Skip to content
This repository was archived by the owner on Jul 11, 2023. It is now read-only.

Commit f0378d7

Browse files
MagicloudMagicloud
committed
New example: Confluence
The example runs Confluence Docker image in a single node ASG, with a RDS, and two ALBs (internal and external). The ALBs have domain names set, and TLS cert (from ACM).
1 parent 614ecfd commit f0378d7

File tree

3 files changed

+315
-0
lines changed

3 files changed

+315
-0
lines changed

‎examples/confluence/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Confluence
2+
3+
Showing pratical usage of a fully functional website, from HTTPS frontend to Postgres backend.

‎examples/confluence/docker-compose.tpl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
version: "3.7"
2+
services:
3+
confluence:
4+
image: atlassian/confluence-server
5+
ports:
6+
- "${http_port}:8090"
7+
volumes:
8+
- /data/confluence:/var/atlassian/application-data/confluence
9+
environment:
10+
- ATL_JDBC_URL=jdbc:postgresql://${db_host}:5432/${db_db}
11+
- ATL_JDBC_USER=${db_user}
12+
- ATL_JDBC_PASSWORD='${db_pass}'
13+
- ATL_DB_TYPE=postgresql

‎examples/confluence/main.tf‎

Lines changed: 299 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,299 @@
1+
variable "region" {
2+
type = string
3+
description = "AWS region to run the example"
4+
}
5+
variable "ssh_key" {
6+
type = string
7+
description = "AWS SSH key name for instance"
8+
}
9+
variable "db_password" {
10+
type = string
11+
description = "Password for RDS"
12+
}
13+
variable "base_domain" {
14+
type = string
15+
description = "Base domain name for internal and external FQDN, with the last dot"
16+
}
17+
18+
data "aws_availability_zones" "azs" {}
19+
20+
data "aws_route53_zone" "sandbox" {
21+
name = var.base_domain
22+
private_zone = false
23+
}
24+
25+
module "vpc" {
26+
source = "fpco/foundation/aws//modules/vpc-scenario-2"
27+
azs = data.aws_availability_zones.azs.names
28+
cidr = "192.168.0.0/16"
29+
name_prefix = "confluence"
30+
private_subnet_cidrs = ["192.168.100.0/24", "192.168.101.0/24"]
31+
public_subnet_cidrs = ["192.168.0.0/24", "192.168.1.0/24"]
32+
region = var.region
33+
}
34+
35+
module "centos" {
36+
source = "fpco/foundation/aws//modules/ami-centos"
37+
release = "7"
38+
}
39+
40+
module "asg-sg" {
41+
source = "fpco/foundation/aws//modules/security-group-base"
42+
name = "asg-sg"
43+
description = "SG for ASG"
44+
vpc_id = module.vpc.vpc_id
45+
}
46+
47+
module "asg-to-world" {
48+
source = "fpco/foundation/aws//modules/open-egress-sg"
49+
security_group_id = module.asg-sg.id
50+
}
51+
52+
module "ssh-port-sg-rule" {
53+
source = "fpco/foundation/aws//modules/single-port-sg"
54+
security_group_id = module.asg-sg.id
55+
cidr_blocks = ["0.0.0.0/0"]
56+
port = 22
57+
description = "SSH from anywhere, for debug."
58+
}
59+
60+
resource "aws_security_group_rule" "asg_int_alb_http_port_sg_rule" {
61+
security_group_id = module.asg-sg.id
62+
from_port = 80
63+
to_port = 80
64+
type = "ingress"
65+
protocol = "TCP"
66+
description = "HTTP ingress for int ALB"
67+
source_security_group_id = module.int-alb.security_group_id
68+
}
69+
70+
resource "aws_security_group_rule" "asg_ext_alb_http_port_sg_rule" {
71+
security_group_id = module.asg-sg.id
72+
from_port = 80
73+
to_port = 80
74+
type = "ingress"
75+
protocol = "TCP"
76+
description = "HTTP ingress for ext ALB"
77+
source_security_group_id = module.ext-alb.security_group_id
78+
}
79+
80+
module "asg" {
81+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/single-node-asg?ref=lb-asg"
82+
ami = module.centos.id
