VED-491 Move mesh to own folder (#680)

robertnovac1 · web-flow · commit 432a894652e5 · 2025-07-23T14:17:18.000+01:00
diff --git a/infra/.env-default b/infra/.env-default
diff --git a/infra/.terraform.lock.hcl b/infra/.terraform.lock.hcl
diff --git a/infra/README.MD b/infra/README.MD
@@ -4,10 +4,15 @@ You can use the commands defined in the Makefile to interact with the infrastruc
 
 Currently, this process is run manually whenever we need to update the base layer of our infrastructure. These core resources remain consistent across all deployments.
 
-## Steps
+## Running terraform
 The general procedures are: 
-1. Configure your environment by copying and updating `.env` based on the `.env-default` file.
+1. Set up your environment by creating a .env file with the following values. Note: some values may require customisation based on your specific setup.
+```dotenv
+ENVIRONMENT=(select subfolder from environments)
+AWS_PROFILE=your-profile
+BUCKET_NAME=(find bucket name in aws)
+TF_VAR_key=state
+```
 2. Run `make init` to initialize the Terraform project.
 3. Run `make plan` to review the proposed infrastructure changes.
-
 4. Once you're confident in the plan and understand its impact, execute `make apply` to apply the changes.
diff --git a/infra/environments/int/variables.tfvars b/infra/environments/int/variables.tfvars
@@ -7,5 +7,3 @@ dspp_admin_role          = "root"
 environment              = "int"
 parent_route53_zone_name = "int.vds.platform.nhs.uk"
 child_route53_zone_name  = "imms.int.vds.platform.nhs.uk"
-mesh_mailbox_id          = "X26OT303"
-mesh_dlq_mailbox_id      = "X26OT304"
diff --git a/infra/environments/non-prod/variables.tfvars b/infra/environments/non-prod/variables.tfvars
@@ -7,8 +7,3 @@ dspp_admin_role          = "root"
 environment              = "dev"
 parent_route53_zone_name = "dev.vds.platform.nhs.uk"
 child_route53_zone_name  = "imms.dev.vds.platform.nhs.uk"
-# TODO - null these out once we're using the int account
-# mesh_mailbox_id          = null
-# mesh_dlq_mailbox_id      = null
-mesh_mailbox_id          = "X26OT303"
-mesh_dlq_mailbox_id      = "X26OT304"
diff --git a/infra/mesh.tf b/infra/mesh.tf
diff --git a/infra/variables.tf b/infra/variables.tf
@@ -16,9 +16,3 @@ variable "build_agent_account_id" {
 variable "environment" {
   default = "non-prod"
 }
-variable "mesh_mailbox_id" {
-  default = null
-}
-variable "mesh_dlq_mailbox_id" {
-  default = null
-}
diff --git a/mesh_infra/.terraform.lock.hcl b/mesh_infra/.terraform.lock.hcl
diff --git a/mesh_infra/Makefile b/mesh_infra/Makefile
@@ -0,0 +1,49 @@
+-include .env
+
+interactionId=$(ENVIRONMENT)
+
+tf_cmd = AWS_PROFILE=$(AWS_PROFILE) terraform
+tf_state= -backend-config="bucket=$(BUCKET_NAME)"
+tf_vars= -var-file=environments/$(ENVIRONMENT)/variables.tfvars
+
+.PHONY: lock-provider workspace init plan apply clean destroy output tf-%
+
+lock-provider:
+	# Run this only when you install a new terraform provider. This will generate sha code in lock file for all platform
+	echo "This may take a while. Be patient!"
+	$(tf_cmd) providers lock -platform=darwin_arm64 -platform=darwin_amd64 -platform=linux_amd64 -platform=windows_amd64
+
+workspace:
+	$(tf_cmd) workspace new $(ENVIRONMENT) || $(tf_cmd) workspace select $(ENVIRONMENT) && echo "Switched to workspace/environment: $(ENVIRONMENT)"
+
+init:
