Skip to content
This repository was archived by the owner on Jul 11, 2023. It is now read-only.

Commit 64febf8

Browse files
MagicloudMagicloud
committed
New example: Confluence
The example runs Confluence Docker image in a single node ASG, with a RDS, and two ALBs (internal and external). The ALBs have domain names set, and TLS cert (from ACM).
1 parent dad0d84 commit 64febf8

File tree

3 files changed

+328
-0
lines changed

3 files changed

+328
-0
lines changed

‎examples/confluence/README.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Confluence
2+
3+
Showing pratical usage of a fully functional website, from HTTPS frontend to Postgres backend.

‎examples/confluence/docker-compose.tpl

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
version: "3.7"
2+
services:
3+
confluence:
4+
image: atlassian/confluence-server
5+
ports:
6+
- "${http_port}:8090"
7+
volumes:
8+
- /data/confluence:/var/atlassian/application-data/confluence
9+
environment:
10+
- ATL_JDBC_URL=jdbc:postgresql://${db_host}:5432/${db_db}
11+
- ATL_JDBC_USER=${db_user}
12+
- ATL_JDBC_PASSWORD='${db_pass}'
13+
- ATL_DB_TYPE=postgresql

‎examples/confluence/main.tf

+312
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,312 @@
1+
variable "region" {
2+
type = string
3+
description = "AWS region to run the example"
4+
default = "ap-northeast-1"
5+
}
6+
variable "ssh_key" {
7+
type = string
8+
description = "AWS SSH key name for instance"
9+
default = "shida-tokyo"
10+
}
11+
variable "db_password" {
12+
type = string
13+
description = "Password for RDS"
14+
default = "Fpco!234"
15+
}
16+
variable "base_domain" {
17+
type = string
18+
description = "Base domain name for internal and external FQDN, with the last dot"
19+
default = "dev-sandbox.fpcomplete.com."
20+
}
21+
22+
data "aws_availability_zones" "azs" {}
23+
24+
data "aws_route53_zone" "sandbox" {
25+
name = var.base_domain
26+
private_zone = false
27+
}
28+
29+
module "vpc" {
30+
source = "fpco/foundation/aws//modules/vpc-scenario-2"
31+
azs = data.aws_availability_zones.azs.names
32+
cidr = "192.168.0.0/16"
33+
name_prefix = "confluence"
34+
private_subnet_cidrs = ["192.168.100.0/24", "192.168.101.0/24"]
35+
public_subnet_cidrs = ["192.168.0.0/24", "192.168.1.0/24"]
36+
region = var.region
37+
}
38+
39+
module "centos" {
40+
source = "fpco/foundation/aws//modules/ami-centos"
41+
release = "7"
42+
}
43+
44+
module "asg-sg" {
45+
source = "fpco/foundation/aws//modules/security-group-base"
46+
name = "asg-sg"
47+
description = "SG for ASG"
48+
vpc_id = module.vpc.vpc_id
49+
}
50+
51+
module "asg-to-world" {
52+
source = "fpco/foundation/aws//modules/open-egress-sg"
53+
security_group_id = module.asg-sg.id
54+
}
55+
56+
module "ssh-port-sg-rule" {
57+
source = "fpco/foundation/aws//modules/single-port-sg"
58+
security_group_id = module.asg-sg.id
59+
cidr_blocks = ["0.0.0.0/0"]
60+
port = 22
61+
description = "SSH from anywhere, for debug."
62+
}
63+
64+
module "asg-int-alb-http-port-sg-rule" {
65+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/single-port-sg-src?ref=spsg"
66+
security_group_id = module.asg-sg.id
67+
port = 80
68+
description = "HTTP ingress for int ALB"
69+
source_security_group_id = module.int-alb.security_group_id
70+
}
71+
72+
module "asg-ext-alb-http-port-sg-rule" {
73+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/single-port-sg-src?ref=spsg"
74+
security_group_id = module.asg-sg.id
75+
port = 80
76+
description = "HTTP ingress for ext ALB"
77+
source_security_group_id = module.ext-alb.security_group_id
78+
}
79+
80+
module "asg" {
81+
source = "fpco/foundation/aws//modules/single-node-asg"
82+
ami = module.centos.id
83+
instance_type = "m5.xlarge"
84+
