Skip to content

Commit e5de47a

Browse files
namgigunjueunk617
namgigun
and
jueunk617
authored
Infra: 도커 파일 작성 및 이미지 빌드
* Infra: 도커 파일 생성 * Fix: SecurityConfig 수정 - 홈 및 스웨거(API 문서) 접근 시, 누구나 들어가는 것 가능 * Chore: 도커 파일 위치 변경 - 기존: /infra/docker -> / * Infra: RDS 설정 추가 - Private Subnet 1개 추가 - RDS Instance 생성 - RDS Subnet/Security Group 생성 - EC2 역할 및 정책 부여 (AmazonEC2RoleforSSM) - EC2 생성시, 사전 작업 진행 설정 (도커/깃 설치, 가상 메모리 4GB 확보) - EC2 루트 볼륨 설정 (gp3, 12GB) * Infra: 운영환경 JWT 설정 추가 및 RDS 설정 추가 - 시크릿 키 - access/refresh-token-expiration 정보 - RDS에 대한 모든 트래픽에 접근 허용 * Chore: 개발/운영 환경 주석처리 - 운영 환경으로 변경하기 편하다록 주석처리 * Infra: ddl-auto 옵션 변경 - 기존 : validate -> 변경 : update * Infra: RDS 설정 변경 - 모든 트래픽에 대한 접근 허용 --------- Co-authored-by: jueunk617 <[email protected]>
1 parent 233a3b9 commit e5de47a

File tree

5 files changed

+214
-24
lines changed

5 files changed

+214
-24
lines changed

‎Dockerfile‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# 첫 번째 스테이지 : 빌드 스테이지
2+
FROM gradle:jdk-21-and-23-graal-jammy AS builder
3+
4+
# 작업용 디렉토리 설명
5+
WORKDIR /app
6+
7+
# Gradle 래퍼 복사
8+
COPY build.gradle.kts .
9+
COPY settings.gradle.kts .
10+
11+
RUN gradle dependencies --no-daemon
12+
13+
# 소스코드 복사
14+
COPY src src
15+
16+
# .env 복사
17+
COPY .env .env
18+
19+
# 애플리케이션 빌드
20+
RUN gradle build --no-daemon
21+
22+
# 두 번째 스테이지 : 실행 스테이지
23+
FROM container-registry.oracle.com/graalvm/jdk:21
24+
25+
WORKDIR /app
26+
27+
# 첫 번째 스테이지에서 빌드된 JAR 파일 복사
28+
COPY --from=builder /app/build/libs/*.jar app.jar
29+
COPY --from=builder /app/.env .env
30+
31+
# 실행할 JAR 파일 지정
32+
ENTRYPOINT ["java", "-Dspring.profiles.active=prod", "-jar", "app.jar"]

‎infra/terraform/main.tf‎

Lines changed: 168 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
// aws 라이브러리 불러옴
33
required_providers {
44
aws = {
5-
source = "hashicorp/aws"
5+
source = "hashicorp/aws"
66
}
77
}
88
}
@@ -14,8 +14,8 @@ provider "aws" {
1414

1515
# VPC_1
1616
resource "aws_vpc" "vpc_1" {
17-
cidr_block = "10.0.0.0/16"
18-
enable_dns_support = true
17+
cidr_block = "10.0.0.0/16"
18+
enable_dns_support = true
1919
enable_dns_hostnames = true
2020

2121
tags = {
@@ -25,9 +25,9 @@ resource "aws_vpc" "vpc_1" {
2525

2626
# 퍼블릭 서브넷 (Subnet_1)
2727
resource "aws_subnet" "subnet_1" {
28-
vpc_id = aws_vpc.vpc_1.id
29-
cidr_block = "10.0.1.0/24"
30-
availability_zone = "ap-northeast-2a"
28+
vpc_id = aws_vpc.vpc_1.id
29+
cidr_block = "10.0.1.0/24"
30+
availability_zone = "ap-northeast-2a"
3131
map_public_ip_on_launch = true # 퍼블릭 IP 자동 할당
3232

3333
tags = {
@@ -37,15 +37,26 @@ resource "aws_subnet" "subnet_1" {
3737

3838
# 프라이빗 서브넷 (Subnet_2)
3939
resource "aws_subnet" "subnet_2" {
40-
vpc_id = aws_vpc.vpc_1.id
41-
cidr_block = "10.0.2.0/24"
42-
availability_zone = "ap-northeast-2b"
40+
vpc_id = aws_vpc.vpc_1.id
41+
cidr_block = "10.0.2.0/24"
42+
availability_zone = "ap-northeast-2a"
4343

