6 +25,7 @@ resource "aws_route53_record" "aaaa_record_audiobookshelf" { } resource "aws_ecs_task_definition" "audiobookshelf" { + count = var.deploy_audiobookshelf ? 1 : 0 family = "audiobookshelf" network_mode = "awsvpc" requires_compatibilities = ["FARGATE"] @@ -108,9 +111,10 @@ resource "aws_ecs_task_definition" "audiobookshelf" { } resource "aws_ecs_service" "audiobookshelf" { + count = var.deploy_audiobookshelf ? 1 : 0 name = "audiobookshelf" cluster = aws_ecs_cluster.ecs_cluster.id - task_definition = aws_ecs_task_definition.audiobookshelf.arn + task_definition = aws_ecs_task_definition.audiobookshelf[0].arn launch_type = "FARGATE" deployment_maximum_percent = 100 deployment_minimum_healthy_percent = 0 @@ -121,7 +125,7 @@ resource "aws_ecs_service" "audiobookshelf" { } load_balancer { - target_group_arn = aws_lb_target_group.audiobookshelf_tg.arn + target_group_arn = aws_lb_target_group.audiobookshelf_tg[0].arn container_name = "audiobookshelf" # Must match the name in your container definition container_port = 80 # The port your container is listening on } @@ -138,6 +142,7 @@ resource "aws_ecs_service" "audiobookshelf" { } resource "aws_lb_target_group" "audiobookshelf_tg" { + count = var.deploy_audiobookshelf ? 1 : 0 name = "audiobookshelf-tg" port = 80 protocol = "HTTP" @@ -161,12 +166,13 @@ resource "aws_lb_target_group" "audiobookshelf_tg" { } resource "aws_lb_listener_rule" "audiobookshelf_https_listener_rule" { + count = var.deploy_audiobookshelf ? 1 : 0 listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn priority = 102 action { type = "forward" - target_group_arn = aws_lb_target_group.audiobookshelf_tg.arn + target_group_arn = aws_lb_target_group.audiobookshelf_tg[0].arn } condition { diff --git a/org-buetow-ecs/bagservice.tf b/org-buetow-ecs/bagservice.tf index 9145f66..ed1526f 100644 --- a/org-buetow-ecs/bagservice.tf +++ b/org-buetow-ecs/bagservice.tf @@ -1,4 +1,5 @@ resource "aws_route53_record" "a_record_bag" { + count = var.deploy_bag ? 1 : 0 zone_id = data.terraform_remote_state.base.outputs.zone_id name = "bag.${data.terraform_remote_state.base.outputs.zone_name}." type = "A" @@ -11,6 +12,7 @@ resource "aws_route53_record" "a_record_bag" { } resource "aws_route53_record" "aaaa_record_bag" { + count = var.deploy_bag ? 1 : 0 zone_id = data.terraform_remote_state.base.outputs.zone_id name = "bag.${data.terraform_remote_state.base.outputs.zone_name}." type = "AAAA" @@ -23,6 +25,7 @@ resource "aws_route53_record" "aaaa_record_bag" { } resource "aws_ecs_task_definition" "bag" { + count = var.deploy_bag ? 1 : 0 family = "bag" network_mode = "awsvpc" requires_compatibilities = ["FARGATE"] @@ -87,9 +90,10 @@ resource "aws_ecs_task_definition" "bag" { } resource "aws_ecs_service" "bag" { + count = var.deploy_bag ? 1 : 0 name = "bag" cluster = aws_ecs_cluster.ecs_cluster.id - task_definition = aws_ecs_task_definition.bag.arn + task_definition = aws_ecs_task_definition.bag[0].arn launch_type = "FARGATE" deployment_maximum_percent = 100 deployment_minimum_healthy_percent = 0 @@ -100,7 +104,7 @@ resource "aws_ecs_service" "bag" { } load_balancer { - target_group_arn = aws_lb_target_group.bag_tg.arn + target_group_arn = aws_lb_target_group.bag_tg[0].arn container_name = "bag" # Must match the name in your container definition container_port = 80 # The port your container is listening on } @@ -117,6 +121,7 @@ resource "aws_ecs_service" "bag" { } resource "aws_lb_target_group" "bag_tg" { + count = var.deploy_bag ? 1 : 0 name = "bag-tg" port = 80 protocol = "HTTP" @@ -140,12 +145,13 @@ resource "aws_lb_target_group" "bag_tg" { } resource "aws_lb_listener_rule" "bag_https_listener_rule" { + count = var.deploy_bag ? 1 : 0 listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn priority = 101 action { type = "forward" - target_group_arn = aws_lb_target_group.bag_tg.arn + target_group_arn = aws_lb_target_group.bag_tg[0].arn } condition { diff --git a/org-buetow-ecs/fluxpostgreservice.tf b/org-buetow-ecs/fluxpostgreservice.tf index e28d7d8..314be7d 100644 --- a/org-buetow-ecs/fluxpostgreservice.tf +++ b/org-buetow-ecs/fluxpostgreservice.tf @@ -1,10 +1,11 @@ resource "aws_lb" "fluxpostgres_nlb" { + count = var.deploy_flux ? 