├── .gitignore
├── README.md
├── ansible.cfg
├── inventory
    ├── hosts
    └── terraform-inventory
├── main.tf
├── modules
    ├── do
    │   ├── main.tf
    │   └── variables.tf
    └── ec2
    │   ├── main.tf
    │   └── variables.tf
├── playbooks
    ├── example.yml
    └── roles
    │   ├── nginx-sites
    │       ├── handlers
    │       │   └── main.yml
    │       ├── tasks
    │       │   └── main.yml
    │       └── templates
    │       │   ├── index.html.j2
    │       │   └── sites-available.j2
    │   ├── nginx
    │       └── tasks
    │       │   └── main.yml
    │   └── ufw
    │       └── tasks
    │           └── main.yml
└── variables.tf


/.gitignore:
--------------------------------------------------------------------------------
1 | .terraform/
2 | *.tfstate
3 | *.tfstate.backup
4 | terraform.tfvars
5 | *.retry
6 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | # Terraform Scripts
  2 | 
  3 | ## Install
  4 | ```
  5 | brew install terraform
  6 | 
  7 | brew install ansible
  8 | brew install terraform-inventory
  9 | ```
 10 | 
 11 | ## Prerequisite 
 12 | 1. Create ~/.aws/credentials. Obtain keys from Profile -> "My Security Credentials"
 13 | ```
 14 | [default]
 15 | aws_access_key_id=<access_key_id>
 16 | aws_secret_access_key=<secret>
 17 | ```
 18 | 
 19 | 2. Create or copy a public-private key pair to access instances to `~/.ssh/terraform.pub`
 20 | ```
 21 | ssh-keygen -f ~/.ssh/terraform
 22 | ```
 23 | 
 24 | 3. Create `terraform.tfvars`
 25 | ```
 26 | cloudflare_email="<cloudflare_email>"
 27 | cloudflare_token="<cloudflare_token>" # From My Profile -> API Keys
 28 | do_token="<digital_ocean_token>" # From Manage -> API -> Tokens
 29 | ```
 30 | 
 31 | ## Usage 
 32 | 1. `terraform init`. This will download plugins needed.
 33 | 2. `terraform apply`. Will create/update/destroy EC2 instances as defined in `main.tf`
 34 | 
 35 | First execution plan will be shown
 36 | ```
 37 | An execution plan has been generated and is shown below.
 38 | Resource actions are indicated with the following symbols:
 39 |   + create
 40 | 
 41 | Terraform will perform the following actions:
 42 | 
 43 |   + aws_vpc.default
 44 |       id:                               <computed>
 45 |       arn:                              <computed>
 46 |       assign_generated_ipv6_cidr_block: "false"
 47 |       cidr_block:                       "10.0.0.0/16"
 48 |       default_network_acl_id:           <computed>
 49 |       default_route_table_id:           <computed>
 50 |       default_security_group_id:        <computed>
 51 |       dhcp_options_id:                  <computed>
 52 |       enable_classiclink:               <computed>
 53 |       enable_classiclink_dns_support:   <computed>
 54 |       enable_dns_hostnames:             <computed>
 55 |       enable_dns_support:               "true"
 56 |       instance_tenancy:                 "default"
 57 |       ipv6_association_id:              <computed>
 58 |       ipv6_cidr_block:                  <computed>
 59 |       main_route_table_id:              <computed>
 60 | 
 61 | 
 62 | Plan: 1 to add, 0 to change, 0 to destroy.
 63 | 
 64 | Do you want to perform these actions?
 65 |   Terraform will perform the actions described above.
 66 |   Only 'yes' will be accepted to approve.
 67 | 
 68 |   Enter a value: 
 69 | 