4444
tags = {
4545
Name = "team5-subnet-2-private"
4646
}
4747
}
4848

49+
# 프라이빗 서브넷 (Subnet_3)
50+
resource "aws_subnet" "subnet_3" {
51+
vpc_id = aws_vpc.vpc_1.id
52+
cidr_block = "10.0.3.0/24"
53+
availability_zone = "ap-northeast-2b"
54+
55+
tags = {
56+
Name = "team5-subnet-3-private"
57+
}
58+
}
59+
4960
# 인터넷 게이트 웨이
5061
resource "aws_internet_gateway" "igw_1" {
5162
vpc_id = aws_vpc.vpc_1.id
@@ -86,17 +97,22 @@ resource "aws_route_table_association" "association_2" {
8697
route_table_id = aws_route_table.rt_1.id
8798
}
8899

100+
resource "aws_route_table_association" "association_3" {
101+
subnet_id = aws_subnet.subnet_3.id
102+
103+
route_table_id = aws_route_table.rt_1.id
104+
}
105+
89106
resource "aws_security_group" "sg_1" {
90-
name = "team5-sg-1"
91-
description = "Allow SSH and HTTP"
92-
vpc_id = aws_vpc.vpc_1.id
107+
name = "team5-sg-1"
108+
vpc_id = aws_vpc.vpc_1.id
93109

94-
ingress {
95-
from_port = 0
96-
to_port = 0
97-
protocol = "all" # 모든 프로토콜
98-
cidr_blocks = ["0.0.0.0/0"] # 모든 IP 허용
99-
}
110+
ingress {
111+
from_port = 0
112+
to_port = 0
113+
protocol = "all" # 모든 프로토콜
114+
cidr_blocks = ["0.0.0.0/0"] # 모든 IP 허용
115+
}
100116

101117
egress {
102118
from_port = 0
@@ -106,16 +122,148 @@ resource "aws_security_group" "sg_1" {
106122
}
107123
}
108124

125+
# EC2 역할 생성
126+
resource "aws_iam_role" "ec2_role_1" {
127+
name = "team5-ec2-role-1"
128+
129+
# 이 역할에 대한 신뢰 정책 설정. EC2 서비스가 이 역할을 가정할 수 있도록 설정
130+
assume_role_policy = <<EOF
131+
{
132+
"Version": "2012-10-17",
133+
"Statement": [
134+
{
135+
"Sid": "",
136+
"Action": "sts:AssumeRole",
137+
"Principal": {
138+
"Service": "ec2.amazonaws.com"
139+
},
140+
"Effect": "Allow"
141+
}
142+
]
143+
}
144+
EOF
145+
}
146+
147+
# EC2 역할에 AmazonEC2RoleforSSM 정책을 부착
148+
resource "aws_iam_role_policy_attachment" "ec2_ssm" {
149+
role = aws_iam_role.ec2_role_1.name
150+
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM"
151+
}
152+
153+
# IAM 인스턴스 프로파일 생성
154+
resource "aws_iam_instance_profile" "instance_profile_1" {
155+
name = "team5-instance-profile-1"
156+
role = aws_iam_role.ec2_role_1.name
157+
}
158+
159+
# EC2 실행마다 적용할 작업
160+
locals {
161+
ec2_user_data_base = <<-END_OF_FILE
162+
#!/bin/bash
163+
yum install docker -y
164+
systemctl enable docker
165+
systemctl start docker
166+
167+
yum install git -y
168+
169+
sudo dd if=/dev/zero of=/swapfile bs=128M count=32
170+
sudo chmod 600 /swapfile
171+
sudo mkswap /swapfile
172+
sudo swapon /swapfile
173+
sudo sh -c 'echo "/swapfile swap swap defaults 0 0" >> /etc/fstab'
174+
175+
END_OF_FILE
176+
}
177+
178+
# EC2 인스턴스 생성
109179
resource "aws_instance" "ec2_1" {
110180
ami = "ami-077ad873396d76f6a"
111-
instance_type = "t2.micro"
181+
instance_type = "t3.micro"
112182

113-
subnet_id = aws_subnet.subnet_1.id
183+
subnet_id = aws_subnet.subnet_1.id
114184
vpc_security_group_ids = [aws_security_group.sg_1.id]
115185

