Skip to content

Commit 01b37f6

Browse files
GordonBeemingGordonBeeming
committed
demo code
1 parent b881650 commit 01b37f6

File tree

6 files changed

+257
-0
lines changed

6 files changed

+257
-0
lines changed

‎envs/local.tfvars

+6
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
11
deploy_region = "westeurope"
22
resource_group_name = "demo4-shared-rg"
33
environment_name = "local"
4+
5+
sshAccess = "Deny" # Allow or Deny
6+
7+
app_vm_size = "Standard_DS2_v2"
8+
app_admin_user = "adminuser"
9+
# app_admin_password = local env variable

‎identity.tf

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
2+
resource "azuread_application" "main" {
3+
display_name = "Demo4-${var.environment_name}"
4+
}
5+
6+
resource "azuread_service_principal" "main" {
7+
application_id = azuread_application.main.application_id
8+
}
9+
10+
resource "azurerm_role_assignment" "rg-owner" {
11+
scope = azurerm_resource_group.main.id
12+
role_definition_name = "Owner"
13+
principal_id = azuread_service_principal.main.object_id
14+
}
15+
16+
resource "azurerm_user_assigned_identity" "app" {
17+
resource_group_name = azurerm_resource_group.main.name
18+
location = azurerm_resource_group.main.location
19+
20+
name = "${var.environment_name}-app-user"
21+
}
22+
23+
output "azure_app" {
24+
value = azuread_application.main.display_name
25+
}
26+
27+
output "client_id" {
28+
value = azuread_application.main.application_id
29+
}

‎network.tf

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
2+
resource "azurerm_virtual_network" "main" {
3+
name = "${var.environment_name}-demo4dso-network"
4+
address_space = ["10.0.0.0/16"]
5+
location = azurerm_resource_group.main.location
6+
resource_group_name = azurerm_resource_group.main.name
7+
}
8+
9+
resource "azurerm_subnet" "external" {
10+
name = "external"
11+
virtual_network_name = "${azurerm_virtual_network.main.name}"
12+
resource_group_name = "${azurerm_resource_group.main.name}"
13+
address_prefixes = ["10.0.1.0/24"]
14+
}
15+
16+
resource "azurerm_public_ip" "pip" {
17+
name = "${var.environment_name}-dso-pip"
18+
resource_group_name = azurerm_resource_group.main.name
19+
location = azurerm_resource_group.main.location
20+
allocation_method = "Static"
21+
22+
lifecycle {
23+
prevent_destroy = true
24+
}
25+
}
26+
27+
resource "azurerm_network_security_group" "main-nsg" {
28+
name = "${var.environment_name}-demo4dso-nsg"
29+
location = azurerm_resource_group.main.location
30+
resource_group_name = azurerm_resource_group.main.name
31+
32+
security_rule {
33+
access = "Deny"
34+
direction = "Inbound"
35+
name = "http"
36+
priority = 150
37+
protocol = "Tcp"
38+
source_port_range = "*"
39+
source_address_prefix = "*"
40+
destination_port_range = "80"
41+
destination_address_prefix = azurerm_network_interface.app-external.private_ip_address
42+
}
43+
44+
security_rule {
45+
access = "Allow"
46+
direction = "Inbound"
47+
name = "https"
48+
priority = 100
49+
protocol = "Tcp"
50+
source_port_range = "*"
51+
source_address_prefix = "*"
52+
destination_port_range = "443"
53+
destination_address_prefix = azurerm_network_interface.app-external.private_ip_address
54+
}
55+
56+
security_rule {
57+
access = var.sshAccess
58+
direction = "Inbound"
59+
name = "ssh-app"
60+
priority = 160
61+
protocol = "Tcp"
62+
source_port_range = "*"
63+
source_address_prefix = "*"
64+
destination_port_range = "22"
65+
destination_address_prefix = azurerm_network_interface.app-external.private_ip_address
66+
}
67+
68+
}
69+
70+
resource "azurerm_network_interface_security_group_association" "app-external" {
71+
network_interface_id = azurerm_network_interface.app-external.id
72+
network_security_group_id = azurerm_network_security_group.main-nsg.id
73+
}
74+
75+
variable "sshAccess" {
76+
type = string
77+
default = "Deny"
78+
}
79+
80+
output "pip" {
81+
value = azurerm_public_ip.pip.ip_address
82+
}

