Skip to content

Commit 6b63edf

Browse files
j4p3j4p3
committed
update infra+ci configs
1 parent c0ea426 commit 6b63edf

File tree

11 files changed

+508
-19
lines changed

11 files changed

+508
-19
lines changed

.github/workflows/ecr.yml renamed to .github/workflows/deploy.yml

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ jobs:
3333
deploy:
3434
name: Deploy
3535
runs-on: ubuntu-latest
36+
if: github.ref == 'refs/heads/master'
3637

3738
steps:
3839
- name: Checkout
@@ -41,9 +42,9 @@ jobs:
4142
- name: Configure AWS credentials
4243
uses: aws-actions/configure-aws-credentials@v1
4344
with:
44-
aws-access-key-id: ${{ secrets.dev.AWS_ACCESS_KEY_ID }}
45-
aws-secret-access-key: ${{ secrets.dev.AWS_SECRET_ACCESS_KEY }}
46-
aws-region: ${{ secrets.dev.AWS_REGION }}
45+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
46+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
47+
aws-region: ${{ secrets.AWS_REGION }}
4748

4849
- name: Login to Amazon ECR
4950
id: login-ecr
@@ -64,17 +65,17 @@ jobs:
6465
echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
6566
6667
# - name: Fill in the new image ID in the Amazon ECS task definition
67-
# id: task-def
68-
# uses: aws-actions/amazon-ecs-render-task-definition@v1
69-
# with:
70-
# task-definition: task-definition.json
71-
# container-name: short_stuff
72-
# image: ${{ steps.build-image.outputs.image }}
68+
id: task-def
69+
uses: aws-actions/amazon-ecs-render-task-definition@v1
70+
with:
71+
task-definition: task-definition.json
72+
container-name: short_stuff
73+
image: ${{ steps.build-image.outputs.image }}
7374

74-
# - name: Deploy Amazon ECS task definition
75-
# uses: aws-actions/amazon-ecs-deploy-task-definition@v1
76-
# with:
77-
# task-definition: ${{ steps.task-def.outputs.task-definition }}
78-
# service: short_stuff-service
79-
# cluster: default
80-
# wait-for-service-stability: true
75+
- name: Deploy Amazon ECS task definition
76+
uses: aws-actions/amazon-ecs-deploy-task-definition@v1
77+
with:
78+
task-definition: ${{ steps.task-def.outputs.task-definition }}
79+
service: dev-shortstuff-service
80+
cluster: default
81+
wait-for-service-stability: true

‎terraform/deploy_user.tf‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,35 @@ resource "aws_iam_user_policy" "ci_ecr_access" {
2121
"ecr:*"
2222
],
2323
"Effect": "Allow",
24-
"Resource": "${aws_ecr_repository.myapp_repo.arn}"
24+
"Resource": "${aws_ecr_repository.short_stuff.arn}"
2525
}
2626
]
2727
}
2828
EOF
29+
}
30+
31+
resource "aws_iam_user_policy" "ecs-fargate-deploy" {
32+
user = aws_iam_user.ci_user.name
2933

34+
policy = <<POLICY
35+
{
36+
"Version": "2012-10-17",
37+
"Statement": [
38+
{
39+
"Action": [
40+
"ecs:UpdateService",
41+
"ecs:UpdateTaskDefinition",
42+
"ecs:DescribeServices",
43+
"ecs:DescribeTaskDefinition",
44+
"ecs:DescribeTasks",
45+
"ecs:RegisterTaskDefinition",
46+
"ecs:ListTasks"
47+
],
48+
"Effect": "Allow",
49+
"Resource": "*"
50+
}
51+
]
52+
}
53+
POLICY
3054
}
55+

‎terraform/ecr.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
resource "aws_ecr_repository" "myapp_repo" {
1+
resource "aws_ecr_repository" "short_stuff" {
22
name = "${var.environment_name}-${var.name}"
33
}

