Skip to content

Commit d09802c

Browse files
cameronbrunnerAlan Clucas
cameronbrunner
authored and
Alan Clucas
committed
Initial route53 support
1 parent 38f1a82 commit d09802c

13 files changed

+777
-0
lines changed

‎terraform/aws_route53/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Terraform files for AWS and Route 53
2+
3+
To use this directory you will need to be authenticated to aws and an existing 'base' zone registered in Route 53.
4+
5+
Read variables.tf and set as appropriate before terraform init, terraform plan and terraform apply

‎terraform/aws_route53/certificates.tf

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# This verifies ownership through Route 53. Other DNS providers are available and
2+
# could be swapped in
3+
4+
resource "aws_acm_certificate" "lb" {
5+
domain_name = "hub.hub-${var.prefix}.${var.dns_zone}"
6+
validation_method = "DNS"
7+
}
8+
9+
data "aws_route53_zone" "dev" {
10+
name = "${var.dns_zone}"
11+
private_zone = false
12+
}
13+
14+
resource "aws_route53_zone" "hub" {
15+
name = "hub-${var.prefix}.${var.dns_zone}"
16+
17+
tags = {
18+
Environment = "hub-${var.prefix}"
19+
}
20+
}
21+
22+
resource "aws_route53_record" "hub-ns" {
23+
zone_id = data.aws_route53_zone.dev.zone_id
24+
name = aws_route53_zone.hub.name
25+
type = "NS"
26+
ttl = "30"
27+
records = aws_route53_zone.hub.name_servers
28+
}
29+
30+
resource "aws_route53_record" "lb_validate" {
31+
for_each = {
32+
for dvo in aws_acm_certificate.lb.domain_validation_options : dvo.domain_name => {
33+
name = dvo.resource_record_name
34+
record = dvo.resource_record_value
35+
type = dvo.resource_record_type
36+
}
37+
}
38+
39+
allow_overwrite = true
40+
name = each.value.name
41+
records = [each.value.record]
42+
ttl = 60
43+
type = each.value.type
44+
zone_id = aws_route53_zone.hub.zone_id
45+
}
46+
47+
resource "aws_acm_certificate_validation" "lb" {
48+
certificate_arn = aws_acm_certificate.lb.arn
49+
validation_record_fqdns = [for record in aws_route53_record.lb_validate : record.fqdn]
50+
}

