From 8c98429e2850b0d906adc5ea5b4bcabfacb15c1c Mon Sep 17 00:00:00 2001 From: bashirmatov Date: Thu, 22 May 2025 10:41:00 -0500 Subject: [PATCH 1/6] add terraform code for doccano service and conf file changes for nginx --- .gitignore | 6 + docker/Dockerfile.nginx | 2 +- docker/nginx/default.conf | 6 +- docker/nginx/nginx.conf.template | 2 +- terraform/.terraform.lock.hcl | 43 ++++ terraform/dev/main.tf | 39 ++++ terraform/dev/provider.tf | 9 + terraform/dev/variables.tf | 27 +++ terraform/main.tf | 3 + terraform/modules/alb/alb.tf | 55 +++++ terraform/modules/alb/outputs.tf | 7 + terraform/modules/alb/variables.tf | 15 ++ terraform/modules/ecs/cloudwatch.tf | 19 ++ terraform/modules/ecs/cluster.tf | 3 + terraform/modules/ecs/ecs.tf | 302 ++++++++++++++++++++++++++++ terraform/modules/ecs/iam.tf | 33 +++ terraform/modules/ecs/outputs.tf | 3 + terraform/modules/ecs/sg.tf | 20 ++ terraform/modules/ecs/ssm.tf | 35 ++++ terraform/modules/ecs/variables.tf | 52 +++++ terraform/modules/efs/efs.tf | 82 ++++++++ terraform/modules/efs/outputs.tf | 15 ++ terraform/modules/efs/variables.tf | 15 ++ terraform/modules/rds/outputs.tf | 11 + terraform/modules/rds/rds.tf | 73 +++++++ terraform/modules/rds/variables.tf | 84 ++++++++ 26 files changed, 956 insertions(+), 5 deletions(-) create mode 100644 terraform/.terraform.lock.hcl create mode 100644 terraform/dev/main.tf create mode 100644 terraform/dev/provider.tf create mode 100644 terraform/dev/variables.tf create mode 100644 terraform/main.tf create mode 100644 terraform/modules/alb/alb.tf create mode 100644 terraform/modules/alb/outputs.tf create mode 100644 terraform/modules/alb/variables.tf create mode 100644 terraform/modules/ecs/cloudwatch.tf create mode 100644 terraform/modules/ecs/cluster.tf create mode 100644 terraform/modules/ecs/ecs.tf create mode 100644 terraform/modules/ecs/iam.tf create mode 100644 terraform/modules/ecs/outputs.tf create mode 100644 terraform/modules/ecs/sg.tf create mode 100644 terraform/modules/ecs/ssm.tf create mode 100644 terraform/modules/ecs/variables.tf create mode 100644 terraform/modules/efs/efs.tf create mode 100644 terraform/modules/efs/outputs.tf create mode 100644 terraform/modules/efs/variables.tf create mode 100644 terraform/modules/rds/outputs.tf create mode 100644 terraform/modules/rds/rds.tf create mode 100644 terraform/modules/rds/variables.tf diff --git a/.gitignore b/.gitignore index 498dc19325..78ec6db816 100644 --- a/.gitignore +++ b/.gitignore @@ -205,3 +205,9 @@ backend/filepond-temp-uploads backend/media backend/*.sqlite3* frontend/assets/fonts + +*.auto.tfvars +.terraform/ +.terraformrc +*.tfstate +terraform.tfstate.backup diff --git a/docker/Dockerfile.nginx b/docker/Dockerfile.nginx index cc542b77f9..18e7f39165 100644 --- a/docker/Dockerfile.nginx +++ b/docker/Dockerfile.nginx @@ -1,5 +1,5 @@ ARG NODE_VERSION="16_16_bullseye_slim" -FROM quay.io/pcdc/node:${NODE_VERSION} AS frontend-builder +FROM node:20.19-bullseye-slim AS frontend-builder COPY frontend/ /app/ WORKDIR /app diff --git a/docker/nginx/default.conf b/docker/nginx/default.conf index ec65788aec..3a5aa77a57 100644 --- a/docker/nginx/default.conf +++ b/docker/nginx/default.conf @@ -12,7 +12,7 @@ server { } location /v1/ { - proxy_pass http://backend:8000/v1/; + proxy_pass http://localhost:8000/v1/; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_redirect off; @@ -20,7 +20,7 @@ server { } location /admin/ { - proxy_pass http://backend:8000/admin/; + proxy_pass http://localhost:8000/admin/; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_redirect off; @@ -32,7 +32,7 @@ server { } location /swagger/ { - proxy_pass http://backend:8000/swagger/; + proxy_pass http://localhost:8000/swagger/; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_redirect off; diff --git a/docker/nginx/nginx.conf.template b/docker/nginx/nginx.conf.template index f3a7155bd7..cb16cc1622 100644 --- a/docker/nginx/nginx.conf.template +++ b/docker/nginx/nginx.conf.template @@ -1,4 +1,4 @@ -worker_processes ${WORKER_PROCESSES}; +worker_processes auto; error_log /var/log/nginx/error.log warn; diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl new file mode 100644 index 0000000000..65995601a1 --- /dev/null +++ b/terraform/.terraform.lock.hcl @@ -0,0 +1,43 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/aws" { + version = "5.97.0" + hashes = [ + "h1:rUDE0OgA+6IiEA+w0cPp3/QQNH4SpjFjYcQ6p7byKS4=", + "zh:02790ad98b767d8f24d28e8be623f348bcb45590205708334d52de2fb14f5a95", + "zh:088b4398a161e45762dc28784fcc41c4fa95bd6549cb708b82de577f2d39ffc7", + "zh:0c381a457b7af391c43fc0167919443f6105ad2702bde4d02ddea9fd7c9d3539", + "zh:1a4b57a5043dcca64d8b8bae8b30ef4f6b98ed2144f792f39c4e816d3f1e2c56", + "zh:1bf00a67f39e67664337bde065180d41d952242801ebcd1c777061d4ffaa1cc1", + "zh:24c549f53d6bd022af31426d3e78f21264d8a72409821669e7fd41966ae68b2b", + "zh:3abda50bbddb35d86081fe39522e995280aea7f004582c4af22112c03ac8b375", + "zh:7388ed7f21ce2eb46bd9066626ce5f3e2a5705f67f643acce8ae71972f66eaf6", + "zh:96740f2ff94e5df2b2d29a5035a1a1026fe821f61712b2099b224fb2c2277663", + "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", + "zh:9f399f8e8683a3a3a6d63a41c7c3a5a5f266eedef40ea69eba75bacf03699879", + "zh:bcf2b288d4706ebd198f75d2159663d657535483331107f2cdef381f10688baf", + "zh:cc76c8a9fc3bad05a8779c1f80fe8c388734f1ec1dd0affa863343490527b466", + "zh:de4359cf1b057bfe7a563be93829ec64bf72e7a2b85a72d075238081ef5eb1db", + "zh:e208fa77051a1f9fa1eff6c5c58aabdcab0de1695b97cdea7b8dd81df3e0ed73", + ] +} + +provider "registry.terraform.io/hashicorp/random" { + version = "3.7.2" + hashes = [ + "h1:KG4NuIBl1mRWU0KD/BGfCi1YN/j3F7H4YgeeM7iSdNs=", + "zh:14829603a32e4bc4d05062f059e545a91e27ff033756b48afbae6b3c835f508f", + "zh:1527fb07d9fea400d70e9e6eb4a2b918d5060d604749b6f1c361518e7da546dc", + "zh:1e86bcd7ebec85ba336b423ba1db046aeaa3c0e5f921039b3f1a6fc2f978feab", + "zh:24536dec8bde66753f4b4030b8f3ef43c196d69cccbea1c382d01b222478c7a3", + "zh:29f1786486759fad9b0ce4fdfbbfece9343ad47cd50119045075e05afe49d212", + "zh:4d701e978c2dd8604ba1ce962b047607701e65c078cb22e97171513e9e57491f", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:7b8434212eef0f8c83f5a90c6d76feaf850f6502b61b53c329e85b3b281cba34", + "zh:ac8a23c212258b7976e1621275e3af7099e7e4a3d4478cf8d5d2a27f3bc3e967", + "zh:b516ca74431f3df4c6cf90ddcdb4042c626e026317a33c53f0b445a3d93b720d", + "zh:dc76e4326aec2490c1600d6871a95e78f9050f9ce427c71707ea412a2f2f1a62", + "zh:eac7b63e86c749c7d48f527671c7aee5b4e26c10be6ad7232d6860167f99dbb0", + ] +} diff --git a/terraform/dev/main.tf b/terraform/dev/main.tf new file mode 100644 index 0000000000..40fc87f9cf --- /dev/null +++ b/terraform/dev/main.tf @@ -0,0 +1,39 @@ +module "doccano_ecs" { + source = "../modules/ecs" + app_name = var.app_name + subnet_ids = var.private_subnet_ids + lb_security_group = [module.doccano_alb.lb_security_group] + load_balancer = { + container_port = 8080 + } + vpc_id = var.vpc_id + target_group_arn = module.doccano_alb.doccano_target_group.arn + container_name = "nginx" + container_count = 2 + efs_volume = module.doccano_efs.aws_efs_file_system + aws_efs_access_point_static_files = module.doccano_efs.access_point_id_static_files + efs_access_point_id_media = module.doccano_efs.access_point_id_media + efs_access_point_id_tmp = module.doccano_efs.access_point_id_tmp + database_url = module.rds.database_url +} + +module "doccano_efs" { + source = "../modules/efs" + efs_name = var.app_name + vpc_id = var.vpc_id + subnet_ids = var.private_subnet_ids + security_groups = [module.doccano_ecs.ecs_tasks_sg] +} + +module "doccano_alb" { + source = "../modules/alb" + environment = var.environment + vpc_id = var.vpc_id + subnet_ids = var.private_subnet_ids +} + +module "rds" { + source = "../modules/rds" + rds_security_groups = module.doccano_ecs.ecs_tasks_sg + vpc_id = var.vpc_id +} \ No newline at end of file diff --git a/terraform/dev/provider.tf b/terraform/dev/provider.tf new file mode 100644 index 0000000000..f68dae8aaa --- /dev/null +++ b/terraform/dev/provider.tf @@ -0,0 +1,9 @@ +provider "aws" { + region = var.aws_region + default_tags { + tags = { + Environment = var.environment + Name = var.app_name + } + } +} \ No newline at end of file diff --git a/terraform/dev/variables.tf b/terraform/dev/variables.tf new file mode 100644 index 0000000000..c65a789909 --- /dev/null +++ b/terraform/dev/variables.tf @@ -0,0 +1,27 @@ +variable "aws_region" { + default = "us-east-1" +} + +variable "environment" { + default = "dev" +} + +variable "app_name" { + default = "doccano" +} + +variable "private_subnet_ids" { + default = ["subnet-02daaea0d231975df", "subnet-0c7f4570d0c82bdc3"] +} + +variable "vpc_id" { + default = "vpc-0e20603ab3c8dd65e" +} + +variable "efs_sg_id" { + default = "" +} + +# variable "alb_sg_id" { +# default = "" +# } \ No newline at end of file diff --git a/terraform/main.tf b/terraform/main.tf new file mode 100644 index 0000000000..b8a3124b3f --- /dev/null +++ b/terraform/main.tf @@ -0,0 +1,3 @@ +module "dev" { + source = "./dev" +} \ No newline at end of file diff --git a/terraform/modules/alb/alb.tf b/terraform/modules/alb/alb.tf new file mode 100644 index 0000000000..0f1fb0452c --- /dev/null +++ b/terraform/modules/alb/alb.tf @@ -0,0 +1,55 @@ +resource "aws_lb" "doccano_lb" { + name = "doccano-lb-${var.environment}" + internal = false + load_balancer_type = "application" + security_groups = [aws_security_group.lb.id] #[aws_security_group.lb.id] + subnets = var.subnet_ids #["subnet-02daaea0d231975df", "subnet-0c7f4570d0c82bdc3"] +} + +resource "aws_lb_listener" "http" { + load_balancer_arn = aws_lb.doccano_lb.arn + port = 80 + protocol = "HTTP" + + default_action { + type = "forward" + target_group_arn = aws_lb_target_group.doccano_target_group.arn + } +} + +resource "aws_lb_target_group" "doccano_target_group" { + name = "doccano-${var.environment}-target-group" + port = 80 + protocol = "HTTP" + target_type = "ip" + vpc_id = var.vpc_id + + health_check { + path = "/" + interval = 30 + timeout = 5 + healthy_threshold = 2 + unhealthy_threshold = 3 + } +} + +# ALB security Group: Edit to restrict access to the application +resource "aws_security_group" "lb" { + name = "doccano-lb-security-group" + description = "controls access to the ALB" + vpc_id = var.vpc_id + + ingress { + protocol = "tcp" + from_port = 80 + to_port = 80 + cidr_blocks = ["0.0.0.0/0"] + } + + egress { + protocol = "-1" + from_port = 0 + to_port = 0 + cidr_blocks = ["0.0.0.0/0"] + } +} \ No newline at end of file diff --git a/terraform/modules/alb/outputs.tf b/terraform/modules/alb/outputs.tf new file mode 100644 index 0000000000..a8136c064d --- /dev/null +++ b/terraform/modules/alb/outputs.tf @@ -0,0 +1,7 @@ +output "doccano_target_group" { + value = aws_lb_target_group.doccano_target_group +} + +output "lb_security_group" { + value = aws_security_group.lb.id +} \ No newline at end of file diff --git a/terraform/modules/alb/variables.tf b/terraform/modules/alb/variables.tf new file mode 100644 index 0000000000..c0f2ec6a0e --- /dev/null +++ b/terraform/modules/alb/variables.tf @@ -0,0 +1,15 @@ +variable "environment" { + +} + +variable "subnet_ids" { + +} + +# variable "security_group_id" { + +# } + +variable "vpc_id" { + +} \ No newline at end of file diff --git a/terraform/modules/ecs/cloudwatch.tf b/terraform/modules/ecs/cloudwatch.tf new file mode 100644 index 0000000000..f2c9156c09 --- /dev/null +++ b/terraform/modules/ecs/cloudwatch.tf @@ -0,0 +1,19 @@ +resource "aws_cloudwatch_log_group" "doccano" { + name = "/ecs/doccano-logs" +} + +resource "aws_cloudwatch_log_group" "flower" { + name = "/ecs/flower-logs" +} + +resource "aws_cloudwatch_log_group" "celery" { + name = "/ecs/celery-logs" +} + +resource "aws_cloudwatch_log_group" "nginx" { + name = "/ecs/nginx-logs" +} + +resource "aws_cloudwatch_log_group" "rabbitmq" { + name = "/ecs/rabbitmq-logs" +} \ No newline at end of file diff --git a/terraform/modules/ecs/cluster.tf b/terraform/modules/ecs/cluster.tf new file mode 100644 index 0000000000..fa8491a866 --- /dev/null +++ b/terraform/modules/ecs/cluster.tf @@ -0,0 +1,3 @@ +resource "aws_ecs_cluster" "cluster" { + name = "${var.environment}-cluster" +} \ No newline at end of file diff --git a/terraform/modules/ecs/ecs.tf b/terraform/modules/ecs/ecs.tf new file mode 100644 index 0000000000..ad09f15cdf --- /dev/null +++ b/terraform/modules/ecs/ecs.tf @@ -0,0 +1,302 @@ +resource "aws_ecs_service" "doccano_service" { + name = var.app_name + cluster = aws_ecs_cluster.cluster.id + task_definition = aws_ecs_task_definition.doccano.arn + desired_count = var.container_count + launch_type = "FARGATE" + enable_execute_command = true + + network_configuration { + security_groups = [aws_security_group.ecs_tasks.id] + subnets = var.subnet_ids + assign_public_ip = true + } + + load_balancer { + target_group_arn = var.target_group_arn + container_name = var.container_name + container_port = var.container_port + } + +} + + +resource "aws_ecs_task_definition" "doccano" { + family = "doccano" + requires_compatibilities = ["FARGATE"] + cpu = 1024 + memory = 2048 + network_mode = "awsvpc" + execution_role_arn = aws_iam_role.ecs_task_execution_role.arn + task_role_arn = aws_iam_role.ecs_task_execution_role.arn + + volume { + name = "static-volume" + efs_volume_configuration { + file_system_id = var.efs_volume + root_directory = "/" + authorization_config { + access_point_id = var.aws_efs_access_point_static_files + iam = "ENABLED" + } + transit_encryption = "ENABLED" + } + } + volume { + name = "media-volume" + efs_volume_configuration { + file_system_id = var.efs_volume + root_directory = "/" + authorization_config { + access_point_id = var.efs_access_point_id_media + iam = "ENABLED" + } + transit_encryption = "ENABLED" + } + } + volume { + name = "tmp-volume" + efs_volume_configuration { + file_system_id = var.efs_volume + root_directory = "/" + authorization_config { + access_point_id = var.efs_access_point_id_tmp + iam = "ENABLED" + } + transit_encryption = "ENABLED" + } + } + container_definitions = jsonencode([ + { + name = "doccano" + image = "quay.io/pcdc/doccano:be_20240813" + essential = true + mountPoints = [ + { + sourceVolume = "static-volume" + containerPath = "/backend/staticfiles" + }, + { + sourceVolume = "media-volume" + containerPath = "/backend/media" + }, + { + sourceVolume = "tmp-volume" + containerPath = "/backend/filepond-temp-uploads" + } + ] + environment = [{ + name = "ADMIN_USERNAME" + value = "admin" + }, { + name = "ADMIN_EMAIL" + value = "pcdc_root@lists.uchicago.edu" + }, { + name = "ALLOW_SIGNUP" + value = "False" + }, { + name = "DEBUG" + value = "False" + }, { + name = "DJANGO_SETTINGS_MODULE" + value = "config.settings.production" + }, { + name = "CELERY_BROKER_URL" + value = aws_ssm_parameter.CELERY_BROKER_URL.value + } + ] + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/doccano-logs", + "awslogs-region" : "us-east-1", + "awslogs-stream-prefix" : "ecs" + } + } + secrets = [{ + name = "ADMIN_PASSWORD" + valueFrom = aws_ssm_parameter.ADMIN_PASSWORD.arn + }, { + name = "DATABASE_URL" + valueFrom = var.database_url + } + ] + }, + { + name = "celery" + image = "quay.io/pcdc/doccano:be_20240813" + essential = true + entryPoint = ["/opt/bin/prod-celery.sh"] + mountPoints = [ + { + sourceVolume = "media-volume" + containerPath = "/backend/media" + }, + { + sourceVolume = "tmp-volume" + containerPath = "/backend/filepond-temp-uploads" + } + ] + depends_on = [ + { + containerName = "rabbitmq" + condition = "START" + } + ] + environment = [{ + name = "PYTHONUNBUFFERED" + value = "1" + }, { + name = "ADMIN_EMAIL" + value = "pcdc_root@lists.uchicago.edu" + }, { + name = "DJANGO_SETTINGS_MODULE" + value = "config.settings.production" + } + ] + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/celery-logs", + "awslogs-region" : "us-east-1", + "awslogs-stream-prefix" : "ecs" + } + } + secrets = [{ + name = "CELERY_BROKER_URL" + valueFrom = aws_ssm_parameter.CELERY_BROKER_URL.arn + }, { + name = "DATABASE_URL" + valueFrom = var.database_url + } + ] + }, + { + name = "flower" + image = "quay.io/pcdc/doccano:be_20240813" + essential = true + entryPoint = ["/opt/bin/prod-flower.sh"] + portMappings = [ + { + containerPort = 5555 + hostPort = 5555 + } + ] + depends_on = [ + { + containerName = "celery" + condition = "START" + } + ] + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/flower-logs", + "awslogs-region" : "us-east-1", + "awslogs-stream-prefix" : "ecs" + } + } + environment = [{ + name = "PYTHONUNBUFFERED" + value = "1" + }, { + name = "ADMIN_EMAIL" + value = "pcdc_root@lists.uchicago.edu" + }, { + name = "DJANGO_SETTINGS_MODULE" + value = "config.settings.production" + } + ] + secrets = [{ + name = "CELERY_BROKER_URL" + valueFrom = aws_ssm_parameter.CELERY_BROKER_URL.arn + }, { + name = "DATABASE_URL" + valueFrom = var.database_url + }, + { + name = "FLOWER_BASIC_AUTH" + valueFrom = aws_ssm_parameter.FLOWER_BASIC_AUTH.arn + } + ] + }, + { + name = "rabbitmq" + image = "rabbitmq:3.10.7-alpine" + essential = true + portMappings = [ + { + containerPort = 5672 + hostPort = 5672 + } + ] + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/rabbitmq-logs", + "awslogs-region" : "us-east-1", + "awslogs-stream-prefix" : "ecs" + } + } + environment = [{ + name = "RABBITMQ_DEFAULT_USER" + value = "doccano" + }] + secrets = [{ + name = "RABBITMQ_DEFAULT_PASS" + valueFrom = aws_ssm_parameter.RABBITMQ_DEFAULT_PASS.arn + } + ] + }, + { + name = "nginx" + image = "954006452010.dkr.ecr.us-east-1.amazonaws.com/doccano-nginx:latest" #"quay.io/pcdc/doccano:fe_20240813" + essential = true + entryPoint = ["/bin/sh", "-c"] + command = ["envsubst < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf && nginx -g 'daemon off;'"] + portMappings = [ + { + containerPort = 8080 + hostPort = 8080 + } + ] + mountPoints = [ + { + sourceVolume = "static-volume" + containerPath = "/static" + }, + { + sourceVolume = "media-volume" + containerPath = "/media" + } + ] + depends_on = [ + { + containerName = "doccano" + condition = "COMPLETE" + } + ] + "logConfiguration" : { + "logDriver" : "awslogs", + "options" : { + "awslogs-group" : "/ecs/nginx-logs", + "awslogs-region" : "us-east-1", + "awslogs-stream-prefix" : "ecs" + } + } + environment = [{ + name = "API_URL" + value = "http://localhost:8000" + }, { + name = "GOOGLE_TRACKING_ID" + value = "" + }, { + name = "WORKER_PROCESSES" + value = "auto" + }] + secrets = [] + } + ]) +} + + diff --git a/terraform/modules/ecs/iam.tf b/terraform/modules/ecs/iam.tf new file mode 100644 index 0000000000..b8d49b9355 --- /dev/null +++ b/terraform/modules/ecs/iam.tf @@ -0,0 +1,33 @@ +resource "aws_iam_role" "ecs_task_execution_role" { + name = "EcsTaskExecutionRole-${var.app_name}-${var.environment}" + + assume_role_policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Action = "sts:AssumeRole" + Effect = "Allow" + Sid = "" + Principal = { + Service = "ecs-tasks.amazonaws.com" + } + }, + ] + }) +} + +resource "aws_iam_role_policy_attachment" "ecs_execution_role_policy" { + for_each = toset([ + # "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy", + "arn:aws:iam::aws:policy/AmazonSSMFullAccess", + "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess", + "arn:aws:iam::aws:policy/service-role/AWSAppRunnerServicePolicyForECRAccess" + ]) + role = aws_iam_role.ecs_task_execution_role.name + policy_arn = each.value +} + +# resource "aws_iam_role_policy" "ecs_execution_inline" { +# name = "task-inline-policy" + +# } \ No newline at end of file diff --git a/terraform/modules/ecs/outputs.tf b/terraform/modules/ecs/outputs.tf new file mode 100644 index 0000000000..dda3213af3 --- /dev/null +++ b/terraform/modules/ecs/outputs.tf @@ -0,0 +1,3 @@ +output "ecs_tasks_sg" { + value = aws_security_group.ecs_tasks.id +} \ No newline at end of file diff --git a/terraform/modules/ecs/sg.tf b/terraform/modules/ecs/sg.tf new file mode 100644 index 0000000000..8ed8ca320b --- /dev/null +++ b/terraform/modules/ecs/sg.tf @@ -0,0 +1,20 @@ +# Traffic to the ECS cluster should only come from the ALB +resource "aws_security_group" "ecs_tasks" { + name = "doccano-ecs-security-group" + description = "allow inbound access from the ALB only" + vpc_id = var.vpc_id + + ingress { + protocol = "tcp" + from_port = 8080 + to_port = 8080 + security_groups = var.lb_security_group + } + + egress { + protocol = "-1" + from_port = 0 + to_port = 0 + cidr_blocks = ["0.0.0.0/0"] + } +} \ No newline at end of file diff --git a/terraform/modules/ecs/ssm.tf b/terraform/modules/ecs/ssm.tf new file mode 100644 index 0000000000..1412267dbc --- /dev/null +++ b/terraform/modules/ecs/ssm.tf @@ -0,0 +1,35 @@ +resource "aws_ssm_parameter" "ADMIN_PASSWORD" { + name = "/${var.environment}/${var.app_name}/ADMIN_PASSWORD" + type = "SecureString" + value = "change-password" + lifecycle { + ignore_changes = [ "value" ] + } +} + +resource "aws_ssm_parameter" "RABBITMQ_DEFAULT_PASS" { + name = "/${var.environment}/${var.app_name}/RABBITMQ_DEFAULT_PASS" + type = "SecureString" + value = "doccano" + lifecycle { + ignore_changes = [ "value" ] + } +} + +resource "aws_ssm_parameter" "FLOWER_BASIC_AUTH" { + name = "/${var.environment}/${var.app_name}/FLOWER_BASIC_AUTH" + type = "SecureString" + value = "change-password" + lifecycle { + ignore_changes = [ "value" ] + } +} + +resource "aws_ssm_parameter" "CELERY_BROKER_URL" { + name = "/${var.environment}/${var.app_name}/CELERY_BROKER_URL" + type = "SecureString" + value = "amqp://doccano:doccano@localhost" + lifecycle { + ignore_changes = [ "value" ] + } +} \ No newline at end of file diff --git a/terraform/modules/ecs/variables.tf b/terraform/modules/ecs/variables.tf new file mode 100644 index 0000000000..568beab6dd --- /dev/null +++ b/terraform/modules/ecs/variables.tf @@ -0,0 +1,52 @@ +variable "environment" { + default = "dev" +} + +variable "app_name" { + default = "doccano" +} + +variable "container_count" { + default = 1 +} + +variable "container_name" { +} + +variable "container_port" { + default = 8080 +} + +variable "aws_efs_access_point_static_files" { +} + +variable "efs_access_point_id_media" { +} + +variable "efs_access_point_id_tmp" { +} + +variable "vpc_id" { +} + +variable "target_group_arn" {} + +variable "lb_security_group" { + type = list(string) +} + +variable "subnet_ids" { + type = list(string) + default = [""] +} + +variable "database_url" { + default = "" +} + +variable "load_balancer" { +} + +variable "efs_volume" { + type = string +} \ No newline at end of file diff --git a/terraform/modules/efs/efs.tf b/terraform/modules/efs/efs.tf new file mode 100644 index 0000000000..a79877b1c7 --- /dev/null +++ b/terraform/modules/efs/efs.tf @@ -0,0 +1,82 @@ +resource "aws_efs_file_system" "this" { + creation_token = var.efs_name +} + +resource "aws_efs_mount_target" "this" { + for_each = toset(var.subnet_ids) + file_system_id = aws_efs_file_system.this.id + subnet_id = each.value + security_groups = [aws_security_group.efs_sg.id] +} + + +resource "aws_efs_access_point" "static_files" { + file_system_id = aws_efs_file_system.this.id + + root_directory { + path = "/backend/staticfiles" + creation_info { + owner_uid = 1000 + owner_gid = 1000 + permissions = "755" + } + } + posix_user { + uid = 1000 + gid = 1000 + } +} + +resource "aws_efs_access_point" "media" { + file_system_id = aws_efs_file_system.this.id + + root_directory { + path = "/backend/media" + creation_info { + owner_uid = 1000 + owner_gid = 1000 + permissions = "755" + } + } + posix_user { + uid = 1000 + gid = 1000 + } +} + +resource "aws_efs_access_point" "tmp" { + file_system_id = aws_efs_file_system.this.id + + root_directory { + path = "/backend/filepond-temp-uploads" + creation_info { + owner_uid = 1000 + owner_gid = 1000 + permissions = "755" + } + } + posix_user { + uid = 1000 + gid = 1000 + } +} + + +resource "aws_security_group" "efs_sg" { + name = "${var.efs_name}-efs-sg" + vpc_id = var.vpc_id + + ingress { + from_port = 2049 + to_port = 2049 + protocol = "tcp" + security_groups = var.security_groups #[aws_security_group.ecs_tasks.id] + } + + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } +} \ No newline at end of file diff --git a/terraform/modules/efs/outputs.tf b/terraform/modules/efs/outputs.tf new file mode 100644 index 0000000000..18bbba09d3 --- /dev/null +++ b/terraform/modules/efs/outputs.tf @@ -0,0 +1,15 @@ +output "aws_efs_file_system" { + value = aws_efs_file_system.this.id +} + +output "access_point_id_static_files" { + value = aws_efs_access_point.static_files.id +} + +output "access_point_id_media" { + value = aws_efs_access_point.media.id +} + +output "access_point_id_tmp" { + value = aws_efs_access_point.tmp.id +} \ No newline at end of file diff --git a/terraform/modules/efs/variables.tf b/terraform/modules/efs/variables.tf new file mode 100644 index 0000000000..edf4159343 --- /dev/null +++ b/terraform/modules/efs/variables.tf @@ -0,0 +1,15 @@ +variable "vpc_id" { + +} + +variable "efs_name" { + +} + +variable "subnet_ids" { + +} + +variable "security_groups" { + type = list(string) +} \ No newline at end of file diff --git a/terraform/modules/rds/outputs.tf b/terraform/modules/rds/outputs.tf new file mode 100644 index 0000000000..d7a3683ce0 --- /dev/null +++ b/terraform/modules/rds/outputs.tf @@ -0,0 +1,11 @@ +output "random_string" { + value = random_string.randompostgres.result +} + +output "rds_enpoint" { + value = aws_db_instance.this.endpoint +} + +output "database_url" { + value = aws_ssm_parameter.DATABASE_URL.arn +} \ No newline at end of file diff --git a/terraform/modules/rds/rds.tf b/terraform/modules/rds/rds.tf new file mode 100644 index 0000000000..17973ccbb6 --- /dev/null +++ b/terraform/modules/rds/rds.tf @@ -0,0 +1,73 @@ +resource "aws_db_instance" "this" { + identifier = var.app_name #var.rds_instance_identifier + engine = var.rds_instance_engine + engine_version = var.rds_instance_engine_version + instance_class = var.rds_instance_class + allocated_storage = var.rds_instance_allocated_storage + max_allocated_storage = var.rds_instance_max_allocated_storage + db_name = var.app_name #var.rds_instance_name + username = var.app_name + password = var.rds_instance_password == "" ? random_string.randompostgres.result : var.rds_instance_password + port = 5432 + publicly_accessible = var.rds_instance_publicly_accessible + multi_az = var.rds_instance_multi_az + storage_encrypted = true + backup_retention_period = var.rds_instance_backup_retention_period + skip_final_snapshot = var.rds_instance_skip_final_snapshot + vpc_security_group_ids = [aws_security_group.rds.id] + db_subnet_group_name = aws_db_subnet_group.this.name + + tags = { + Name = var.rds_instance_name + environment = var.environment + } +} + +resource "aws_db_subnet_group" "this" { + name = "${var.rds_instance_name}-${var.environment}" + subnet_ids = ["subnet-02daaea0d231975df", "subnet-0c7f4570d0c82bdc3"] + + tags = { + Name = var.rds_instance_name + } +} + +resource "random_string" "randompostgres" { + length = 16 + special = false +} + +resource "aws_ssm_parameter" "POSTGRES_PASSWORD" { + name = "/${var.environment}/${var.app_name}/POSTGRES_PASSWORD" + type = "SecureString" + value = random_string.randompostgres.result +} + +resource "aws_ssm_parameter" "DATABASE_URL" { + name = "/${var.environment}/${var.app_name}/DATABASE_URL" + type = "SecureString" + value = "postgres://doccano:${random_string.randompostgres.result}@${aws_db_instance.this.endpoint}/doccano?sslmode=disable" +} + + +#RDS DB Security Group +resource "aws_security_group" "rds" { + name = "doccano-rds-security-group" + description = "controls access to the RDS" + vpc_id = var.vpc_id + + ingress { + protocol = "tcp" + from_port = 5432 + to_port = 5432 + # cidr_blocks = ["0.0.0.0/0"] + security_groups = [var.rds_security_groups] + } + + egress { + protocol = "-1" + from_port = 0 + to_port = 0 + cidr_blocks = ["0.0.0.0/0"] + } +} \ No newline at end of file diff --git a/terraform/modules/rds/variables.tf b/terraform/modules/rds/variables.tf new file mode 100644 index 0000000000..78c9b84ebe --- /dev/null +++ b/terraform/modules/rds/variables.tf @@ -0,0 +1,84 @@ +variable "vpc_id" { + +} +variable "app_name" { + default = "doccano" +} + +variable "environment" { + default = "dev" +} + +variable "rds_instance_name" { + default = "doccano" +} + +variable "rds_instance_skip_final_snapshot" { + description = "rds instance skip final snapshot" + default = false +} + +variable "rds_instance_backup_retention_period" { + description = "The days to retain backups for. Must be between 0 and 35" + default = 0 +} + +variable "rds_instance_multi_az" { + description = "Specifies if the RDS instance is multi-AZ" + default = false +} + +variable "rds_instance_publicly_accessible" { + description = "Control if instance is publicly accessible" + default = true +} + +# variable "rds_instance_username" { +# default = "" #Defaulting to app name +# } + +variable "rds_instance_allocated_storage" { + description = "The allocated storage in GiB" + default = 10 +} + +variable "rds_instance_storage_type" { + description = "gp2, io1, standard" + default = "gp2" +} + +variable "rds_instance_class" { + description = "The instance type of the RDS instance" + default = "db.t3.micro" +} + +variable "rds_instance_engine" { + default = "postgres" +} + +variable "rds_instance_engine_version" { + description = "The engine version to use. If auto_minor_version_upgrade is enabled, you can provide a prefix of the version such as 5.7 (for 5.7.10) and this attribute will ignore differences in the patch version automatically (e.g. 5.7.17)" + default = "13" +} + +variable "rds_instance_max_allocated_storage" { + description = "Specifies the value for Storage Autoscaling" + default = 0 +} + +variable "rds_instance_password" { + description = "Password to use" + default = "" +} + +# variable "rds_instance_identifier" { +# description = "The name of the RDS instance, if omitted, Terraform will assign a random, unique identifier" +# type = string +# } + +# variable "database_url" { +# default = "" +# } +variable "rds_security_groups" { + default = "" +} \ No newline at end of file From 5f56c6565196958410452cb2781b67ad3742582a Mon Sep 17 00:00:00 2001 From: bashirmatov Date: Thu, 22 May 2025 11:19:12 -0500 Subject: [PATCH 2/6] update values for dev account --- terraform/dev/main.tf | 2 +- terraform/dev/variables.tf | 4 ++-- terraform/modules/ecs/cloudwatch.tf | 5 +++++ 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/terraform/dev/main.tf b/terraform/dev/main.tf index 40fc87f9cf..6a7e84231b 100644 --- a/terraform/dev/main.tf +++ b/terraform/dev/main.tf @@ -9,7 +9,7 @@ module "doccano_ecs" { vpc_id = var.vpc_id target_group_arn = module.doccano_alb.doccano_target_group.arn