├── .gitignore ├── LICENSE ├── Makefile ├── README.md ├── Vagrantfile ├── ansible ├── roles │ ├── common │ │ ├── tasks │ │ │ ├── main.yml │ │ │ ├── packages.yml │ │ │ ├── services.yml │ │ │ └── slack.yml │ │ └── templates │ │ │ ├── ec2tags.sh.j2 │ │ │ ├── path.sh.j2 │ │ │ ├── prompt.sh.j2 │ │ │ ├── slack.j2 │ │ │ └── slack_ssh_notify.j2 │ ├── datadog │ │ ├── CHANGELOG.md │ │ ├── README.md │ │ ├── defaults │ │ │ └── main.yml │ │ ├── handlers │ │ │ └── main.yml │ │ ├── meta │ │ │ └── main.yml │ │ ├── tasks │ │ │ ├── checks.yml │ │ │ ├── main.yml │ │ │ └── pkg-redhat.yml │ │ └── templates │ │ │ ├── checks.yaml.j2 │ │ │ ├── datadog.conf.j2 │ │ │ ├── datadog.repo.j2 │ │ │ └── process.yaml.j2 │ ├── loggly │ │ ├── LICENSE │ │ ├── README.md │ │ ├── defaults │ │ │ └── main.yml │ │ ├── handlers │ │ │ └── main.yml │ │ ├── meta │ │ │ └── main.yml │ │ ├── tasks │ │ │ ├── CentOS.yml │ │ │ ├── Ubuntu.yml │ │ │ └── main.yml │ │ ├── templates │ │ │ ├── 22-loggly.conf.j2 │ │ │ └── loggly_full.crt.j2 │ │ └── vars │ │ │ ├── CentOS.yml │ │ │ ├── Ubuntu.yml │ │ │ └── main.yml │ ├── newrelic │ │ ├── defaults │ │ │ └── main.yml │ │ ├── handlers │ │ │ └── main.yml │ │ ├── tasks │ │ │ └── main.yml │ │ └── templates │ │ │ ├── newrelic.cfg.j2 │ │ │ ├── newrelic.ini.j2 │ │ │ └── newrelic.repo.j2 │ ├── nginx │ │ ├── handlers │ │ │ └── main.yml │ │ ├── tasks │ │ │ ├── main.yml │ │ │ └── vhost.yml │ │ └── templates │ │ │ ├── 21-nginx-loggly.conf.j2 │ │ │ ├── nginx.conf.j2 │ │ │ └── wp.conf.j2 │ ├── php-fpm │ │ ├── handlers │ │ │ └── main.yml │ │ ├── tasks │ │ │ └── main.yml │ │ └── templates │ │ │ └── wordpress.conf.j2 │ ├── rsyslog │ │ ├── .travis.yml │ │ ├── LICENSE │ │ ├── README.md │ │ ├── defaults │ │ │ └── main.yml │ │ ├── handlers │ │ │ └── main.yml │ │ ├── meta │ │ │ └── main.yml │ │ ├── tasks │ │ │ ├── CentOS.yml │ │ │ ├── Ubuntu.yml │ │ │ ├── logs.yml │ │ │ └── main.yml │ │ ├── templates │ │ │ ├── app.conf.j2 │ │ │ └── rsyslog.conf.j2 │ │ ├── tests │ │ │ ├── inventory │ │ │ └── test.yml │ │ └── vars │ │ │ ├── CentOS.yml │ │ │ ├── Ubuntu.yml │ │ │ └── main.yml │ └── wordpress │ │ ├── tasks │ │ └── main.yml │ │ └── templates │ │ └── deploy_wordpress.j2 └── wp.yml ├── examples ├── advanced.tf ├── basic-with-fastly-statuscake.tf ├── basic-with-fastly.tf ├── basic-with-statuscake.tf ├── basic.tf └── no-rds.tf ├── mikado.conf.example ├── packer └── wp.json ├── resources └── mikado-infra.png ├── scripts ├── aws_data.sh ├── deploy_ami.sh ├── install.py ├── install.yaml ├── mikado-boom └── yamlordereddictloader.py └── terraform ├── asg ├── asg.tf ├── elb.tf ├── iam.tf ├── output.tf ├── sg.tf ├── variables.tf └── watches.tf ├── base.tf ├── base_3rdparty.tf ├── cloudtrail └── cloudtrail.tf ├── datadog └── datadog.tf ├── efs └── efs.tf ├── loggly └── loggly.tf ├── sg └── sg.tf ├── variables.tf ├── vpc ├── tf_aws_vpc │ ├── .gitignore │ ├── LICENSE │ ├── README.md │ ├── main.tf │ ├── outputs.tf │ └── variables.tf └── vpc.tf ├── wp-fastly ├── fastly.tf ├── fastly_service.vcl ├── provider.tf ├── r53.tf ├── s3.tf ├── sg.tf └── variables.tf ├── wp-statuscake └── statuscake.tf └── wp ├── ami.tf ├── asg.tf ├── r53.tf ├── rds.tf ├── sg.tf └── variables.tf /.gitignore: -------------------------------------------------------------------------------- 1 | *.mk 2 | terraform.tfstate* 3 | terraform.tfplan 4 | .tfplan 5 | .terraform 6 | .packer-out.log 7 | .vagrant 8 | terraform/wpexample.com.tf 9 | terraform-error-1480468042.log 10 | .mikado 11 | mikado.conf 12 | mikado.conf.dev 13 | __pycache__ 14 | *.pyc 15 | .DS_Store 16 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2016 Nandor Sivok 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /Makefile: -------------------------------------------------------------------------------- 1 | .PHONY: build-ami deploy-ami plan apply destroy graph clean 2 | 3 | -include .mikado.conf.mk 4 | -include .aws_data.mk 5 | 6 | .mikado.conf.mk: 7 | @cat mikado.conf | sed 's/"//g ; s/=/:=/' > .mikado.conf.mk 8 | 9 | .aws_data.mk: 10 | @bash ./scripts/aws_data.sh | sed 's/"//g ; s/=/:=/' > .aws_data.mk 