Skip to content

Commit 89134cd

Browse files
author
Premdeep Saini
committed
cleanup main.tf by separating resources logically by functionality
1 parent 562cefa commit 89134cd

File tree

17 files changed

+455
-480
lines changed

17 files changed

+455
-480
lines changed

‎backup.tf‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
/* Resources for setting up Gitlab remote backup on Amazon S3 */
2+
3+
resource "aws_s3_bucket" "gitlab_backup" {
4+
count = var.enable_gitlab_backup_to_s3 ? 1 : 0
5+
bucket = var.gitlab_backup_bucket_name
6+
7+
tags = merge(local.default_tags, var.additional_tags)
8+
9+
lifecycle {
10+
precondition {
11+
condition = anytrue([
12+
(var.enable_gitlab_backup_to_s3 == false),
13+
(var.enable_gitlab_backup_to_s3 == true && var.gitlab_backup_bucket_name != null)
14+
])
15+
error_message = "Gitlab backup to S3 is set to ${var.enable_gitlab_backup_to_s3}. gitlab_backup_bucket_name is mandatory to create S3 bucket."
16+
}
17+
}
18+
}
19+
20+
resource "aws_s3_bucket_acl" "gitlab_backup" {
21+
count = var.enable_gitlab_backup_to_s3 ? 1 : 0
22+
bucket = aws_s3_bucket.gitlab_backup[0].id
23+
acl = "private"
24+
}
25+
26+
data "aws_iam_policy_document" "gitlab_s3_backup" {
27+
count = var.enable_gitlab_backup_to_s3 ? 1 : 0
28+
statement {
29+
effect = "Allow"
30+
actions = [
31+
"s3:AbortMultipartUpload",
32+
"s3:GetBucketAcl",
33+
"s3:GetBucketLocation",
34+
"s3:GetObject",
35+
"s3:GetObjectAcl",
36+
"s3:ListBucketMultipartUploads",
37+
"s3:PutObject",
38+
"s3:PutObjectAcl"
39+
]
40+
resources = [
41+
"arn:aws:s3:::${aws_s3_bucket.gitlab_backup[0].bucket}/*"
42+
]
43+
}
44+
statement {
45+
effect = "Allow"
46+
actions = [
47+
"s3:GetBucketLocation",
48+
"s3:ListAllMyBuckets"
49+
]
50+
resources = [
51+
"*"
52+
]
53+
}
54+
statement {
55+
effect = "Allow"
56+
actions = [
57+
"s3:ListBucket"
58+
]
59+
resources = [
60+
"arn:aws:s3:::${aws_s3_bucket.gitlab_backup[0].bucket}"
61+
]
62+
}
63+
}
64+
65+
resource "aws_iam_policy" "gitlab_backup" {
66+
count = var.enable_gitlab_backup_to_s3 ? 1 : 0
67+
name = "${local.environment_prefix}-gitlab-backup"
68+
policy = data.aws_iam_policy_document.gitlab_s3_backup[0].json
69+
tags = merge({
70+
Name = "${local.environment_prefix}-gitlab-backup"
71+
}, local.default_tags, var.additional_tags)
72+
}
73+
74+
resource "aws_iam_role" "gitlab_backup" {
75+
name = "${local.environment_prefix}-gitlab-backup"
76+
assume_role_policy = <<EOF
77+
{
78+
"Version": "2012-10-17",
79+
"Statement": [
80+
{
81+
"Action": "sts:AssumeRole",
82+
"Principal": {
83+
"Service": "ec2.amazonaws.com"
84+
},
85+
"Effect": "Allow",
86+
"Sid": ""
87+
}
88+
]
89+
}
90+
EOF
91+
managed_policy_arns = var.enable_gitlab_backup_to_s3 ? [aws_iam_policy.gitlab_backup[0].arn] : []
92+
tags = merge({
93+
Name = "${local.environment_prefix}-gitlab-backup"
94+
}, local.default_tags, var.additional_tags)
95+
}

