131
}
resource "aws_security_group" "nginx" {
name = "nginx_sec_group_public"
description = "Security group for backend servers and private ELBs"
vpc_id = "${aws_vpc.vpc_main.id}"
# SSH access from anywhere
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
# HTTPS access from anywhere
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
# HTTP access from the anywhere
ingress {
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.0.0/16"]
}
# Allow all from private subnet
ingress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["${aws_subnet.private1.cidr_block}"]
}
# Outbound internet access
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
module "bastion" {
source = "bastion"
subnet_id = "${aws_subnet.public1.id}"
key_pair_id = "prod-eu-central-bastion-key"
security_group_id = "${aws_security_group.bastion.id}"
count = 1
group_name = "bastion"
132
}
module "nginx" {
source = "nginx"
subnet_id = "${aws_subnet.public1.id}"
key_pair_id = "prod-eu-central-bastion-keygit pu"
security_group_id = "${aws_security_group.nginx.id}"
// ami = "ami-0b4e8331acfc156ee"
count = 1
group_name = "nginx"
}
resource "aws_elb" "bastion" {
name = "elb-public-backend"
subnets = ["${aws_subnet.public1.id}", "${aws_subnet.public2.id}"]
security_groups = ["${aws_security_group.elb.id}"]
instances = ["${module.bastion.instance_ids}"]
listener {
instance_port = 22
instance_protocol = "TCP"
lb_port = 22
lb_protocol = "TCP"
}
health_check {
healthy_threshold = 2
unhealthy_threshold = 2
timeout = 3
target = "TCP:22"
interval = 30
}
}
# Public Frontend ELB
resource "aws_elb" "nginx" {
name = "elb-public-frontend"
subnets = ["${aws_subnet.public1.id}", "${aws_subnet.public2.id}"]
security_groups = ["${aws_security_group.elb.id}"]
instances = ["${module.nginx.instance_ids}"]
listener {
instance_port = 80
instance_protocol = "http"
lb_port = 80
lb_protocol = "http"
//ssl_certificate_id = false
}
health_check {
healthy_threshold = 2
unhealthy_threshold = 2
133
timeout = 3
target = "HTTP:80/healthcheck.php"
interval = 30
}
}
module "db" {
source = "rds"
identifier = "demodb"
engine = "postgres"
engine_version = "10.6"
instance_class = "db.t2.small"
allocated_storage = 5
storage_encrypted = false
multi_az = true
# kms_key_id = "arm:aws:kms:<region>:<account id>:key/<kms key id>"
name = "hapi"
username = "hapiuser"
password = "LongPassword"
port = "5432"
vpc_security_group_ids = ["${aws_security_group.elb.id}"]
maintenance_window = "Mon:00:00-Mon:03:00"
backup_window = "03:00-06:00"
# disable backups to create DB faster
backup_retention_period = 0
tags = {
Owner = "user"
Environment = "prod-eu"
Name = "${var.environment_name}-Postrges-DB-Instance"
VPC = "${aws_vpc.vpc_main.id}"
ManagedBy = "terraform"
Environment = "${var.environment_name}"
}
# DB subnet group
subnet_ids = ["${aws_subnet.private1.id}","${aws_subnet.private2.id}"]
# DB parameter group
family = "postgres10"
# DB option group
major_engine_version = "10.6"
# Snapshot name upon DB deletion
final_snapshot_identifier = "hapidb"
# Database Deletion Protection
deletion_protection = false
}
Модуль Terraform для Nginx сервера
resource "aws_instance" "instance" {
count = "${var.count}"
134
instance_type = "${var.instance_type}"
ami = "${lookup(var.aws_amis, var.aws_region)}"
key_name = "${var.key_pair_id}"
vpc_security_group_ids = ["${var.security_group_id}"]
subnet_id = "${var.subnet_id}"
root_block_device {
volume_size = "${var.disk_size}"
}
tags {
Name = "${format("%s%02d", var.group_name, count.index + 1)}" # -> "backend02"
Group = "${var.group_name}"
}
lifecycle {
create_before_destroy = true
}
# Provisioning
connection {
user = "ubuntu"
private_key = "${file(var.private_key_path)}"
agent = false
}
provisioner "remote-exec" {
inline = [
"sudo apt-get -y update",
]
}
}
Создание модуля Terraform для базы данных AWS RDS
locals {
db_subnet_group_name = "${coalesce(var.db_subnet_group_name,
module.db_subnet_group.this_db_subnet_group_id)}"
enable_create_db_subnet_group = "${var.db_subnet_group_name == "" ?