‎storage.tf

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
2+
resource "azurerm_storage_account" "main" {
3+
name = "demo4${var.environment_name}dso"
4+
resource_group_name = azurerm_resource_group.main.name
5+
location = azurerm_resource_group.main.location
6+
account_tier = "Standard"
7+
account_replication_type = "LRS"
8+
allow_nested_items_to_be_public = false
9+
10+
lifecycle {
11+
prevent_destroy = true
12+
}
13+
14+
}
15+
16+
resource "azurerm_storage_container" "appdata" {
17+
name = "appdata"
18+
storage_account_name = azurerm_storage_account.main.name
19+
container_access_type = "private"
20+
21+
lifecycle {
22+
prevent_destroy = true
23+
}
24+
}
25+
26+
resource "azurerm_role_assignment" "app_mainstorage_access" {
27+
scope = azurerm_storage_account.main.id
28+
role_definition_name = "Reader and Data Access"
29+
principal_id = azurerm_user_assigned_identity.app.principal_id
30+
}

‎vm.sh

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#! /bin/bash
2+
3+
while [ "$(hostname -I)" = "" ]; do
4+
echo -e "\e[1A\e[KNo network: $(date)"
5+
sleep 1
6+
done
7+
echo "I have network";
8+
9+
resource_group_name=${resource_group_name}
10+
storage_account_name=${storage_account_name}
11+
12+
sudo apt-add-repository -y 'deb http://archive.ubuntu.com/ubuntu/ kinetic main restricted'
13+
sudo apt-add-repository -y 'deb http://archive.ubuntu.com/ubuntu/ kinetic-updates main restricted'
14+
sudo apt-add-repository -y 'deb http://archive.ubuntu.com/ubuntu/ kinetic universe'
15+
sudo apt-add-repository -y 'deb http://archive.ubuntu.com/ubuntu/ kinetic-updates universe'
16+
sudo apt-add-repository -y 'deb http://archive.ubuntu.com/ubuntu/ kinetic-backports main restricted universe multiverse'
17+
18+
sudo apt update
19+
20+
echo '* libraries/restart-without-asking boolean true' | sudo debconf-set-selections
21+
22+
sudo apt-get update
23+
sudo apt-get install -y ca-certificates curl apt-transport-https lsb-release gnupg
24+
curl -sL https://packages.microsoft.com/keys/microsoft.asc |
25+
gpg --dearmor |
26+
sudo tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null
27+
AZ_REPO="bullseye" # $(lsb_release -cs)
28+
echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" |
29+
sudo tee /etc/apt/sources.list.d/azure-cli.list
30+
sudo apt-get update
31+
sudo apt-get install -y azure-cli
32+
33+
az extension add --name storage-preview
34+
35+
az login --identity
36+
37+
# app
38+
sudo mkdir /var/app/
39+
sudo az storage blob directory download --container "appdata" --account-name $storage_account_name --source-path "*" --destination-path "/var/app/" --recursive
40+
41+
# Debug Things
42+
# cat /etc/apt/sources.list
43+
# cat /var/log/cloud-init-output.log
44+

‎vm.tf

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
2+
resource "azurerm_network_interface" "app-external" {
3+
name = "${var.environment_name}-demodso-ext-app-nic"
4+
resource_group_name = azurerm_resource_group.main.name
5+
location = azurerm_resource_group.main.location
6+
7+
ip_configuration {
8+
name = "app-external"
9+
subnet_id = azurerm_subnet.external.id
10+
private_ip_address_allocation = "Dynamic"
11+
public_ip_address_id = azurerm_public_ip.pip.id
12+
}
13+
}
14+
15+
data "template_file" "app-cloud-init" {
16+
template = file("vm.sh")
17+
vars = {
18+
resource_group_name = azurerm_resource_group.main.name
19+
storage_account_name = azurerm_storage_account.main.name
20+
}
21+
}
22+
23+
resource "azurerm_linux_virtual_machine" "app" {
24+
name = "${var.environment_name}-demodso-vm"
25+
resource_group_name = azurerm_resource_group.main.name
26+
location = azurerm_resource_group.main.location
27+
size = var.app_vm_size
28+
admin_username = var.app_admin_user
29+
admin_password = var.app_admin_password
30+
disable_password_authentication = false
31+
32+
custom_data = base64encode(data.template_file.app-cloud-init.rendered)
33+
34+
network_interface_ids = [
35+
azurerm_network_interface.app-external.id,
36+
]
37+
38+
identity {
39+
type = "UserAssigned"
40+
identity_ids = [ azurerm_user_assigned_identity.app.id ]
41+
}
42+
43+
source_image_reference {
44+
publisher = "canonical"
45+
offer = "0001-com-ubuntu-server-groovy"
46+
sku = "20_10-gen2"
47+
version = "latest"
48+
}
49+
50+
os_disk {
51+
storage_account_type = "StandardSSD_ZRS"
52+
caching = "ReadWrite"
53+
}
54+
}
55+
56+
variable "app_vm_size" {
57+
type = string
58+
}
59+
variable "app_admin_user" {
60+
type = string
61+
sensitive = true
62+
}
63+
variable "app_admin_password" {
64+
type = string
65+
sensitive = true
66+
}

0 commit comments

Comments
 (0)