Skip to content

Commit e70db54

Browse files
patrickmoore-ncpatrickmoore-nc
committed
feat: infra base layer
1 parent 16b55de commit e70db54

File tree

9 files changed

+482
-4
lines changed

9 files changed

+482
-4
lines changed

‎infrastructure/environments/poc/variables.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,5 @@ HUB_SUBSCRIPTION="Lung Cancer Screening - Dev"
55
STORAGE_ACCOUNT_RG=rg-tfstate-poc-uks
66
TERRAFORM_MODULES_REF=main
77
ENABLE_SOFT_DELETE=false
8+
DOCKER_IMAGE=docker.io/nginxdemos/hello
9+
DOCKER_IMAGE_TAG=latest

‎infrastructure/modules/infra/main.tf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
resource "azurerm_resource_group" "main" {
2+
name = var.resource_group_name
3+
location = var.region
4+
}
5+
6+
module "app-key-vault" {
7+
source = "../dtos-devops-templates/infrastructure/modules/key-vault"
8+
9+
name = "kv-${var.app_short_name}-${var.environment}-app"
10+
resource_group_name = azurerm_resource_group.main.name
11+
enable_rbac_authorization = true
12+
location = var.region
13+
log_analytics_workspace_id = module.log_analytics_workspace_audit.id
14+
monitor_diagnostic_setting_keyvault_enabled_logs = ["AuditEvent", "AzurePolicyEvaluationDetails"]
15+
monitor_diagnostic_setting_keyvault_metrics = ["AllMetrics"]
16+
private_endpoint_properties = var.features.private_networking ? {
17+
private_dns_zone_ids_keyvault = [data.azurerm_private_dns_zone.key-vault[0].id]
18+
private_endpoint_enabled = true
19+
private_endpoint_subnet_id = module.main_subnet.id
20+
private_endpoint_resource_group_name = azurerm_resource_group.main.name
21+
private_service_connection_is_manual = false
22+
} : null
23+
purge_protection_enabled = var.protect_keyvault
24+
}
25+
26+
module "log_analytics_workspace_audit" {
27+
source = "../dtos-devops-templates/infrastructure/modules/log-analytics-workspace"
28+
29+
name = "law-${var.environment}-uks-${var.app_short_name}"
30+
location = var.region
31+
32+
law_sku = "PerGB2018"
33+
retention_days = 30
34+
35+
monitor_diagnostic_setting_log_analytics_workspace_enabled_logs = ["SummaryLogs", "Audit"]
36+
monitor_diagnostic_setting_log_analytics_workspace_metrics = ["AllMetrics"]
37+
38+
resource_group_name = azurerm_resource_group.main.name
39+
}
40+
41+
module "container-app-environment" {
42+
source = "../dtos-devops-templates/infrastructure/modules/container-app-environment"
43+
44+
providers = {
45+
azurerm = azurerm
46+
azurerm.dns = azurerm.hub
47+
}
48+
49+
name = "cae-${var.environment}-uks-${var.app_short_name}"
50+
resource_group_name = azurerm_resource_group.main.name
51+
log_analytics_workspace_id = module.log_analytics_workspace_audit.id
52+
vnet_integration_subnet_id = module.container_app_subnet.id
53+
private_dns_zone_rg_name = var.features.private_networking ? "rg-hub-${var.hub}-uks-private-dns-zones" : null
54+
}

