Skip to content
This repository was archived by the owner on Jul 11, 2023. It is now read-only.

Commit 45970f2

Browse files
MagicloudMagicloud
committed
New example: Confluence
The example runs Confluence Docker image in a single node ASG, with a RDS, and two ALBs (internal and external). The ALBs have domain names set, and TLS cert (from ACM).
1 parent dad0d84 commit 45970f2

File tree

3 files changed

+324
-0
lines changed

3 files changed

+324
-0
lines changed

‎examples/confluence/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Confluence
2+
3+
Showing pratical usage of a fully functional website, from HTTPS frontend to Postgres backend.

‎examples/confluence/docker-compose.tpl

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
version: "3.7"
2+
services:
3+
confluence:
4+
image: atlassian/confluence-server
5+
ports:
6+
- "${http_port}:8090"
7+
volumes:
8+
- /data/confluence:/var/atlassian/application-data/confluence
9+
environment:
10+
- ATL_JDBC_URL=jdbc:postgresql://${db_host}:5432/${db_db}
11+
- ATL_JDBC_USER=${db_user}
12+
- ATL_JDBC_PASSWORD='${db_pass}'
13+
- ATL_DB_TYPE=postgresql

‎examples/confluence/main.tf

Lines changed: 308 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,308 @@
1+
variable "region" {
2+
type = string
3+
description = "AWS region to run the example"
4+
}
5+
variable "ssh_key" {
6+
type = string
7+
description = "AWS SSH key name for instance"
8+
}
9+
variable "db_password" {
10+
type = string
11+
description = "Password for RDS"
12+
}
13+
variable "base_domain" {
14+
type = string
15+
description = "Base domain name for internal and external FQDN, with the last dot"
16+
}
17+
18+
data "aws_availability_zones" "azs" {}
19+
20+
data "aws_route53_zone" "sandbox" {
21+
name = var.base_domain
22+
private_zone = false
23+
}
24+
25+
module "vpc" {
26+
source = "fpco/foundation/aws//modules/vpc-scenario-2"
27+
azs = data.aws_availability_zones.azs.names
28+
cidr = "192.168.0.0/16"
29+
name_prefix = "confluence"
30+
private_subnet_cidrs = ["192.168.100.0/24", "192.168.101.0/24"]
31+
public_subnet_cidrs = ["192.168.0.0/24", "192.168.1.0/24"]
32+
region = var.region
33+
}
34+
35+
module "centos" {
36+
source = "fpco/foundation/aws//modules/ami-centos"
37+
release = "7"
38+
}
39+
40+
module "asg-sg" {
41+
source = "fpco/foundation/aws//modules/security-group-base"
42+
name = "asg-sg"
43+
description = "SG for ASG"
44+
vpc_id = module.vpc.vpc_id
45+
}
46+
47+
module "asg-to-world" {
48+
source = "fpco/foundation/aws//modules/open-egress-sg"
49+
security_group_id = module.asg-sg.id
50+
}
51+
52+
module "ssh-port-sg-rule" {
53+
source = "fpco/foundation/aws//modules/single-port-sg"
54+
security_group_id = module.asg-sg.id
55+
cidr_blocks = ["0.0.0.0/0"]
56+
port = 22
57+
description = "SSH from anywhere, for debug."
58+
}
59+
60+
module "asg-int-alb-http-port-sg-rule" {
61+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/single-port-sg-src?ref=spsg"
62+
security_group_id = module.asg-sg.id
63+
port = 80
64+
description = "HTTP ingress for int ALB"
65+
source_security_group_id = module.int-alb.security_group_id
66+
}
67+
68+
module "asg-ext-alb-http-port-sg-rule" {
69+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/single-port-sg-src?ref=spsg"
70+
security_group_id = module.asg-sg.id
71+
port = 80
72+
description = "HTTP ingress for ext ALB"
73+
source_security_group_id = module.ext-alb.security_group_id
74+
}
75+
76+
module "asg" {
77+
source = "fpco/foundation/aws//modules/single-node-asg"
78+
ami = module.centos.id
79+
instance_type = "m5.xlarge"
80+
key_name = var.ssh_key
81+
name_prefix = "confluence"
82+
name_suffix = ""
83+