‎terraform/ecs.tf‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
# Role for ECS task
2+
# This is because our Fargate ECS must be able to pull images from ECS
3+
# and put logs from application container to log driver
4+
5+
data "aws_iam_policy_document" "ecs_task_exec_role" {
6+
statement {
7+
actions = ["sts:AssumeRole"]
8+
9+
principals {
10+
type = "Service"
11+
identifiers = ["ecs-tasks.amazonaws.com"]
12+
}
13+
}
14+
}
15+
16+
resource "aws_iam_role" "ecsTaskExecutionRole" {
17+
name = "${var.environment_name}-${var.name}-taskrole-ecs"
18+
assume_role_policy = data.aws_iam_policy_document.ecs_task_exec_role.json
19+
}
20+
21+
resource "aws_iam_role_policy_attachment" "ecs_task_exec_role" {
22+
role = aws_iam_role.ecsTaskExecutionRole.name
23+
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
24+
}
25+
26+
# Cloudwatch logs
27+
28+
resource "aws_cloudwatch_log_group" "short_stuff" {
29+
name = "/fargate/${var.environment_name}-${var.name}"
30+
}
31+
32+
# Cluster
33+
34+
resource "aws_ecs_cluster" "default" {
35+
depends_on = [aws_cloudwatch_log_group.short_stuff]
36+
name = "${var.environment_name}-${var.name}"
37+
}
38+
39+
# Task definition for the application
40+
41+
resource "aws_ecs_task_definition" "short_stuff" {
42+
family = "${var.environment_name}-${var.name}-td"
43+
requires_compatibilities = ["FARGATE"]
44+
cpu = var.ecs_fargate_application_cpu
45+
memory = var.ecs_fargate_application_mem
46+
network_mode = "awsvpc"
47+
execution_role_arn = aws_iam_role.ecsTaskExecutionRole.arn
48+
container_definitions = <<DEFINITION
49+
[
50+
{
51+
"environment": [
52+
{"name": "SECRET_KEY_BASE", "value": "generate one with mix phx.gen.secret"}
53+
],
54+
"image": "${aws_ecr_repository.short_stuff.repository_url}:latest",
55+
"name": "${var.environment_name}-${var.name}",
56+
"portMappings": [
57+
{
58+
"containerPort": 4000
59+
}
60+
],
61+
"logConfiguration": {
62+
"logDriver": "awslogs",
63+
"options": {
64+
"awslogs-group": "${aws_cloudwatch_log_group.short_stuff.name}",
65+
"awslogs-region": "${var.aws_region}",
66+
"awslogs-stream-prefix": "ecs-fargate"
67+
}
68+
}
69+
}
70+
]
71+
DEFINITION
72+
}
73+
74+
75+
resource "aws_ecs_service" "short_stuff" {
76+
name = "${var.environment_name}-${var.name}-service"
77+
cluster = aws_ecs_cluster.default.id
78+
launch_type = "FARGATE"
79+
task_definition = aws_ecs_task_definition.short_stuff.arn
80+
desired_count = var.ecs_application_count
81+
82+
load_balancer {
83+
target_group_arn = aws_lb_target_group.short_stuff.arn
84+
container_name = "${var.environment_name}-${var.name}"
85+
container_port = 4000
86+
}
87+
88+
network_configuration {
89+
assign_public_ip = false
90+
91+
security_groups = [
92+
aws_security_group.egress-all.id,
93+
aws_security_group.short_stuff-service.id
94+
]
95+
subnets = [aws_subnet.private.id]
96+
}
97+
98+
depends_on = [
99+
aws_lb_listener.short_stuff_http,
100+
aws_lb_listener.short_stuff_https,
101+
aws_ecs_task_definition.short_stuff
102+
]
103+
}

