Skip to content

Commit 8f0bbf1

Browse files
author
Ulfat
authored
Merge branch 'master' into split-bootstrap-role
2 parents f55cf0e + 2188a62 commit 8f0bbf1

36 files changed

+1186
-85
lines changed

‎deployment/terraform/aws/main.tf

+93
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
provider "aws" {
2+
alias = "region_1"
3+
region = var.region_1
4+
}
5+
6+
provider "aws" {
7+
alias = "region_2"
8+
region = var.region_2
9+
}
10+
11+
# Validator
12+
module "validator" {
13+
source = "./validator"
14+
providers = {
15+
aws = aws.region_1
16+
}
17+
}
18+
19+
# Private Sentries
20+
module "private_sentries" {
21+
source = "./private-sentries"
22+
23+
providers = {
24+
aws = aws.region_1
25+
aws.peer = aws.region_1
26+
}
27+
28+
peer_vpc = module.validator.vpc
29+
}
30+
31+
# Public Sentries region 1
32+
module "public_sentries_1" {
33+
source = "./public-sentries"
34+
nodes_count = 1
35+
36+
# enable_ipv6 = false
37+
38+
providers = {
39+
aws = aws.region_1
40+
aws.peer = aws.region_1
41+
}
42+
43+
region_index = 1
44+
peer_vpc = module.private_sentries.vpc
45+
}
46+
47+
# Public Sentries region 2
48+
module "public_sentries_2" {
49+
source = "./public-sentries"
50+
nodes_count = 1
51+
52+
# enable_ipv6 = false
53+
54+
providers = {
55+
aws = aws.region_2
56+
aws.peer = aws.region_1
57+
}
58+
59+
region_index = 2
60+
peer_vpc = module.private_sentries.vpc
61+
}
62+
63+
# Observers region 1
64+
module "observers_1" {
65+
source = "./observers"
66+
67+
providers = {
68+
aws = aws.region_1
69+
aws.peer = aws.region_1
70+
}
71+
72+
root_domain_name = var.root_domain_name
73+
enable_tls = var.enable_tls
74+
75+
region_index = 1
76+
peer_vpc = module.private_sentries.vpc
77+
}
78+
79+
# Observers region 2
80+
module "observers_2" {
81+
source = "./observers"
82+
83+
providers = {
84+
aws = aws.region_2
85+
aws.peer = aws.region_1
86+
}
87+
88+
root_domain_name = var.root_domain_name
89+
enable_tls = var.enable_tls
90+
91+
region_index = 2
92+
peer_vpc = module.private_sentries.vpc
93+
}

‎deployment/terraform/aws/observers/acm.tf

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
resource "aws_acm_certificate" "this_acm_cert" {
2+
count = local.enable_tls ? 1 : 0
3+
4+
domain_name = "on.${data.aws_route53_zone.this_zone[0].name}"
5+
validation_method = "DNS"
6+
}
7+
8+
resource "aws_route53_record" "this_acm_val_records" {
9+
count = local.enable_tls ? length(aws_acm_certificate.this_acm_cert[0].domain_validation_options) : 0
10+
11+
name = tolist(aws_acm_certificate.this_acm_cert[0].domain_validation_options)[count.index].resource_record_name
12+
records = [tolist(aws_acm_certificate.this_acm_cert[0].domain_validation_options)[count.index].resource_record_value]
13+
type = tolist(aws_acm_certificate.this_acm_cert[0].domain_validation_options)[count.index].resource_record_type
14+
15+
allow_overwrite = true
16+
ttl = 60
17+
zone_id = data.aws_route53_zone.this_zone[0].zone_id
18+
}
19+
20+
resource "aws_acm_certificate_validation" "this_acm_cert_validation" {
21+
count = local.enable_tls ? 1 : 0
22+
23+
certificate_arn = aws_acm_certificate.this_acm_cert[0].arn
24+
validation_record_fqdns = aws_route53_record.this_acm_val_records[*].fqdn
25+
}