1 : 0 name = "fluxpostgres-nlb" internal = true load_balancer_type = "network" ip_address_type = "dualstack" security_groups = [ - aws_security_group.fluxpostgres.id, + aws_security_group.fluxpostgres[0].id, ] subnets = [ data.terraform_remote_state.base.outputs.public_subnet_a_id, @@ -18,13 +19,14 @@ resource "aws_lb" "fluxpostgres_nlb" { } resource "aws_lb_listener" "fluxpostgres_tcp" { - load_balancer_arn = aws_lb.fluxpostgres_nlb.arn + count = var.deploy_flux ? 1 : 0 + load_balancer_arn = aws_lb.fluxpostgres_nlb[0].arn protocol = "TCP" port = 5432 default_action { type = "forward" - target_group_arn = aws_lb_target_group.fluxpostgres_tcp.arn + target_group_arn = aws_lb_target_group.fluxpostgres_tcp[0].arn } tags = { @@ -33,6 +35,7 @@ resource "aws_lb_listener" "fluxpostgres_tcp" { } resource "aws_lb_target_group" "fluxpostgres_tcp" { + count = var.deploy_flux ? 1 : 0 name = "fluxpostgres-tcp" port = 5432 protocol = "TCP" @@ -45,6 +48,7 @@ resource "aws_lb_target_group" "fluxpostgres_tcp" { } resource "aws_ecs_task_definition" "fluxpostgres" { + count = var.deploy_flux ? 1 : 0 family = "fluxpostgres" network_mode = "awsvpc" requires_compatibilities = ["FARGATE"] @@ -103,6 +107,7 @@ resource "aws_ecs_task_definition" "fluxpostgres" { } resource "aws_security_group" "fluxpostgres" { + count = var.deploy_flux ? 1 : 0 name = "allow-fluxpostgres" description = "Allow traffic on fluxpostgres ports" vpc_id = data.terraform_remote_state.base.outputs.vpc_id @@ -140,9 +145,10 @@ resource "aws_security_group" "fluxpostgres" { } resource "aws_ecs_service" "fluxpostgres" { + count = var.deploy_flux ? 1 : 0 name = "fluxpostgres" cluster = aws_ecs_cluster.ecs_cluster.id - task_definition = aws_ecs_task_definition.fluxpostgres.arn + task_definition = aws_ecs_task_definition.fluxpostgres[0].arn launch_type = "FARGATE" deployment_maximum_percent = 100 deployment_minimum_healthy_percent = 0 @@ -153,7 +159,7 @@ resource "aws_ecs_service" "fluxpostgres" { } load_balancer { - target_group_arn = aws_lb_target_group.fluxpostgres_tcp.arn + target_group_arn = aws_lb_target_group.fluxpostgres_tcp[0].arn container_name = "fluxpostgres" container_port = 5432 } @@ -164,7 +170,7 @@ resource "aws_ecs_service" "fluxpostgres" { data.terraform_remote_state.base.outputs.public_subnet_b_id, data.terraform_remote_state.base.outputs.public_subnet_c_id, ] - security_groups = [aws_security_group.fluxpostgres.id] + security_groups = [aws_security_group.fluxpostgres[0].id] assign_public_ip = false } } diff --git a/org-buetow-ecs/fluxservice.tf b/org-buetow-ecs/fluxservice.tf index 4aeb443..fb1d4b9 100644 --- a/org-buetow-ecs/fluxservice.tf +++ b/org-buetow-ecs/fluxservice.tf @@ -1,4 +1,5 @@ resource "aws_route53_record" "a_record_flux" { + count = var.deploy_flux ? 1 : 0 zone_id = data.terraform_remote_state.base.outputs.zone_id name = "flux.${data.terraform_remote_state.base.outputs.zone_name}." type = "A" @@ -11,6 +12,7 @@ resource "aws_route53_record" "a_record_flux" { } resource "aws_route53_record" "aaaa_record_flux" { + count = var.deploy_flux ? 1 : 0 zone_id = data.terraform_remote_state.base.outputs.zone_id name = "flux.${data.terraform_remote_state.base.outputs.zone_name}." type = "AAAA" @@ -23,6 +25,7 @@ resource "aws_route53_record" "aaaa_record_flux" { } resource "aws_ecs_task_definition" "flux" { + count = var.deploy_flux ? 1 : 0 family = "flux" network_mode = "awsvpc" requires_compatibilities = ["FARGATE"] @@ -48,7 +51,7 @@ resource "aws_ecs_task_definition" "flux" { environment = [ { name = "DATABASE_URL", - value = "postgres://miniflux:${jsondecode(data.aws_secretsmanager_secret_version.fluxdb_password.secret_string)["fluxdb_password"]}@${aws_lb.fluxpostgres_nlb.dns_name}/miniflux?sslmode=disable", + value = "postgres://miniflux:${jsondecode(data.aws_secretsmanager_secret_version.fluxdb_password.secret_string)["fluxdb_password"]}@${aws_lb.fluxpostgres_nlb[0].dns_name}/miniflux?sslmode=disable", }, { name = "RUN_MIGRATIONS", @@ -79,9 +82,10 @@ resource "aws_ecs_task_definition" "flux" { } resource "aws_ecs_service" "flux" { + count = var.deploy_flux ? 