‎terraform/aws_route53/common.tf

+130
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
terraform {
2+
required_providers {
3+
aws = {
4+
source = "hashicorp/aws"
5+
version = "~> 3.0"
6+
}
7+
}
8+
}
9+
10+
provider "aws" {
11+
region = "${var.region}"
12+
}
13+
14+
resource "aws_vpc" "amber" {
15+
cidr_block = "172.17.0.0/16"
16+
tags = {
17+
Name = "${var.prefix}-amber"
18+
}
19+
}
20+
21+
resource "aws_vpc" "green" {
22+
cidr_block = "172.18.0.0/16"
23+
tags = {
24+
Name = "${var.prefix}-green"
25+
}
26+
}
27+
28+
29+
resource "aws_subnet" "amber-lb" {
30+
vpc_id = aws_vpc.amber.id
31+
cidr_block = "172.17.1.0/24"
32+
availability_zone = "${var.region}a"
33+
map_public_ip_on_launch = "true"
34+
tags = {
35+
Name = "${var.prefix}-amber-lb"
36+
}
37+
}
38+
39+
resource "aws_subnet" "amber-vms" {
40+
vpc_id = aws_vpc.amber.id
41+
cidr_block = "172.17.2.0/24"
42+
availability_zone = "${var.region}b"
43+
map_public_ip_on_launch = "true"
44+
tags = {
45+
Name = "${var.prefix}-amber-vms"
46+
}
47+
}
48+
49+
resource "aws_subnet" "green-a" {
50+
vpc_id = aws_vpc.green.id
51+
cidr_block = "172.18.1.0/24"
52+
availability_zone = "${var.region}a"
53+
tags = {
54+
Name = "${var.prefix}-green-a"
55+
}
56+
}
57+
58+
resource "aws_subnet" "green-b" {
59+
vpc_id = aws_vpc.green.id
60+
cidr_block = "172.18.2.0/24"
61+
availability_zone = "${var.region}b"
62+
tags = {
63+
Name = "${var.prefix}-green-b"
64+
}
65+
}
66+
67+
data "aws_caller_identity" "current" {}
68+
69+
resource "aws_vpc_peering_connection" "amber2green" {
70+
vpc_id = "${aws_vpc.amber.id}"
71+
peer_owner_id = "${data.aws_caller_identity.current.account_id}"
72+
peer_vpc_id = "${aws_vpc.green.id}"
73+
auto_accept = true
74+
}
75+
76+
resource "aws_route" "green2amber" {
77+
route_table_id = "${aws_vpc.green.main_route_table_id}"
78+
destination_cidr_block = "${aws_vpc.amber.cidr_block}"
79+
vpc_peering_connection_id = "${aws_vpc_peering_connection.amber2green.id}"
80+
}
81+
82+
resource "aws_internet_gateway" "gw" {
83+
vpc_id = aws_vpc.amber.id
84+
}
85+
86+
resource "aws_default_route_table" "amber" {
87+
default_route_table_id = aws_vpc.amber.default_route_table_id
88+
89+
route {
90+
cidr_block = "0.0.0.0/0"
91+
gateway_id = aws_internet_gateway.gw.id
92+
}
93+
route {
94+
cidr_block = "${aws_vpc.green.cidr_block}"
95+
vpc_peering_connection_id = "${aws_vpc_peering_connection.amber2green.id}"
96+
}
97+
tags = {
98+
Name = "${var.prefix}-amber-internet"
99+
}
100+
}
101+
102+
resource "aws_key_pair" "common-auth" {
103+
key_name = "auth-${var.prefix}"
104+
public_key = "${var.ssh_public_key}"
105+
}
106+
107+
108+
109+
data "aws_ami" "centos" {
110+
owners = ["679593333241"]
111+
most_recent = true
112+
113+
filter {
114+
name = "name"
115+
values = ["AlmaLinux OS 8.5 *"]
116+
}
117+
118+
filter {
119+
name = "architecture"
120+
values = ["x86_64"]
121+
}
122+
123+
filter {
124+
name = "root-device-type"
125+
values = ["ebs"]
126+
}
127+
}
128+
129+
130+

‎terraform/aws_route53/database.tf

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
resource "aws_security_group" "hubdb" {
2+
name = "${var.prefix}-hubdb"
3+
vpc_id = aws_vpc.green.id
4+
5+
ingress {
6+
from_port = 5432
7+
to_port = 5432
8+
protocol = "tcp"
9+
cidr_blocks = ["${aws_instance.hub.private_ip}/32"]
10+
}
11+
12+
egress {
13+
from_port = 5432
14+
to_port = 5432
15+
protocol = "tcp"
16+
cidr_blocks = ["${aws_instance.hub.private_ip}/32"]
17+
}
18+
19+
tags = {
20+
Name = "${var.prefix}-hub-db"
21+
}
22+
}
23+
24+
resource "aws_db_subnet_group" "hubdb" {
25+
name = "${var.prefix}-hubdb"
26+
subnet_ids = [aws_subnet.green-a.id,aws_subnet.green-b.id]
27+
tags = {
28+
Name = "${var.prefix}-hub-db"
29+
}
30+
}
31+
32+
resource "aws_db_instance" "hubdb" {
33+
allocated_storage = 8
34+
engine = "postgres"
35+
identifier = "${var.prefix}-hub-db"
36+
engine_version = "13"
37+
instance_class = "db.t3.medium"
38+
name = "${var.prefix}hub"
39+
username = "${var.dbusername}"
40+
password = "${var.dbpassword}"
41+
vpc_security_group_ids = [aws_security_group.hubdb.id]
42+
db_subnet_group_name = aws_db_subnet_group.hubdb.name
43+
skip_final_snapshot = true
44+
publicly_accessible = false
45+
storage_encrypted = true
46+
tags = {
47+
Name = "${var.prefix}-hub-db"
48+
}
49+
}
50+