container_name = "nginx" - container_count = 2 + # container_count = 2 efs_volume = module.doccano_efs.aws_efs_file_system aws_efs_access_point_static_files = module.doccano_efs.access_point_id_static_files efs_access_point_id_media = module.doccano_efs.access_point_id_media diff --git a/terraform/dev/variables.tf b/terraform/dev/variables.tf index c65a789909..c7870ae353 100644 --- a/terraform/dev/variables.tf +++ b/terraform/dev/variables.tf @@ -11,11 +11,11 @@ variable "app_name" { } variable "private_subnet_ids" { - default = ["subnet-02daaea0d231975df", "subnet-0c7f4570d0c82bdc3"] + default = ["subnet-013e8d4a439201a84", "subnet-0025d9b857876f8a5"] } variable "vpc_id" { - default = "vpc-0e20603ab3c8dd65e" + default = "vpc-0ab59a594548de1b9" #doccano dev vpc } variable "efs_sg_id" { diff --git a/terraform/modules/ecs/cloudwatch.tf b/terraform/modules/ecs/cloudwatch.tf index f2c9156c09..e592d53f74 100644 --- a/terraform/modules/ecs/cloudwatch.tf +++ b/terraform/modules/ecs/cloudwatch.tf @@ -1,19 +1,24 @@ resource "aws_cloudwatch_log_group" "doccano" { name = "/ecs/doccano-logs" + retention_in_days = 7 } resource "aws_cloudwatch_log_group" "flower" { name = "/ecs/flower-logs" + retention_in_days = 7 } resource "aws_cloudwatch_log_group" "celery" { name = "/ecs/celery-logs" + retention_in_days = 7 } resource "aws_cloudwatch_log_group" "nginx" { name = "/ecs/nginx-logs" + retention_in_days = 7 } resource "aws_cloudwatch_log_group" "rabbitmq" { name = "/ecs/rabbitmq-logs" + retention_in_days = 7 } \ No newline at end of file From a0aa4ecf01049634b90610790d19386455a94412 Mon Sep 17 00:00:00 2001 From: bashirmatov Date: Fri, 30 May 2025 15:17:29 -0500 Subject: [PATCH 3/6] make rds and efs module --- terraform/dev/main.tf | 84 ++++++++++++++++++++++------- terraform/dev/variables.tf | 4 +- terraform/modules/alb/alb.tf | 6 +-- terraform/modules/alb/variables.tf | 10 ++-- terraform/modules/ecs/cloudwatch.tf | 10 ++-- terraform/modules/ecs/ecs.tf | 42 +++++++-------- terraform/modules/ecs/ssm.tf | 32 +++++------ terraform/modules/ecs/variables.tf | 2 +- terraform/modules/efs/efs.tf | 82 ---------------------------- terraform/modules/efs/outputs.tf | 15 ------ terraform/modules/efs/variables.tf | 15 ------ terraform/modules/rds/outputs.tf | 11 ---- terraform/modules/rds/rds.tf | 73 ------------------------- terraform/modules/rds/variables.tf | 84 ----------------------------- 14 files changed, 116 insertions(+), 354 deletions(-) delete mode 100644 terraform/modules/efs/efs.tf delete mode 100644 terraform/modules/efs/outputs.tf delete mode 100644 terraform/modules/efs/variables.tf delete mode 100644 terraform/modules/rds/outputs.tf delete mode 100644 terraform/modules/rds/rds.tf delete mode 100644 terraform/modules/rds/variables.tf diff --git a/terraform/dev/main.tf b/terraform/dev/main.tf index 6a7e84231b..19b97cd6df 100644 --- a/terraform/dev/main.tf +++ b/terraform/dev/main.tf @@ -1,39 +1,85 @@ module "doccano_ecs" { - source = "../modules/ecs" - app_name = var.app_name - subnet_ids = var.private_subnet_ids + source = "../modules/ecs" + app_name = var.app_name + subnet_ids = var.private_subnet_ids lb_security_group = [module.doccano_alb.lb_security_group] load_balancer = { container_port = 8080 } - vpc_id = var.vpc_id + vpc_id = var.vpc_id target_group_arn = module.doccano_alb.doccano_target_group.arn - container_name = "nginx" + container_name = "nginx" # container_count = 2 - efs_volume = module.doccano_efs.aws_efs_file_system - aws_efs_access_point_static_files = module.doccano_efs.access_point_id_static_files - efs_access_point_id_media = module.doccano_efs.access_point_id_media - efs_access_point_id_tmp = module.doccano_efs.access_point_id_tmp - database_url = module.rds.database_url + efs_volume = module.doccano_efs.efs_id + efs_access_point_static_files = module.doccano_efs.access_point_ids["staticfiles"] + efs_access_point_id_media = module.doccano_efs.access_point_ids["media"] + efs_access_point_id_tmp = module.doccano_efs.access_point_ids["tmp"] + database_url = aws_ssm_parameter.DATABASE_URL.arn } module "doccano_efs" { - source = "../modules/efs" - efs_name = var.app_name - vpc_id = var.vpc_id - subnet_ids = var.private_subnet_ids + source = "git::ssh://git@github.com/chicagopcdc/terraform_modules.git//aws/efs?ref=0.4.2" + vpc_id = var.vpc_id + efs_name = var.app_name + subnet_ids = var.private_subnet_ids security_groups = [module.doccano_ecs.ecs_tasks_sg] + access_points = [ + { + name = "media" + posix_user = { uid = 1000, gid = 1000 } + root_directory = { + path = "/backend/media" + creation_info = { + owner_uid = "1000" + owner_gid = "1000" + permissions = "755" + } + } + }, + { + name = "staticfiles" + posix_user = { uid = 1000, gid = 1000 } + root_directory = { + path = "/backend/staticfiles" + creation_info = { + owner_uid = "1000" + owner_gid = "1000" + permissions = "755" + } + } + }, + { + name = "tmp" + posix_user = { uid = 1000, gid = 1000 } + root_directory = { + path = "/backend/filepond-temp-uploads" + creation_info = { + owner_uid = "1000" + owner_gid = "1000" + permissions = "755" + } + } + } + ] } module "doccano_alb" { - source = "../modules/alb" + source = "../modules/alb" environment = var.environment - vpc_id = var.vpc_id - subnet_ids = var.private_subnet_ids + vpc_id = var.vpc_id + subnet_ids = var.private_subnet_ids } module "rds" { - source = "../modules/rds" + source = "git::ssh://git@github.com/chicagopcdc/terraform_modules.git//aws/rds?ref=0.4.2" rds_security_groups = module.doccano_ecs.ecs_tasks_sg - vpc_id = var.vpc_id + vpc_id = var.vpc_id + subnet_ids = var.private_subnet_ids + db_name = "doccano" +} + +resource "aws_ssm_parameter" "DATABASE_URL" { + name = "/${var.environment}/${var.app_name}/DATABASE_URL" + type = "SecureString" + value = "postgres://doccano:${module.rds.rds_random_password}@${module.rds.rds_enpoint}/doccano?sslmode=disable" } \ No newline at end of file diff --git a/terraform/dev/variables.tf b/terraform/dev/variables.tf index c7870ae353..2be645ee8a 100644 --- a/terraform/dev/variables.tf +++ b/terraform/dev/variables.tf @@ -11,11 +11,11 @@ variable "app_name" { } variable "private_subnet_ids" { - default = ["subnet-013e8d4a439201a84", "subnet-0025d9b857876f8a5"] + default = ["subnet-02daaea0d231975df", "subnet-0c7f4570d0c82bdc3"] } variable "vpc_id" { - default = "vpc-0ab59a594548de1b9" #doccano dev vpc + default = "vpc-0e20603ab3c8dd65e" #doccano dev vpc } variable "efs_sg_id" { diff --git a/terraform/modules/alb/alb.tf b/terraform/modules/alb/alb.tf index 0f1fb0452c..29fc4d4703 100644 --- a/terraform/modules/alb/alb.tf +++ b/terraform/modules/alb/alb.tf @@ -2,8 +2,8 @@ resource "aws_lb" "doccano_lb" { name = "doccano-lb-${var.environment}" internal = false load_balancer_type = "application" - security_groups = [aws_security_group.lb.id] #[aws_security_group.lb.id] - subnets = var.subnet_ids #["subnet-02daaea0d231975df", "subnet-0c7f4570d0c82bdc3"] + security_groups = [aws_security_group.lb.id] + subnets = var.subnet_ids } resource "aws_lb_listener" "http" { @@ -33,7 +33,7 @@ resource "aws_lb_target_group" "doccano_target_group" { } } -# ALB security Group: Edit to restrict access to the application +# ALB security Group: Need to add 443, once we get DNS domain hosted zone resource "aws_security_group" "lb" { name = "doccano-lb-security-group" description = "controls access to the ALB" diff --git a/terraform/modules/alb/variables.tf b/terraform/modules/alb/variables.tf index c0f2ec6a0e..205c1e2c7e 100644 --- a/terraform/modules/alb/variables.tf +++ b/terraform/modules/alb/variables.tf @@ -1,15 +1,11 @@ variable "environment" { - + } variable "subnet_ids" { - -} -# variable "security_group_id" { - -# } +} variable "vpc_id" { - + } \ No newline at end of file diff --git a/terraform/modules/ecs/cloudwatch.tf b/terraform/modules/ecs/cloudwatch.tf index e592d53f74..c4ac11b1d5 100644 --- a/terraform/modules/ecs/cloudwatch.tf +++ b/terraform/modules/ecs/cloudwatch.tf @@ -1,24 +1,24 @@ resource "aws_cloudwatch_log_group" "doccano" { - name = "/ecs/doccano-logs" + name = "/ecs/doccano-logs" retention_in_days = 7 } resource "aws_cloudwatch_log_group" "flower" { - name = "/ecs/flower-logs" + name = "/ecs/flower-logs" retention_in_days = 7 } resource "aws_cloudwatch_log_group" "celery" { - name = "/ecs/celery-logs" + name = "/ecs/celery-logs" retention_in_days = 7 } resource "aws_cloudwatch_log_group" "nginx" { - name = "/ecs/nginx-logs" + name = "/ecs/nginx-logs" retention_in_days = 7 } resource "aws_cloudwatch_log_group" "rabbitmq" { - name = "/ecs/rabbitmq-logs" + name = "/ecs/rabbitmq-logs" retention_in_days = 7 } \ No newline at end of file diff --git a/terraform/modules/ecs/ecs.tf b/terraform/modules/ecs/ecs.tf index ad09f15cdf..c1321cd345 100644 --- a/terraform/modules/ecs/ecs.tf +++ b/terraform/modules/ecs/ecs.tf @@ -12,7 +12,7 @@ resource "aws_ecs_service" "doccano_service" { assign_public_ip = true } - load_balancer { + load_balancer { target_group_arn = var.target_group_arn container_name = var.container_name container_port = var.container_port @@ -33,11 +33,11 @@ resource "aws_ecs_task_definition" "doccano" { volume { name = "static-volume" efs_volume_configuration { - file_system_id = var.efs_volume + file_system_id = var.efs_volume root_directory = "/" authorization_config { - access_point_id = var.aws_efs_access_point_static_files - iam = "ENABLED" + access_point_id = var.efs_access_point_static_files + iam = "ENABLED" } transit_encryption = "ENABLED" } @@ -45,11 +45,11 @@ resource "aws_ecs_task_definition" "doccano" { volume { name = "media-volume" efs_volume_configuration { - file_system_id = var.efs_volume + file_system_id = var.efs_volume root_directory = "/" authorization_config { access_point_id = var.efs_access_point_id_media - iam = "ENABLED" + iam = "ENABLED" } transit_encryption = "ENABLED" } @@ -57,19 +57,19 @@ resource "aws_ecs_task_definition" "doccano" { volume { name = "tmp-volume" efs_volume_configuration { - file_system_id = var.efs_volume + file_system_id = var.efs_volume root_directory = "/" authorization_config { access_point_id = var.efs_access_point_id_tmp - iam = "ENABLED" + iam = "ENABLED" } transit_encryption = "ENABLED" } } container_definitions = jsonencode([ { - name = "doccano" - image = "quay.io/pcdc/doccano:be_20240813" + name = "doccano" + image = "quay.io/pcdc/doccano:be_20240813" essential = true mountPoints = [ { @@ -101,7 +101,7 @@ resource "aws_ecs_task_definition" "doccano" { name = "DJANGO_SETTINGS_MODULE" value = "config.settings.production" }, { - name = "CELERY_BROKER_URL" + name = "CELERY_BROKER_URL" value = aws_ssm_parameter.CELERY_BROKER_URL.value } ] @@ -123,8 +123,8 @@ resource "aws_ecs_task_definition" "doccano" { ] }, { - name = "celery" - image = "quay.io/pcdc/doccano:be_20240813" + name = "celery" + image = "quay.io/pcdc/doccano:be_20240813" essential = true entryPoint = ["/opt/bin/prod-celery.sh"] mountPoints = [ @@ -132,7 +132,7 @@ resource "aws_ecs_task_definition" "doccano" { sourceVolume = "media-volume" containerPath = "/backend/media" }, - { + { sourceVolume = "tmp-volume" containerPath = "/backend/filepond-temp-uploads" } @@ -172,8 +172,8 @@ resource "aws_ecs_task_definition" "doccano" { ] }, { - name = "flower" - image = "quay.io/pcdc/doccano:be_20240813" + name = "flower" + image = "quay.io/pcdc/doccano:be_20240813" essential = true entryPoint = ["/opt/bin/prod-flower.sh"] portMappings = [ @@ -213,7 +213,7 @@ resource "aws_ecs_task_definition" "doccano" { }, { name = "DATABASE_URL" valueFrom = var.database_url - }, + }, { name = "FLOWER_BASIC_AUTH" valueFrom = aws_ssm_parameter.FLOWER_BASIC_AUTH.arn @@ -221,8 +221,8 @@ resource "aws_ecs_task_definition" "doccano" { ] }, { - name = "rabbitmq" - image = "rabbitmq:3.10.7-alpine" + name = "rabbitmq" + image = "rabbitmq:3.10.7-alpine" essential = true portMappings = [ { @@ -249,8 +249,8 @@ resource "aws_ecs_task_definition" "doccano" { ] }, { - name = "nginx" - image = "954006452010.dkr.ecr.us-east-1.amazonaws.com/doccano-nginx:latest" #"quay.io/pcdc/doccano:fe_20240813" + name = "nginx" + image = "954006452010.dkr.ecr.us-east-1.amazonaws.com/doccano-nginx:latest" #"quay.io/pcdc/doccano:fe_20240813" essential = true entryPoint = ["/bin/sh", "-c"] command = ["envsubst < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf && nginx -g 'daemon off;'"] diff --git a/terraform/modules/ecs/ssm.tf b/terraform/modules/ecs/ssm.tf index 1412267dbc..a84c7e62b4 100644 --- a/terraform/modules/ecs/ssm.tf +++ b/terraform/modules/ecs/ssm.tf @@ -1,35 +1,35 @@ resource "aws_ssm_parameter" "ADMIN_PASSWORD" { - name = "/${var.environment}/${var.app_name}/ADMIN_PASSWORD" - type = "SecureString" - value = "change-password" + name = "/${var.environment}/${var.app_name}/ADMIN_PASSWORD" + type = "SecureString" + value = "change-password" lifecycle { - ignore_changes = [ "value" ] + ignore_changes = ["value"] } } resource "aws_ssm_parameter" "RABBITMQ_DEFAULT_PASS" { - name = "/${var.environment}/${var.app_name}/RABBITMQ_DEFAULT_PASS" - type = "SecureString" - value = "doccano" + name = "/${var.environment}/${var.app_name}/RABBITMQ_DEFAULT_PASS" + type = "SecureString" + value = "doccano" lifecycle { - ignore_changes = [ "value" ] + ignore_changes = ["value"] } } resource "aws_ssm_parameter" "FLOWER_BASIC_AUTH" { - name = "/${var.environment}/${var.app_name}/FLOWER_BASIC_AUTH" - type = "SecureString" - value = "change-password" + name = "/${var.environment}/${var.app_name}/FLOWER_BASIC_AUTH" + type = "SecureString" + value = "change-password" lifecycle { - ignore_changes = [ "value" ] + ignore_changes = ["value"] } } resource "aws_ssm_parameter" "CELERY_BROKER_URL" { - name = "/${var.environment}/${var.app_name}/CELERY_BROKER_URL" - type = "SecureString" - value = "amqp://doccano:doccano@localhost" + name = "/${var.environment}/${var.app_name}/CELERY_BROKER_URL" + type = "SecureString" + value = "amqp://doccano:doccano@localhost" lifecycle { - ignore_changes = [ "value" ] + ignore_changes = ["value"] } } \ No newline at end of file diff --git a/terraform/modules/ecs/variables.tf b/terraform/modules/ecs/variables.tf index 568beab6dd..ff366c0522 100644 --- a/terraform/modules/ecs/variables.tf +++ b/terraform/modules/ecs/variables.tf @@ -17,7 +17,7 @@ variable "container_port" { default = 8080 } -variable "aws_efs_access_point_static_files" { +variable "efs_access_point_static_files" { } variable "efs_access_point_id_media" { diff --git a/terraform/modules/efs/efs.tf b/terraform/modules/efs/efs.tf deleted file mode 100644 index a79877b1c7..0000000000 --- a/terraform/modules/efs/efs.tf +++ /dev/null @@ -1,82 +0,0 @@ -resource "aws_efs_file_system" "this" { - creation_token = var.efs_name -} - -resource "aws_efs_mount_target" "this" { - for_each = toset(var.subnet_ids) - file_system_id = aws_efs_file_system.this.id - subnet_id = each.value - security_groups = [aws_security_group.efs_sg.id] -} - - -resource "aws_efs_access_point" "static_files" { - file_system_id = aws_efs_file_system.this.id - - root_directory { - path = "/backend/staticfiles" - creation_info { - owner_uid = 1000 - owner_gid = 1000 - permissions = "755" - } - } - posix_user { - uid = 1000 - gid = 1000 - } -} - -resource "aws_efs_access_point" "media" { - file_system_id = aws_efs_file_system.this.id - - root_directory { - path = "/backend/media" - creation_info { - owner_uid = 1000 - owner_gid = 1000 - permissions = "755" - } - } - posix_user { - uid = 1000 - gid = 1000 - } -} - -resource "aws_efs_access_point" "tmp" { - file_system_id = aws_efs_file_system.this.id - - root_directory { - path = "/backend/filepond-temp-uploads" - creation_info { - owner_uid = 1000 - owner_gid = 1000 - permissions = "755" - } - } - posix_user { - uid = 1000 - gid = 1000 - } -} - - -resource "aws_security_group" "efs_sg" { - name = "${var.efs_name}-efs-sg" - vpc_id = var.vpc_id - - ingress { - from_port = 2049 - to_port = 2049 - protocol = "tcp" - security_groups = var.security_groups #[aws_security_group.ecs_tasks.id] - } - - egress { - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - } -} \ No newline at end of file diff --git a/terraform/modules/efs/outputs.tf b/terraform/modules/efs/outputs.tf deleted file mode 100644 index 18bbba09d3..0000000000 --- a/terraform/modules/efs/outputs.tf +++ /dev/null @@ -1,15 +0,0 @@ -output "aws_efs_file_system" { - value = aws_efs_file_system.this.id -} - -output "access_point_id_static_files" { - value = aws_efs_access_point.static_files.id -} - -output "access_point_id_media" { - value = aws_efs_access_point.media.id -} - -output "access_point_id_tmp" { - value = aws_efs_access_point.tmp.id -} \ No newline at end of file diff --git a/terraform/modules/efs/variables.tf b/terraform/modules/efs/variables.tf deleted file mode 100644 index edf4159343..0000000000 --- a/terraform/modules/efs/variables.tf +++ /dev/null @@ -1,15 +0,0 @@ -variable "vpc_id" { - -} - -variable "efs_name" { - -} - -variable "subnet_ids" { - -} - -variable "security_groups" { - type = list(string) -} \ No newline at end of file diff --git a/terraform/modules/rds/outputs.tf b/terraform/modules/rds/outputs.tf deleted file mode 100644 index d7a3683ce0..0000000000 --- a/terraform/modules/rds/outputs.tf +++ /dev/null @@ -1,11 +0,0 @@ -output "random_string" { - value = random_string.randompostgres.result -} - -output "rds_enpoint" { - value = aws_db_instance.this.endpoint -} - -output "database_url" { - value = aws_ssm_parameter.DATABASE_URL.arn -} \ No newline at end of file diff --git a/terraform/modules/rds/rds.tf b/terraform/modules/rds/rds.tf deleted file mode 100644 index 17973ccbb6..0000000000 --- a/terraform/modules/rds/rds.tf +++ /dev/null @@ -1,73 +0,0 @@ -resource "aws_db_instance" "this" { - identifier = var.app_name #var.rds_instance_identifier - engine = var.rds_instance_engine - engine_version = var.rds_instance_engine_version - instance_class = var.rds_instance_class - allocated_storage = var.rds_instance_allocated_storage - max_allocated_storage = var.rds_instance_max_allocated_storage - db_name = var.app_name #var.rds_instance_name - username = var.app_name - password = var.rds_instance_password == "" ? random_string.randompostgres.result : var.rds_instance_password - port = 5432 - publicly_accessible = var.rds_instance_publicly_accessible - multi_az = var.rds_instance_multi_az - storage_encrypted = true - backup_retention_period = var.rds_instance_backup_retention_period - skip_final_snapshot = var.rds_instance_skip_final_snapshot - vpc_security_group_ids = [aws_security_group.rds.id] - db_subnet_group_name = aws_db_subnet_group.this.name - - tags = { - Name = var.rds_instance_name - environment = var.environment - } -} - -resource "aws_db_subnet_group" "this" { - name = "${var.rds_instance_name}-${var.environment}" - subnet_ids = ["subnet-02daaea0d231975df", "subnet-0c7f4570d0c82bdc3"] - - tags = { - Name = var.rds_instance_name - } -} - -resource "random_string" "randompostgres" { - length = 16 - special = false -} - -resource "aws_ssm_parameter" "POSTGRES_PASSWORD" { - name = "/${var.environment}/${var.app_name}/POSTGRES_PASSWORD" - type = "SecureString" - value = random_string.randompostgres.result -} - -resource "aws_ssm_parameter" "DATABASE_URL" { - name = "/${var.environment}/${var.app_name}/DATABASE_URL" - type = "SecureString" - value = "postgres://doccano:${random_string.randompostgres.result}@${aws_db_instance.this.endpoint}/doccano?sslmode=disable" -} - - -#RDS DB Security Group -resource "aws_security_group" "rds" { - name = "doccano-rds-security-group" - description = "controls access to the RDS" - vpc_id = var.vpc_id - - ingress { - protocol = "tcp" - from_port = 5432 - to_port = 5432 - # cidr_blocks = ["0.0.0.0/0"] - security_groups = [var.rds_security_groups] - } - - egress { - protocol = "-1" - from_port = 0 - to_port = 0 - cidr_blocks = ["0.0.0.0/0"] - } -} \ No newline at end of file diff --git a/terraform/modules/rds/variables.tf b/terraform/modules/rds/variables.tf deleted file mode 100644 index 78c9b84ebe..0000000000 --- a/terraform/modules/rds/variables.tf +++ /dev/null @@ -1,84 +0,0 @@ -variable "vpc_id" { - -} -variable "app_name" { - default = "doccano" -} - -variable "environment" { - default = "dev" -} - -variable "rds_instance_name" { - default = "doccano" -} - -variable "rds_instance_skip_final_snapshot" { - description = "rds instance skip final snapshot" - default = false -} - -variable "rds_instance_backup_retention_period" { - description = "The days to retain backups for. Must be between 0 and 35" - default = 0 -} - -variable "rds_instance_multi_az" { - description = "Specifies if the RDS instance is multi-AZ" - default = false -} - -variable "rds_instance_publicly_accessible" { - description = "Control if instance is publicly accessible" - default = true -} - -# variable "rds_instance_username" { -# default = "" #Defaulting to app name -# } - -variable "rds_instance_allocated_storage" { - description = "The allocated storage in GiB" - default = 10 -} - -variable "rds_instance_storage_type" { - description = "gp2, io1, standard" - default = "gp2" -} - -variable "rds_instance_class" { - description = "The instance type of the RDS instance" - default = "db.t3.micro" -} - -variable "rds_instance_engine" { - default = "postgres" -} - -variable "rds_instance_engine_version" { - description = "The engine version to use. If auto_minor_version_upgrade is enabled, you can provide a prefix of the version such as 5.7 (for 5.7.10) and this attribute will ignore differences in the patch version automatically (e.g. 5.7.17)" - default = "13" -} - -variable "rds_instance_max_allocated_storage" { - description = "Specifies the value for Storage Autoscaling" - default = 0 -} - -variable "rds_instance_password" { - description = "Password to use" - default = "" -} - -# variable "rds_instance_identifier" { -# description = "The name of the RDS instance, if omitted, Terraform will assign a random, unique identifier" -# type = string -# } - -# variable "database_url" { -# default = "" -# } -variable "rds_security_groups" { - default = "" -} \ No newline at end of file From 72e3163b88ecf8c5815cedd67984afcf38cfb61f Mon Sep 17 00:00:00 2001 From: bashirmatov Date: Tue, 3 Jun 2025 16:04:06 -0500 Subject: [PATCH 4/6] updates to use alb module --- terraform/dev/.terraform.lock.hcl | 43 +++++++++++++++++++++++ terraform/dev/main.tf | 7 ++-- terraform/dev/provider.tf | 12 ++++++- terraform/modules/alb/alb.tf | 55 ------------------------------ terraform/modules/alb/outputs.tf | 7 ---- terraform/modules/alb/variables.tf | 11 ------ terraform/modules/ecs/ecs.tf | 21 ++++++------ terraform/modules/ecs/variables.tf | 23 +++++++++++++ 8 files changed, 91 insertions(+), 88 deletions(-) create mode 100644 terraform/dev/.terraform.lock.hcl delete mode 100644 terraform/modules/alb/alb.tf delete mode 100644 terraform/modules/alb/outputs.tf delete mode 100644 terraform/modules/alb/variables.tf diff --git a/terraform/dev/.terraform.lock.hcl b/terraform/dev/.terraform.lock.hcl new file mode 100644 