 70 | ```
 71 | 
 72 | Then it is applied after keyboard confirmation
 73 | 
 74 | ```
 75 |   Enter a value: yes
 76 | 
 77 | aws_vpc.default: Creating...
 78 |   arn:                              "" => "<computed>"
 79 |   assign_generated_ipv6_cidr_block: "" => "false"
 80 |   cidr_block:                       "" => "10.0.0.0/16"
 81 |   default_network_acl_id:           "" => "<computed>"
 82 |   default_route_table_id:           "" => "<computed>"
 83 |   default_security_group_id:        "" => "<computed>"
 84 |   dhcp_options_id:                  "" => "<computed>"
 85 |   enable_classiclink:               "" => "<computed>"
 86 |   enable_classiclink_dns_support:   "" => "<computed>"
 87 |   enable_dns_hostnames:             "" => "<computed>"
 88 |   enable_dns_support:               "" => "true"
 89 |   instance_tenancy:                 "" => "default"
 90 |   ipv6_association_id:              "" => "<computed>"
 91 |   ipv6_cidr_block:                  "" => "<computed>"
 92 |   main_route_table_id:              "" => "<computed>"
 93 | [aws_vpc.default: Creation complete after 6s (ID: vpc-080051c8aaca21b68)
 94 | 
 95 | Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
 96 | 
 97 | Outputs:
 98 | 
 99 | example01-ip = 44.252.122.77
100 | ```
101 | 
102 | Outputs we see are what is defined in the `output` block in `main.tf`
103 | 
104 | 3. ssh to the instance
105 | 
106 | We can query for it or use in the ssh script to the instance, or use DNS entry created by cloudflare.
107 | ```
108 | ❯❯❯ terraform output example01-ip
109 | 44.252.122.77
110 | ❯❯❯ ssh -i ~/.ssh/terraform ubuntu@`terraform output example01-ip`
111 | 
112 | ### DNS should work after a while
113 | ❯❯❯ ssh -i ~/.ssh/terraform ubuntu@example01.varokas.com
114 | 
115 | ```
116 | 
117 | 4. State of the execution is kept in `terraform.tfstate.*`. Check this in a repository to share system state with others.
118 | 
119 | ## Notes on using Ansible with Terraform
120 | * Ansible dynamic scripts downloaded from https://github.com/adammck/terraform-inventory via brew
121 | * Put it as default inventory source via `ansible.cfg`
122 | * ansible.cfg is configured to read files in inventory/ as inventory file, so we need to symlink from `/usr/local/bin/terraform-inventory`
123 | 
124 | ```
125 |  ❯❯❯ ansible all --list-hosts
126 |   hosts (1):
127 |     35.165.28.244
128 | 
129 |  ❯❯❯ ansible role_example --list-hosts
130 |   hosts (1):
131 |     35.165.28.244
132 | 
133 |  ❯❯❯ ansible-playbook playbooks/example.yml
134 | 
135 | PLAY [role_example] *********************************
136 | 
137 | TASK [Gathering Facts] ******************************
138 | ok: [35.162.30.126]
139 | 
140 | TASK [ufw : Enable Firewall and allow SSH] **********
141 | changed: [35.162.30.126]
142 | 
143 | PLAY RECAP ******************************************
144 | 35.162.30.126              : ok=2    changed=1    unreachable=0    failed=0  
145 | ```
146 | 
147 | ## Reference
148 | * https://github.com/terraform-providers/terraform-provider-aws/tree/master/examples/two-tier
149 | * https://docs.aws.amazon.com/cli/latest/userguide/cli-config-files.html
150 | * https://cloud-images.ubuntu.com/locator/ec2/
151 | * https://github.com/adammck/terraform-inventory
152 | * https://www.digitalocean.com/community/tutorials/how-to-install-nginx-on-ubuntu-18-04
153 | 


