Skip to content

Commit c14524e

Browse files
sgtojsgtoj
committed
feat: add terraform module code with ci for versioning
1 parent 5f7fecb commit c14524e

16 files changed

+1033
-1
lines changed

‎.editorconfig

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
[*]
2+
indent_style = space
3+
indent_size = 2
4+
end_of_line = lf
5+
insert_final_newline = true
6+
trim_trailing_whitespace = true
7+
charset = utf-8
8+
9+
[{Dockerfile,Dockerfile.*}]
10+
indent_size = 4
11+
tab_width = 4
12+
13+
[{Makefile,makefile,GNUmakefile}]
14+
indent_style = tab
15+
indent_size = 4
16+
17+
[Makefile.*]
18+
indent_style = tab
19+
indent_size = 4
20+
21+
[**/*.{go,mod,sum}]
22+
indent_style = tab
23+
indent_size = unset
24+
25+
[**/*.py]
26+
indent_size = 4

‎.github/.dependabot.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "daily"

‎.github/workflows/release.yml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: release
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
permissions:
9+
contents: write
10+
11+
jobs:
12+
release:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout Code
16+
uses: actions/checkout@v3
17+
- name: Bump Version
18+
id: tag_version
19+
uses: mathieudutour/[email protected]
20+
with:
21+
github_token: ${{ secrets.GITHUB_TOKEN }}
22+
default_bump: minor
23+
custom_release_rules: bug:patch:Fixes,chore:patch:Chores,docs:patch:Documentation,feat:minor:Features,refactor:minor:Refactors,test:patch:Tests,ci:patch:Development,dev:patch:Development
24+
- name: Create Release
25+
uses: ncipollo/[email protected]
26+
with:
27+
tag: ${{ steps.tag_version.outputs.new_tag }}
28+
name: ${{ steps.tag_version.outputs.new_tag }}
29+
body: ${{ steps.tag_version.outputs.changelog }}

‎.github/workflows/semantic-check.yml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: semantic-check
2+
on:
3+
pull_request_target:
4+
types:
5+
- opened
6+
- edited
7+
- synchronize
8+
9+
permissions:
10+
contents: read
11+
pull-requests: read
12+
13+
jobs:
14+
main:
15+
name: Semantic Commit Message Check
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout Code
19+
uses: actions/checkout@v3
20+
- uses: amannn/[email protected]
21+
name: Check PR for Semantic Commit Message
22+
env:
23+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
24+
with:
25+
requireScope: false
26+
validateSingleCommit: true

‎.github/workflows/test.yml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: test
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
8+
jobs:
9+
test:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Checkout Code
13+
uses: actions/checkout@v3
14+
- name: Terraform Setup
15+
run: |
16+
terraform init
17+
- name: Lint Terraform
18+
uses: reviewdog/action-tflint@master
19+
with:
20+
github_token: ${{ secrets.github_token }}
21+
filter_mode: "nofilter"

‎README.md

+73-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,73 @@
1-
# terraform-aws-network-protocol-proxy
1+
# terraform-aws-network-protocol-proxy
2+
3+
This terraform module provisions a simple, scalable tcp proxy based on haproxy.
4+
It deploys an EC2 autoscaling group behind a network load balancer (NLB), sets
5+
up cloudwatch logging, optionally configures a vpc endpoint service, and
6+
provides a configurable way to forward tcp traffic to any specified backend
7+
target.
8+
9+
## how it works
10+
11+
- an ec2 autoscaling group is created, each instance running haproxy
12+
- a network load balancer routes incoming traffic on tcp ports you define
13+
- haproxy listens on the same ports and forwards traffic to your backend
14+
target(s)
15+
- security group rules are created to allow ingress on the listener port from
16+
allowed cidrs
17+
- optional vpc endpoint service can be created if you need a private service endpoint
18+
19+
## usage
20+
21+
```hcl
22+
module "network_protocol_proxy" {
23+
source = "cruxstack/network-protocol-proxy/aws"
24+
version = "x.x.x"
25+
26+
name = "database-proxy"
27+
vpc_id = "vpc-1234567890abcdef"
28+
vpc_public_subnet_ids = ["subnet-1234abcd", "subnet-5678efgh"]
29+
vpc_private_subnet_ids = ["subnet-1234abcd", "subnet-5678efgh"]
30+
vpc_pr
31+
32+
proxies = {
33+
default = {
34+
target = "10.0.1.10:5432"
35+
listener_port = 10432
36+
listener_allowed_cidrs = [
37+
{
38+
cidr = "0.0.0.0/0"
39+
description = "allow all inbound for testing"
40+
}
41+
]
42+
}
43+
}
44+
}
45+
```
46+
47+
## inputs
48+
49+
| name | type | default | description |
50+
|--------------------------|--------------|---------|--------------------------------------------------------------|
51+
| `enabled` | bool | `true` | enable or disable the module |
52+
| `proxies` | object(...) | n/a | configuration for one or more haproxy proxies |
53+
| `capacity` | object(...) | `{}` | autoscaling desired, min, max settings |
54+
| `logs_bucket_name` | string | `""` | s3 bucket name for logs |
55+
| `ssm_sessions` | object(...) | `{}` | enable session manager logging |
56+
| `public_accessible` | bool | `false` | set to true to place the nlb in public subnets |
57+
| `eip_allocation_ids` | list(string) | `[]` | list of eip allocation ids for the nlb |
58+
| `vpc_id` | string | n/a | id of the vpc |
59+
| `vpc_private_subnet_ids` | list(string) | `[]` | list of private subnet ids |
60+
| `vpc_public_subnet_ids` | list(string) | `[]` | list of public subnet ids |
61+
| `vpc_security_group_ids` | list(string) | `[]` | additional security group ids to attach to the instances |
62+
| `vpc_endpoint_service` | object(...) | `{}` | configuration for optionally creating a vpc endpoint service |
63+
| `aws_account_id` | string | n/a | your aws account id |
64+
| `aws_kv_namespace` | string | n/a | your aws k/v namespace |
65+
| `aws_region_name` | string | n/a | the aws region |
66+
| `experimental_mode` | bool | n/a | toggles extra debug or development settings |
67+
68+
## outputs
69+
70+
| name | description |
71+
|-----------------|--------------------------------------|
72+
| `nlb_dns_name` | the dns name of the network lb (nlb) |
73+