+	$(tf_cmd) init $(tf_state) -upgrade $(tf_vars)
+
+init-reconfigure:
+	$(tf_cmd) init $(tf_state) -upgrade $(tf_vars) -reconfigure
+
+plan: workspace
+	 $(tf_cmd) plan $(tf_vars)
+
+apply: workspace
+	$(tf_cmd) apply $(tf_vars) -auto-approve
+
+clean:
+	rm -rf build .terraform upload-key
+
+destroy: workspace
+	$(tf_cmd) destroy $(tf_vars) -auto-approve
+	$(tf_cmd) workspace select default
+	$(tf_cmd) workspace delete $(ENVIRONMENT)
+
+output:
+ifndef name
+	$(error name variable not set. Use 'make output name=...')
+endif
+	$(tf_cmd) output -raw $(name)
+
+import: 
+	$(tf_cmd) import $(tf_vars) $(to) $(id)
+
+tf-%:
+	$(tf_cmd) $*
diff --git a/mesh_infra/README.md b/mesh_infra/README.md
@@ -0,0 +1,16 @@
+# Important 
+The Mesh module is not idempotent, which is why it is kept separate from the main infrastructure folder. Each time the module is applied, it triggers the recreation of various AWS resources related to the Mesh configuration. 
+There is 1 mesh mailbox for int that currently resides in the dev AWS account. This should be moved to the new INT AWS account once it becomes active.
+
+## Running terraform
+The general procedures are: 
+1. Set up your environment by creating a .env file with the following values. Note: some values may require customisation based on your specific setup.
+```dotenv
+ENVIRONMENT=int or prod
+AWS_PROFILE=your-profile
+BUCKET_NAME=(find mesh bucket name in aws s3)
+TF_VAR_key=state
+```
+2. Run `make init` to initialize the Terraform project.
+3. Run `make plan` to review the proposed infrastructure changes.
+4. Once you're confident in the plan and understand its impact, execute `make apply` to apply the changes.
diff --git a/mesh_infra/environments/dev/variables.tfvars b/mesh_infra/environments/dev/variables.tfvars
@@ -0,0 +1,5 @@
+aws_environment     = "dev"
+imms_account_id     = "345594581768"
+mesh_environment    = "integration"
+mesh_mailbox_ids    = ["X26OT303"]
+mesh_dlq_mailbox_id = "X26OT304"
diff --git a/mesh_infra/environments/prod/variables.tfvars b/mesh_infra/environments/prod/variables.tfvars
@@ -0,0 +1,5 @@
+aws_environment     = "prod"
+imms_account_id     = "664418956997"
+mesh_environment    = "production"
+mesh_mailbox_ids    = ["X26HC138"]
+mesh_dlq_mailbox_id = null
diff --git a/mesh_infra/main.tf b/mesh_infra/main.tf
@@ -0,0 +1,38 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6"
+    }
+  }
+  backend "s3" {
+    region = "eu-west-2"
+    key    = "state"
+  }
+  required_version = ">= 1.5.0"
+}
+
+provider "aws" {
+  region = "eu-west-2"
+  default_tags {
+    tags = {
+      Project     = "immunisation-fhir-api"
+      Environment = var.aws_environment
+    }
+  }
+}
+
+
+module "mesh" {
+  source = "git::https://github.com/nhsdigital/terraform-aws-mesh-client.git//module?ref=v2.1.5"
+
+  name_prefix = "imms-${var.aws_environment}"
+  account_id  = var.imms_account_id
+  mesh_env    = var.mesh_environment
+  subnet_ids  = toset([])
+  mailbox_ids = var.mesh_mailbox_ids
+
+  compress_threshold          = 1 * 1024 * 1024
+  get_message_max_concurrency = 10
+  handshake_schedule          = "rate(24 hours)"
+}
diff --git a/mesh_infra/variables.tf b/mesh_infra/variables.tf
@@ -0,0 +1,5 @@
+variable "imms_account_id" {}
+variable "aws_environment" {}
+variable "mesh_environment" {}
+variable "mesh_mailbox_ids" {}
+variable "mesh_dlq_mailbox_id" {}