--------------------------------------------------------------------------------
/ansible.cfg:
--------------------------------------------------------------------------------
1 | [defaults]
2 | inventory=inventory/
3 | 


--------------------------------------------------------------------------------
/inventory/hosts:
--------------------------------------------------------------------------------
1 | [all:vars]
2 | ansible_user=ubuntu
3 | ansible_ssh_private_key_file=~/.ssh/terraform
4 | ansible_python_interpreter=/usr/bin/python3
5 | 


--------------------------------------------------------------------------------
/inventory/terraform-inventory:
--------------------------------------------------------------------------------
1 | /usr/local/bin/terraform-inventory


--------------------------------------------------------------------------------
/main.tf:
--------------------------------------------------------------------------------
1 | module "varokas_com" {
2 |   source  = "modules/do"
3 |   do_token = "${var.do_token}"
4 |   cloudflare_email = "${var.cloudflare_email}"
5 |   cloudflare_token = "${var.cloudflare_token}"
6 |   terraform_ssh_fingerprint = "${var.terraform_ssh_fingerprint}"
7 | }


--------------------------------------------------------------------------------
/modules/do/main.tf:
--------------------------------------------------------------------------------
 1 | provider "digitalocean" {
 2 |   token = "${var.do_token}"
 3 | }
 4 | 
 5 | provider "cloudflare" {
 6 |   email = "${var.cloudflare_email}"
 7 |   token = "${var.cloudflare_token}"
 8 | }
 9 | 
10 | resource "digitalocean_ssh_key" "terraform" {
11 |   name       = "terraform"
12 |   public_key = "${file(var.public_key_path)}"
13 | }
14 | 
15 | resource "digitalocean_droplet" "winter" {
16 |   image  = "ubuntu-18-04-x64"
17 |   name   = "winter"
18 |   region = "sfo2"
19 |   size   = "s-1vcpu-1gb"
20 |   backups = "true"
21 |   ssh_keys = ["${var.terraform_ssh_fingerprint}"]
22 | }
23 | 
24 | # Create DNS record on CloudFlare
25 | resource "cloudflare_record" "winter" {
26 |   domain = "varokas.com"
27 |   name   = "winter"
28 |   value  = "${digitalocean_droplet.winter.ipv4_address}"
29 |   type   = "A"
30 |   ttl    = 3600
31 | }


--------------------------------------------------------------------------------
/modules/do/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "public_key_path" {
 2 |   description = <<DESCRIPTION
 3 | Path to the SSH public key to be used for authentication.
 4 | Ensure this keypair is added to your local SSH agent so provisioners can
 5 | connect.
 6 | Example: ~/.ssh/terraform.pub
 7 | DESCRIPTION
 8 |   default = "~/.ssh/terraform.pub"
 9 | }
10 | 
11 | variable "do_token" {
12 |   description = "Digital Ocean access token"
13 | }
14 | 
15 | variable "cloudflare_email" { }
16 | variable "cloudflare_token" { } 
17 | variable "terraform_ssh_fingerprint" { }