region = var.region
84+
security_group_ids = [module.asg-sg.id]
85+
subnet_id = module.vpc.private_subnet_ids[0]
86+
public_ip = false
87+
data_volume_size = 50
88+
init_prefix = <<EOF
89+
yum install -y python3-pip
90+
pip3 install awscli
91+
${module.install-docker-compose.init_snippet}
92+
EOF
93+
init_suffix = <<EOF
94+
mkdir -p /data
95+
mkfs.xfs /dev/xvdf
96+
mount /dev/xvdf /data
97+
mkdir -p /data/confluence
98+
cat > /tmp/docker-compose.yml <<EOCAT
99+
${data.template_file.docker_compose.rendered}
100+
EOCAT
101+
cd /tmp
102+
docker-compose up -d
103+
# rm docker-compose.yml
104+
EOF
105+
}
106+
107+
data "template_file" "docker_compose" {
108+
template = file("${path.module}/docker-compose.tpl")
109+
vars = {
110+
http_port = 80
111+
db_host = module.rds.endpoint
112+
db_db = "confluence"
113+
db_user = "confluence"
114+
db_pass = var.db_password
115+
}
116+
}
117+
118+
module "data-backup" {
119+
source = "fpco/foundation/aws//modules/dlm-lifecycle-policy"
120+
name_prefix = "confluence"
121+
ebs_target_tags = { Name = module.asg.data_volume_name_tag }
122+
}
123+
124+
module "install-docker-compose" {
125+
source = "fpco/foundation/aws//modules/init-snippet-install-docker-yum"
126+
}
127+
128+
module "rds-sg" {
129+
source = "fpco/foundation/aws//modules/security-group-base"
130+
name = "rds-sg"
131+
description = "SG for RDS"
132+
vpc_id = module.vpc.vpc_id
133+
}
134+
135+
module "rds_sg_rule" {
136+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/single-port-sg-src?ref=spsg"
137+
security_group_id = module.rds-sg.id
138+
port = 5432
139+
description = "PGSQL ingress for RDS"
140+
source_security_group_id = module.asg-sg.id
141+
}
142+
143+
module "rds" {
144+
source = "fpco/foundation/aws//modules/rds"
145+
db_engine = "postgres"
146+
db_instance_type = "db.m5.xlarge"
147+
db_name = "confluence"
148+
db_password = var.db_password
149+
db_storage_size = 20
150+
db_storage_type = "gp2"
151+
db_username = "confluence"
152+
engine_version = "11"
153+
name_prefix = "confluence"
154+
security_group_id = module.rds-sg.id
155+
subnet_ids = module.vpc.private_subnet_ids
156+
}
157+
158+
module "int-alb" {
159+
source = "fpco/foundation/aws//modules/alb"
160+
vpc_id = module.vpc.vpc_id
161+
name_prefix = "confluence-int"
162+
subnet_ids = module.vpc.public_subnet_ids
163+
}
164+
165+
module "int-alb-http-port-sg-rule" {
166+
source = "fpco/foundation/aws//modules/single-port-sg"
167+
security_group_id = module.int-alb.security_group_id
168+
cidr_blocks = ["192.168.0.0/16"]
169+
port = 80
170+
description = "HTTP ingress for ALB"
171+
}
172+
173+
module "int-alb-https-port-sg-rule" {
174+
source = "fpco/foundation/aws//modules/single-port-sg"
175+
security_group_id = module.int-alb.security_group_id
176+
cidr_blocks = ["192.168.0.0/16"]
177+
port = 443
178+
description = "HTTPS ingress for ALB"
179+
}
180+
181+
module "int-alb-to-asg" {
182+
source = "fpco/foundation/aws//modules/open-egress-sg"
183+
security_group_id = module.int-alb.security_group_id
184+
}
185+
186+
module "int-forwarder" {
187+
source = "fpco/foundation/aws//modules/alb-default-forward"
188+
lb_arn = module.int-alb.lb_arn
189+
lb_port = 443
190+
name_prefix = "confluence-int-https"
191+
protocol = "HTTPS"
192+
service_port = 80
193+
vpc_id = module.vpc.vpc_id
194+
https_cert_arn = aws_acm_certificate_validation.validation.certificate_arn
195+
}
196+
197+
module "int-redirector" {
198+
source = "fpco/foundation/aws//modules/alb-redirect"
199+
lb_arn = module.int-alb.lb_arn
200+
http_port = 80
201+
https_port = 443
202+
}
203+
204+
module "ext-alb" {
205+
source = "fpco/foundation/aws//modules/alb"
206+