116186
associate_public_ip_address = true
117187

188+
# 인스턴스에 IAM 역할 설정
189+
iam_instance_profile = aws_iam_instance_profile.instance_profile_1.name
190+
118191
tags = {
119192
Name = "team5-ec2-1"
120193
}
194+
195+
# 루트 불륨 설정
196+
root_block_device {
197+
volume_type = "gp3"
198+
volume_size = 12
199+
}
200+
201+
# EC2 실행 시, 작업진행
202+
user_data = <<-EOF
203+
${local.ec2_user_data_base}
204+
EOF
205+
}
206+
207+
# RDS용 Security Group
208+
resource "aws_security_group" "rds_sg_1" {
209+
name = "team5-rds-sg-1"
210+
description = "Allow All"
211+
vpc_id = aws_vpc.vpc_1.id
212+
213+
ingress {
214+
from_port = 3306
215+
to_port = 3306
216+
protocol = "tcp"
217+
cidr_blocks = ["0.0.0.0/0"]
218+
}
219+
220+
egress {
221+
from_port = 0
222+
to_port = 0
223+
protocol = "all"
224+
cidr_blocks = ["0.0.0.0/0"]
225+
}
226+
227+
tags = {
228+
Name = "team5-rds-sg-1"
229+
}
230+
}
231+
232+
# RDS Subnet Group
233+
resource "aws_db_subnet_group" "db_subnet_group" {
234+
name = "team5-db-subnet-group"
235+
subnet_ids = [aws_subnet.subnet_2.id, aws_subnet.subnet_3.id]
236+
237+
tags = {
238+
Name = "team5-db-subnet-group"
239+
}
240+
}
241+
242+
resource "aws_db_instance" "mysql" {
243+
identifier = "team5-mysql"
244+
engine = "mysql"
245+
engine_version = "8.0"
246+
instance_class = "db.t3.micro"
247+
allocated_storage = 20
248+
storage_type = "gp2"
249+
250+
db_name = "catfe"
251+
username = "catfe_user"
252+
password = "catfe_pass"
253+
254+
db_subnet_group_name = aws_db_subnet_group.db_subnet_group.name
255+
vpc_security_group_ids = [aws_security_group.rds_sg_1.id]
256+
257+
258+
multi_az = false
259+
260+
# 자동 백업 보관 기간
261+
backup_retention_period = 1
262+
263+
# 삭제 시 최종 스냅샷 생성 여부 (개발용은 true, 운영은 false 권장)
264+
skip_final_snapshot = true
265+
266+
tags = {
267+
Name = "team5-rds-mysql"
268+
}
121269
}

‎src/main/java/com/back/global/security/SecurityConfig.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
3030
auth -> auth
3131
.requestMatchers("/api/auth/**").permitAll()
3232
.requestMatchers("/api/rooms/**").permitAll() // 테스트용 임시 허용
33-
.requestMatchers("/swagger-ui/**", "/v3/api-docs/**").permitAll() // Swagger 허용
33+
.requestMatchers("/","/swagger-ui/**", "/v3/api-docs/**").permitAll() // Swagger 허용
3434
.requestMatchers("/h2-console/**").permitAll() // H2 Console 허용
3535
.anyRequest().authenticated()
3636
)

‎src/main/resources/application-prod.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ spring:
22
jpa:
33
database-platform: org.hibernate.dialect.MySQLDialect
44
hibernate:
5-
ddl-auto: validate # [none | validate | update | create | create-drop]
5+
ddl-auto: update # [none | validate | update | create | create-drop]
66

77
config:
88
import: optional:file:.env[.properties]
@@ -14,4 +14,9 @@ spring:
1414
password: ${MYSQL_PASSWORD}
1515

1616
springdoc:
17-
default-produces-media-type: application/json;charset=UTF-8
17+
default-produces-media-type: application/json;charset=UTF-8
18+
19+
jwt:
20+
secret: ${JWT_SECRET:test-jwt-secret-key-12345678901234567890} # 운영 시에는 반드시 환경 변수로 설정할 것
21+
access-token-expiration: ${JWT_ACCESS_TOKEN_EXPIRATION:1800} # 30분 (초 단위)
22+
refresh-token-expiration: ${JWT_REFRESH_TOKEN_EXPIRATION:604800} # 7일 (초 단위)

‎src/main/resources/application.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,10 @@ spring:
22
application:
33
name: catfe-backend
44

5+
# 개발환경
56
profiles:
6-
active: dev
7+
active: dev
8+
9+
# 운영환경
10+
# profiles:
11+
# active: prod

0 commit comments

Comments
 (0)