‎infrastructure/modules/infra/networking.tf‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
module "main_vnet" {
2+
source = "../dtos-devops-templates/infrastructure/modules/vnet"
3+
4+
name = "vnet-${var.environment}-uks-${var.app_short_name}"
5+
resource_group_name = azurerm_resource_group.main.name
6+
location = var.region
7+
dns_servers = var.features.private_networking ? [data.azurerm_private_dns_resolver_inbound_endpoint.this[0].ip_configurations[0].private_ip_address] : []
8+
log_analytics_workspace_id = module.log_analytics_workspace_audit.id
9+
monitor_diagnostic_setting_vnet_enabled_logs = ["VMProtectionAlerts"]
10+
monitor_diagnostic_setting_vnet_metrics = ["AllMetrics"]
11+
vnet_address_space = var.vnet_address_space
12+
}
13+
14+
module "postgres_subnet" {
15+
source = "../dtos-devops-templates/infrastructure/modules/subnet"
16+
17+
name = "snet-postgres"
18+
resource_group_name = azurerm_resource_group.main.name
19+
vnet_name = module.main_vnet.name
20+
address_prefixes = [cidrsubnet(var.vnet_address_space, 7, 1)]
21+
create_nsg = false
22+
location = var.region
23+
monitor_diagnostic_setting_network_security_group_enabled_logs = []
24+
log_analytics_workspace_id = module.log_analytics_workspace_audit.id
25+
network_security_group_name = "nsg-postgres"
26+
}
27+
28+
29+
data "azurerm_private_dns_resolver" "this" {
30+
count = var.features.private_networking ? 1 : 0
31+
32+
provider = azurerm.hub
33+
34+
name = "${var.hub}-uks-hub-private-dns-zone-resolver"
35+
resource_group_name = "rg-hub-${var.hub}-uks-private-dns-zones"
36+
}
37+
38+
data "azurerm_private_dns_resolver_inbound_endpoint" "this" {
39+
count = var.features.private_networking ? 1 : 0
40+
41+
provider = azurerm.hub
42+
43+
name = "private-dns-resolver-inbound-endpoint"
44+
private_dns_resolver_id = data.azurerm_private_dns_resolver.this[0].id
45+
}
46+
47+
data "azurerm_virtual_network" "hub" {
48+
count = var.features.hub_and_spoke ? 1 : 0
49+
50+
provider = azurerm.hub
51+
52+
name = module.hub_config.names.virtual-network
53+
resource_group_name = local.hub_vnet_rg_name
54+
}
55+
56+
module "peering_spoke_hub" {
57+
count = var.features.hub_and_spoke ? 1 : 0
58+
59+
source = "../dtos-devops-templates/infrastructure/modules/vnet-peering"
60+
61+
name = "${module.main_vnet.name}-to-hub-peering"
62+
resource_group_name = azurerm_resource_group.main.name
63+
vnet_name = module.main_vnet.name
64+
remote_vnet_id = data.azurerm_virtual_network.hub[0].id
65+
66+
allow_virtual_network_access = true
67+
allow_forwarded_traffic = true
68+
allow_gateway_transit = false
69+
70+
use_remote_gateways = false
71+
}
72+
73+
module "peering_hub_spoke" {
74+
count = var.features.hub_and_spoke ? 1 : 0
75+
76+
providers = {
77+
azurerm = azurerm.hub
78+
}
79+
80+
source = "../dtos-devops-templates/infrastructure/modules/vnet-peering"
81+
82+
name = "hub-to-${module.main_vnet.name}-peering"
83+
resource_group_name = local.hub_vnet_rg_name
84+
vnet_name = data.azurerm_virtual_network.hub[0].name
85+
remote_vnet_id = module.main_vnet.vnet.id
86+
87+
allow_virtual_network_access = true
88+
allow_forwarded_traffic = true
89+
allow_gateway_transit = false
90+
91+
use_remote_gateways = false
92+
}
93+
94+
95+
module "container_app_subnet" {
96+
source = "../dtos-devops-templates/infrastructure/modules/subnet"
97+
98+
name = "snet-container-apps"
99+
resource_group_name = azurerm_resource_group.main.name
100+
vnet_name = module.main_vnet.name
101+
address_prefixes = [cidrsubnet(var.vnet_address_space, 7, 0)]
102+
create_nsg = false
103+
location = "UK South"
104+
monitor_diagnostic_setting_network_security_group_enabled_logs = []
105+
log_analytics_workspace_id = module.log_analytics_workspace_audit.id
106+
network_security_group_name = "nsg-container-apps"
107+
delegation_name = "delegation"
108+
service_delegation_name = "Microsoft.App/environments"
109+
service_delegation_actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
110+
}
111+
112+
module "main_subnet" {
113+
source = "../dtos-devops-templates/infrastructure/modules/subnet"
114+
115+
name = "snet-main"
116+
resource_group_name = azurerm_resource_group.main.name
117+
vnet_name = module.main_vnet.name
118+
address_prefixes = [cidrsubnet(var.vnet_address_space, 7, 2)]
119+
create_nsg = false
120+
location = "UK South"
121+
monitor_diagnostic_setting_network_security_group_enabled_logs = []
122+
log_analytics_workspace_id = module.log_analytics_workspace_audit.id
123+
network_security_group_name = "nsg-container-apps"
124+
}
125+
126+
data "azurerm_private_dns_zone" "key-vault" {
127+
count = var.features.private_networking ? 1 : 0
128+
129+
provider = azurerm.hub
130+
131+
name = "privatelink.vaultcore.azure.net"
132+
resource_group_name = "rg-hub-${var.hub}-uks-private-dns-zones"
133+
}
134+

‎infrastructure/modules/infra/output.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
output "app_key_vault_id" {
2+
value = module.app-key-vault.key_vault_id
3+
}
4+
5+
output "container_app_environment_id" {
6+
value = module.container-app-environment.id
7+
}
8+
9+
output "vnet_name" {
10+
value = module.main_vnet.name
11+
}
12+
13+
output "log_analytics_workspace_audit_id" {
14+
value = module.log_analytics_workspace_audit.id
15+
}
16+
17+
output "default_domain" {
18+
value = module.container-app-environment.default_domain
19+
}
20+
21+
output "postgres_subnet_id" {
22+
value = module.postgres_subnet.id
23+
}
24+
25+
output "main_subnet_id" {
26+
value = module.main_subnet.id
27+
}