vpc_id = module.vpc.vpc_id
207+
name_prefix = "confluence-ext"
208+
subnet_ids = module.vpc.public_subnet_ids
209+
internal = false
210+
}
211+
212+
module "ext-alb-http-port-sg-rule" {
213+
source = "fpco/foundation/aws//modules/single-port-sg"
214+
security_group_id = module.ext-alb.security_group_id
215+
cidr_blocks = ["0.0.0.0/0"]
216+
port = 80
217+
description = "HTTP ingress for ALB"
218+
}
219+
220+
module "ext-alb-https-port-sg-rule" {
221+
source = "fpco/foundation/aws//modules/single-port-sg"
222+
security_group_id = module.ext-alb.security_group_id
223+
cidr_blocks = ["0.0.0.0/0"]
224+
port = 443
225+
description = "HTTPS ingress for ALB"
226+
}
227+
228+
module "ext-alb-to-asg" {
229+
source = "fpco/foundation/aws//modules/open-egress-sg"
230+
security_group_id = module.ext-alb.security_group_id
231+
}
232+
233+
module "ext-forwarder" {
234+
source = "fpco/foundation/aws//modules/alb-default-forward"
235+
lb_arn = module.ext-alb.lb_arn
236+
lb_port = 443
237+
name_prefix = "confluence-ext-https"
238+
protocol = "HTTPS"
239+
service_port = 80
240+
vpc_id = module.vpc.vpc_id
241+
https_cert_arn = aws_acm_certificate_validation.validation.certificate_arn
242+
}
243+
244+
module "ext-redirector" {
245+
source = "fpco/foundation/aws//modules/alb-redirect"
246+
lb_arn = module.ext-alb.lb_arn
247+
http_port = 80
248+
https_port = 443
249+
}
250+
251+
resource "aws_autoscaling_attachment" "asg_int_alb" {
252+
autoscaling_group_name = module.asg.asg_name
253+
alb_target_group_arn = module.int-forwarder.target_group_arn
254+
}
255+
256+
resource "aws_autoscaling_attachment" "asg_ext_alb" {
257+
autoscaling_group_name = module.asg.asg_name
258+
alb_target_group_arn = module.ext-forwarder.target_group_arn
259+
}
260+
261+
resource "aws_route53_record" "int" {
262+
zone_id = data.aws_route53_zone.sandbox.zone_id
263+
name = "c-i.${data.aws_route53_zone.sandbox.name}"
264+
type = "A"
265+
alias {
266+
name = module.int-alb.lb_dns_name
267+
zone_id = module.int-alb.lb_zone_id
268+
evaluate_target_health = true
269+
}
270+
}
271+
272+
resource "aws_route53_record" "ext" {
273+
zone_id = data.aws_route53_zone.sandbox.zone_id
274+
name = "c-e.${data.aws_route53_zone.sandbox.name}"
275+
type = "A"
276+
alias {
277+
name = module.ext-alb.lb_dns_name
278+
zone_id = module.ext-alb.lb_zone_id
279+
evaluate_target_health = true
280+
}
281+
}
282+
283+
resource "aws_acm_certificate" "cert" {
284+
domain_name = aws_route53_record.ext.fqdn
285+
subject_alternative_names = [aws_route53_record.int.fqdn]
286+
validation_method = "DNS"
287+
}
288+
289+
resource "aws_route53_record" "cert_validation_ext" {
290+
name = aws_acm_certificate.cert.domain_validation_options.0.resource_record_name
291+
type = aws_acm_certificate.cert.domain_validation_options.0.resource_record_type
292+
zone_id = data.aws_route53_zone.sandbox.id
293+
records = [aws_acm_certificate.cert.domain_validation_options.0.resource_record_value]
294+
ttl = 60
295+
}
296+
297+
resource "aws_route53_record" "cert_validation_int" {
298+
name = aws_acm_certificate.cert.domain_validation_options.1.resource_record_name
299+
type = aws_acm_certificate.cert.domain_validation_options.1.resource_record_type
300+
zone_id = data.aws_route53_zone.sandbox.id
301+
records = [aws_acm_certificate.cert.domain_validation_options.1.resource_record_value]
302+
ttl = 60
303+
}
304+
305+
resource "aws_acm_certificate_validation" "validation" {
306+
certificate_arn = aws_acm_certificate.cert.arn
307+
validation_record_fqdns = [aws_route53_record.cert_validation_ext.fqdn, aws_route53_record.cert_validation_int.fqdn]
308+
}

0 commit comments

Comments
 (0)