[WIP] Implement terraform bootstrap stage

.pre-commit-config.yaml

@@ -37,6 +37,6 @@ repos:
   - repo: https://github.com/tofuutils/pre-commit-opentofu
     rev: v1.0.4
     hooks:
+      - id: tofu_validate
       - id: tofu_fmt
       - id: tofu_tflint
-      - id: tofu_validate

web/deploy/terraform/modules/shared_resources/main.tf → web/deploy/terraform/shared/networking/main.tf

@@ -9,34 +9,6 @@ terraform {
   }
 }
 
-# tflint-ignore: terraform_unused_declarations
-variable "aws_region" {
-  description = "AWS region"
-  default     = "us-east-1"
-  type        = string
-}
-
-# tflint-ignore: terraform_unused_declarations
-variable "s3_bucket" {
-  description = "S3 bucket for Terraform state"
-  default     = "osm-storage"
-  type        = string
-}
-
-# tflint-ignore: terraform_unused_declarations
-variable "dynamodb_table" {
-  description = "DynamoDB table for Terraform state locking"
-  default     = "terraform-locks"
-  type        = string
-}
-
-# tflint-ignore: terraform_unused_declarations
-variable "ssh_port" {
-  description = "Non-standard port for SSH"
-  default     = 22
-  type        = number
-}
-
 # VPC
 resource "aws_vpc" "main" {
   cidr_block           = "10.0.0.0/16"
@@ -192,29 +164,3 @@ data "aws_ami" "ubuntu" {
     values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
   }
 }
-
-
-
-
-# Outputs
-output "vpc_id" {
-  value = aws_vpc.main.id
-}
-output "subnet_id" {
-  value = aws_subnet.main.id
-}
-output "security_group_id" {
-  value = aws_security_group.allow_all.id
-}
-output "internet_gateway_id" {
-  value = aws_internet_gateway.main.id
-}
-output "route_table_id" {
-  value = aws_route_table.main.id
-}
-output "aws_network_acl_id" {
-  value = aws_network_acl.allow_all.id
-}
-output "ami_id" {
-  value = data.aws_ami.ubuntu.id
-}

web/deploy/terraform/shared/networking/outputs.tf

@@ -0,0 +1,27 @@
+output "vpc_id" {
+  value = aws_vpc.main.id
+}
+
+output "subnet_id" {
+  value = aws_subnet.main.id
+}
+
+output "security_group_id" {
+  value = aws_security_group.allow_all.id
+}
+
+output "internet_gateway_id" {
+  value = aws_internet_gateway.main.id
+}
+
+output "route_table_id" {
+  value = aws_route_table.main.id
+}
+
+output "aws_network_acl_id" {
+  value = aws_network_acl.allow_all.id
+}
+
+output "ami_id" {
+  value = data.aws_ami.ubuntu.id
+}

web/deploy/terraform/shared/networking/variables.tf

@@ -0,0 +1,27 @@
+# tflint-ignore: terraform_unused_declarations
+variable "aws_region" {
+  description = "AWS region"
+  default     = "us-east-1"
+  type        = string
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "s3_bucket" {
+  description = "S3 bucket for Terraform state"
+  default     = "osm-storage"
+  type        = string
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "dynamodb_table" {
+  description = "DynamoDB table for Terraform state locking"
+  default     = "terraform-locks"
+  type        = string
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "ssh_port" {
+  description = "Non-standard port for SSH"
+  default     = 22
+  type        = number
+}

web/deploy/terraform/staging/main.tf

@@ -69,34 +69,3 @@ resource "aws_eip_association" "staging" {
   instance_id   = aws_instance.staging.id
   allocation_id = aws_eip.staging.id
 }
-
-output "vpc_id" {
-  value = module.shared_resources.vpc_id
-}
-output "internet_gateway_id" {
-  value = module.shared_resources.internet_gateway_id
-}
-output "route_table_id" {
-  value = module.shared_resources.route_table_id
-}
-output "network_acl_id" {
-  value = module.shared_resources.aws_network_acl_id
-}
-output "security_group_id" {
-  value = module.shared_resources.security_group_id
-}
-output "subnet_id" {
-  value = module.shared_resources.subnet_id
-}
-
-output "instance_id" {
-  value = aws_instance.staging.id
-}
-
-output "public_dns" {
-  value = aws_eip.staging.public_dns
-}
-
-output "public_ip" {
-  value = aws_eip.staging.public_ip
-}