‎config.tf‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
/* Resources for management of gitlab.rb from within the terraform module itself using Ansible playbooks */
2+
3+
locals {
4+
gitlab_config_file_name = "gitlab.rb"
5+
rendered_gitlab_config_file_name = "gitlab_rendered.rb"
6+
gitlab_additional_config_file_name = "gitlab_additional.rb"
7+
gitlab_config_tmp_path = "/tmp/gitlab/gitlab_config"
8+
gitlab_config_template_file_path = "${path.module}/templates"
9+
gitlab_config_file_path = "${path.cwd}/gitlab_config"
10+
gitlab_config_playbook_file = "${path.module}/playbooks/gitlab_setup.yaml"
11+
gitlab_complete_url = join("", tolist(["https://", values(module.records.route53_record_name)[0]]))
12+
}
13+
14+
data "template_file" "gitlab_config_template" {
15+
template = join("\n", [
16+
file("${local.gitlab_config_template_file_path}/postgres.tftpl"),
17+
file("${local.gitlab_config_template_file_path}/redis.tftpl"),
18+
file("${local.gitlab_config_template_file_path}/nginx.tftpl"),
19+
file("${local.gitlab_config_template_file_path}/rails.tftpl"),
20+
var.create_ses_identity ? file("${local.gitlab_config_template_file_path}/smtp.tftpl") : "",
21+
])
22+
vars = merge({
23+
gitlab_url = local.gitlab_complete_url,
24+
gitlab_db_name = module.gitlab_pg.db_instance_name,
25+
gitlab_db_username = module.gitlab_pg.db_instance_username,
26+
gitlab_db_password = module.gitlab_pg.db_instance_password,
27+
gitlab_db_host = module.gitlab_pg.db_instance_address,
28+
gitlab_redis_host = aws_elasticache_cluster.gitlab_redis.cache_nodes[0].address,
29+
aws_region = aws_s3_bucket.gitlab_backup[0].region,
30+
gitlab_backup_s3_bucket_name = aws_s3_bucket.gitlab_backup[0].bucket
31+
}, var.create_ses_identity ? {
32+
smtp_address = "email-smtp.${var.aws_region}.amazonaws.com",
33+
smtp_username = aws_iam_access_key.gitlab_smtp_user[0].id,
34+
smtp_password = aws_iam_access_key.gitlab_smtp_user[0].ses_smtp_password_v4,
35+
smtp_domain = data.aws_route53_zone.email_domain[0].name
36+
} : {})
37+
}
38+
39+
resource "local_sensitive_file" "rendered_gitlab_config_file" {
40+
filename = "${local.gitlab_config_tmp_path}/${local.rendered_gitlab_config_file_name}"
41+
content = data.template_file.gitlab_config_template.rendered
42+
}
43+
44+
data "local_sensitive_file" "gitlab_additional_config" {
45+
count = fileexists("${local.gitlab_config_file_path}/${local.gitlab_additional_config_file_name}") ? 1 : 0
46+
filename = "${local.gitlab_config_file_path}/${local.gitlab_additional_config_file_name}"
47+
}
48+
49+
resource "local_sensitive_file" "gitlab_config_file" {
50+
filename = "${local.gitlab_config_tmp_path}/${local.gitlab_config_file_name}"
51+
content = join("\n", tolist([
52+
data.template_file.gitlab_config_template.rendered,
53+
data.local_sensitive_file.gitlab_additional_config != [] ? data.local_sensitive_file.gitlab_additional_config[0].content : ""
54+
]))
55+
}
56+
57+
/*
58+
Adding null_resource trigger on timestamp is a hack to always check the diff in the
59+
config if any and apply the config changes to Gitlab.
60+
*/
61+
resource "null_resource" "gitlab_reconfigure" {
62+
triggers = {
63+
timestamp = timestamp()
64+
}
65+
provisioner "local-exec" {
66+
command = "ansible-playbook -u ubuntu -i '${aws_instance.gitlab.private_ip},' --private-key ${var.private_key} -e 'instance_ip_address=${aws_instance.gitlab.private_ip} workdir=${local.gitlab_config_tmp_path} config_file=${local_sensitive_file.gitlab_config_file.filename}' ${local.gitlab_config_playbook_file}"
67+
}
68+
}