--------------------------------------------------------------------------------
/modules/ec2/main.tf:
--------------------------------------------------------------------------------
  1 | provider "aws" {
  2 |   region = "us-west-2"
  3 | }
  4 | 
  5 | provider "cloudflare" {
  6 |   email = "${var.cloudflare_email}"
  7 |   token = "${var.cloudflare_token}"
  8 | }
  9 | 
 10 | # Define public key to be used to access instances
 11 | resource "aws_key_pair" "auth" {
 12 |   key_name   = "aws_key"
 13 |   public_key = "${file(var.public_key_path)}"
 14 | }
 15 | 
 16 | # Create VPC for instances
 17 | resource "aws_vpc" "default" {
 18 |   cidr_block = "10.0.0.0/16"
 19 | }
 20 | 
 21 | # Create an internet gateway to give our subnet access to the outside world
 22 | resource "aws_internet_gateway" "default" {
 23 |   vpc_id = "${aws_vpc.default.id}"
 24 | }
 25 | 
 26 | # Grant the VPC internet access on its main route table
 27 | resource "aws_route" "internet_access" {
 28 |   route_table_id         = "${aws_vpc.default.main_route_table_id}"
 29 |   destination_cidr_block = "0.0.0.0/0"
 30 |   gateway_id             = "${aws_internet_gateway.default.id}"
 31 | }
 32 | 
 33 | 
 34 | # Create a subnet from VPC to run instances
 35 | resource "aws_subnet" "default" {
 36 |   vpc_id                  = "${aws_vpc.default.id}" # lookup id from "aws_vpc" resource named "default" above
 37 |   cidr_block              = "10.0.1.0/24"
 38 |   map_public_ip_on_launch = true
 39 | }
 40 | 
 41 | # Create security group to allow ssh in and all outbound connections
 42 | resource "aws_security_group" "basic" {
 43 |   name        = "basic_security_group"
 44 |   description = "Allow SSH in and outbound internet access"
 45 |   vpc_id      = "${aws_vpc.default.id}"
 46 | 
 47 |   # SSH access from anywhere
 48 |   ingress {
 49 |     from_port   = 22
 50 |     to_port     = 22
 51 |     protocol    = "tcp"
 52 |     cidr_blocks = ["0.0.0.0/0"]
 53 |   }
 54 | 
 55 |   # outbound internet access
 56 |   egress {
 57 |     from_port   = 0
 58 |     to_port     = 0
 59 |     protocol    = "-1"
 60 |     cidr_blocks = ["0.0.0.0/0"]
 61 |   }
 62 | }
 63 | 
 64 | # Create security group to allow http and https
 65 | resource "aws_security_group" "https" {
 66 |   name        = "https_security_group"
 67 |   description = "Allow HTTP and HTTPs"
 68 |   vpc_id      = "${aws_vpc.default.id}"
 69 | 
 70 |   # HTTP access from anywhere
 71 |   ingress {
 72 |     from_port   = 80 
 73 |     to_port     = 80
 74 |     protocol    = "tcp"
 75 |     cidr_blocks = ["0.0.0.0/0"]
 76 |   }
 77 | 
 78 |   # HTTPs access from anywhere
 79 |   ingress {
 80 |     from_port   = 443
 81 |     to_port     = 443
 82 |     protocol    = "tcp"
 83 |     cidr_blocks = ["0.0.0.0/0"]
 84 |   }
 85 | }
 86 | 
 87 | 
 88 | # Create 1 instance of this name
 89 | resource "aws_instance" "example01" {
 90 |   instance_type = "t3.nano"
 91 |   ami = "${var.ubuntu_1804_uswest_2}" #Variable defined in variables.tf
 92 | 
 93 |   connection {
 94 |     user = "ubuntu"
 95 |   } 
 96 |   key_name = "${aws_key_pair.auth.id}"
 97 | 
 98 |   vpc_security_group_ids = ["${aws_security_group.basic.id}","${aws_security_group.https.id}"]
 99 |   subnet_id = "${aws_subnet.default.id}"
100 |   tags = { # These will be exposed to ansible as groups (e.g. role_example, env_dev)
101 |     role = "example"
102 |     env = "dev"
103 |   }
104 | }
105 | 
106 | # Create DNS record on CloudFlare
107 | resource "cloudflare_record" "example01" {
108 |   domain = "varokas.com"
109 |   name   = "example01"
110 |   value  = "${aws_instance.example01.public_ip}"
111 |   type   = "A"
112 |   ttl    = 3600
113 | }
114 | 
115 | # Define output that will print out when done and can be queried later
116 | # `terraform output example01-ip`
117 | output "example01-ip" {
118 |   value = "${aws_instance.example01.public_ip}"
119 | }
120 |     
121 | 


--------------------------------------------------------------------------------
/modules/ec2/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "public_key_path" {
 2 |   description = <<DESCRIPTION
 3 | Path to the SSH public key to be used for authentication.
 4 | Ensure this keypair is added to your local SSH agent so provisioners can
 5 | connect.
 6 | Example: ~/.ssh/terraform.pub
 7 | DESCRIPTION
 8 |   default = "~/.ssh/terraform.pub"
 9 | }
10 | 
11 | variable "ubuntu_1804_uswest_2" {
12 |   default = "ami-05705259d15c98ef1" #Ubuntu 18.04 AMI for us-west-02 region
13 | }
14 | 
15 | variable "cloudflare_email" { }
16 | variable "cloudflare_token" { } 
17 | 


--------------------------------------------------------------------------------
/playbooks/example.yml:
--------------------------------------------------------------------------------
1 | ---
2 | - hosts: role_example
3 |   vars:
4 |     domain_name: example01.varokas.com 
5 |   roles:
6 |     - ufw
7 |     - nginx
8 |     - nginx-sites


--------------------------------------------------------------------------------
/playbooks/roles/nginx-sites/handlers/main.yml:
--------------------------------------------------------------------------------
1 | - name: restart_nginx
2 |   become: yes
3 |   service: name=nginx state=restarted