1 : 0 name = "flux" cluster = aws_ecs_cluster.ecs_cluster.id - task_definition = aws_ecs_task_definition.flux.arn + task_definition = aws_ecs_task_definition.flux[0].arn launch_type = "FARGATE" deployment_maximum_percent = 100 deployment_minimum_healthy_percent = 0 @@ -92,7 +96,7 @@ resource "aws_ecs_service" "flux" { } load_balancer { - target_group_arn = aws_lb_target_group.flux_tg.arn + target_group_arn = aws_lb_target_group.flux_tg[0].arn container_name = "flux" # Must match the name in your container definition container_port = 8080 # The port your container is listening on } @@ -109,6 +113,7 @@ resource "aws_ecs_service" "flux" { } resource "aws_lb_target_group" "flux_tg" { + count = var.deploy_flux ? 1 : 0 name = "flux-tg" port = 8080 protocol = "HTTP" @@ -132,6 +137,7 @@ resource "aws_lb_target_group" "flux_tg" { } resource "aws_lb_listener_rule" "flux_https_listener_rule" { + count = var.deploy_flux ? 1 : 0 listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn priority = 105 @@ -141,7 +147,7 @@ resource "aws_lb_listener_rule" "flux_https_listener_rule" { action { type = "forward" - target_group_arn = aws_lb_target_group.flux_tg.arn + target_group_arn = aws_lb_target_group.flux_tg[0].arn } condition { diff --git a/org-buetow-ecs/nginxservice.tf b/org-buetow-ecs/nginxservice.tf index ad19684..6e0baa5 100644 --- a/org-buetow-ecs/nginxservice.tf +++ b/org-buetow-ecs/nginxservice.tf @@ -1,124 +1,130 @@ -#resource "aws_route53_record" "a_record_nginx" { -# zone_id = data.terraform_remote_state.base.outputs.zone_id -# name = "nginx.${data.terraform_remote_state.base.outputs.zone_name}." -# type = "A" -# -# alias { -# name = data.terraform_remote_state.elb.outputs.alb_dns_name -# zone_id = data.terraform_remote_state.elb.outputs.alb_zone_id -# evaluate_target_health = true -# } -#} -# -#resource "aws_route53_record" "aaaa_record_nginx" { -# zone_id = data.terraform_remote_state.base.outputs.zone_id -# name = "nginx.${data.terraform_remote_state.base.outputs.zone_name}." -# type = "AAAA" -# -# alias { -# name = data.terraform_remote_state.elb.outputs.alb_dns_name -# zone_id = data.terraform_remote_state.elb.outputs.alb_zone_id -# evaluate_target_health = true -# } -#} -# -#resource "aws_ecs_task_definition" "nginx" { -# family = "nginx" -# network_mode = "awsvpc" -# requires_compatibilities = ["FARGATE"] -# cpu = "256" -# memory = "512" -# execution_role_arn = aws_iam_role.ecs_execution_role.arn -# -# tags = { -# Name = "nginx" -# } -# -# container_definitions = jsonencode([{ -# name = "nginx", -# image = "nginx:latest", -# portMappings = [{ -# containerPort = 80, -# hostPort = 80 -# }], -# "logConfiguration" : { -# "logDriver" : "awslogs", -# "options" : { -# "awslogs-group" : "/ecs/containers", -# "awslogs-region" : "eu-central-1", -# "awslogs-stream-prefix" : "nginx" -# } -# } -# }]) -#} -# -#resource "aws_ecs_service" "nginx" { -# name = "nginx" -# cluster = aws_ecs_cluster.ecs_cluster.id -# task_definition = aws_ecs_task_definition.nginx.arn -# launch_type = "FARGATE" -# desired_count = 1 -# -# tags = { -# Name = "nginx" -# } -# -# load_balancer { -# target_group_arn = aws_lb_target_group.nginx_tg.arn -# container_name = "nginx" # Must match the name in your container definition -# container_port = 80 # The port your container is listening on -# } -# -# network_configuration { -# subnets = [ -# data.terraform_remote_state.base.outputs.public_subnet_a_id, -# data.terraform_remote_state.base.outputs.public_subnet_b_id, -# data.terraform_remote_state.base.outputs.public_subnet_c_id, -# ] -# security_groups = [data.terraform_remote_state.base.outputs.allow_web_sg_id] -# assign_public_ip = true -# } -#} -# -#resource "aws_lb_target_group" "nginx_tg" { -# name = "nginx-tg" -# port = 80 -# protocol = "HTTP" -# vpc_id = data.terraform_remote_state.base.outputs.vpc_id -# target_type = "ip" -# -# tags = { -# Name = "nginx" -# } -# -# health_check { -# enabled = true -# healthy_threshold = 2 -# unhealthy_threshold = 2 -# interval = 30 -# path = "/" # Modify if your app has a specific health check path -# protocol = "HTTP" -# timeout = 3 -# matcher = "200-299" -# } -#} -# -#resource "aws_lb_listener_rule" "nginx_https_listener_rule" { -# listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn -# priority = 100 -# -# action { -# type = "forward" -# target_group_arn = aws_lb_target_group.nginx_tg.arn -# } -# -# condition { -# host_header { -# values = ["nginx.${data.terraform_remote_state.base.outputs.zone_name}"] -# } -# } -# -# tags = { -# Name = "nginx" -# } -#} +resource "aws_route53_record" "a_record_nginx" { + count = var.deploy_nginx ? 1 : 0 + zone_id = data.terraform_remote_state.base.outputs.zone_id + name = "nginx.${data.terraform_remote_state.base.outputs.zone_name}." + type = "A" + + alias { + name = data.terraform_remote_state.elb.outputs.alb_dns_name + zone_id = data.terraform_remote_state.elb.outputs.alb_zone_id + evaluate_target_health = true + } +} + +resource "aws_route53_record" "aaaa_record_nginx" { + count = var.deploy_nginx ? 1 : 0 + zone_id = data.terraform_remote_state.base.outputs.zone_id + name = "nginx.${data.terraform_remote_state.base.outputs.zone_name}." + type = "AAAA" + + alias { + name = data.terraform_remote_state.elb.outputs.alb_dns_name + zone_id = data.terraform_remote_state.elb.outputs.alb_zone_id + evaluate_target_health = true + } +} + +resource "aws_ecs_task_definition" "nginx" { + count = var.deploy_nginx ? 1 : 0 + family = "nginx" + network_mode = "awsvpc" + requires_compatibilities = ["FARGATE"] + cpu = "256" + memory = "512" + execution_role_arn = aws_iam_role.ecs_execution_role.arn + + tags = { + Name = "nginx" + } + + container_definitions = jsonencode([{ + name = "nginx", + image = "nginx:latest", + portMappings = [{ + containerPort = 80, + hostPort = 80 + }], + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/containers", + "awslogs-region" : "eu-central-1", + "awslogs-stream-prefix" : "nginx" + } + } + }]) +} + +resource "aws_ecs_service" "nginx" { + count = var.deploy_nginx ? 1 : 0 + name = "nginx" + cluster = aws_ecs_cluster.ecs_cluster.id + task_definition = aws_ecs_task_definition.nginx[0].arn + launch_type = "FARGATE" + desired_count = 1 + + tags = { + Name = "nginx" + } + + load_balancer { + target_group_arn = aws_lb_target_group.nginx_tg[0].arn + container_name = "nginx" # Must match the name in your container definition + container_port = 80 # The port your container is listening on + } + + network_configuration { + subnets = [ + data.terraform_remote_state.base.outputs.public_subnet_a_id, + data.terraform_remote_state.base.outputs.public_subnet_b_id, + data.terraform_remote_state.base.outputs.public_subnet_c_id, + ] + security_groups = [data.terraform_remote_state.base.outputs.allow_web_sg_id] + assign_public_ip = true + } +} + +resource "aws_lb_target_group" "nginx_tg" { + count = var.deploy_nginx ? 1 : 0 + name = "nginx-tg" + port = 80 + protocol = "HTTP" + vpc_id = data.terraform_remote_state.base.outputs.vpc_id + target_type = "ip" + + tags = { + Name = "nginx" + } + + health_check { + enabled = true + healthy_threshold = 2 + unhealthy_threshold = 2 + interval = 30 + path = "/" # Modify if your app has a specific health check path + protocol = "HTTP" + timeout = 3 + matcher = "200-299" + } +} + +resource "aws_lb_listener_rule" "nginx_https_listener_rule" { + count = var.deploy_nginx ? 1 : 0 + listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn + priority = 100 + + action { + type = "forward" + target_group_arn = aws_lb_target_group.nginx_tg[0].arn + } + + condition { + host_header { + values = ["nginx.