web/deploy/terraform/staging/outputs.tf

@@ -0,0 +1,35 @@
+output "vpc_id" {
+  value = module.shared_resources.vpc_id
+}
+
+output "internet_gateway_id" {
+  value = module.shared_resources.internet_gateway_id
+}
+
+output "route_table_id" {
+  value = module.shared_resources.route_table_id
+}
+
+output "network_acl_id" {
+  value = module.shared_resources.aws_network_acl_id
+}
+
+output "security_group_id" {
+  value = module.shared_resources.security_group_id
+}
+
+output "subnet_id" {
+  value = module.shared_resources.subnet_id
+}
+
+output "instance_id" {
+  value = aws_instance.staging.id
+}
+
+output "public_dns" {
+  value = aws_eip.staging.public_dns
+}
+
+output "public_ip" {
+  value = aws_eip.staging.public_ip
+}

web/deploy/terraform/state/deprecated/README.md

@@ -0,0 +1,3 @@
+The files in this directory are deprecated and only included for reference. 
+
+This directory might be removed in the future

web/deploy/terraform/state/main.tf

@@ -0,0 +1,18 @@
+terraform {
+  required_version = ">= 1.0.0, < 2.0.0"
+}
+
+module "stage_state" {
+  source      = "./modules/state/"
+  environment = "stage"
+}
+
+module "prod_state" {
+  source      = "./modules/state/"
+  environment = "prod"
+}
+
+module "shared_state" {
+  source      = "./modules/state/"
+  environment = "shared"
+}

web/deploy/terraform/state/modules/state/main.tf

@@ -0,0 +1,92 @@
+terraform {
+  required_version = ">= 1.0.0, < 2.0.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = var.aws_region
+}
+
+resource "aws_s3_bucket" "tf_state" {
+  bucket = "${var.bucket_name}-${var.environment}"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+
+  tags = {
+    Name = "${var.bucket_name}-${var.environment}"
+  }
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "tf_state" {
+  bucket = aws_s3_bucket.tf_state.id
+  rule {
+    id     = "tf_state_${var.environment}"
+    status = "Enabled"
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    expiration {
+      days = 365
+    }
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "aws_s3_bucket_versioning" "enabled" {
+  bucket = aws_s3_bucket.tf_state.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
+  bucket = aws_s3_bucket.tf_state.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "aws_dynamodb_table" "tf_locks" {
+  name         = "${var.table_name}-${var.environment}"
+  billing_mode = "PAY_PER_REQUEST"
+  hash_key     = "LockID"
+
+  attribute {
+    name = "LockID"
+    type = "S"
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+
+  tags = {
+    Name = "${var.bucket_name}-${var.environment}"
+  }
+}

web/deploy/terraform/state/modules/state/outputs.tf

@@ -0,0 +1,9 @@
+output "s3_bucket_arn" {
+  value       = aws_s3_bucket.tf_state.arn
+  description = "The ARN of the S3 bucket"
+}
+
+output "dynamodb_table_name" {
+  value       = aws_dynamodb_table.tf_locks.name
+  description = "The name of the DynamoDB table"
+}

web/deploy/terraform/state/modules/state/variables.tf

@@ -0,0 +1,22 @@
+variable "bucket_name" {
+  description = "The name of the S3 bucket to store Terraform state. Must be globally unique."
+  type        = string
+  default     = "osm-terraform-state-storage"
+}
+
+variable "table_name" {
+  description = "The name of the DynamoDB table. Must be unique in this AWS account."
+  type        = string
+  default     = "terraform-state-locks"
+}
+
+variable "aws_region" {
+  description = "The AWS region used by the deployment"
+  type        = string
+  default     = "us-east-1"
+}
+
+variable "environment" {
+  description = "The name of the development environment. Usually `stage` or `prod`."
+  type        = string
+}