‎deployment/terraform/aws/observers/elb.tf

+162
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
resource "aws_lb" "this_nlb" {
2+
name = "observers-network-lb"
3+
internal = false
4+
load_balancer_type = "network"
5+
subnets = module.this_vpc.public_subnets
6+
7+
enable_cross_zone_load_balancing = true
8+
# enable_deletion_protection = true
9+
10+
tags = {
11+
Name = "Observers NLB"
12+
}
13+
}
14+
15+
locals {
16+
tls_cert_arn = var.enable_tls ? aws_acm_certificate_validation.this_acm_cert_validation[0].certificate_arn : ""
17+
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06" # TLS 1.3 (recommended)
18+
}
19+
20+
resource "aws_lb_listener" "rest" {
21+
count = local.enable_tls ? 0 : 1
22+
23+
load_balancer_arn = aws_lb.this_nlb.arn
24+
port = "80"
25+
protocol = "TCP"
26+
27+
default_action {
28+
type = "forward"
29+
target_group_arn = aws_lb_target_group.rest.arn
30+
}
31+
}
32+
33+
resource "aws_lb_listener" "grpc" {
34+
count = local.enable_tls ? 0 : 1
35+
36+
load_balancer_arn = aws_lb.this_nlb.arn
37+
port = "9090"
38+
protocol = "TCP"
39+
40+
default_action {
41+
type = "forward"
42+
target_group_arn = aws_lb_target_group.grpc.arn
43+
}
44+
}
45+
46+
resource "aws_lb_listener" "rpc" {
47+
count = local.enable_tls ? 0 : 1
48+
49+
load_balancer_arn = aws_lb.this_nlb.arn
50+
port = "8080"
51+
protocol = "TCP"
52+
53+
default_action {
54+
type = "forward"
55+
target_group_arn = aws_lb_target_group.rpc.arn
56+
}
57+
}
58+
59+
resource "aws_lb_listener" "tls_rest" {
60+
count = local.enable_tls ? 1 : 0
61+
62+
load_balancer_arn = aws_lb.this_nlb.arn
63+
port = "443"
64+
protocol = "TLS"
65+
certificate_arn = local.tls_cert_arn
66+
ssl_policy = local.ssl_policy
67+
68+
default_action {
69+
type = "forward"
70+
target_group_arn = aws_lb_target_group.rest.arn
71+
}
72+
73+
depends_on = [
74+
aws_acm_certificate_validation.this_acm_cert_validation[0]
75+
]
76+
}
77+
78+
resource "aws_lb_listener" "tls_grpc" {
79+
count = local.enable_tls ? 1 : 0
80+
81+
load_balancer_arn = aws_lb.this_nlb.arn
82+
port = "8443"
83+
protocol = "TLS"
84+
certificate_arn = local.tls_cert_arn
85+
ssl_policy = local.ssl_policy
86+
87+
default_action {
88+
type = "forward"
89+
target_group_arn = aws_lb_target_group.grpc.arn
90+
}
91+
92+
depends_on = [
93+
aws_acm_certificate_validation.this_acm_cert_validation[0]
94+
]
95+
}
96+
97+
resource "aws_lb_listener" "tls_rpc" {
98+
count = local.enable_tls ? 1 : 0
99+
100+
load_balancer_arn = aws_lb.this_nlb.arn
101+
port = "26657"
102+
protocol = "TLS"
103+
certificate_arn = local.tls_cert_arn
104+
ssl_policy = local.ssl_policy
105+
106+
default_action {
107+
type = "forward"
108+
target_group_arn = aws_lb_target_group.rpc.arn
109+
}
110+
111+
depends_on = [
112+
aws_acm_certificate_validation.this_acm_cert_validation[0]
113+
]
114+
}
115+
116+
resource "aws_lb_target_group" "rest" {
117+
name = "observers-rest-target-group"
118+
port = 1317
119+
protocol = "TCP"
120+
vpc_id = module.this_vpc.vpc_id
121+
preserve_client_ip = false
122+
}
123+
124+
resource "aws_lb_target_group" "grpc" {
125+
name = "observers-grpc-target-group"
126+
port = 9090
127+
protocol = "TCP"
128+
vpc_id = module.this_vpc.vpc_id
129+
preserve_client_ip = false
130+
}
131+
132+
resource "aws_lb_target_group" "rpc" {
133+
name = "observers-rpc-target-group"
134+
port = 26657
135+
protocol = "TCP"
136+
vpc_id = module.this_vpc.vpc_id
137+
preserve_client_ip = false
138+
}
139+
140+
resource "aws_lb_target_group_attachment" "rest_targets" {
141+
count = length(aws_instance.this_nodes)
142+
143+
target_group_arn = aws_lb_target_group.rest.arn
144+
target_id = aws_instance.this_nodes[count.index].id
145+
port = 80
146+
}
147+
148+
resource "aws_lb_target_group_attachment" "grpc_targets" {
149+
count = length(aws_instance.this_nodes)
150+
151+
target_group_arn = aws_lb_target_group.grpc.arn
152+
target_id = aws_instance.this_nodes[count.index].id
153+
port = 9090
154+
}
155+
156+
resource "aws_lb_target_group_attachment" "rpc_targets" {
157+
count = length(aws_instance.this_nodes)
158+
159+
target_group_arn = aws_lb_target_group.rpc.arn
160+
target_id = aws_instance.this_nodes[count.index].id
161+
port = 26657
162+
}