${data.terraform_remote_state.base.outputs.zone_name}"] + } + } + + tags = { + Name = "nginx" + } +} diff --git a/org-buetow-ecs/radicaleservice.tf b/org-buetow-ecs/radicaleservice.tf index 175f295..4d6c1a7 100644 --- a/org-buetow-ecs/radicaleservice.tf +++ b/org-buetow-ecs/radicaleservice.tf @@ -1,4 +1,5 @@ resource "aws_route53_record" "a_record_radicale" { + count = var.deploy_radicale ? 1 : 0 zone_id = data.terraform_remote_state.base.outputs.zone_id name = "radicale.${data.terraform_remote_state.base.outputs.zone_name}." type = "A" @@ -11,6 +12,7 @@ resource "aws_route53_record" "a_record_radicale" { } resource "aws_route53_record" "aaaa_record_radicale" { + count = var.deploy_radicale ? 1 : 0 zone_id = data.terraform_remote_state.base.outputs.zone_id name = "radicale.${data.terraform_remote_state.base.outputs.zone_name}." type = "AAAA" @@ -23,6 +25,7 @@ resource "aws_route53_record" "aaaa_record_radicale" { } resource "aws_ecs_task_definition" "radicale" { + count = var.deploy_radicale ? 1 : 0 family = "radicale" network_mode = "awsvpc" requires_compatibilities = ["FARGATE"] @@ -81,9 +84,10 @@ resource "aws_ecs_task_definition" "radicale" { } resource "aws_ecs_service" "radicale" { + count = var.deploy_radicale ? 1 : 0 name = "radicale" cluster = aws_ecs_cluster.ecs_cluster.id - task_definition = aws_ecs_task_definition.radicale.arn + task_definition = aws_ecs_task_definition.radicale[0].arn launch_type = "FARGATE" deployment_maximum_percent = 100 deployment_minimum_healthy_percent = 0 @@ -94,7 +98,7 @@ resource "aws_ecs_service" "radicale" { } load_balancer { - target_group_arn = aws_lb_target_group.radicale_tg.arn + target_group_arn = aws_lb_target_group.radicale_tg[0].arn container_name = "radicale" # Must match the name in your container definition container_port = 8080 # The port your container is listening on } @@ -111,6 +115,7 @@ resource "aws_ecs_service" "radicale" { } resource "aws_lb_target_group" "radicale_tg" { + count = var.deploy_radicale ? 1 : 0 name = "radicale-tg" port = 8080 protocol = "HTTP" @@ -134,12 +139,13 @@ resource "aws_lb_target_group" "radicale_tg" { } resource "aws_lb_listener_rule" "radicale_https_listener_rule" { + count = var.deploy_radicale ? 1 : 0 listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn priority = 106 action { type = "forward" - target_group_arn = aws_lb_target_group.radicale_tg.arn + target_group_arn = aws_lb_target_group.radicale_tg[0].arn } condition { diff --git a/org-buetow-ecs/syncthingservice.tf b/org-buetow-ecs/syncthingservice.tf index 16c6210..71fb8f4 100644 --- a/org-buetow-ecs/syncthingservice.tf +++ b/org-buetow-ecs/syncthingservice.tf @@ -1,10 +1,11 @@ resource "aws_lb" "syncthing_nlb" { + count = var.deploy_syncthing ? 1 : 0 name = "syncthing-nlb" internal = false load_balancer_type = "network" ip_address_type = "dualstack" security_groups = [ - aws_security_group.syncthing.id, + aws_security_group.syncthing[0].id, ] subnets = [ data.terraform_remote_state.base.outputs.public_subnet_a_id, @@ -18,13 +19,14 @@ resource "aws_lb" "syncthing_nlb" { } resource "aws_lb_listener" "syncthing_data_tcp" { - load_balancer_arn = aws_lb.syncthing_nlb.arn + count = var.deploy_syncthing ? 1 : 0 + load_balancer_arn = aws_lb.syncthing_nlb[0].arn protocol = "TCP" port = 22000 default_action { type = "forward" - target_group_arn = aws_lb_target_group.syncthing_data_tcp.arn + target_group_arn = aws_lb_target_group.syncthing_data_tcp[0].arn } tags = { @@ -33,6 +35,7 @@ resource "aws_lb_listener" "syncthing_data_tcp" { } resource "aws_lb_target_group" "syncthing_data_tcp" { + count = var.deploy_syncthing ? 1 : 0 name = "syncthing-data-tcp" port = 22000 protocol = "TCP" @@ -45,6 +48,7 @@ resource "aws_lb_target_group" "syncthing_data_tcp" { } resource "aws_route53_record" "a_record_syncthing" { + count = var.deploy_syncthing ? 1 : 0 zone_id = data.terraform_remote_state.base.outputs.zone_id name = "syncthing.${data.terraform_remote_state.base.outputs.zone_name}." type = "A" @@ -57,6 +61,7 @@ resource "aws_route53_record" "a_record_syncthing" { } resource "aws_route53_record" "aaaa_record_syncthing" { + count = var.deploy_syncthing ? 