83+
instance_type = "m5.xlarge"
84+
key_name = var.ssh_key
85+
name_prefix = "confluence"
86+
name_suffix = ""
87+
region = var.region
88+
security_group_ids = [module.asg-sg.id]
89+
subnet_id = module.vpc.private_subnet_ids[0]
90+
public_ip = false
91+
alb_target_group_arns = [module.int-forwarder.target_group_arn, module.ext-forwarder.target_group_arn]
92+
data_volume_size = 50
93+
init_prefix = <<EOF
94+
yum install -y python3-pip
95+
pip3 install awscli
96+
${module.install-docker-compose.init_snippet}
97+
EOF
98+
init_suffix = <<EOF
99+
mkdir -p /data
100+
mkfs.xfs /dev/xvdf
101+
mount /dev/xvdf /data
102+
mkdir -p /data/confluence
103+
cat > /tmp/docker-compose.yml <<EOCAT
104+
${data.template_file.docker_compose.rendered}
105+
EOCAT
106+
cd /tmp
107+
docker-compose up -d
108+
# rm docker-compose.yml
109+
EOF
110+
}
111+
112+
data "template_file" "docker_compose" {
113+
template = file("${path.module}/docker-compose.tpl")
114+
vars = {
115+
http_port = 80
116+
db_host = module.rds.endpoint
117+
db_db = "confluence"
118+
db_user = "confluence"
119+
db_pass = var.db_password
120+
}
121+
}
122+
123+
module "install-docker-compose" {
124+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/init-snippet-install-docker-yum?ref=install-docker"
125+
}
126+
127+
module "rds-sg" {
128+
source = "fpco/foundation/aws//modules/security-group-base"
129+
name = "rds-sg"
130+
description = "SG for RDS"
131+
vpc_id = module.vpc.vpc_id
132+
}
133+
134+
resource "aws_security_group_rule" "rds_sg_rule" {
135+
security_group_id = module.rds-sg.id
136+
from_port = 5432
137+
to_port = 5432
138+
type = "ingress"
139+
protocol = "TCP"
140+
description = "PGSQL ingress for RDS"
141+
source_security_group_id = module.asg-sg.id
142+
}
143+
144+
module "rds" {
145+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/rds?ref=rds"
146+
db_engine = "postgres"
147+
db_instance_type = "db.m5.xlarge"
148+
db_name = "confluence"
149+
db_password = var.db_password
150+
db_storage_size = 20
151+
db_storage_type = "gp2"
152+
db_username = "confluence"
153+
engine_version = "11"
154+
name_prefix = "confluence"
155+
security_group_id = module.rds-sg.id
156+
subnet_ids = module.vpc.private_subnet_ids
157+
}
158+
159+
module "int-alb" {
160+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb?ref=alb"
161+
vpc_id = module.vpc.vpc_id
162+
name_prefix = "confluence-int"
163+
subnet_ids = module.vpc.public_subnet_ids
164+
}
165+
166+
module "int_alb_http_port_sg_rule" {
167+
source = "fpco/foundation/aws//modules/single-port-sg"
168+
security_group_id = module.int-alb.security_group_id
169+
cidr_blocks = ["192.168.0.0/16"]
170+
port = 80
171+
description = "HTTP ingress for ALB"
172+
}
173+
174+
module "int_alb_https_port_sg_rule" {
175+
source = "fpco/foundation/aws//modules/single-port-sg"
176+
security_group_id = module.int-alb.security_group_id
177+
cidr_blocks = ["192.168.0.0/16"]
178+
port = 443
179+
description = "HTTPS ingress for ALB"
180+
}
181+
182+
module "int-alb-to-asg" {
183+
source = "fpco/foundation/aws//modules/open-egress-sg"
184+
security_group_id = module.int-alb.security_group_id
185+
}
186+
187+
module "int-forwarder" {
188+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb-default-forward?ref=alb"
189+
lb_arn = module.int-alb.lb_arn
190+
lb_port = 443
191+
name_prefix = "confluence-int-https"
192+
protocol = "HTTPS"
193+
service_port = 80
194+
vpc_id = module.vpc.vpc_id
195+
https_cert_arn = aws_acm_certificate_validation.validation.certificate_arn
196+
}
197+
198+
module "int_redirector" {