‎terraform/lb.tf‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
resource "aws_lb" "short_stuff" {
2+
name = "${var.environment_name}-${var.name}"
3+
4+
subnets = [
5+
aws_subnet.public.id,
6+
aws_subnet.private.id
7+
]
8+
9+
security_groups = [
10+
aws_security_group.http.id,
11+
aws_security_group.https.id,
12+
aws_security_group.egress-all.id
13+
]
14+
15+
tags = {
16+
Environment = var.environment_name
17+
}
18+
}
19+
20+
resource "aws_acm_certificate" "short_stuff" {
21+
domain_name = "isthesqueezesquoze.com"
22+
validation_method = "DNS"
23+
24+
tags = {
25+
Environment = var.environment_name
26+
}
27+
28+
lifecycle {
29+
create_before_destroy = true
30+
}
31+
}
32+
33+
resource "aws_lb_target_group" "short_stuff" {
34+
port = "4000"
35+
protocol = "HTTP"
36+
vpc_id = aws_vpc.default.id
37+
target_type = "ip"
38+
39+
health_check {
40+
enabled = true
41+
path = "/health"
42+
matcher = "200"
43+
interval = 30
44+
unhealthy_threshold = 10
45+
timeout = 25
46+
}
47+
48+
tags = {
49+
Environment = var.environment_name
50+
}
51+
52+
depends_on = [aws_lb.short_stuff]
53+
}
54+
55+
resource "aws_lb_listener" "short_stuff_http" {
56+
load_balancer_arn = aws_lb.short_stuff.arn
57+
port = "80"
58+
protocol = "HTTP"
59+
60+
default_action {
61+
target_group_arn = aws_lb_target_group.short_stuff.arn
62+
type = "forward"
63+
}
64+
65+
# default_action {
66+
# type = "redirect"
67+
68+
# redirect {
69+
# port = "443"
70+
# protocol = "HTTPS"
71+
# status_code = "HTTP_301"
72+
# }
73+
# }
74+
}
75+
76+
resource "aws_lb_listener" "short_stuff_https" {
77+
load_balancer_arn = aws_lb.short_stuff.arn
78+
port = "443"
79+
protocol = "HTTPS"
80+
ssl_policy = "ELBSecurityPolicy-2016-08"
81+
certificate_arn = aws_acm_certificate.short_stuff.arn
82+
83+
default_action {
84+
type = "forward"
85+
target_group_arn = aws_lb_target_group.short_stuff.arn
86+
}
87+
}
88+
89+

‎terraform/main.tf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,54 @@
11
provider "aws" {
22
region = "us-west-1"
33
}
4+
5+
resource "aws_vpc" "default" {
6+
cidr_block = "10.0.0.0/16"
7+
8+
tags = {
9+
Environment = var.environment_name
10+
}
11+
}
12+
13+
resource "aws_route_table" "public" {
14+
vpc_id = aws_vpc.default.id
15+
}
16+
17+
resource "aws_route_table" "private" {
18+
vpc_id = aws_vpc.default.id
19+
}
20+
21+
resource "aws_route_table_association" "public_subnet" {
22+
subnet_id = aws_subnet.public.id
23+
route_table_id = aws_route_table.public.id
24+
}
25+
26+
resource "aws_route_table_association" "private_subnet" {
27+
subnet_id = aws_subnet.private.id
28+
route_table_id = aws_route_table.private.id
29+
}
30+
31+
resource "aws_eip" "nat_ip" {
32+
vpc = true
33+
}
34+
35+
resource "aws_internet_gateway" "igw" {
36+
vpc_id = aws_vpc.default.id
37+
}
38+
39+
resource "aws_nat_gateway" "ngw" {
40+
subnet_id = aws_subnet.public.id
41+
allocation_id = aws_eip.nat_ip.id
42+
}
43+
44+
resource "aws_route" "public_igw" {
45+
route_table_id = aws_route_table.public.id
46+
destination_cidr_block = "0.0.0.0/0"
47+
gateway_id = aws_internet_gateway.igw.id
48+
}
49+
50+
resource "aws_route" "private_ngw" {
51+
route_table_id = aws_route_table.private.id
52+
destination_cidr_block = "0.0.0.0/0"
53+
nat_gateway_id = aws_nat_gateway.ngw.id
54+
}

‎terraform/outputs.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
output "load_balancer_dns" {
2+
value = aws_lb.short_stuff.dns_name
3+
}

‎terraform/rds.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
resource "aws_db_instance" "default" {
2+
allocated_storage = var.db_storage
3+
engine = var.db_engine
4+
engine_version = var.db_engine_version
5+
instance_class = var.db_instance_type
6+
name = var.db_name
7+
username = var.db_username
8+
password = var.db_password
9+
10+
availability_zone = var.aws_default_zone
11+
12+
publicly_accessible = false
13+
vpc_security_group_ids = [aws_security_group.db.id]
14+
db_subnet_group_name = aws_db_subnet_group.default.name
15+
16+
tags = {
17+
App = var.name
18+
Environment = var.environment_name
19+
}
20+
}

0 commit comments

Comments
 (0)