key_name = var.ssh_key
85+
name_prefix = "confluence"
86+
name_suffix = ""
87+
region = var.region
88+
security_group_ids = [module.asg-sg.id]
89+
subnet_id = module.vpc.private_subnet_ids[0]
90+
public_ip = false
91+
data_volume_size = 50
92+
init_prefix = <<EOF
93+
yum install -y python3-pip
94+
pip3 install awscli
95+
${module.install-docker-compose.init_snippet}
96+
EOF
97+
init_suffix = <<EOF
98+
mkdir -p /data
99+
mkfs.xfs /dev/xvdf
100+
mount /dev/xvdf /data
101+
mkdir -p /data/confluence
102+
cat > /tmp/docker-compose.yml <<EOCAT
103+
${data.template_file.docker_compose.rendered}
104+
EOCAT
105+
cd /tmp
106+
docker-compose up -d
107+
# rm docker-compose.yml
108+
EOF
109+
}
110+
111+
data "template_file" "docker_compose" {
112+
template = file("${path.module}/docker-compose.tpl")
113+
vars = {
114+
http_port = 80
115+
db_host = module.rds.endpoint
116+
db_db = "confluence"
117+
db_user = "confluence"
118+
db_pass = var.db_password
119+
}
120+
}
121+
122+
module "data-backup" {
123+
source = "fpco/foundation/aws//modules/dlm-lifecycle-policy"
124+
name_prefix = "confluence"
125+
ebs_target_tags = { Name = module.asg.data_volume_name_tag }
126+
}
127+
128+
module "install-docker-compose" {
129+
source = "fpco/foundation/aws//modules/init-snippet-install-docker-yum"
130+
}
131+
132+
module "rds-sg" {
133+
source = "fpco/foundation/aws//modules/security-group-base"
134+
name = "rds-sg"
135+
description = "SG for RDS"
136+
vpc_id = module.vpc.vpc_id
137+
}
138+
139+
module "rds_sg_rule" {
140+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/single-port-sg-src?ref=spsg"
141+
security_group_id = module.rds-sg.id
142+
port = 5432
143+
description = "PGSQL ingress for RDS"
144+
source_security_group_id = module.asg-sg.id
145+
}
146+
147+
module "rds" {
148+
source = "fpco/foundation/aws//modules/rds"
149+
db_engine = "postgres"
150+
db_instance_type = "db.m5.xlarge"
151+
db_name = "confluence"
152+
db_password = var.db_password
153+
db_storage_size = 20
154+
db_storage_type = "gp2"
155+
db_username = "confluence"
156+
engine_version = "11"
157+
name_prefix = "confluence"
158+
security_group_id = module.rds-sg.id
159+
subnet_ids = module.vpc.private_subnet_ids
160+
}
161+
162+
module "int-alb" {
163+
source = "fpco/foundation/aws//modules/alb"
164+
vpc_id = module.vpc.vpc_id
165+
name_prefix = "confluence-int"
166+
subnet_ids = module.vpc.public_subnet_ids
167+
}
168+
169+
module "int-alb-http-port-sg-rule" {
170+
source = "fpco/foundation/aws//modules/single-port-sg"
171+
security_group_id = module.int-alb.security_group_id
172+
cidr_blocks = ["192.168.0.0/16"]
173+
port = 80
174+
description = "HTTP ingress for ALB"
175+
}
176+
177+
module "int-alb-https-port-sg-rule" {
178+
source = "fpco/foundation/aws//modules/single-port-sg"
179+
security_group_id = module.int-alb.security_group_id
180+
cidr_blocks = ["192.168.0.0/16"]
181+
port = 443
182+
description = "HTTPS ingress for ALB"
183+
}
184+
185+
module "int-alb-to-asg" {
186+
source = "fpco/foundation/aws//modules/open-egress-sg"
187+
security_group_id = module.int-alb.security_group_id
188+
}
189+
190+
module "int-forwarder" {
191+
source = "fpco/foundation/aws//modules/alb-default-forward"
192+
lb_arn = module.int-alb.lb_arn
193+
lb_port = 443
194+
name_prefix = "confluence-int-https"
195+
protocol = "HTTPS"
196+
service_port = 80
197+
vpc_id = module.vpc.vpc_id
198+
https_cert_arn = aws_acm_certificate_validation.validation.certificate_arn
199+
}
200+
201+
module "int-redirector" {
202+
source = "fpco/foundation/aws//modules/alb-redirect"
203+
lb_arn = module.int-alb.lb_arn
204+
http_port = 80
205+
https_port = 443
206+
}
207+
208+
module "ext-alb" {
209+