199+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb-redirect?ref=alb"
200+
lb_arn = module.int-alb.lb_arn
201+
http_port = 80
202+
https_port = 443
203+
}
204+
205+
module "ext-alb" {
206+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb?ref=alb"
207+
vpc_id = module.vpc.vpc_id
208+
name_prefix = "confluence-ext"
209+
subnet_ids = module.vpc.public_subnet_ids
210+
internal = false
211+
}
212+
213+
module "ext_alb_http_port_sg_rule" {
214+
source = "fpco/foundation/aws//modules/single-port-sg"
215+
security_group_id = module.ext-alb.security_group_id
216+
cidr_blocks = ["0.0.0.0/0"]
217+
port = 80
218+
description = "HTTP ingress for ALB"
219+
}
220+
221+
module "ext_alb_https_port_sg_rule" {
222+
source = "fpco/foundation/aws//modules/single-port-sg"
223+
security_group_id = module.ext-alb.security_group_id
224+
cidr_blocks = ["0.0.0.0/0"]
225+
port = 443
226+
description = "HTTPS ingress for ALB"
227+
}
228+
229+
module "ext-alb-to-asg" {
230+
source = "fpco/foundation/aws//modules/open-egress-sg"
231+
security_group_id = module.ext-alb.security_group_id
232+
}
233+
234+
module "ext-forwarder" {
235+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb-default-forward?ref=alb"
236+
lb_arn = module.ext-alb.lb_arn
237+
lb_port = 443
238+
name_prefix = "confluence-ext-https"
239+
protocol = "HTTPS"
240+
service_port = 80
241+
vpc_id = module.vpc.vpc_id
242+
https_cert_arn = aws_acm_certificate_validation.validation.certificate_arn
243+
}
244+
245+
module "ext_redirector" {
246+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb-redirect?ref=alb"
247+
lb_arn = module.ext-alb.lb_arn
248+
http_port = 80
249+
https_port = 443
250+
}
251+
252+
resource "aws_route53_record" "int" {
253+
zone_id = data.aws_route53_zone.sandbox.zone_id
254+
name = "c-i.${data.aws_route53_zone.sandbox.name}"
255+
type = "A"
256+
alias {
257+
name = module.int-alb.lb_dns_name
258+
zone_id = module.int-alb.lb_zone_id
259+
evaluate_target_health = true
260+
}
261+
}
262+
263+
resource "aws_route53_record" "ext" {
264+
zone_id = data.aws_route53_zone.sandbox.zone_id
265+
name = "c-e.${data.aws_route53_zone.sandbox.name}"
266+
type = "A"
267+
alias {
268+
name = module.ext-alb.lb_dns_name
269+
zone_id = module.ext-alb.lb_zone_id
270+
evaluate_target_health = true
271+
}
272+
}
273+
274+
resource "aws_acm_certificate" "cert" {
275+
domain_name = aws_route53_record.ext.fqdn
276+
subject_alternative_names = [aws_route53_record.int.fqdn]
277+
validation_method = "DNS"
278+
}
279+
280+
resource "aws_route53_record" "cert_validation_ext" {
281+
name = aws_acm_certificate.cert.domain_validation_options.0.resource_record_name
282+
type = aws_acm_certificate.cert.domain_validation_options.0.resource_record_type
283+
zone_id = data.aws_route53_zone.sandbox.id
284+
records = [aws_acm_certificate.cert.domain_validation_options.0.resource_record_value]
285+
ttl = 60
286+
}
287+
288+
resource "aws_route53_record" "cert_validation_int" {
289+
name = aws_acm_certificate.cert.domain_validation_options.1.resource_record_name
290+
type = aws_acm_certificate.cert.domain_validation_options.1.resource_record_type
291+
zone_id = data.aws_route53_zone.sandbox.id
292+
records = [aws_acm_certificate.cert.domain_validation_options.1.resource_record_value]
293+
ttl = 60
294+
}
295+
296+
resource "aws_acm_certificate_validation" "validation" {
297+
certificate_arn = aws_acm_certificate.cert.arn
298+
validation_record_fqdns = [aws_route53_record.cert_validation_ext.fqdn, aws_route53_record.cert_validation_int.fqdn]
299+
}

0 commit comments

Comments
 (0)