Skip to content

Commit 595434b

Browse files
author
Premdeep Saini
committed
add resources for gitlab-omnibus setup with RDS for postgres and Elasticache for Redis
1 parent 2ed8d3c commit 595434b

File tree

4 files changed

+666
-0
lines changed

4 files changed

+666
-0
lines changed

‎main.tf‎

Lines changed: 359 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,359 @@
1+
locals {
2+
managed_by = "Terraform"
3+
}
4+
5+
resource "aws_instance" "gitlab" {
6+
count = 1
7+
ami = var.ami_id
8+
instance_type = var.instance_type
9+
subnet_id = var.private_subnet_id
10+
associate_public_ip_address = false
11+
vpc_security_group_ids = [aws_security_group.gitlab.id]
12+
key_name = var.gitlab_ssh_public_key != null ? aws_key_pair.gitlab_ssh[0].key_name : null
13+
root_block_device {
14+
volume_type = var.volume_type
15+
volume_size = var.volume_size
16+
delete_on_termination = false
17+
}
18+
tags = {
19+
Name = "${var.environment_prefix}-gitlab"
20+
Environment = var.environment_prefix
21+
ManagedBy = local.managed_by
22+
}
23+
}
24+
25+
resource "aws_key_pair" "gitlab_ssh" {
26+
count = var.gitlab_ssh_public_key != null ? 1 : 0
27+
key_name = "${var.environment_prefix}-gitlab-key-pair"
28+
public_key = var.gitlab_ssh_public_key
29+
}
30+
31+
data "aws_vpc" "vpc" {
32+
id = var.vpc_id
33+
}
34+
35+
data "aws_route53_zone" "zone" {
36+
name = var.hosted_zone
37+
}
38+
39+
resource "aws_security_group" "gitlab" {
40+
name = "${var.environment_prefix}-gitlab"
41+
vpc_id = data.aws_vpc.vpc.id
42+
description = "Security group for Gitlab instance"
43+
ingress = [
44+
{
45+
from_port = 80
46+
protocol = "tcp"
47+
to_port = 80
48+
cidr_blocks = [data.aws_vpc.vpc.cidr_block]
49+
ipv6_cidr_blocks = data.aws_vpc.vpc.ipv6_cidr_block != "" ? tolist([data.aws_vpc.vpc.ipv6_cidr_block]) : []
50+
prefix_list_ids = []
51+
security_groups = []
52+
self = false
53+
description = "allow http ingress from within VPC"
54+
},
55+
{
56+
from_port = 443
57+
protocol = "tcp"
58+
to_port = 443
59+
cidr_blocks = [data.aws_vpc.vpc.cidr_block]
60+
ipv6_cidr_blocks = data.aws_vpc.vpc.ipv6_cidr_block != "" ? tolist([data.aws_vpc.vpc.ipv6_cidr_block]) : []
61+
prefix_list_ids = []
62+
security_groups = []
63+
self = false
64+
description = "allow https ingress from within VPC"
65+
},
66+
{
67+
from_port = 22
68+
protocol = "tcp"
69+
to_port = 22
70+
cidr_blocks = [data.aws_vpc.vpc.cidr_block]
71+
ipv6_cidr_blocks = data.aws_vpc.vpc.ipv6_cidr_block != "" ? tolist([data.aws_vpc.vpc.ipv6_cidr_block]) : []
72+
prefix_list_ids = []
73+
security_groups = [aws_security_group.gitlab_lb.id]
74+
self = false
75+
description = "allow SSH within VPC"
76+
}
77+
]
78+
egress = [
79+
{
80+
from_port = 0
81+
protocol = "-1"
82+
to_port = 0
83+
cidr_blocks = ["0.0.0.0/0"]
84+
ipv6_cidr_blocks = ["::/0"]
85+
prefix_list_ids = []
86+
security_groups = []
87+
self = false
88+
description = "allow all egress"
89+
}
90+
]
91+
tags = {
92+
Environment = var.environment_prefix
93+
ManagedBy = local.managed_by
94+
}
95+
}
96+
97+
resource "aws_security_group" "gitlab_lb" {
98+
name = "${var.environment_prefix}-gitlab-lb"
99+
vpc_id = data.aws_vpc.vpc.id
100+
description = "Security group for Gitlab load balancer"
101+
ingress = [
102+
{
103+
from_port = 80
104+
protocol = "tcp"
105+
to_port = 80
106+
cidr_blocks = ["0.0.0.0/0"]
107+
ipv6_cidr_blocks = ["::/0"]
108+
prefix_list_ids = []
109+
security_groups = []
110+
self = false
111+
description = "allow http ingress from anywhere"
112+
},
113+
{
114+
from_port = 443
115+
protocol = "tcp"
116+
to_port = 443
117+
cidr_blocks = ["0.0.0.0/0"]
118+
ipv6_cidr_blocks = ["::/0"]
119+
prefix_list_ids = []
120+
security_groups = []
121+
self = false