1 : 0 zone_id = data.terraform_remote_state.base.outputs.zone_id name = "syncthing.${data.terraform_remote_state.base.outputs.zone_name}." type = "AAAA" @@ -69,6 +74,7 @@ resource "aws_route53_record" "aaaa_record_syncthing" { } resource "aws_lb_target_group" "syncthing_ui_tg" { + count = var.deploy_syncthing ? 1 : 0 name = "syncthing-ui-tg" port = 8384 protocol = "HTTP" @@ -92,12 +98,13 @@ resource "aws_lb_target_group" "syncthing_ui_tg" { } resource "aws_lb_listener_rule" "syncthing_ui_https_listener_rule" { + count = var.deploy_syncthing ? 1 : 0 listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn priority = 104 action { type = "forward" - target_group_arn = aws_lb_target_group.syncthing_ui_tg.arn + target_group_arn = aws_lb_target_group.syncthing_ui_tg[0].arn } condition { @@ -113,30 +120,33 @@ resource "aws_lb_listener_rule" "syncthing_ui_https_listener_rule" { resource "aws_route53_record" "a_record_syncthing_data" { + count = var.deploy_syncthing ? 1 : 0 zone_id = data.terraform_remote_state.base.outputs.zone_id name = "syncthing-data.${data.terraform_remote_state.base.outputs.zone_name}." type = "A" alias { - name = aws_lb.syncthing_nlb.dns_name - zone_id = aws_lb.syncthing_nlb.zone_id + name = aws_lb.syncthing_nlb[0].dns_name + zone_id = aws_lb.syncthing_nlb[0].zone_id evaluate_target_health = true } } resource "aws_route53_record" "aaaa_record_syncthing_data" { + count = var.deploy_syncthing ? 1 : 0 zone_id = data.terraform_remote_state.base.outputs.zone_id name = "syncthing-data.${data.terraform_remote_state.base.outputs.zone_name}." type = "AAAA" alias { - name = aws_lb.syncthing_nlb.dns_name - zone_id = aws_lb.syncthing_nlb.zone_id + name = aws_lb.syncthing_nlb[0].dns_name + zone_id = aws_lb.syncthing_nlb[0].zone_id evaluate_target_health = true } } resource "aws_ecs_task_definition" "syncthing" { + count = var.deploy_syncthing ? 1 : 0 family = "syncthing" network_mode = "awsvpc" requires_compatibilities = ["FARGATE"] @@ -216,6 +226,7 @@ resource "aws_ecs_task_definition" "syncthing" { } resource "aws_security_group" "syncthing" { + count = var.deploy_syncthing ? 1 : 0 name = "allow-syncthing" description = "Allow traffic on syncthing ports" vpc_id = data.terraform_remote_state.base.outputs.vpc_id @@ -270,9 +281,10 @@ resource "aws_security_group" "syncthing" { } resource "aws_ecs_service" "syncthing" { + count = var.deploy_syncthing ? 1 : 0 name = "syncthing" cluster = aws_ecs_cluster.ecs_cluster.id - task_definition = aws_ecs_task_definition.syncthing.arn + task_definition = aws_ecs_task_definition.syncthing[0].arn launch_type = "FARGATE" deployment_maximum_percent = 100 deployment_minimum_healthy_percent = 0 @@ -283,13 +295,13 @@ resource "aws_ecs_service" "syncthing" { } load_balancer { - target_group_arn = aws_lb_target_group.syncthing_ui_tg.arn + target_group_arn = aws_lb_target_group.syncthing_ui_tg[0].arn container_name = "syncthing" # Must match the name in your container definition container_port = 8384 # The port your container is listening on } load_balancer { - target_group_arn = aws_lb_target_group.syncthing_data_tcp.arn + target_group_arn = aws_lb_target_group.syncthing_data_tcp[0].arn container_name = "syncthing" # Must match the name in your container definition container_port = 22000 # The port your container is listening on } @@ -300,7 +312,7 @@ resource "aws_ecs_service" "syncthing" { data.terraform_remote_state.base.outputs.public_subnet_b_id, data.terraform_remote_state.base.outputs.public_subnet_c_id, ] - security_groups = [aws_security_group.syncthing.id] + security_groups = [aws_security_group.syncthing[0].id] assign_public_ip = true } } diff --git a/org-buetow-ecs/variables.tf b/org-buetow-ecs/variables.tf index bb3fffa..6b3a81f 100644 --- a/org-buetow-ecs/variables.tf +++ b/org-buetow-ecs/variables.tf @@ -3,3 +3,45 @@ variable "deploy_anki" { type = bool default = false } + +variable "deploy_audiobookshelf" { + description = "Deploy Audio Bool Shelf Server?" + type = bool + default = true +} + +variable "deploy_bag" { + description = "Deploy Wallabag Server?" + type = bool + default = true +} + +variable "deploy_nginx" { + description = "Deploy Nginx Server?" + type = bool + default = false +} + +variable "deploy_radicale" { + description = "Deploy Radicale Server?" + type = bool + default = true +} + +variable "deploy_syncthing" { + description = "Deploy Syncthing Server?" + type = bool + default = true +} + +variable "deploy_vault" { + description = "Deploy Vaultwarden Server?" + type = bool + default = false +} + +variable "deploy_flux" { + description = "Deploy Miniflux Server?" + type = bool + default = true +} diff --git a/org-buetow-ecs/vaultservice.tf b/org-buetow-ecs/vaultservice.tf index 22f97e0..689a7ea 100644 --- a/org-buetow-ecs/vaultservice.tf +++ b/org-buetow-ecs/vaultservice.tf @@ -1,141 +1,147 @@ -#resource "aws_route53_record" "a_record_vault" { -# zone_id = data.terraform_remote_state.base.outputs.zone_id -# name = "vault.${data.terraform_remote_state.base.outputs.zone_name}." -# type = "A" -# -# alias { -# name = data.terraform_remote_state.elb.outputs.alb_dns_name -# zone_id = data.terraform_remote_state.elb.outputs.alb_zone_id -# evaluate_target_health = true -# } -#} -# -#resource "aws_route53_record" "aaaa_record_vault" { -# zone_id = data.terraform_remote_state.base.outputs.zone_id -# name = "vault.${data.terraform_remote_state.base.outputs.zone_name}." -# type = "AAAA" -# -# alias { -# name = data.terraform_remote_state.elb.outputs.alb_dns_name -# zone_id = data.terraform_remote_state.elb.outputs.alb_zone_id -# evaluate_target_health = true -# } -#} -# -#resource "aws_ecs_task_definition" "vault" { -# family = "vault" -# network_mode = "awsvpc" -# requires_compatibilities = ["FARGATE"] -# cpu = "256" -# memory = "512" -# execution_role_arn = aws_iam_role.ecs_execution_role.arn -# -# tags = { -# Name = "vault" -# } -# -# volume { -# name = "vault-data-efs-volume" -# efs_volume_configuration { -# file_system_id = data.terraform_remote_state.base.outputs.self_hosted_services_efs_id -# root_directory = "/ecs/vault/data" -# } -# } -# -# container_definitions = jsonencode([{ -# name = "vault", -# image = "vaultwarden/server:latest", -# portMappings = [{ -# containerPort = 80, -# hostPort = 80 -# }], -# mountPoints = [ -# { -# sourceVolume = "vault-data-efs-volume" -# containerPath = "/data" -# readOnly = false -# } -# ], -# "logConfiguration" : { -# "logDriver" : "awslogs", -# "options" : { -# "awslogs-group" : "/ecs/containers", -# "awslogs-region" : "eu-central-1", -# "awslogs-stream-prefix" : "vault" -# } -# } -# }]) -#} -# -#resource "aws_ecs_service" "vault" { -# name = "vault" -# cluster = aws_ecs_cluster.ecs_cluster.id -# task_definition = aws_ecs_task_definition.vault.arn -# launch_type = "FARGATE" -# deployment_maximum_percent = 100 -# deployment_minimum_healthy_percent = 0 -# desired_count = 1 -# -# tags = { -# Name = "vault" -# } -# -# load_balancer { -# target_group_arn = aws_lb_target_group.vault_tg.arn -# container_name = "vault" # Must match the name in your container definition -# container_port = 80 # The port your container is listening on -# } -# -# network_configuration { -# subnets = [ -# data.terraform_remote_state.base.outputs.public_subnet_a_id, -# data.terraform_remote_state.base.outputs.public_subnet_b_id, -# data.terraform_remote_state.base.outputs.public_subnet_c_id, -# ] -# security_groups = [data.terraform_remote_state.base.outputs.allow_web_sg_id] -# assign_public_ip = true -# } -#} -# -#resource "aws_lb_target_group" "vault_tg" { -# name = "vault-tg" -# port = 80 -# protocol = "HTTP" -# vpc_id = data.terraform_remote_state.base.outputs.vpc_id -# target_type = "ip" -# -# health_check { -# enabled = true -# healthy_threshold = 2 -# unhealthy_threshold = 2 -# interval = 30 -# path = "/" -# protocol = "HTTP" -# timeout = 3 -# matcher = "200-299" -# } -# -# tags = { -# Name = "vault" -# } -#} -# -#resource "aws_lb_listener_rule" "vault_https_listener_rule" { -# listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn -# priority = 103 -# -# action { -# type = "forward" -# target_group_arn = aws_lb_target_group.vault_tg.arn -# } -# -# condition { -# host_header { -# values = ["vault.