diff --git a/.gitignore b/.gitignore index 498dc19325..78ec6db816 100644 --- a/.gitignore +++ b/.gitignore @@ -205,3 +205,9 @@ backend/filepond-temp-uploads backend/media backend/*.sqlite3* frontend/assets/fonts + +*.auto.tfvars +.terraform/ +.terraformrc +*.tfstate +terraform.tfstate.backup diff --git a/docker/Dockerfile.nginx b/docker/Dockerfile.nginx index 6343894bd3..fe871c583c 100644 --- a/docker/Dockerfile.nginx +++ b/docker/Dockerfile.nginx @@ -1,4 +1,4 @@ -ARG NODE_VERSION="18.20-bullseye-slim" +ARG NODE_VERSION="20.19-bullseye-slim" FROM node:${NODE_VERSION} AS frontend-builder COPY frontend/ /app/ diff --git a/docker/nginx/nginx.conf.template b/docker/nginx/nginx.conf.template index f3a7155bd7..cb16cc1622 100644 --- a/docker/nginx/nginx.conf.template +++ b/docker/nginx/nginx.conf.template @@ -1,4 +1,4 @@ -worker_processes ${WORKER_PROCESSES}; +worker_processes auto; error_log /var/log/nginx/error.log warn; diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl new file mode 100644 index 0000000000..65995601a1 --- /dev/null +++ b/terraform/.terraform.lock.hcl @@ -0,0 +1,43 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/aws" { + version = "5.97.0" + hashes = [ + "h1:rUDE0OgA+6IiEA+w0cPp3/QQNH4SpjFjYcQ6p7byKS4=", + "zh:02790ad98b767d8f24d28e8be623f348bcb45590205708334d52de2fb14f5a95", + "zh:088b4398a161e45762dc28784fcc41c4fa95bd6549cb708b82de577f2d39ffc7", + "zh:0c381a457b7af391c43fc0167919443f6105ad2702bde4d02ddea9fd7c9d3539", + "zh:1a4b57a5043dcca64d8b8bae8b30ef4f6b98ed2144f792f39c4e816d3f1e2c56", + "zh:1bf00a67f39e67664337bde065180d41d952242801ebcd1c777061d4ffaa1cc1", + "zh:24c549f53d6bd022af31426d3e78f21264d8a72409821669e7fd41966ae68b2b", + "zh:3abda50bbddb35d86081fe39522e995280aea7f004582c4af22112c03ac8b375", + "zh:7388ed7f21ce2eb46bd9066626ce5f3e2a5705f67f643acce8ae71972f66eaf6", + "zh:96740f2ff94e5df2b2d29a5035a1a1026fe821f61712b2099b224fb2c2277663", + "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", + "zh:9f399f8e8683a3a3a6d63a41c7c3a5a5f266eedef40ea69eba75bacf03699879", + "zh:bcf2b288d4706ebd198f75d2159663d657535483331107f2cdef381f10688baf", + "zh:cc76c8a9fc3bad05a8779c1f80fe8c388734f1ec1dd0affa863343490527b466", + "zh:de4359cf1b057bfe7a563be93829ec64bf72e7a2b85a72d075238081ef5eb1db", + "zh:e208fa77051a1f9fa1eff6c5c58aabdcab0de1695b97cdea7b8dd81df3e0ed73", + ] +} + +provider "registry.terraform.io/hashicorp/random" { + version = "3.7.2" + hashes = [ + "h1:KG4NuIBl1mRWU0KD/BGfCi1YN/j3F7H4YgeeM7iSdNs=", + "zh:14829603a32e4bc4d05062f059e545a91e27ff033756b48afbae6b3c835f508f", + "zh:1527fb07d9fea400d70e9e6eb4a2b918d5060d604749b6f1c361518e7da546dc", + "zh:1e86bcd7ebec85ba336b423ba1db046aeaa3c0e5f921039b3f1a6fc2f978feab", + "zh:24536dec8bde66753f4b4030b8f3ef43c196d69cccbea1c382d01b222478c7a3", + "zh:29f1786486759fad9b0ce4fdfbbfece9343ad47cd50119045075e05afe49d212", + "zh:4d701e978c2dd8604ba1ce962b047607701e65c078cb22e97171513e9e57491f", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:7b8434212eef0f8c83f5a90c6d76feaf850f6502b61b53c329e85b3b281cba34", + "zh:ac8a23c212258b7976e1621275e3af7099e7e4a3d4478cf8d5d2a27f3bc3e967", + "zh:b516ca74431f3df4c6cf90ddcdb4042c626e026317a33c53f0b445a3d93b720d", + "zh:dc76e4326aec2490c1600d6871a95e78f9050f9ce427c71707ea412a2f2f1a62", + "zh:eac7b63e86c749c7d48f527671c7aee5b4e26c10be6ad7232d6860167f99dbb0", + ] +} diff --git a/terraform/dev/.terraform.lock.hcl b/terraform/dev/.terraform.lock.hcl new file mode 100644 index 0000000000..f5e5d6bc52 --- /dev/null +++ b/terraform/dev/.terraform.lock.hcl @@ -0,0 +1,43 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/aws" { + version = "5.99.1" + hashes = [ + "h1:xgPyZArCfKVMy8sThzhb0IernbFy0fJGm897ztejZAQ=", + "zh:00b0a61c6d295300f0aa7a79a7d40e9f836164f1fff816d38324c148cd846887", + "zh:1ee9d5ccb67378704642db62113ac6c0d56d69408a9c1afb9a8e14b095fc0733", + "zh:2035977ed418dcb18290785c1eeb79b7133b39f718c470346e043ac48887ffc7", + "zh:67e3ca1bf7061900f81cf958d5c771a2fd6048c2b185bec7b27978349b173a90", + "zh:87fadbe5de7347ede72ad879ff8d8d9334103cd9aa4a321bb086bfac91654944", + "zh:901d170c457c2bff244a2282d9de595bdb3ebecc33a2034c5ce8aafbcff66db9", + "zh:92c07d6cf530679565b87934f9f98604652d787968cce6a3d24c148479b7e34b", + "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", + "zh:a7d4803b4c5ff17f029f8b270c91480442ece27cec7922c38548bcfea2ac2d26", + "zh:afda848da7993a07d29018ec25ab6feda652e01d4b22721da570ce4fcc005292", + "zh:baaf16c98b81bad070e0908f057a97108ecd6e8c9f754d7a79b18df4c8453279", + "zh:c3dd496c5014427599d6b6b1c14c7ebb09a15df78918ae0be935e7bfa83b894c", + "zh:e2b84c1d40b3f2c4b1d74bf170b9e932983b61bac0e6dab2e36f5057ddcc997f", + "zh:e49c92cb29c53b4573ed4d9c946486e6bcfc1b63f1aee0c79cc7626f3d9add03", + "zh:efae8e339c4b13f546e0f96c42eb95bf8347de22e941594849b12688574bf380", + ] +} + +provider "registry.terraform.io/hashicorp/random" { + version = "3.7.2" + hashes = [ + "h1:KG4NuIBl1mRWU0KD/BGfCi1YN/j3F7H4YgeeM7iSdNs=", + "zh:14829603a32e4bc4d05062f059e545a91e27ff033756b48afbae6b3c835f508f", + "zh:1527fb07d9fea400d70e9e6eb4a2b918d5060d604749b6f1c361518e7da546dc", + "zh:1e86bcd7ebec85ba336b423ba1db046aeaa3c0e5f921039b3f1a6fc2f978feab", + "zh:24536dec8bde66753f4b4030b8f3ef43c196d69cccbea1c382d01b222478c7a3", + "zh:29f1786486759fad9b0ce4fdfbbfece9343ad47cd50119045075e05afe49d212", + "zh:4d701e978c2dd8604ba1ce962b047607701e65c078cb22e97171513e9e57491f", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:7b8434212eef0f8c83f5a90c6d76feaf850f6502b61b53c329e85b3b281cba34", + "zh:ac8a23c212258b7976e1621275e3af7099e7e4a3d4478cf8d5d2a27f3bc3e967", + "zh:b516ca74431f3df4c6cf90ddcdb4042c626e026317a33c53f0b445a3d93b720d", + "zh:dc76e4326aec2490c1600d6871a95e78f9050f9ce427c71707ea412a2f2f1a62", + "zh:eac7b63e86c749c7d48f527671c7aee5b4e26c10be6ad7232d6860167f99dbb0", + ] +} diff --git a/terraform/dev/main.tf b/terraform/dev/main.tf new file mode 100644 index 0000000000..6d6bb35645 --- /dev/null +++ b/terraform/dev/main.tf @@ -0,0 +1,87 @@ +module "doccano_ecs" { + source = "../modules/ecs" + app_name = var.app_name + subnet_ids = var.private_subnet_ids + lb_security_group = [module.doccano_alb.alb_security_group] + load_balancer = { + container_port = 8080 + } + vpc_id = var.vpc_id + target_group_arn = module.doccano_alb.alb_target_group_arn + container_name = "nginx" + # container_count = 2 + efs_volume = module.doccano_efs.efs_id + efs_access_point_static_files = module.doccano_efs.access_point_ids["staticfiles"] + efs_access_point_id_media = module.doccano_efs.access_point_ids["media"] + efs_access_point_id_tmp = module.doccano_efs.access_point_ids["tmp"] + database_url = aws_ssm_parameter.DATABASE_URL.arn +} + +module "doccano_efs" { + source = "git::ssh://git@github.com/chicagopcdc/terraform_modules.git//aws/efs?ref=0.5.0" + vpc_id = var.vpc_id + efs_name = var.app_name + subnet_ids = var.private_subnet_ids + security_groups = [module.doccano_ecs.ecs_tasks_sg] + access_points = [ + { + name = "media" + posix_user = { uid = 1000, gid = 1000 } + root_directory = { + path = "/backend/media" + creation_info = { + owner_uid = "1000" + owner_gid = "1000" + permissions = "755" + } + } + }, + { + name = "staticfiles" + posix_user = { uid = 1000, gid = 1000 } + root_directory = { + path = "/backend/staticfiles" + creation_info = { + owner_uid = "1000" + owner_gid = "1000" + permissions = "755" + } + } + }, + { + name = "tmp" + posix_user = { uid = 1000, gid = 1000 } + root_directory = { + path = "/backend/filepond-temp-uploads" + creation_info = { + owner_uid = "1000" + owner_gid = "1000" + permissions = "755" + } + } + } + ] +} + +module "doccano_alb" { + source = "git::ssh://git@github.com/chicagopcdc/terraform_modules.git//aws/alb?ref=0.5.0" + environment = var.environment + app_name = "doccano" + vpc_id = var.vpc_id + subnet_ids = var.private_subnet_ids + acm_cert_arn = "arn:aws:acm:us-east-1:471835990085:certificate/c1cebe37-738d-4766-a635-bc23d3e8caa7" # +} + +module "rds" { + source = "git::ssh://git@github.com/chicagopcdc/terraform_modules.git//aws/rds?ref=0.5.0" + rds_security_groups = module.doccano_ecs.ecs_tasks_sg + vpc_id = var.vpc_id + subnet_ids = var.private_subnet_ids + db_name = "doccano" +} + +resource "aws_ssm_parameter" "DATABASE_URL" { + name = "/${var.environment}/${var.app_name}/DATABASE_URL" + type = "SecureString" + value = "postgres://doccano:${module.rds.rds_random_password}@${module.rds.rds_enpoint}/doccano?sslmode=disable" +} \ No newline at end of file diff --git a/terraform/dev/provider.tf b/terraform/dev/provider.tf new file mode 100644 index 0000000000..d7266e3cea --- /dev/null +++ b/terraform/dev/provider.tf @@ -0,0 +1,19 @@ +provider "aws" { + region = var.aws_region + default_tags { + tags = { + Environment = var.environment + Name = var.app_name + } + } +} + +# terraform { +# backend "s3" { +# bucket = "pcdc-doccano-dev-tfstate-bucket" +# key = "terraform.tfstate" +# region = var.aws_region +# dynamodb_table = "pcdc-doccano-dynomodb-table-terraform-lock" +# encrypt = true +# } +# } \ No newline at end of file diff --git a/terraform/dev/variables.tf b/terraform/dev/variables.tf new file mode 100644 index 0000000000..2be645ee8a --- /dev/null +++ b/terraform/dev/variables.tf @@ -0,0 +1,27 @@ +variable "aws_region" { + default = "us-east-1" +} + +variable "environment" { + default = "dev" +} + +variable "app_name" { + default = "doccano" +} + +variable "private_subnet_ids" { + default = ["subnet-02daaea0d231975df", "subnet-0c7f4570d0c82bdc3"] +} + +variable "vpc_id" { + default = "vpc-0e20603ab3c8dd65e" #doccano dev vpc +} + +variable "efs_sg_id" { + default = "" +} + +# variable "alb_sg_id" { +# default = "" +# } \ No newline at end of file diff --git a/terraform/main.tf b/terraform/main.tf new file mode 100644 index 0000000000..b8a3124b3f --- /dev/null +++ b/terraform/main.tf @@ -0,0 +1,3 @@ +module "dev" { + source = "./dev" +} \ No newline at end of file diff --git a/terraform/modules/ecs/cloudwatch.tf b/terraform/modules/ecs/cloudwatch.tf new file mode 100644 index 0000000000..c4ac11b1d5 --- /dev/null +++ b/terraform/modules/ecs/cloudwatch.tf @@ -0,0 +1,24 @@ +resource "aws_cloudwatch_log_group" "doccano" { + name = "/ecs/doccano-logs" + retention_in_days = 7 +} + +resource "aws_cloudwatch_log_group" "flower" { + name = "/ecs/flower-logs" + retention_in_days = 7 +} + +resource "aws_cloudwatch_log_group" "celery" { + name = "/ecs/celery-logs" + retention_in_days = 7 +} + +resource "aws_cloudwatch_log_group" "nginx" { + name = "/ecs/nginx-logs" + retention_in_days = 7 +} + +resource "aws_cloudwatch_log_group" "rabbitmq" { + name = "/ecs/rabbitmq-logs" + retention_in_days = 7 +} \ No newline at end of file diff --git a/terraform/modules/ecs/cluster.tf b/terraform/modules/ecs/cluster.tf new file mode 100644 index 0000000000..fa8491a866 --- /dev/null +++ b/terraform/modules/ecs/cluster.tf @@ -0,0 +1,3 @@ +resource "aws_ecs_cluster" "cluster" { + name = "${var.environment}-cluster" +} \ No newline at end of file diff --git a/terraform/modules/ecs/ecs.tf b/terraform/modules/ecs/ecs.tf new file mode 100644 index 0000000000..c4ac3c51f6 --- /dev/null +++ b/terraform/modules/ecs/ecs.tf @@ -0,0 +1,301 @@ +resource "aws_ecs_service" "doccano_service" { + name = var.app_name + cluster = aws_ecs_cluster.cluster.id + task_definition = aws_ecs_task_definition.doccano.arn + desired_count = var.container_count + launch_type = "FARGATE" + enable_execute_command = true + + network_configuration { + security_groups = [aws_security_group.ecs_tasks.id] + subnets = var.subnet_ids + assign_public_ip = true + } + + load_balancer { + target_group_arn = var.target_group_arn + container_name = var.container_name + container_port = var.container_port + } + +} + + +resource "aws_ecs_task_definition" "doccano" { + family = "doccano" + requires_compatibilities = ["FARGATE"] + cpu = var.cpu + memory = var.memory + network_mode = "awsvpc" + execution_role_arn = aws_iam_role.ecs_task_execution_role.arn + task_role_arn = aws_iam_role.ecs_task_execution_role.arn + + volume { + name = "static-volume" + efs_volume_configuration { + file_system_id = var.efs_volume + root_directory = "/" + authorization_config { + access_point_id = var.efs_access_point_static_files + iam = "ENABLED" + } + transit_encryption = "ENABLED" + } + } + volume { + name = "media-volume" + efs_volume_configuration { + file_system_id = var.efs_volume + root_directory = "/" + authorization_config { + access_point_id = var.efs_access_point_id_media + iam = "ENABLED" + } + transit_encryption = "ENABLED" + } + } + volume { + name = "tmp-volume" + efs_volume_configuration { + file_system_id = var.efs_volume + root_directory = "/" + authorization_config { + access_point_id = var.efs_access_point_id_tmp + iam = "ENABLED" + } + transit_encryption = "ENABLED" + } + } + container_definitions = jsonencode([ + { + name = "doccano" + image = "quay.io/pcdc/doccano:${var.application_tag}" #"quay.io/pcdc/doccano:be_20240813" + essential = true + mountPoints = [ + { + sourceVolume = "static-volume" + containerPath = "/backend/staticfiles" + }, + { + sourceVolume = "media-volume" + containerPath = "/backend/media" + }, + { + sourceVolume = "tmp-volume" + containerPath = "/backend/filepond-temp-uploads" + } + ] + environment = [{ + name = "ADMIN_USERNAME" + value = "admin" + }, { + name = "ADMIN_EMAIL" + value = "pcdc_root@lists.uchicago.edu" + }, { + name = "ALLOW_SIGNUP" + value = "False" + }, { + name = "DEBUG" + value = "False" + }, { + name = "DJANGO_SETTINGS_MODULE" + value = "config.settings.production" + }, { + name = "CELERY_BROKER_URL" + value = aws_ssm_parameter.CELERY_BROKER_URL.value + } + ] + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/doccano-logs", + "awslogs-region" : "us-east-1", + "awslogs-stream-prefix" : "ecs" + } + } + secrets = [{ + name = "ADMIN_PASSWORD" + valueFrom = aws_ssm_parameter.ADMIN_PASSWORD.arn + }, { + name = "DATABASE_URL" + valueFrom = var.database_url + } + ] + }, + { + name = "celery" + image = "quay.io/pcdc/doccano:${var.application_tag}" + essential = true + entryPoint = ["/opt/bin/prod-celery.sh"] + mountPoints = [ + { + sourceVolume = "media-volume" + containerPath = "/backend/media" + }, + { + sourceVolume = "tmp-volume" + containerPath = "/backend/filepond-temp-uploads" + } + ] + depends_on = [ + { + containerName = "rabbitmq" + condition = "START" + } + ] + environment = [{ + name = "PYTHONUNBUFFERED" + value = "1" + }, { + name = "ADMIN_EMAIL" + value = "pcdc_root@lists.uchicago.edu" + }, { + name = "DJANGO_SETTINGS_MODULE" + value = "config.settings.production" + } + ] + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/celery-logs", + "awslogs-region" : "us-east-1", + "awslogs-stream-prefix" : "ecs" + } + } + secrets = [{ + name = "CELERY_BROKER_URL" + valueFrom = aws_ssm_parameter.CELERY_BROKER_URL.arn + }, { + name = "DATABASE_URL" + valueFrom = var.database_url + } + ] + }, + { + name = "flower" + image = "quay.io/pcdc/doccano:${var.application_tag}" + essential = true + entryPoint = ["/opt/bin/prod-flower.sh"] + portMappings = [ + { + containerPort = 5555 + hostPort = 5555 + } + ] + depends_on = [ + { + containerName = "celery" + condition = "START" + } + ] + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/flower-logs", + "awslogs-region" : "us-east-1", + "awslogs-stream-prefix" : "ecs" + } + } + environment = [{ + name = "PYTHONUNBUFFERED" + value = "1" + }, { + name = "ADMIN_EMAIL" + value = "pcdc_root@lists.uchicago.edu" + }, { + name = "DJANGO_SETTINGS_MODULE" + value = "config.settings.production" + } + ] + secrets = [{ + name = "CELERY_BROKER_URL" + valueFrom = aws_ssm_parameter.CELERY_BROKER_URL.arn + }, { + name = "DATABASE_URL" + valueFrom = var.database_url + }, { + name = "FLOWER_BASIC_AUTH" + valueFrom = aws_ssm_parameter.FLOWER_BASIC_AUTH.arn + } + ] + }, + { + name = "rabbitmq" + image = "${var.rabbitmq_image}:${var.application_tag}" + essential = true + portMappings = [ + { + containerPort = 5672 + hostPort = 5672 + } + ] + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/rabbitmq-logs", + "awslogs-region" : "us-east-1", + "awslogs-stream-prefix" : "ecs" + } + } + environment = [{ + name = "RABBITMQ_DEFAULT_USER" + value = "doccano" + }] + secrets = [{ + name = "RABBITMQ_DEFAULT_PASS" + valueFrom = aws_ssm_parameter.RABBITMQ_DEFAULT_PASS.arn + } + ] + }, + { + name = "nginx" + image = "quay.io/pcdc/doccano:${var.application_tag}" #"quay.io/pcdc/doccano:fe_20240813" + essential = true + entryPoint = ["/bin/sh", "-c"] + command = ["envsubst < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf && nginx -g 'daemon off;'"] + portMappings = [ + { + containerPort = 8080 + hostPort = 8080 + } + ] + mountPoints = [ + { + sourceVolume = "static-volume" + containerPath = "/static" + }, + { + sourceVolume = "media-volume" + containerPath = "/media" + } + ] + depends_on = [ + { + containerName = "doccano" + condition = "COMPLETE" + } + ] + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/nginx-logs", + "awslogs-region" : "us-east-1", + "awslogs-stream-prefix" : "ecs" + } + } + environment = [{ + name = "API_URL" + value = "http://localhost:8000" + }, { + name = "GOOGLE_TRACKING_ID" + value = "" + }, { + name = "WORKER_PROCESSES" + value = "auto" + }] + secrets = [] + } + ]) +} + + diff --git a/terraform/modules/ecs/iam.tf b/terraform/modules/ecs/iam.tf new file mode 100644 index 0000000000..b8d49b9355 --- /dev/null +++ b/terraform/modules/ecs/iam.tf @@ -0,0 +1,33 @@ +resource "aws_iam_role" "ecs_task_execution_role" { + name = "EcsTaskExecutionRole-${var.app_name}-${var.environment}" + + assume_role_policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Action = "sts:AssumeRole" + Effect = "Allow" + Sid = "" + Principal = { + Service = "ecs-tasks.amazonaws.com" + } + }, + ] + }) +} + +resource "aws_iam_role_policy_attachment" "ecs_execution_role_policy" { + for_each = toset([ + # "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy", + "arn:aws:iam::aws:policy/AmazonSSMFullAccess", + "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess", + "arn:aws:iam::aws:policy/service-role/AWSAppRunnerServicePolicyForECRAccess" + ]) + role = aws_iam_role.ecs_task_execution_role.name + policy_arn = each.value +} + +# resource "aws_iam_role_policy" "ecs_execution_inline" { +# name = "task-inline-policy" + +# } \ No newline at end of file diff --git a/terraform/modules/ecs/outputs.tf b/terraform/modules/ecs/outputs.tf new file mode 100644 index 0000000000..dda3213af3 --- /dev/null +++ b/terraform/modules/ecs/outputs.tf @@ -0,0 +1,3 @@ +output "ecs_tasks_sg" { + value = aws_security_group.ecs_tasks.id +} \ No newline at end of file diff --git a/terraform/modules/ecs/sg.tf b/terraform/modules/ecs/sg.tf new file mode 100644 index 0000000000..8ed8ca320b --- /dev/null +++ b/terraform/modules/ecs/sg.tf @@ -0,0 +1,20 @@ +# Traffic to the ECS cluster should only come from the ALB +resource "aws_security_group" "ecs_tasks" { + name = "doccano-ecs-security-group" + description = "allow inbound access from the ALB only" + vpc_id = var.vpc_id + + ingress { + protocol = "tcp" + from_port = 8080 + to_port = 8080 + security_groups = var.lb_security_group + } + + egress { + protocol = "-1" + from_port = 0 + to_port = 0 + cidr_blocks = ["0.0.0.0/0"] + } +} \ No newline at end of file diff --git a/terraform/modules/ecs/ssm.tf b/terraform/modules/ecs/ssm.tf new file mode 100644 index 0000000000..a84c7e62b4 --- /dev/null +++ b/terraform/modules/ecs/ssm.tf @@ -0,0 +1,35 @@ +resource "aws_ssm_parameter" "ADMIN_PASSWORD" { + name = "/${var.environment}/${var.app_name}/ADMIN_PASSWORD" + type = "SecureString" + value = "change-password" + lifecycle { + ignore_changes = ["value"] + } +} + +resource "aws_ssm_parameter" "RABBITMQ_DEFAULT_PASS" { + name = "/${var.environment}/${var.app_name}/RABBITMQ_DEFAULT_PASS" + type = "SecureString" + value = "doccano" + lifecycle { + ignore_changes = ["value"] + } +} + +resource "aws_ssm_parameter" "FLOWER_BASIC_AUTH" { + name = "/${var.environment}/${var.app_name}/FLOWER_BASIC_AUTH" + type = "SecureString" + value = "change-password" + lifecycle { + ignore_changes = ["value"] + } +} + +resource "aws_ssm_parameter" "CELERY_BROKER_URL" { + name = "/${var.environment}/${var.app_name}/CELERY_BROKER_URL" + type = "SecureString" + value = "amqp://doccano:doccano@localhost" + lifecycle { + ignore_changes = ["value"] + } +} \ No newline at end of file diff --git a/terraform/modules/ecs/variables.tf b/terraform/modules/ecs/variables.tf new file mode 100644 index 0000000000..cb5e1ed611 --- /dev/null +++ b/terraform/modules/ecs/variables.tf @@ -0,0 +1,75 @@ +variable "environment" { + default = "dev" +} + +variable "app_name" { + default = "doccano" +} + +variable "container_count" { + default = 1 +} + +variable "container_name" { +} + +variable "container_port" { + default = 8080 +} + +variable "doccano_image" { + default = "quay.io/pcdc/doccano" +} + +variable "application_tag" { + default = "latest" +} + +variable "rabbitmq_image" { + default = "rabbitmq" +} + +variable "cpu" { + description = "Default cpu amount for task" + default = "512" +} + +variable "memory" { + description = "Default memory amount for task" + default = "1024" +} + + +variable "efs_access_point_static_files" { +} + +variable "efs_access_point_id_media" { +} + +variable "efs_access_point_id_tmp" { +} + +variable "vpc_id" { +} + +variable "target_group_arn" {} + +variable "lb_security_group" { + type = list(string) +} + +variable "subnet_ids" { + type = list(string) + default = [""] +} + +variable "database_url" { + default = "" +} + +variable "load_balancer" { +} + +variable "efs_volume" { + type = string +} \ No newline at end of file