122+
description = "allow https ingress from anywhere"
123+
},
124+
{
125+
from_port = 22
126+
protocol = "tcp"
127+
to_port = 22
128+
cidr_blocks = ["0.0.0.0/0"]
129+
ipv6_cidr_blocks = ["::/0"]
130+
prefix_list_ids = []
131+
security_groups = []
132+
self = false
133+
description = "allow SSH ingress from anywhere"
134+
}
135+
]
136+
egress = [
137+
{
138+
from_port = 0
139+
protocol = "-1"
140+
to_port = 0
141+
cidr_blocks = ["0.0.0.0/0"]
142+
ipv6_cidr_blocks = ["::/0"]
143+
prefix_list_ids = []
144+
security_groups = []
145+
self = false
146+
description = "allow all egress"
147+
}
148+
]
149+
tags = {
150+
Environment = var.environment_prefix
151+
ManagedBy = local.managed_by
152+
}
153+
}
154+
155+
module "records" {
156+
source = "terraform-aws-modules/route53/aws//modules/records"
157+
version = "~> 2.0"
158+
159+
zone_name = var.hosted_zone
160+
create = var.create_gitlab_domain
161+
records = [
162+
{
163+
name = var.gitlab_domain
164+
type = "A"
165+
alias = {
166+
name = module.elb.this_elb_dns_name
167+
zone_id = module.elb.this_elb_zone_id
168+
}
169+
},
170+
]
171+
}
172+
173+
module "acm" {
174+
source = "terraform-aws-modules/acm/aws"
175+
version = "~> 4.0"
176+
create_certificate = var.create_gitlab_domain
177+
domain_name = var.gitlab_fqdn
178+
zone_id = data.aws_route53_zone.zone.zone_id
179+
180+
wait_for_validation = true
181+
182+
tags = {
183+
Name = var.gitlab_domain
184+
}
185+
}
186+
187+
module "elb" {
188+
source = "terraform-aws-modules/elb/aws"
189+
version = "~> 2.0"
190+
191+
name = "${var.environment_prefix}-gitlab"
192+
193+
subnets = var.public_subnet_ids
194+
security_groups = [aws_security_group.gitlab_lb.id]
195+
internal = false
196+
197+
listener = [
198+
{
199+
instance_port = 80
200+
instance_protocol = "HTTP"
201+
lb_port = 80
202+
lb_protocol = "HTTP"
203+
},
204+
{
205+
instance_port = 80
206+
instance_protocol = "HTTP"
207+
lb_port = 443
208+
lb_protocol = "HTTPS"
209+
ssl_certificate_id = var.create_acm_certificate ? module.acm.acm_certificate_arn : var.acm_certificate_arn
210+
},
211+
{
212+
instance_port = 22
213+
instance_protocol = "TCP"
214+
lb_port = 22
215+
lb_protocol = "TCP"
216+
},
217+
]
218+
219+
health_check = {
220+
target = "${var.healthcheck_protocol}:${var.healthcheck_port}${var.healthcheck_path}"
221+
interval = var.healthcheck_interval
222+
healthy_threshold = var.healthcheck_healthy_threshold
223+
unhealthy_threshold = var.healthcheck_unhealthy_threshold
224+
timeout = var.healthcheck_timeout
225+
}
226+
#
227+
# access_logs = {
228+
# bucket = "my-access-logs-bucket"
229+
# }
230+
231+
// ELB attachments
232+
number_of_instances = length(aws_instance.gitlab)
233+
instances = aws_instance.gitlab[*].id
234+
235+
tags = {
236+
Environment = var.environment_prefix
237+
}
238+
}
239+
240+
module "gitlab_pg" {
241+
source = "terraform-aws-modules/rds/aws"
242+
identifier = "${var.environment_prefix}-gitlab-pg"
243+
create_db_instance = true
244+
create_db_subnet_group = true
245+
create_db_parameter_group = var.gitlab_pg_create_db_parameter_group
246+
parameter_group_name = var.gitlab_pg_parameter_group_name
247+
parameters = var.gitlab_pg_parameters
248+
db_subnet_group_name = "${var.environment_prefix}-gitlab-pg"
249+
subnet_ids = var.gitlab_pg_subnet_ids
250+
allocated_storage = var.gitlab_pg_allocated_storage
251+
storage_type = var.gitlab_pg_storage_type
252+
db_name = var.gitlab_pg_db_name
253+
port = tostring(var.gitlab_pg_port)
254+
engine = "postgres"
255+
engine_version = var.gitlab_pg_engine_version
256+
instance_class = var.gitlab_pg_db_instance_class
257+
username = var.gitlab_pg_username
258+
password = var.gitlab_pg_password
259+