source = "fpco/foundation/aws//modules/alb"
210+
vpc_id = module.vpc.vpc_id
211+
name_prefix = "confluence-ext"
212+
subnet_ids = module.vpc.public_subnet_ids
213+
internal = false
214+
}
215+
216+
module "ext-alb-http-port-sg-rule" {
217+
source = "fpco/foundation/aws//modules/single-port-sg"
218+
security_group_id = module.ext-alb.security_group_id
219+
cidr_blocks = ["0.0.0.0/0"]
220+
port = 80
221+
description = "HTTP ingress for ALB"
222+
}
223+
224+
module "ext-alb-https-port-sg-rule" {
225+
source = "fpco/foundation/aws//modules/single-port-sg"
226+
security_group_id = module.ext-alb.security_group_id
227+
cidr_blocks = ["0.0.0.0/0"]
228+
port = 443
229+
description = "HTTPS ingress for ALB"
230+
}
231+
232+
module "ext-alb-to-asg" {
233+
source = "fpco/foundation/aws//modules/open-egress-sg"
234+
security_group_id = module.ext-alb.security_group_id
235+
}
236+
237+
module "ext-forwarder" {
238+
source = "fpco/foundation/aws//modules/alb-default-forward"
239+
lb_arn = module.ext-alb.lb_arn
240+
lb_port = 443
241+
name_prefix = "confluence-ext-https"
242+
protocol = "HTTPS"
243+
service_port = 80
244+
vpc_id = module.vpc.vpc_id
245+
https_cert_arn = aws_acm_certificate_validation.validation.certificate_arn
246+
}
247+
248+
module "ext-redirector" {
249+
source = "fpco/foundation/aws//modules/alb-redirect"
250+
lb_arn = module.ext-alb.lb_arn
251+
http_port = 80
252+
https_port = 443
253+
}
254+
255+
resource "aws_autoscaling_attachment" "asg_int_alb" {
256+
autoscaling_group_name = module.asg.asg_name
257+
alb_target_group_arn = module.int-forwarder.target_group_arn
258+
}
259+
260+
resource "aws_autoscaling_attachment" "asg_ext_alb" {
261+
autoscaling_group_name = module.asg.asg_name
262+
alb_target_group_arn = module.ext-forwarder.target_group_arn
263+
}
264+
265+
resource "aws_route53_record" "int" {
266+
zone_id = data.aws_route53_zone.sandbox.zone_id
267+
name = "c-i.${data.aws_route53_zone.sandbox.name}"
268+
type = "A"
269+
alias {
270+
name = module.int-alb.lb_dns_name
271+
zone_id = module.int-alb.lb_zone_id
272+
evaluate_target_health = true
273+
}
274+
}
275+
276+
resource "aws_route53_record" "ext" {
277+
zone_id = data.aws_route53_zone.sandbox.zone_id
278+
name = "c-e.${data.aws_route53_zone.sandbox.name}"
279+
type = "A"
280+
alias {
281+
name = module.ext-alb.lb_dns_name
282+
zone_id = module.ext-alb.lb_zone_id
283+
evaluate_target_health = true
284+
}
285+
}
286+
287+
resource "aws_acm_certificate" "cert" {
288+
domain_name = aws_route53_record.ext.fqdn
289+
subject_alternative_names = [aws_route53_record.int.fqdn]
290+
validation_method = "DNS"
291+
}
292+
293+
resource "aws_route53_record" "cert_validation_ext" {
294+
name = aws_acm_certificate.cert.domain_validation_options.0.resource_record_name
295+
type = aws_acm_certificate.cert.domain_validation_options.0.resource_record_type
296+
zone_id = data.aws_route53_zone.sandbox.id
297+
records = [aws_acm_certificate.cert.domain_validation_options.0.resource_record_value]
298+
ttl = 60
299+
}
300+
301+
resource "aws_route53_record" "cert_validation_int" {
302+
name = aws_acm_certificate.cert.domain_validation_options.1.resource_record_name
303+
type = aws_acm_certificate.cert.domain_validation_options.1.resource_record_type
304+
zone_id = data.aws_route53_zone.sandbox.id
305+
records = [aws_acm_certificate.cert.domain_validation_options.1.resource_record_value]
306+
ttl = 60
307+
}
308+
309+
resource "aws_acm_certificate_validation" "validation" {
310+
certificate_arn = aws_acm_certificate.cert.arn
311+
validation_record_fqdns = [aws_route53_record.cert_validation_ext.fqdn, aws_route53_record.cert_validation_int.fqdn]
312+
}

0 commit comments

Comments
 (0)