Skip to content
This repository was archived by the owner on Jul 11, 2023. It is now read-only.

Commit 03552c9

Browse files
MagicloudMagicloud
committed
New example: Confluence
The example runs Confluence Docker image in a single node ASG, with a RDS, and two ALBs (internal and external). The ALBs have domain names set, and TLS cert (from ACM).
1 parent 614ecfd commit 03552c9

File tree

3 files changed

+330
-0
lines changed

3 files changed

+330
-0
lines changed

‎examples/confluence/README.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Confluence
2+
3+
Showing pratical usage of a fully functional website, from HTTPS frontend to Postgres backend.

‎examples/confluence/docker-compose.tpl

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
version: "3.7"
2+
services:
3+
confluence:
4+
image: atlassian/confluence-server
5+
ports:
6+
- "${http_port}:8090"
7+
volumes:
8+
- /data/confluence:/var/atlassian/application-data/confluence
9+
environment:
10+
- ATL_JDBC_URL=jdbc:postgresql://${db_host}:5432/${db_db}
11+
- ATL_JDBC_USER=${db_user}
12+
- ATL_JDBC_PASSWORD='${db_pass}'
13+
- ATL_DB_TYPE=postgresql

‎examples/confluence/main.tf

+314
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,314 @@
1+
variable "region" {
2+
type = string
3+
description = "AWS region to run the example"
4+
}
5+
variable "ssh_key" {
6+
type = string
7+
description = "AWS SSH key name for instance"
8+
}
9+
variable "db_password" {
10+
type = string
11+
description = "Password for RDS"
12+
}
13+
variable "base_domain" {
14+
type = string
15+
description = "Base domain name for internal and external FQDN, with the last dot"
16+
}
17+
18+
data "aws_availability_zones" "azs" {}
19+
20+
data "aws_route53_zone" "sandbox" {
21+
name = var.base_domain
22+
private_zone = false
23+
}
24+
25+
module "vpc" {
26+
source = "fpco/foundation/aws//modules/vpc-scenario-2"
27+
azs = data.aws_availability_zones.azs.names
28+
cidr = "192.168.0.0/16"
29+
name_prefix = "confluence"
30+
private_subnet_cidrs = ["192.168.100.0/24", "192.168.101.0/24"]
31+
public_subnet_cidrs = ["192.168.0.0/24", "192.168.1.0/24"]
32+
region = var.region
33+
}
34+
35+
module "centos" {
36+
source = "fpco/foundation/aws//modules/ami-centos"
37+
release = "7"
38+
}
39+
40+
module "asg-sg" {
41+
source = "fpco/foundation/aws//modules/security-group-base"
42+
name = "asg-sg"
43+
description = "SG for ASG"
44+
vpc_id = module.vpc.vpc_id
45+
}
46+
47+
module "asg-to-world" {
48+
source = "fpco/foundation/aws//modules/open-egress-sg"
49+
security_group_id = module.asg-sg.id
50+
}
51+
52+
module "ssh-port-sg-rule" {
53+
source = "fpco/foundation/aws//modules/single-port-sg"
54+
security_group_id = module.asg-sg.id
55+
cidr_blocks = ["0.0.0.0/0"]
56+
port = 22
57+
description = "SSH from anywhere, for debug."
58+
}
59+
60+
resource "aws_security_group_rule" "asg_int_alb_http_port_sg_rule" {
61+
security_group_id = module.asg-sg.id
62+
from_port = 80
63+
to_port = 80
64+
type = "ingress"
65+
protocol = "TCP"
66+
description = "HTTP ingress for int ALB"
67+
source_security_group_id = module.int-alb.security_group_id
68+
}
69+
70+
resource "aws_security_group_rule" "asg_ext_alb_http_port_sg_rule" {
71+
security_group_id = module.asg-sg.id
72+
from_port = 80
73+
to_port = 80
74+
type = "ingress"
75+
protocol = "TCP"
76+
description = "HTTP ingress for ext ALB"
77+
source_security_group_id = module.ext-alb.security_group_id
78+
}
79+
80+
module "asg" {
81+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/single-node-asg?ref=lb-asg"
82+
ami = module.centos.id
83+
instance_type = "m5.xlarge"
84+
key_name = var.ssh_key
85+
name_prefix = "confluence"
86+
name_suffix = ""
87+
region = var.region
88+
security_group_ids = [module.asg-sg.id]