‎terraform/aws_route53/dns.tf

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# This generates records in route53. Other DNS providers could be substituted.
2+
3+
resource "aws_route53_record" "lb" {
4+
zone_id = aws_route53_zone.hub.zone_id
5+
ttl = 300
6+
name = "${aws_acm_certificate.lb.domain_name}"
7+
records = ["${aws_lb.hublb.dns_name}"]
8+
type = "CNAME"
9+
}
10+
11+
resource "aws_route53_record" "hub" {
12+
zone_id = aws_route53_zone.hub.zone_id
13+
ttl = 300
14+
name = "hubvm.hub-${var.prefix}.${var.dns_zone}"
15+
records = ["${aws_instance.hub.private_ip}"]
16+
type = "A"
17+
}
18+
19+
resource "aws_route53_record" "worker" {
20+
count = var.worker_vm_count
21+
ttl = 300
22+
zone_id = aws_route53_zone.hub.zone_id
23+
name = "worker${count.index}.hub-${var.prefix}.${var.dns_zone}"
24+
records = ["${aws_instance.worker[count.index].private_ip}"]
25+
type = "A"
26+
}

‎terraform/aws_route53/efs.tf

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
resource "aws_efs_file_system" "shared_store" {
2+
creation_token = "${var.prefix}-shared_store"
3+
encrypted = true
4+
5+
lifecycle_policy {
6+
transition_to_ia = "AFTER_30_DAYS"
7+
}
8+
tags = {
9+
Name = "${var.prefix}-shared_store"
10+
}
11+
}
12+
13+
resource "aws_security_group" "shared_store" {
14+
name = "shared_store"
15+
vpc_id = "${aws_vpc.amber.id}"
16+
17+
# SSH access from anywhere
18+
ingress {
19+
from_port = 2049
20+
to_port = 2049
21+
protocol = "tcp"
22+
cidr_blocks = [aws_subnet.amber-vms.cidr_block]
23+
}
24+
25+
# outbound internet access
26+
egress {
27+
from_port = 0
28+
to_port = 0
29+
protocol = "-1"
30+
cidr_blocks = ["0.0.0.0/0"]
31+
ipv6_cidr_blocks = ["::/0"]
32+
}
33+
tags = {
34+
Name = "shared_store"
35+
}
36+
}
37+
38+
resource "aws_efs_mount_target" "shared_store" {
39+
file_system_id = aws_efs_file_system.shared_store.id
40+
subnet_id = aws_subnet.amber-vms.id
41+
security_groups = [aws_security_group.shared_store.id]
42+
}

‎terraform/aws_route53/hosts.tpl

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
[all:vars]
2+
ingress_url = ${ingress_url}
3+
shared_store_ip = ${shared_store_ip}
4+
db_host = ${db_host}
5+
db_name = ${db_name}
6+
db_user = ${db_user}
7+
db_password = ${db_password}
8+
s3_useIam = ${s3_useIam}
9+
s3_endpoint = ${s3_endpoint}
10+
s3_accessKeyId = ${s3_accessKeyId}
11+
s3_secretAccessKey = ${s3_secretAccessKey}
12+
s3_bucket = ${s3_bucket}
13+
s3_region = ${s3_region}
14+
15+
[hub]
16+
${hub_ip} ansible_user=${username} private_name=${hub_private_name}
17+
18+
[workers]
19+
%{ for worker in workers ~}
20+
${worker.public_ip} ansible_user=${username} private_name=${worker.private_name}
21+
%{endfor ~}

0 commit comments

Comments
 (0)