‎deployment/terraform/aws/observers/locals.tf

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
locals {
2+
enable_tls = var.enable_tls && var.root_domain_name != ""
3+
}

‎deployment/terraform/aws/observers/main.tf

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
data "aws_ami" "ubuntu" {
2+
most_recent = true
3+
owners = ["099720109477"]
4+
5+
filter {
6+
name = "name"
7+
values = ["ubuntu-minimal/images/hvm-ssd/ubuntu-focal-20.04-amd64-minimal-*"]
8+
}
9+
10+
filter {
11+
name = "virtualization-type"
12+
values = ["hvm"]
13+
}
14+
}
15+
16+
resource "aws_key_pair" "key_pair" {
17+
public_key = file(var.ssh_public_key_path)
18+
}
19+
20+
resource "aws_instance" "this_nodes" {
21+
count = var.nodes_count
22+
23+
ami = data.aws_ami.ubuntu.id
24+
instance_type = "t3.medium"
25+
26+
subnet_id = element(module.this_vpc.public_subnets, count.index % length(module.this_vpc.public_subnets))
27+
vpc_security_group_ids = [
28+
module.this_dev_sg.security_group_id,
29+
module.this_private_sg.security_group_id
30+
]
31+
32+
key_name = aws_key_pair.key_pair.id
33+
monitoring = true
34+
35+
tags = {
36+
Name = "Observer Node [${count.index}]"
37+
}
38+
39+
root_block_device {
40+
encrypted = true
41+
volume_size = 30
42+
}
43+
}

‎deployment/terraform/aws/observers/outputs.tf

Whitespace-only changes.

‎deployment/terraform/aws/observers/provider.tf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
terraform {
2+
required_providers {
3+
aws = {
4+
source = "hashicorp/aws"
5+
version = ">= 3.72"
6+
configuration_aliases = [aws, aws.peer]
7+
}
8+
}
9+
}

‎deployment/terraform/aws/observers/route53.tf

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
locals {
2+
enable_routing = var.root_domain_name == "" ? 0 : 1
3+
}
4+
5+
data "aws_route53_zone" "this_zone" {
6+
count = local.enable_routing
7+
name = var.root_domain_name
8+
}
9+
10+
data "aws_region" "current" {}
11+
12+
resource "aws_route53_record" "on" {
13+
count = local.enable_routing
14+
15+
zone_id = data.aws_route53_zone.this_zone[0].zone_id
16+
name = "on.${data.aws_route53_zone.this_zone[0].name}"
17+
type = "CNAME"
18+
ttl = "300"
19+
20+
latency_routing_policy {
21+
region = data.aws_region.current.name
22+
}
23+
24+
set_identifier = "Observers NLB [${var.region_index}]"
25+
records = ["${aws_lb.this_nlb.dns_name}"]
26+
}

0 commit comments

Comments
 (0)