89+
subnet_id = module.vpc.private_subnet_ids[0]
90+
public_ip = false
91+
data_volume_size = 50
92+
init_prefix = <<EOF
93+
yum install -y python3-pip
94+
pip3 install awscli
95+
${module.install-docker-compose.init_snippet}
96+
EOF
97+
init_suffix = <<EOF
98+
mkdir -p /data
99+
mkfs.xfs /dev/xvdf
100+
mount /dev/xvdf /data
101+
mkdir -p /data/confluence
102+
cat > /tmp/docker-compose.yml <<EOCAT
103+
${data.template_file.docker_compose.rendered}
104+
EOCAT
105+
cd /tmp
106+
docker-compose up -d
107+
# rm docker-compose.yml
108+
EOF
109+
}
110+
111+
data "template_file" "docker_compose" {
112+
template = file("${path.module}/docker-compose.tpl")
113+
vars = {
114+
http_port = 80
115+
db_host = module.rds.endpoint
116+
db_db = "confluence"
117+
db_user = "confluence"
118+
db_pass = var.db_password
119+
}
120+
}
121+
122+
module "data-backup" {
123+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/dlm-lifecycle-policy?ref=dlm"
124+
name_prefix = "confluence"
125+
ebs_target_tags = { Name = module.asg.data_volume_name_tag }
126+
}
127+
128+
module "install-docker-compose" {
129+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/init-snippet-install-docker-yum?ref=install-docker"
130+
}
131+
132+
module "rds-sg" {
133+
source = "fpco/foundation/aws//modules/security-group-base"
134+
name = "rds-sg"
135+
description = "SG for RDS"
136+
vpc_id = module.vpc.vpc_id
137+
}
138+
139+
resource "aws_security_group_rule" "rds_sg_rule" {
140+
security_group_id = module.rds-sg.id
141+
from_port = 5432
142+
to_port = 5432
143+
type = "ingress"
144+
protocol = "TCP"
145+
description = "PGSQL ingress for RDS"
146+
source_security_group_id = module.asg-sg.id
147+
}
148+
149+
module "rds" {
150+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/rds?ref=rds"
151+
db_engine = "postgres"
152+
db_instance_type = "db.m5.xlarge"
153+
db_name = "confluence"
154+
db_password = var.db_password
155+
db_storage_size = 20
156+
db_storage_type = "gp2"
157+
db_username = "confluence"
158+
engine_version = "11"
159+
name_prefix = "confluence"
160+
security_group_id = module.rds-sg.id
161+
subnet_ids = module.vpc.private_subnet_ids
162+
}
163+
164+
module "int-alb" {
165+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb?ref=alb"
166+
vpc_id = module.vpc.vpc_id
167+
name_prefix = "confluence-int"
168+
subnet_ids = module.vpc.public_subnet_ids
169+
}
170+
171+
module "int-alb-http-port-sg-rule" {
172+
source = "fpco/foundation/aws//modules/single-port-sg"
173+
security_group_id = module.int-alb.security_group_id
174+
cidr_blocks = ["192.168.0.0/16"]
175+
port = 80
176+
description = "HTTP ingress for ALB"
177+
}
178+
179+
module "int-alb-https-port-sg-rule" {
180+
source = "fpco/foundation/aws//modules/single-port-sg"
181+
security_group_id = module.int-alb.security_group_id
182+
cidr_blocks = ["192.168.0.0/16"]
183+
port = 443
184+
description = "HTTPS ingress for ALB"
185+
}
186+
187+
module "int-alb-to-asg" {
188+
source = "fpco/foundation/aws//modules/open-egress-sg"
189+
security_group_id = module.int-alb.security_group_id
190+
}
191+
192+
module "int-forwarder" {
193+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb-default-forward?ref=alb"
194+
lb_arn = module.int-alb.lb_arn
195+
lb_port = 443
196+
name_prefix = "confluence-int-https"
197+
protocol = "HTTPS"
198+
service_port = 80
199+
vpc_id = module.vpc.vpc_id
200+
https_cert_arn = aws_acm_certificate_validation.validation.certificate_arn
201+
}
202+
203+
module "int-redirector" {
204+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb-redirect?ref=alb"
205+
lb_arn = module.int-alb.lb_arn
206+
http_port = 80
207+
https_port = 443
208+
}
209+
210+
module "ext-alb" {