‎infrastructure/modules/infra/providers.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
terraform {
2+
required_providers {
3+
azurerm = {
4+
source = "hashicorp/azurerm"
5+
configuration_aliases = [azurerm.hub]
6+
}
7+
}
8+
}

‎infrastructure/modules/infra/variables.tf‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
variable "app_short_name" {
2+
description = "Application short name (6 characters)"
3+
type = string
4+
}
5+
6+
variable "environment" {
7+
description = "Application environment name"
8+
type = string
9+
}
10+
11+
variable "features" {
12+
description = "Feature flags for the deployment"
13+
type = object({
14+
front_door = optional(bool, true)
15+
hub_and_spoke = optional(bool, true)
16+
private_networking = optional(bool, true)
17+
})
18+
}
19+
20+
variable "resource_group_name" {
21+
description = "Infra resource group name"
22+
type = string
23+
}
24+
25+
variable "hub" {
26+
description = "Hub name (dev or prod)"
27+
type = string
28+
}
29+
30+
variable "region" {
31+
description = "The region to deploy in"
32+
type = string
33+
}
34+
35+
variable "vnet_address_space" {
36+
description = "VNET address space. Must be unique across the hub."
37+
type = string
38+
}
39+
40+
variable "protect_keyvault" {
41+
description = "Ability to recover the key vault or its secrets after deletion"
42+
type = bool
43+
default = true
44+
}
45+
46+
locals {
47+
hub_vnet_rg_name = "rg-hub-${var.hub}-uks-hub-networking"
48+
}

‎infrastructure/terraform/main.tf‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
module "infra" {
2+
count = var.deploy_infra ? 1 : 0
3+
4+
source = "../modules/infra"
5+
6+
providers = {
7+
azurerm = azurerm
8+
azurerm.hub = azurerm.hub
9+
}
10+
11+
region = local.region
12+
resource_group_name = local.resource_group_name
13+
app_short_name = var.app_short_name
14+
environment = var.env_config
15+
features = var.features
16+
hub = var.hub
17+
private_networking = var.private_networking
18+
protect_keyvault = var.protect_keyvault
19+
vnet_address_space = var.vnet_address_space
20+
}
21+
22+
# module "container-apps" {
23+
# count = var.deploy_container_apps ? 1 : 0
24+
25+
# source = "../modules/container-apps"
26+
27+
# providers = {
28+
# azurerm = azurerm
29+
# azurerm.hub = azurerm.hub
30+
# }
31+
32+
# region = local.region
33+
# app_key_vault_id = var.deploy_infra ? module.infra[0].app_key_vault_id : data.azurerm_key_vault.app_key_vault[0].id
34+
# app_short_name = var.app_short_name
35+
# container_app_environment_id = var.deploy_infra ? module.infra[0].container_app_environment_id : data.azurerm_container_app_environment.this[0].id
36+
# default_domain = var.deploy_infra ? module.infra[0].default_domain : data.azurerm_container_app_environment.this[0].default_domain
37+
# dns_zone_name = var.dns_zone_name
38+
# docker_image = var.docker_image
39+
# deploy_database_as_container = var.deploy_database_as_container
40+
# enable_auth = var.enable_auth
41+
# environment = var.environment
42+
# env_config = var.env_config
43+
# fetch_secrets_from_app_key_vault = var.fetch_secrets_from_app_key_vault
44+
# front_door_profile = var.front_door_profile
45+
# hub = var.hub
46+
# log_analytics_workspace_audit_id = var.deploy_infra ? module.infra[0].log_analytics_workspace_audit_id : data.azurerm_log_analytics_workspace.audit[0].id
47+
# postgres_backup_retention_days = var.postgres_backup_retention_days
48+
# postgres_geo_redundant_backup_enabled = var.postgres_geo_redundant_backup_enabled
49+
# postgres_sku_name = var.postgres_sku_name
50+
# postgres_sql_admin_group = "postgres_${var.app_short_name}_${var.env_config}_uks_admin"
51+
# postgres_storage_mb = var.postgres_storage_mb
52+
# postgres_storage_tier = var.postgres_storage_tier
53+
# postgres_subnet_id = var.deploy_infra ? module.infra[0].postgres_subnet_id : data.azurerm_subnet.postgres[0].id
54+
# main_subnet_id = var.deploy_infra ? module.infra[0].main_subnet_id : data.azurerm_subnet.main[0].id
55+
# seed_demo_data = var.seed_demo_data
56+
# use_apex_domain = var.use_apex_domain
57+
# }

0 commit comments

Comments
 (0)