var.create_db_subnet_group : 0}"
parameter_group_name = "${coalesce(var.parameter_group_name,
module.db_parameter_group.this_db_parameter_group_id)}"
enable_create_db_parameter_group = "${var.parameter_group_name == "" ?
var.create_db_parameter_group : 0}"
option_group_name = "${coalesce(var.option_group_name,
module.db_option_group.this_db_option_group_id)}"
enable_create_db_option_group = "${var.option_group_name == "" && var.engine !=
"postgres" ? var.create_db_option_group : 0}"
}
module "db_subnet_group" {
135
source = "./modules/db_subnet_group"
create = "${local.enable_create_db_subnet_group}"
identifier = "${var.identifier}"
name_prefix = "${var.identifier}-"
subnet_ids = ["${var.subnet_ids}"]
tags = "${var.tags}"
}
module "db_parameter_group" {
source = "./modules/db_parameter_group"
create = "${local.enable_create_db_parameter_group}"
identifier = "${var.identifier}"
name_prefix = "${var.identifier}-"
family = "${var.family}"
parameters = ["${var.parameters}"]
tags = "${var.tags}"
}
module "db_option_group" {
source = "./modules/db_option_group"
create = "${local.enable_create_db_option_group}"
identifier = "${var.identifier}"
name_prefix = "${var.identifier}-"
option_group_description = "${var.option_group_description}"
engine_name = "${var.engine}"
major_engine_version = "${var.major_engine_version}"
options = ["${var.options}"]
tags = "${var.tags}"
}
module "db_instance" {
source = "./modules/db_instance"
create = "${var.create_db_instance}"
identifier = "${var.identifier}"
engine = "${var.engine}"
engine_version = "${var.engine_version}"
instance_class = "${var.instance_class}"
allocated_storage = "${var.allocated_storage}"
storage_type = "${var.storage_type}"
storage_encrypted = "${var.storage_encrypted}"
kms_key_id = "${var.kms_key_id}"
license_model = "${var.license_model}"
name = "${var.name}"
username = "${var.username}"
136
password = "${var.password}"
port = "${var.port}"
iam_database_authentication_enabled = "${var.iam_database_authentication_enabled}"
replicate_source_db = "${var.replicate_source_db}"
snapshot_identifier = "${var.snapshot_identifier}"
vpc_security_group_ids = ["${var.vpc_security_group_ids}"]
db_subnet_group_name = "${local.db_subnet_group_name}"
parameter_group_name = "${local.parameter_group_name}"
option_group_name = "${local.option_group_name}"
availability_zone = "${var.availability_zone}"
multi_az = "${var.multi_az}"
iops = "${var.iops}"
publicly_accessible = "${var.publicly_accessible}"
allow_major_version_upgrade = "${var.allow_major_version_upgrade}"
auto_minor_version_upgrade = "${var.auto_minor_version_upgrade}"
apply_immediately = "${var.apply_immediately}"
maintenance_window = "${var.maintenance_window}"
skip_final_snapshot = "${var.skip_final_snapshot}"
copy_tags_to_snapshot = "${var.copy_tags_to_snapshot}"
final_snapshot_identifier = "${var.final_snapshot_identifier}"
backup_retention_period = "${var.backup_retention_period}"
backup_window = "${var.backup_window}"
monitoring_interval = "${var.monitoring_interval}"
monitoring_role_arn = "${var.monitoring_role_arn}"
monitoring_role_name = "${var.monitoring_role_name}"
create_monitoring_role = "${var.create_monitoring_role}"
timezone = "${var.timezone}"
character_set_name = "${var.character_set_name}"
enabled_cloudwatch_logs_exports = "${var.enabled_cloudwatch_logs_exports}"
timeouts = "${var.timeouts}"
deletion_protection = "${var.deletion_protection}"
tags = "${var.tags}"
}
Создание серверов для инфраструктуры
resource "aws_instance" "instance" {
count = "${var.count}"
instance_type = "${var.instance_type}"
ami = "${lookup(var.aws_amis, var.aws_region)}"
key_name = "${var.key_pair_id}"
vpc_security_group_ids = ["${var.security_group_id}"]
137
subnet_id = "${var.subnet_id}"
root_block_device {
