diff --git a/terraform/README.md b/terraform/README.md deleted file mode 100644 index a7551fa..0000000 --- a/terraform/README.md +++ /dev/null @@ -1 +0,0 @@ -This repo contains [Terraform](https://terraform.io) configuration files and related source code used in [Guide to automating a multi-tiered application securely on AWS with Docker and Terraform](https://www.airpair.com/aws/posts/ntiered-aws-docker-terraform-guide) examples. diff --git a/terraform/app-servers.tf b/terraform/app-servers.tf index dd4463b..4f4d70e 100644 --- a/terraform/app-servers.tf +++ b/terraform/app-servers.tf @@ -9,13 +9,13 @@ resource "aws_instance" "app" { source_dest_check = false user_data = "${file(\"cloud-config/app.yml\")}" tags = { - Name = "airpair-example-app-${count.index}" + Name = "meetup-example-app-${count.index}" } } /* Load balancer */ resource "aws_elb" "app" { - name = "airpair-example-elb" + name = "meetup-example-elb" subnets = ["${aws_subnet.public.id}"] security_groups = ["${aws_security_group.default.id}", "${aws_security_group.web.id}"] listener { @@ -24,5 +24,13 @@ resource "aws_elb" "app" { lb_port = 80 lb_protocol = "http" } + health_check { + healthy_threshold = 2 + unhealthy_threshold = 2 + timeout = 5 + target = "HTTP:80/" + interval = 15 + } + instances = ["${aws_instance.app.*.id}"] } diff --git a/terraform/assets/header.png b/terraform/assets/header.png deleted file mode 100644 index f2a37cd..0000000 Binary files a/terraform/assets/header.png and /dev/null differ diff --git a/terraform/aws-vpc.tf b/terraform/aws-vpc.tf index ab2c54a..6b3c159 100644 --- a/terraform/aws-vpc.tf +++ b/terraform/aws-vpc.tf @@ -10,6 +10,6 @@ resource "aws_vpc" "default" { cidr_block = "${var.vpc_cidr}" enable_dns_hostnames = true tags { - Name = "airpair-example" + Name = "meetup-example" } } diff --git a/terraform/bin/ovpn-client-config b/terraform/bin/ovpn-client-config index 4bd5dd7..eb84ac1 100755 --- a/terraform/bin/ovpn-client-config +++ b/terraform/bin/ovpn-client-config @@ -1 +1 @@ -ssh -t -i ssh/insecure-deployer "ubuntu@$(terraform output nat.ip)" sudo docker run --volumes-from ovpn-data --rm gosuri/openvpn ovpn_getclient "${1}" > "${1}-airpair-example.ovpn" +ssh -t -i ssh/insecure-deployer "ubuntu@$(terraform output nat.ip)" sudo docker run --volumes-from ovpn-data --rm gosuri/openvpn ovpn_getclient "${1}" > "${1}-meetup-example.ovpn" diff --git a/terraform/bin/ovpn-init b/terraform/bin/ovpn-init index a497db5..d579a09 100755 --- a/terraform/bin/ovpn-init +++ b/terraform/bin/ovpn-init @@ -1 +1 @@ -ssh -t -i ssh/insecure-deployer ubuntu@54.153.64.109 sudo docker run --volumes-from ovpn-data --rm -it gosuri/openvpn ovpn_initpki +ssh -t -i ssh/insecure-deployer "ubuntu@$(terraform output nat.ip)" sudo docker run --volumes-from ovpn-data --rm -it gosuri/openvpn ovpn_initpki diff --git a/terraform/cloud-config/app.yml b/terraform/cloud-config/app.yml index af0fcb9..1ca3e74 100644 --- a/terraform/cloud-config/app.yml +++ b/terraform/cloud-config/app.yml @@ -5,4 +5,4 @@ runcmd: # Install docker - curl -sSL https://get.docker.com/ubuntu/ | sudo sh # Run nginx - - docker run -d -p 80:80 dockerfile/nginx + - docker run -d -p 80:80 nginx diff --git a/terraform/key-pairs.tf b/terraform/key-pairs.tf index 11dd553..b866a15 100644 --- a/terraform/key-pairs.tf +++ b/terraform/key-pairs.tf @@ -1,5 +1,5 @@ resource "aws_key_pair" "deployer" { - key_name = "deployer-airpair-example" + key_name = "deployer-meetup-example" public_key = "${file(\"ssh/insecure-deployer.pub\")}" } diff --git a/terraform/nat-server.tf b/terraform/nat-server.tf index dfffec9..da7e36e 100644 --- a/terraform/nat-server.tf +++ b/terraform/nat-server.tf @@ -16,7 +16,7 @@ resource "aws_instance" "nat" { provisioner "remote-exec" { inline = [ "sudo iptables -t nat -A POSTROUTING -j MASQUERADE", - "echo 1 > /proc/sys/net/ipv4/conf/all/forwarding", + "echo 1 | sudo tee /proc/sys/net/ipv4/conf/all/forwarding", /* Install docker */ "curl -sSL https://get.docker.com/ubuntu/ | sudo sh", /* Initialize open vpn data container */ diff --git a/terraform/outputs.tf b/terraform/outputs.tf index 6774034..890db6d 100644 --- a/terraform/outputs.tf +++ b/terraform/outputs.tf @@ -6,6 +6,10 @@ output "app.1.ip" { value = "${aws_instance.app.1.private_ip}" } +/*output "appservers" { + value = "${join(",", aws_instance.app.*.private_ip)}" +}*/ + output "nat.ip" { value = "${aws_instance.nat.public_ip}" } diff --git a/terraform/private-subnet.tf b/terraform/private-subnet.tf index 869c64b..36090cc 100644 --- a/terraform/private-subnet.tf +++ b/terraform/private-subnet.tf @@ -2,7 +2,7 @@ resource "aws_subnet" "private" { vpc_id = "${aws_vpc.default.id}" cidr_block = "${var.private_subnet_cidr}" - availability_zone = "us-west-1a" + availability_zone = "us-west-1b" map_public_ip_on_launch = false depends_on = ["aws_instance.nat"] tags { diff --git a/terraform/public-subnet.tf b/terraform/public-subnet.tf index 1008258..c063633 100644 --- a/terraform/public-subnet.tf +++ b/terraform/public-subnet.tf @@ -7,7 +7,7 @@ resource "aws_internet_gateway" "default" { resource "aws_subnet" "public" { vpc_id = "${aws_vpc.default.id}" cidr_block = "${var.public_subnet_cidr}" - availability_zone = "us-west-1a" + availability_zone = "us-west-1b" map_public_ip_on_launch = true depends_on = ["aws_internet_gateway.default"] tags { diff --git a/terraform/security-groups.tf b/terraform/security-groups.tf index 58f68c0..65d9509 100644 --- a/terraform/security-groups.tf +++ b/terraform/security-groups.tf @@ -1,6 +1,6 @@ /* Default security group */ resource "aws_security_group" "default" { - name = "default-airpair-example" + name = "default-meetup-example" description = "Default security group that allows inbound and outbound traffic from all instances in the VPC" vpc_id = "${aws_vpc.default.id}" @@ -10,16 +10,23 @@ resource "aws_security_group" "default" { protocol = "-1" self = true } - - tags { - Name = "airpair-example-default-vpc" + + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] +} + + tags { + Name = "meetup-example-default-vpc" } } /* Security group for the nat server */ resource "aws_security_group" "nat" { - name = "nat-airpair-example" + name = "nat-meetup-example" description = "Security group for nat instances that allows SSH and VPN traffic from internet" vpc_id = "${aws_vpc.default.id}" @@ -36,15 +43,22 @@ resource "aws_security_group" "nat" { protocol = "udp" cidr_blocks = ["0.0.0.0/0"] } - - tags { - Name = "nat-airpair-example" + + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] +} + + tags { + Name = "nat-meetup-example" } } /* Security group for the web */ resource "aws_security_group" "web" { - name = "web-airpair-example" + name = "web-meetup-example" description = "Security group for web that allows web traffic from internet" vpc_id = "${aws_vpc.default.id}" @@ -63,6 +77,6 @@ resource "aws_security_group" "web" { } tags { - Name = "web-airpair-example" + Name = "web-meetup-example" } }