211+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb?ref=alb"
212+
vpc_id = module.vpc.vpc_id
213+
name_prefix = "confluence-ext"
214+
subnet_ids = module.vpc.public_subnet_ids
215+
internal = false
216+
}
217+
218+
module "ext-alb-http-port-sg-rule" {
219+
source = "fpco/foundation/aws//modules/single-port-sg"
220+
security_group_id = module.ext-alb.security_group_id
221+
cidr_blocks = ["0.0.0.0/0"]
222+
port = 80
223+
description = "HTTP ingress for ALB"
224+
}
225+
226+
module "ext-alb-https-port-sg-rule" {
227+
source = "fpco/foundation/aws//modules/single-port-sg"
228+
security_group_id = module.ext-alb.security_group_id
229+
cidr_blocks = ["0.0.0.0/0"]
230+
port = 443
231+
description = "HTTPS ingress for ALB"
232+
}
233+
234+
module "ext-alb-to-asg" {
235+
source = "fpco/foundation/aws//modules/open-egress-sg"
236+
security_group_id = module.ext-alb.security_group_id
237+
}
238+
239+
module "ext-forwarder" {
240+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb-default-forward?ref=alb"
241+
lb_arn = module.ext-alb.lb_arn
242+
lb_port = 443
243+
name_prefix = "confluence-ext-https"
244+
protocol = "HTTPS"
245+
service_port = 80
246+
vpc_id = module.vpc.vpc_id
247+
https_cert_arn = aws_acm_certificate_validation.validation.certificate_arn
248+
}
249+
250+
module "ext-redirector" {
251+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb-redirect?ref=alb"
252+
lb_arn = module.ext-alb.lb_arn
253+
http_port = 80
254+
https_port = 443
255+
}
256+
257+
resource "aws_autoscaling_attachment" "asg_int_alb" {
258+
autoscaling_group_name = module.asg.asg_name
259+
alb_target_group_arn = module.int-forwarder.target_group_arn
260+
}
261+
262+
resource "aws_autoscaling_attachment" "asg_ext_alb" {
263+
autoscaling_group_name = module.asg.asg_name
264+
alb_target_group_arn = module.ext-forwarder.target_group_arn
265+
}
266+
267+
resource "aws_route53_record" "int" {
268+
zone_id = data.aws_route53_zone.sandbox.zone_id
269+
name = "c-i.${data.aws_route53_zone.sandbox.name}"
270+
type = "A"
271+
alias {
272+
name = module.int-alb.lb_dns_name
273+
zone_id = module.int-alb.lb_zone_id
274+
evaluate_target_health = true
275+
}
276+
}
277+
278+
resource "aws_route53_record" "ext" {
279+
zone_id = data.aws_route53_zone.sandbox.zone_id
280+
name = "c-e.${data.aws_route53_zone.sandbox.name}"
281+
type = "A"
282+
alias {
283+
name = module.ext-alb.lb_dns_name
284+
zone_id = module.ext-alb.lb_zone_id
285+
evaluate_target_health = true
286+
}
287+
}
288+
289+
resource "aws_acm_certificate" "cert" {
290+
domain_name = aws_route53_record.ext.fqdn
291+
subject_alternative_names = [aws_route53_record.int.fqdn]
292+
validation_method = "DNS"
293+
}
294+
295+
resource "aws_route53_record" "cert_validation_ext" {
296+
name = aws_acm_certificate.cert.domain_validation_options.0.resource_record_name
297+
type = aws_acm_certificate.cert.domain_validation_options.0.resource_record_type
298+
zone_id = data.aws_route53_zone.sandbox.id
299+
records = [aws_acm_certificate.cert.domain_validation_options.0.resource_record_value]
300+
ttl = 60
301+
}
302+
303+
resource "aws_route53_record" "cert_validation_int" {
304+
name = aws_acm_certificate.cert.domain_validation_options.1.resource_record_name
305+
type = aws_acm_certificate.cert.domain_validation_options.1.resource_record_type
306+
zone_id = data.aws_route53_zone.sandbox.id
307+
records = [aws_acm_certificate.cert.domain_validation_options.1.resource_record_value]
308+
ttl = 60
309+
}
310+
311+
resource "aws_acm_certificate_validation" "validation" {
312+
certificate_arn = aws_acm_certificate.cert.arn
313+
validation_record_fqdns = [aws_route53_record.cert_validation_ext.fqdn, aws_route53_record.cert_validation_int.fqdn]
314+
}

0 commit comments

Comments
 (0)