${data.terraform_remote_state.base.outputs.zone_name}"] -# } -# } -# -# tags = { -# Name = "vault" -# } -#} +resource "aws_route53_record" "a_record_vault" { + count = var.deploy_vault ? 1 : 0 + zone_id = data.terraform_remote_state.base.outputs.zone_id + name = "vault.${data.terraform_remote_state.base.outputs.zone_name}." + type = "A" + + alias { + name = data.terraform_remote_state.elb.outputs.alb_dns_name + zone_id = data.terraform_remote_state.elb.outputs.alb_zone_id + evaluate_target_health = true + } +} + +resource "aws_route53_record" "aaaa_record_vault" { + count = var.deploy_vault ? 1 : 0 + zone_id = data.terraform_remote_state.base.outputs.zone_id + name = "vault.${data.terraform_remote_state.base.outputs.zone_name}." + type = "AAAA" + + alias { + name = data.terraform_remote_state.elb.outputs.alb_dns_name + zone_id = data.terraform_remote_state.elb.outputs.alb_zone_id + evaluate_target_health = true + } +} + +resource "aws_ecs_task_definition" "vault" { + count = var.deploy_vault ? 1 : 0 + family = "vault" + network_mode = "awsvpc" + requires_compatibilities = ["FARGATE"] + cpu = "256" + memory = "512" + execution_role_arn = aws_iam_role.ecs_execution_role.arn + + tags = { + Name = "vault" + } + + volume { + name = "vault-data-efs-volume" + efs_volume_configuration { + file_system_id = data.terraform_remote_state.base.outputs.self_hosted_services_efs_id + root_directory = "/ecs/vault/data" + } + } + + container_definitions = jsonencode([{ + name = "vault", + image = "vaultwarden/server:latest", + portMappings = [{ + containerPort = 80, + hostPort = 80 + }], + mountPoints = [ + { + sourceVolume = "vault-data-efs-volume" + containerPath = "/data" + readOnly = false + } + ], + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/containers", + "awslogs-region" : "eu-central-1", + "awslogs-stream-prefix" : "vault" + } + } + }]) +} + +resource "aws_ecs_service" "vault" { + count = var.deploy_vault ? 1 : 0 + name = "vault" + cluster = aws_ecs_cluster.ecs_cluster.id + task_definition = aws_ecs_task_definition.vault[0].arn + launch_type = "FARGATE" + deployment_maximum_percent = 100 + deployment_minimum_healthy_percent = 0 + desired_count = 1 + + tags = { + Name = "vault" + } + + load_balancer { + target_group_arn = aws_lb_target_group.vault_tg[0].arn + container_name = "vault" # Must match the name in your container definition + container_port = 80 # The port your container is listening on + } + + network_configuration { + subnets = [ + data.terraform_remote_state.base.outputs.public_subnet_a_id, + data.terraform_remote_state.base.outputs.public_subnet_b_id, + data.terraform_remote_state.base.outputs.public_subnet_c_id, + ] + security_groups = [data.terraform_remote_state.base.outputs.allow_web_sg_id] + assign_public_ip = true + } +} + +resource "aws_lb_target_group" "vault_tg" { + count = var.deploy_vault ? 1 : 0 + name = "vault-tg" + port = 80 + protocol = "HTTP" + vpc_id = data.terraform_remote_state.base.outputs.vpc_id + target_type = "ip" + + health_check { + enabled = true + healthy_threshold = 2 + unhealthy_threshold = 2 + interval = 30 + path = "/" + protocol = "HTTP" + timeout = 3 + matcher = "200-299" + } + + tags = { + Name = "vault" + } +} + +resource "aws_lb_listener_rule" "vault_https_listener_rule" { + count = var.deploy_vault ? 1 : 0 + listener_arn = data.terraform_remote_state.elb.outputs.alb_https_listener_arn + priority = 103 + + action { + type = "forward" + target_group_arn = aws_lb_target_group.vault_tg[0].arn + } + + condition { + host_header { + values = ["vault.${data.terraform_remote_state.base.outputs.zone_name}"] + } + } + + tags = { + Name = "vault" + } +} -- cgit v1.2.3