11 | 12 | update: 13 | @terraform get ./terraform 14 | 15 | build-ami: 16 | @packer build packer/wp.json 2>&1 | tee .packer-out.log 17 | @$(MAKE) clean 18 | 19 | deploy-ami: 20 | @bash ./scripts/deploy_ami.sh 21 | @$(MAKE) clean 22 | 23 | # This target executes the terraform plan stage 24 | # This will not change anything in you AWS setup only displays the changes 25 | plan: update 26 | @terraform plan \ 27 | -out ./.tfplan \ 28 | ./terraform 29 | 30 | # Once you happy with the output of make plan run this target 31 | # This will change your remote resources 32 | apply: plan 33 | @while [ -z "$$CONTINUE" ]; do \ 34 | read -r -p "Dow you want to apply these changes? [y/N] " CONTINUE; \ 35 | done ; \ 36 | if [ ! $$CONTINUE == "y" ]; then \ 37 | if [ ! $$CONTINUE == "Y" ]; then \ 38 | echo "Exiting." ; exit 1 ; \ 39 | fi \ 40 | fi 41 | @terraform apply \ 42 | ./terraform 43 | @$(MAKE) -s clean 44 | 45 | graph: update 46 | @terraform graph \ 47 | -draw-cycles ./terraform | dot -Tpng > graph.png 48 | @$(MAKE) -s clean 49 | 50 | # Don't run this 51 | destroy: update 52 | @terraform plan -destroy -out ./terraform.tfplan ./terraform/ 53 | @terraform apply ./terraform.tfplan 54 | @$(MAKE) -s clean 55 | 56 | clean: 57 | @rm -rf ./.tmp 58 | @rm -rf ./.terraform 59 | @rm -f ./.mikado.conf.mk 60 | @rm -f ./.aws_data.mk 61 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Mikado 2 | 3 | 4 | ## Intro 5 | 6 | Mikado helps managing your AWS infrastructure for WordPress sites by defining an out-of-box, highly available, easy-to-deploy setup. 7 | 8 | The project goals are: 9 | - Provide an oversimplified but flexible and resilient one-click WordPress deployment 10 | - Create a widely used standardized WordPress infrastructure 11 | - Implement performance, security and infrastructure best practices 12 | - Have automated, auditable, and idempotent configuration 13 | 14 | 15 | ## Overview 16 | 17 | Mikado provides a fully automated way to deploy and maintain your infrastructure built with [Terraform](https://terraform.io/) and [Packer](https://packer.io/) + [Ansible](https://www.ansible.com/) with the following services integrated optionally: 18 | 19 | - [Fastly](https://fastly.com/) - CDN 20 | - [Statuscake](https://statuscake.com/) - external monitoring 21 | - [Datadog](http://datadog.com/) - server monitoring & AWS resource monitoring 22 | - [Loggly](https://loggly.com/) - remote log collection 23 | - [Newrelic](https://newrelic.com/) - application monitoring 24 | 25 | ## Infrastructure overview 26 | 27 | ![Mikado overview](https://github.com/dominis/mikado/blob/master/resources/mikado-infra.png) 28 | 29 | - Mikado will create its own VPC with public and private subnets in all the available Availability Zones in the selected region - providing a geo-redundant highly-available setup 30 | - The WordPress site will be deployed to an Multi-AZ Auto scaling group with a set of pre-defined but fine tunable up/down scaling rules 31 | - Uploaded assets are stored on an EFS drive 32 | - A Multi-AZ RDS cluster is used in the database layer 33 | - Route53 used to manage DNS for the site 34 | - Optionally you can deploy a Fastly service for your site to cache all your requests. 35 | 36 | ## Quick start 37 | 38 | ``` 39 | curl -s https://raw.githubusercontent.com/dominis/mikado/master/scripts/mikado-boom > /tmp/mikado-boom ; bash /tmp/mikado-boom 40 | ``` 41 | 42 | Mikado provides a Vagrant instance for local development with all the dependencies installed. 43 | 44 | Also a dialog based installer provided. 