create_random_password = false
260+
publicly_accessible = var.gitlab_pg_publicly_accessible
261+
vpc_security_group_ids = [aws_security_group.gitlab_rds.id]
262+
}
263+
264+
resource "aws_security_group" "gitlab_rds" {
265+
name = "${var.environment_prefix}-gitlab-rds"
266+
vpc_id = data.aws_vpc.vpc.id
267+
description = "Security group for Gitlab RDS"
268+
ingress = [
269+
{
270+
from_port = var.gitlab_pg_port
271+
protocol = "tcp"
272+
to_port = var.gitlab_pg_port
273+
cidr_blocks = []
274+
ipv6_cidr_blocks = []
275+
prefix_list_ids = []
276+
security_groups = [aws_security_group.gitlab.id]
277+
self = false
278+
description = "allow TCP access from Gitlab instance"
279+
}
280+
]
281+
tags = {
282+
Environment = var.environment_prefix
283+
ManagedBy = local.managed_by
284+
}
285+
}
286+
287+
resource "aws_elasticache_cluster" "gitlab_redis" {
288+
cluster_id = "${var.environment_prefix}-gitlab-redis"
289+
engine = "redis"
290+
node_type = var.gitlab_redis_node_type
291+
num_cache_nodes = var.gitlab_redis_num_cache_nodes
292+
parameter_group_name = var.gitlab_redis_create_parameter_group == true ? aws_elasticache_parameter_group.gitlab_redis[0].name : var.gitlab_redis_parameter_group_name
293+
engine_version = var.gitlab_redis_engine_version
294+
port = var.gitlab_redis_port
295+
security_group_ids = [aws_security_group.gitlab_redis.id]
296+
subnet_group_name = var.gitlab_redis_create_subnet_group == true ? aws_elasticache_subnet_group.gitlab_redis[0].name : var.gitlab_redis_subnet_group_name
297+
298+
lifecycle {
299+
precondition {
300+
condition = anytrue([
301+
(var.gitlab_redis_create_parameter_group == false && var.gitlab_redis_parameter_group_name != null),
302+
(var.gitlab_redis_create_parameter_group)
303+
])
304+
error_message = "Parameter Group creation for Gitlab Redis is set to ${var.gitlab_redis_create_parameter_group}. Provide a pre-existing Parameter Group name."
305+
}
306+
}
307+
}
308+
309+
resource "aws_elasticache_parameter_group" "gitlab_redis" {
310+
count = var.gitlab_redis_create_parameter_group == true ? 1 : 0
311+
family = var.gitlab_redis_parameter_group.family
312+
name = var.gitlab_redis_parameter_group.name
313+
314+
lifecycle {
315+
precondition {
316+
condition = var.gitlab_redis_parameter_group.name != null && var.gitlab_redis_parameter_group.family != null
317+
error_message = "Provide name and family in gitlab_redis_parameter_group for Parameter Group creation"
318+
}
319+
}
320+
}
321+
322+
resource "aws_elasticache_subnet_group" "gitlab_redis" {
323+
count = var.gitlab_redis_create_subnet_group == true ? 1 : 0
324+
name = "${var.environment_prefix}-gitlab-redis"
325+
subnet_ids = var.gitlab_redis_subnet_ids
326+
tags = {
327+
Name = "${var.environment_prefix}-gitlab-redis"
328+
ManagedBy = local.managed_by
329+
}
330+
lifecycle {
331+
precondition {
332+
condition = var.gitlab_redis_create_subnet_group && length(var.gitlab_redis_subnet_ids) != 0
333+
error_message = "Subnet Group creation needs subnet-ids. Add subnet-ids to gitlab_redis_subnet_ids"
334+
}
335+
}
336+
}
337+
338+
resource "aws_security_group" "gitlab_redis" {
339+
name = "${var.environment_prefix}-gitlab-redis"
340+
vpc_id = data.aws_vpc.vpc.id
341+
description = "Security group for Gitlab Redis"
342+
ingress = [
343+
{
344+
from_port = var.gitlab_redis_port
345+
protocol = "tcp"
346+
to_port = var.gitlab_redis_port
347+
cidr_blocks = []
348+
ipv6_cidr_blocks = []
349+
prefix_list_ids = []
350+
security_groups = [aws_security_group.gitlab.id]
351+
self = false
352+
description = "allow TCP access from Gitlab instance"
353+
}
354+
]
355+
tags = {
356+
Environment = var.environment_prefix
357+
ManagedBy = local.managed_by
358+
}
359+
}