volume_size = "${var.disk_size}"
}
tags {
Name = "${format("%s%02d", var.group_name, count.index + 1)}" # -> "backend02"
Group = "${var.group_name}"
}
lifecycle {
create_before_destroy = true
}
# Provisioning
connection {
user = "ec2-user"
private_key = "${file(var.private_key_path)}"
agent = false
}
provisioner "remote-exec" {
inline = [
"sudo yum -y update",
]
}
}
Управление конфигурацией Nginx сервера с помощью Ansible
---
# tasks file for nginx.hapi
- name: Update and upgrade apt packages
become: true
apt:
upgrade: yes
update_cache: yes
cache_valid_time: 86400
- name: Ensure group "nginx" exists
group:
name: nginx
state: present
- name: Add user "nginx"
user:
name: nginx
groups: nginx
shell: /sbin/nologin
append: yes
comment: "Nginx nologin User"
state: present
become: true
138
- name: Clean artifact path
file:
state: absent
path: /etc/nginx/
become: yes
- name: copy the nginx config files
copy:
src: ../../../nginx/config/{{ nginx.env }}/nginx/
dest: /etc/nginx
force: True
become: yes
- name: Check NGINX configs
shell: "/usr/sbin/nginx -t"
register: nginx_config_status
- name: NGINX test full status
debug:
msg: "{{ nginx_config_status }}"
- name: NGINX test status RC
debug:
msg: "{{ nginx_config_status.rc }}"
- name: Service NGINX restart and enable on boot
systemd:
name: nginx
state: restarted
enabled: yes
daemon_reload: yes
when: nginx_config_status.rc == 0
- name: Creates directory aws-es-proxy
file:
path: /opt/aws-es-proxy/
state: directory
owner: ubuntu
group: ubuntu
mode: 0775
- name: download sources
get_url:
url: https://github.com/abutaha/aws-es-proxy/releases/download/v0.9/aws-es-proxy-
0.9-linux-amd64
dest: /opt/aws-es-proxy/aws-es-proxy-0.9-linux-amd64
owner: ubuntu
mode: a+x
- name: Create AWS ES proxy configuration.
template:
src: "{{ item }}.j2"
dest: "/opt/aws-es-proxy/{{ item }}"
owner: ubuntu
139
group: ubuntu
mode: a+x
with_items:
- proxy-service.sh
- name: Creates directory for logs AWS ES proxy
file:
path: /var/log/aws-es-proxy/
state: directory
owner: ubuntu
group: ubuntu
mode: 0775
notify: restart awsproxy
- name: Install Monit.
apt:
name: monit
state: present
- name: Create Monit configuration.
template:
src: "{{ item }}.j2"
dest: "/etc/monit/conf.d/awsproxy"
owner: ubuntu
group: ubuntu
mode: a+x
with_items:
- awsproxy
notify: restart monit
- name: Create Logrotate configuration.
template:
src: "{{ item }}.j2"
dest: "/etc/logrotate.d/nginx"
owner: root
group: root
mode: 0644
with_items:
- nginx
notify: restart logrotate
Конфигурирование Logstash сервера для пересылки и обработки
логов
---
- name: HTTPS APT transport for Elasticsearch repository.
apt:
name: apt-transport-https
state: present
- name: Add Elasticsearch apt key.
apt_key:
url: https://artifacts.elastic.co/GPG-KEY-elasticsearch
140
state: present
- name: Add Logstash repository.
apt_repository:
repo: 'deb https://artifacts.elastic.co/packages/{{ logstash_version }}/apt stable main'
state: present
- name: Check if Logstash is already installed.
stat: path=/etc/init.d/logstash
register: logstash_installed
- name: Update apt cache if repository just added.
apt: update_cache=yes
when: logstash_installed.stat.exists == false
- name: Install Logstash.
apt:
name: logstash
state: present
- name: Add Logstash user to adm group (Debian).
user:
name: logstash
group: logstash
groups: adm
notify: restart logstash
- name: Add Logstash user to adm group (Debian).
user:
name: logstash
group: logstash
groups: admin
notify: restart logstash
---
- name: Creates directory aws_filebeat
file:
path: /etc/logstash/aws_filebeat/
state: directory
owner: logstash
group: logstash
mode: 0775
- name: Creates directory aws_logstash
file:
path: /etc/logstash/aws_logstash/
state: directory
owner: logstash
group: logstash
mode: 0775
- name: Creates directory aws_opsgenie