45 | 46 | ![mikado](https://cloud.githubusercontent.com/assets/157738/21269257/54795560-c3b2-11e6-90d9-8432dcb38e01.gif) 47 | 48 | ### Manual setup 49 | 50 | If you don't want to use the installer or you want more control of what's happening you can run the following steps: 51 | 52 | ``` 53 | git clone https://github.com/dominis/mikado.git 54 | cd mikado 55 | 56 | # create your configuration 57 | cp mikado.conf.example mikado.conf 58 | vi mikado.conf 59 | 60 | # now you can build the base infra 61 | # this will create a VPC with subnets, IAM roles, trusted SG, EFS storage for the uploads 62 | # more info in terraform/base*.tf 63 | # NB terraform always called through make because of the config 64 | make apply 65 | 66 | 67 | # the next step is building your first AMI 68 | # this image will be used in the Auto Scaling Group 69 | make build-ami 70 | 71 | # at this point you need to deploy this AMI to your production ASG 72 | # this step is only needed because you need an AMI id to be able to create the ASG 73 | # in the future you can create a new AMI and only deploy it to the test ASG 74 | # more info at: https://github.com/dominis/mikado#working-with-amis 75 | make deploy-ami 76 | 77 | # go to the examples directory and find a config suitable for you 78 | cp examples/basic.tf terraform/mydomain.tf 79 | sed -i -e "s|###DOMAIN###|mydomain.com|g" terraform/mydomain.tf 80 | 81 | make apply 82 | 83 | # Apply complete! Resources: 45 added, 0 changed, 0 destroyed. 84 | # 👏 🍾 85 | ``` 86 | 87 | 88 | 89 | ### Deploying your website 90 | 91 | Mikado has a very simple automated deploy workflow based on git and branches. 92 | 93 | You need to set the `site_repo` variable in your `mikado.conf` file in the following format: `https://YOUR_GITHUB_OAUTH_TOKEN:x-oauth-basic@github.com/YOUR_GITHUB_USER/wordpress.example.com.git` 94 | 95 | [More info on the token creation](https://help.github.com/articles/creating-an-access-token-for-command-line-use/) 96 | 97 | 98 | Take a look at the [example repository](https://github.com/dominis/wordpress.example.com). The simplest way to start is forking this repo. 99 | 100 | #### Important information about the WordPress deploy process: 101 | 102 | - `develop` branch will be deployed to the test server 103 | - `production` branch will be deployed to the prod server 104 | - the `wp-contents/uploads` directory should be ignored in the `.gitignore` and shouldn't exists in the repo, a symlink is created pointing to the EFS mount here automatically 105 | - for the test/prod database config check out the [wp-config.php](https://github.com/dominis/wordpress.example.com/blob/develop/wp-config-sample.php#L32-L36) 106 | - [this is the script](https://github.com/dominis/mikado/blob/master/ansible/roles/wordpress/templates/deploy_wordpress.j2) which pulls the changes from git every minute on the instances 107 | 108 | ### Working with AMIs 109 | 110 | With `make build-ami` you can generate new AMIs and with running `make apply` the latest AMI will be rolled out to the `test` ASG. 111 | 112 | If you happy with the result on your test site you can run `make deploy-ami` to tag the AMI as production ready and with `make apply` you can initiate a rolling update on your production ASG. 113 | 114 | ## FAQ 115 | 116 | - Q: How can I ssh to my instances 117 | - A: Both the test and prod ELB exposes ssh for the IP blocks in the internal SG (TF_VAR_allowed_cidrs env var), so you can simply `ssh ec2-user@origin.domain.com` or `ssh ec2-user@test.domain.com`. 118 | 119 | 120 | - Q: The following error is thrown during `vagrant up`: 121 | _The box 'bento/centos-7.1' could not be found or could not be accessed in the remote catalog. If this is a private box on HashiCorp's Atlas, please verify you're logged in via `vagrant login`. Also, please double-check the name. The expanded URL and error message are shown below:_ (sic!) 122 | - A: On version 1.8.7 the embedded curl Vagrant uses had a [bug](https://github.com/mitchellh/vagrant/issues/7969). 123 | Workaround for v1.8.7: `sudo rm -rf /opt/vagrant/embedded/bin/curl` 124 | Or, update Vagrant to v1.8.8 125 | 126 | ## Mailing list 127 | 128 | https://groups.google.com/forum/#!forum/mikado-dev 129 | -------------------------------------------------------------------------------- /Vagrantfile: -------------------------------------------------------------------------------- 1 | # -*- mode: ruby -*- 2 | # vi: set ft=ruby : 3 | 4 | VAGRANTFILE_API_VERSION = "2" 5 | UBUNTUVERSION = "16.04" 6 | CPUCOUNT = "2" 7 | RAM = "4096" 8 | 9 | $script = <