‎outputs.tf‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
output "gitlab_instance_id" {
2+
description = "Instance Id of the Gitlab EC2 instance."
3+
value = aws_instance.gitlab[*].id
4+
}
5+
6+
output "gitlab_sg_id" {
7+
description = "Id of Gitlab instance security group."
8+
value = aws_security_group.gitlab.id
9+
}
10+
11+
output "gitlab_lb_sg_id" {
12+
description = "Id of Gitlab load balancer security group."
13+
value = aws_security_group.gitlab_lb.id
14+
}
15+
16+
output "gitlab_lb_arn" {
17+
description = "The ARN for Gitlab load balancer."
18+
value = module.elb.this_elb_arn
19+
}
20+
21+
output "acm_certificate_arn" {
22+
description = "The ARN of the certificate."
23+
value = module.acm.acm_certificate_arn
24+
}
25+
26+
output "acm_certificate_status" {
27+
description = "Status of the certificate."
28+
value = module.acm.acm_certificate_status
29+
}
30+
31+
output "gitlab_pg_address" {
32+
value = module.gitlab_pg.db_instance_address
33+
description = "Gitlab RDS DB instance address"
34+
}
35+
36+
output "gitlab_redis_address" {
37+
value = aws_elasticache_cluster.gitlab_redis.cache_nodes[0].address
38+
description = "Gitlab Redis cluster address"
39+
}

0 commit comments

Comments
 (0)