‎assets/cloud-config.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#cloud-config
2+
packages:
3+
- amazon-cloudwatch-agent
4+
package_update: true
5+
package_upgrade: true
6+
write_files:
7+
- path: /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d/user.json
8+
content: ${cloudwatch_agent_config_encoded}
9+
encoding: base64
10+
permissions: "0644"
11+
power_state:
12+
delay: now
13+
mode: reboot
14+
timeout: 10
15+

‎assets/cloudwatch-agent-config.json

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"agent": {
3+
"run_as_user": "cwagent"
4+
},
5+
"logs": {
6+
"logs_collected": {
7+
"files": {
8+
"collect_list": [
9+
{
10+
"file_path": "/opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.log",
11+
"log_group_name": "${log_group_name}",
12+
"log_stream_name": "/ec2/instance/{instance_id}/amazon-cloudwatch-agent.log",
13+
"timestamp_format": "%Y-%m-%dT%H:%M:%SZ"
14+
},
15+
{
16+
"file_path": "/var/log/dmesg",
17+
"log_group_name": "${log_group_name}",
18+
"log_stream_name": "/ec2/instance/{instance_id}/dmesg"
19+
},
20+
{
21+
"file_path": "/var/log/messages",
22+
"log_group_name": "${log_group_name}",
23+
"log_stream_name": "/ec2/instance/{instance_id}/messages",
24+
"timestamp_format": "%b %d %H:%M:%S"
25+
},
26+
{
27+
"file_path": "/var/log/cloud-init.log",
28+
"log_group_name": "${log_group_name}",
29+
"log_stream_name": "/ec2/instance/{instance_id}/cloud-init.log",
30+
"multi_line_start_pattern": "\\w+ \\d{2} \\d{2}:\\d{2}:\\d{2} cloud-init\\[[\\w]+]:",
31+
"timestamp_format": "%B %d %H:%M:%S",
32+
"timezone": "UTC"
33+
},
34+
{
35+
"file_path": "/var/log/cloud-init-output.log",
36+
"log_group_name": "${log_group_name}",
37+
"log_stream_name": "/ec2/instance/{instance_id}/cloud-init-output.log",
38+
"multi_line_start_pattern": "Cloud-init v. \\d+.\\d+-\\d+"
39+
}
40+
]
41+
}
42+
}
43+
}
44+
}
45+

‎assets/haproxy.cfg.tmplt

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
global
2+
log stdout format raw local0
3+
4+
defaults
5+
log global
6+
mode tcp
7+
option tcplog
8+
timeout connect 5s
9+
timeout client 1m
10+
timeout server 1m
11+
12+
resolvers vpcdns
13+
nameserver dns2 ${resolver}:53
14+
hold valid 10s
15+
16+
%{ for proxy in proxies ~}
17+
18+
frontend proxy_fe_${proxy.name}
19+
bind *:${proxy.listener_port}
20+
default_backend proxy_be_${proxy.name}
21+
22+
backend proxy_be_${proxy.name}
23+
server target ${proxy.target} check resolvers vpcdns resolve-prefer ipv4
24+
25+
%{ endfor ~}
26+
27+
frontend healthcheck_fe
28+
bind *:8080
29+
mode http
30+
default_backend healthcheck_be
31+
32+
backend healthcheck_be
33+
mode http
34+
http-request return status 200 content-type text/plain lf-string "ok"

‎assets/provision.sh

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash -xe
2+
3+
# ---------------------------------------------------------------------- fns ---
4+
5+
function cwagent_ctl {
6+
/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl "$@"
7+
}
8+
export -f cwagent_ctl
9+
10+
# ------------------------------------------------------------------- script ---
11+
12+
yum update -y
13+
14+
chmod 644 /var/log/cloud-init-output.log
15+
chmod 644 /var/log/messages
16+
17+
cwagent_ctl -a fetch-config -s -m ec2 \
18+
-c file:/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d/user.json

‎assets/userdata.sh

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/bash
2+
# shellcheck disable=SC2034,2154
3+
4+
# --------------------------------------------------------- terraform inputs ---
5+
6+
HAPROXY_CONFIG_ENCODED=${haproxy_config_encoded}
7+
8+
# ------------------------------------------------------------------- script ---
9+
#
10+
yum install -y haproxy
11+
echo "$HAPROXY_CONFIG_ENCODED" | base64 -d >/etc/haproxy/haproxy.cfg
12+
systemctl enable --now haproxy

0 commit comments

Comments
 (0)