--------------------------------------------------------------------------------
/playbooks/roles/nginx-sites/tasks/main.yml:
--------------------------------------------------------------------------------
 1 | ---
 2 | - name: Create domain directory
 3 |   become: yes
 4 |   file: 
 5 |     path: "/var/www/{{domain_name}}"
 6 |     state: directory
 7 |     owner: ubuntu
 8 |     group: ubuntu
 9 | 
10 | - name: Create domain site directory
11 |   become: yes
12 |   file: 
13 |     path: "/var/www/{{domain_name}}/html"
14 |     state: directory
15 |     owner: ubuntu
16 |     group: ubuntu
17 | 
18 | - name: Create index.html
19 |   template: 
20 |     src: "index.html.j2"
21 |     dest: "/var/www/{{domain_name}}/html/index.html"
22 | 
23 | - name: Create sites-available
24 |   become: yes
25 |   template: 
26 |     src: "sites-available.j2"
27 |     dest: "/etc/nginx/sites-available/{{domain_name}}"
28 |   notify:
29 |     - restart_nginx
30 | 
31 | - name: Create sites-enabled
32 |   become: yes
33 |   file:
34 |     src: "/etc/nginx/sites-available/{{domain_name}}"
35 |     dest: "/etc/nginx/sites-enabled/{{domain_name}}"
36 |     state: link
37 |   notify:
38 |     - restart_nginx
39 | 
40 | - name: Adjust hash bucket size
41 |   become: yes
42 |   lineinfile:
43 |     path: /etc/nginx/nginx.conf
44 |     regexp: '# server_names_hash_bucket_size 64;'
45 |     line: 'server_names_hash_bucket_size 64;'
46 |   notify:
47 |     - restart_nginx
48 | 


--------------------------------------------------------------------------------
/playbooks/roles/nginx-sites/templates/index.html.j2:
--------------------------------------------------------------------------------
1 | <html>
2 |     <head>
3 |         <title>Welcome to {{domain_name}}</title>
4 |     </head>
5 |     <body>
6 |         <h1>The {{domain_name}} server block is working!</h1>
7 |     </body>
8 | </html>


--------------------------------------------------------------------------------
/playbooks/roles/nginx-sites/templates/sites-available.j2:
--------------------------------------------------------------------------------
 1 | server {
 2 |     listen 80;
 3 |     listen [::]:80;
 4 | 
 5 |     root /var/www/{{domain_name}}/html;
 6 |     index index.html index.htm index.nginx-debian.html;
 7 | 
 8 |     server_name {{domain_name}};
 9 | 
10 |     location / {
11 |         try_files $uri $uri/ =404;
12 |     }
13 | }


--------------------------------------------------------------------------------
/playbooks/roles/nginx/tasks/main.yml:
--------------------------------------------------------------------------------
 1 | ---
 2 | - name: Install nginx
 3 |   become: yes
 4 |   apt: name=nginx state=present
 5 | 
 6 | - name: Firewall allow both HTTP and HTTPs
 7 |   become: yes
 8 |   ufw: rule=allow name="Nginx Full" state=enabled
 9 | 
10 | - name: Ensure nginx service started
11 |   become: yes
12 |   service: name=nginx state=started enabled=yes


--------------------------------------------------------------------------------
/playbooks/roles/ufw/tasks/main.yml:
--------------------------------------------------------------------------------
1 | ---
2 | - name: Enable Firewall and allow SSH
3 |   become: yes
4 |   ufw:
5 |     rule: allow
6 |     name: OpenSSH
7 |     state: enabled
8 | 


--------------------------------------------------------------------------------
/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "public_key_path" {
 2 |   description = <<DESCRIPTION
 3 | Path to the SSH public key to be used for authentication.
 4 | Ensure this keypair is added to your local SSH agent so provisioners can
 5 | connect.
 6 | Example: ~/.ssh/terraform.pub
 7 | DESCRIPTION
 8 |   default = "~/.ssh/terraform.pub"
 9 | }
10 | 
11 | variable "ubuntu_1804_uswest_2" {
12 |   default = "ami-05705259d15c98ef1" #Ubuntu 18.04 AMI for us-west-02 region
13 | }
14 | 
15 | variable "cloudflare_email" { }
16 | variable "cloudflare_token" { } 
17 | 
18 | variable "do_token" {
19 |   description = "Digital Ocean access token"
20 | }
21 | variable "terraform_ssh_fingerprint" { }


--------------------------------------------------------------------------------