‎gitlab_config_templates/gitlab-nginx.rb.tftpl‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎gitlab_config_templates/gitlab-postgres.tftpl‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎gitlab_config_templates/gitlab-rails.tftpl‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎gitlab_config_templates/gitlab-redis.tftpl‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎load_balancers.tf‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
/* Resources for Gitlab classic load balancer */
2+
resource "aws_security_group" "gitlab_lb" {
3+
name = "${local.environment_prefix}-gitlab-lb"
4+
vpc_id = data.aws_vpc.vpc.id
5+
description = "Security group for Gitlab load balancer"
6+
ingress = [
7+
{
8+
from_port = 80
9+
protocol = "tcp"
10+
to_port = 80
11+
cidr_blocks = ["0.0.0.0/0"]
12+
ipv6_cidr_blocks = ["::/0"]
13+
prefix_list_ids = []
14+
security_groups = []
15+
self = false
16+
description = "allow http ingress from anywhere"
17+
},
18+
{
19+
from_port = 443
20+
protocol = "tcp"
21+
to_port = 443
22+
cidr_blocks = ["0.0.0.0/0"]
23+
ipv6_cidr_blocks = ["::/0"]
24+
prefix_list_ids = []
25+
security_groups = []
26+
self = false
27+
description = "allow https ingress from anywhere"
28+
},
29+
{
30+
from_port = 22
31+
protocol = "tcp"
32+
to_port = 22
33+
cidr_blocks = ["0.0.0.0/0"]
34+
ipv6_cidr_blocks = ["::/0"]
35+
prefix_list_ids = []
36+
security_groups = []
37+
self = false
38+
description = "allow SSH ingress from anywhere"
39+
}
40+
]
41+
egress = [
42+
{
43+
from_port = 0
44+
protocol = "-1"
45+
to_port = 0
46+
cidr_blocks = ["0.0.0.0/0"]
47+
ipv6_cidr_blocks = ["::/0"]
48+
prefix_list_ids = []
49+
security_groups = []
50+
self = false
51+
description = "allow all egress"
52+
}
53+
]
54+
tags = merge({
55+
Name = "${local.environment_prefix}-gitlab-lb"
56+
}, local.default_tags, var.additional_tags)
57+
}
58+
59+
module "elb" {
60+
source = "terraform-aws-modules/elb/aws"
61+
version = "~> 2.0"
62+
name = "${local.environment_prefix}-gitlab"
63+
subnets = var.public_subnet_ids
64+
security_groups = [aws_security_group.gitlab_lb.id]
65+
internal = false
66+
listener = [
67+
{
68+
instance_port = 80
69+
instance_protocol = "HTTP"
70+
lb_port = 80
71+
lb_protocol = "HTTP"
72+
},
73+
{
74+
instance_port = 80
75+
instance_protocol = "HTTP"
76+
lb_port = 443
77+
lb_protocol = "HTTPS"
78+
ssl_certificate_id = var.create_acm_certificate ? module.acm.acm_certificate_arn : var.acm_certificate_arn
79+
},
80+
{
81+
instance_port = 22
82+
instance_protocol = "TCP"
83+
lb_port = 22
84+
lb_protocol = "TCP"
85+
},
86+
]
87+
health_check = {
88+
target = "${var.healthcheck_protocol}:${var.healthcheck_port}${var.healthcheck_path}"
89+
interval = var.healthcheck_interval
90+
healthy_threshold = var.healthcheck_healthy_threshold
91+
unhealthy_threshold = var.healthcheck_unhealthy_threshold
92+
timeout = var.healthcheck_timeout
93+
}
94+
number_of_instances = 1
95+
instances = tolist([aws_instance.gitlab.id])
96+
tags = merge({
97+
Name = "${local.environment_prefix}-gitlab"
98+
}, local.default_tags, var.additional_tags)
99+
}

0 commit comments

Comments
 (0)