index 0000000000..f5e5d6bc52 --- /dev/null +++ b/terraform/dev/.terraform.lock.hcl @@ -0,0 +1,43 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/aws" { + version = "5.99.1" + hashes = [ + "h1:xgPyZArCfKVMy8sThzhb0IernbFy0fJGm897ztejZAQ=", + "zh:00b0a61c6d295300f0aa7a79a7d40e9f836164f1fff816d38324c148cd846887", + "zh:1ee9d5ccb67378704642db62113ac6c0d56d69408a9c1afb9a8e14b095fc0733", + "zh:2035977ed418dcb18290785c1eeb79b7133b39f718c470346e043ac48887ffc7", + "zh:67e3ca1bf7061900f81cf958d5c771a2fd6048c2b185bec7b27978349b173a90", + "zh:87fadbe5de7347ede72ad879ff8d8d9334103cd9aa4a321bb086bfac91654944", + "zh:901d170c457c2bff244a2282d9de595bdb3ebecc33a2034c5ce8aafbcff66db9", + "zh:92c07d6cf530679565b87934f9f98604652d787968cce6a3d24c148479b7e34b", + "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", + "zh:a7d4803b4c5ff17f029f8b270c91480442ece27cec7922c38548bcfea2ac2d26", + "zh:afda848da7993a07d29018ec25ab6feda652e01d4b22721da570ce4fcc005292", + "zh:baaf16c98b81bad070e0908f057a97108ecd6e8c9f754d7a79b18df4c8453279", + "zh:c3dd496c5014427599d6b6b1c14c7ebb09a15df78918ae0be935e7bfa83b894c", + "zh:e2b84c1d40b3f2c4b1d74bf170b9e932983b61bac0e6dab2e36f5057ddcc997f", + "zh:e49c92cb29c53b4573ed4d9c946486e6bcfc1b63f1aee0c79cc7626f3d9add03", + "zh:efae8e339c4b13f546e0f96c42eb95bf8347de22e941594849b12688574bf380", + ] +} + +provider "registry.terraform.io/hashicorp/random" { + version = "3.7.2" + hashes = [ + "h1:KG4NuIBl1mRWU0KD/BGfCi1YN/j3F7H4YgeeM7iSdNs=", + "zh:14829603a32e4bc4d05062f059e545a91e27ff033756b48afbae6b3c835f508f", + "zh:1527fb07d9fea400d70e9e6eb4a2b918d5060d604749b6f1c361518e7da546dc", + "zh:1e86bcd7ebec85ba336b423ba1db046aeaa3c0e5f921039b3f1a6fc2f978feab", + "zh:24536dec8bde66753f4b4030b8f3ef43c196d69cccbea1c382d01b222478c7a3", + "zh:29f1786486759fad9b0ce4fdfbbfece9343ad47cd50119045075e05afe49d212", + "zh:4d701e978c2dd8604ba1ce962b047607701e65c078cb22e97171513e9e57491f", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:7b8434212eef0f8c83f5a90c6d76feaf850f6502b61b53c329e85b3b281cba34", + "zh:ac8a23c212258b7976e1621275e3af7099e7e4a3d4478cf8d5d2a27f3bc3e967", + "zh:b516ca74431f3df4c6cf90ddcdb4042c626e026317a33c53f0b445a3d93b720d", + "zh:dc76e4326aec2490c1600d6871a95e78f9050f9ce427c71707ea412a2f2f1a62", + "zh:eac7b63e86c749c7d48f527671c7aee5b4e26c10be6ad7232d6860167f99dbb0", + ] +} diff --git a/terraform/dev/main.tf b/terraform/dev/main.tf index 19b97cd6df..497b77a70d 100644 --- a/terraform/dev/main.tf +++ b/terraform/dev/main.tf @@ -2,12 +2,12 @@ module "doccano_ecs" { source = "../modules/ecs" app_name = var.app_name subnet_ids = var.private_subnet_ids - lb_security_group = [module.doccano_alb.lb_security_group] + lb_security_group = [module.doccano_alb.alb_security_group] load_balancer = { container_port = 8080 } vpc_id = var.vpc_id - target_group_arn = module.doccano_alb.doccano_target_group.arn + target_group_arn = module.doccano_alb.alb_target_group_arn container_name = "nginx" # container_count = 2 efs_volume = module.doccano_efs.efs_id @@ -64,8 +64,9 @@ module "doccano_efs" { } module "doccano_alb" { - source = "../modules/alb" + source = "git::ssh://git@github.com/chicagopcdc/terraform_modules.git//aws/alb?ref=0.4.2" environment = var.environment + app_name = "doccano" vpc_id = var.vpc_id subnet_ids = var.private_subnet_ids } diff --git a/terraform/dev/provider.tf b/terraform/dev/provider.tf index f68dae8aaa..d7266e3cea 100644 --- a/terraform/dev/provider.tf +++ b/terraform/dev/provider.tf @@ -6,4 +6,14 @@ provider "aws" { Name = var.app_name } } -} \ No newline at end of file +} + +# terraform { +# backend "s3" { +# bucket = "pcdc-doccano-dev-tfstate-bucket" +# key = "terraform.tfstate" +# region = var.aws_region +# dynamodb_table = "pcdc-doccano-dynomodb-table-terraform-lock" +# encrypt = true +# } +# } \ No newline at end of file diff --git a/terraform/modules/alb/alb.tf b/terraform/modules/alb/alb.tf deleted file mode 100644 index 29fc4d4703..0000000000 --- a/terraform/modules/alb/alb.tf +++ /dev/null @@ -1,55 +0,0 @@ -resource "aws_lb" "doccano_lb" { - name = "doccano-lb-${var.environment}" - internal = false - load_balancer_type = "application" - security_groups = [aws_security_group.lb.id] - subnets = var.subnet_ids -} - -resource "aws_lb_listener" "http" { - load_balancer_arn = aws_lb.doccano_lb.arn - port = 80 - protocol = "HTTP" - - default_action { - type = "forward" - target_group_arn = aws_lb_target_group.doccano_target_group.arn - } -} - -resource "aws_lb_target_group" "doccano_target_group" { - name = "doccano-${var.environment}-target-group" - port = 80 - protocol = "HTTP" - target_type = "ip" - vpc_id = var.vpc_id - - health_check { - path = "/" - interval = 30 - timeout = 5 - healthy_threshold = 2 - unhealthy_threshold = 3 - } -} - -# ALB security Group: Need to add 443, once we get DNS domain hosted zone -resource "aws_security_group" "lb" { - name = "doccano-lb-security-group" - description = "controls access to the ALB" - vpc_id = var.vpc_id - - ingress { - protocol = "tcp" - from_port = 80 - to_port = 80 - cidr_blocks = ["0.0.0.0/0"] - } - - egress { - protocol = "-1" - from_port = 0 - to_port = 0 - cidr_blocks = ["0.0.0.0/0"] - } -} \ No newline at end of file diff --git a/terraform/modules/alb/outputs.tf b/terraform/modules/alb/outputs.tf deleted file mode 100644 index a8136c064d..0000000000 --- a/terraform/modules/alb/outputs.tf +++ /dev/null @@ -1,7 +0,0 @@ -output "doccano_target_group" { - value = aws_lb_target_group.doccano_target_group -} - -output "lb_security_group" { - value = aws_security_group.lb.id -} \ No newline at end of file diff --git a/terraform/modules/alb/variables.tf b/terraform/modules/alb/variables.tf deleted file mode 100644 index 205c1e2c7e..0000000000 --- a/terraform/modules/alb/variables.tf +++ /dev/null @@ -1,11 +0,0 @@ -variable "environment" { - -} - -variable "subnet_ids" { - -} - -variable "vpc_id" { - -} \ No newline at end of file diff --git a/terraform/modules/ecs/ecs.tf b/terraform/modules/ecs/ecs.tf index c1321cd345..c4ac3c51f6 100644 --- a/terraform/modules/ecs/ecs.tf +++ b/terraform/modules/ecs/ecs.tf @@ -24,8 +24,8 @@ resource "aws_ecs_service" "doccano_service" { resource "aws_ecs_task_definition" "doccano" { family = "doccano" requires_compatibilities = ["FARGATE"] - cpu = 1024 - memory = 2048 + cpu = var.cpu + memory = var.memory network_mode = "awsvpc" execution_role_arn = aws_iam_role.ecs_task_execution_role.arn task_role_arn = aws_iam_role.ecs_task_execution_role.arn @@ -69,7 +69,7 @@ resource "aws_ecs_task_definition" "doccano" { container_definitions = jsonencode([ { name = "doccano" - image = "quay.io/pcdc/doccano:be_20240813" + image = "quay.io/pcdc/doccano:${var.application_tag}" #"quay.io/pcdc/doccano:be_20240813" essential = true mountPoints = [ { @@ -124,7 +124,7 @@ resource "aws_ecs_task_definition" "doccano" { }, { name = "celery" - image = "quay.io/pcdc/doccano:be_20240813" + image = "quay.io/pcdc/doccano:${var.application_tag}" essential = true entryPoint = ["/opt/bin/prod-celery.sh"] mountPoints = [ @@ -173,7 +173,7 @@ resource "aws_ecs_task_definition" "doccano" { }, { name = "flower" - image = "quay.io/pcdc/doccano:be_20240813" + image = "quay.io/pcdc/doccano:${var.application_tag}" essential = true entryPoint = ["/opt/bin/prod-flower.sh"] portMappings = [ @@ -213,16 +213,15 @@ resource "aws_ecs_task_definition" "doccano" { }, { name = "DATABASE_URL" valueFrom = var.database_url - }, - { - name = "FLOWER_BASIC_AUTH" - valueFrom = aws_ssm_parameter.FLOWER_BASIC_AUTH.arn + }, { + name = "FLOWER_BASIC_AUTH" + valueFrom = aws_ssm_parameter.FLOWER_BASIC_AUTH.arn } ] }, { name = "rabbitmq" - image = "rabbitmq:3.10.7-alpine" + image = "${var.rabbitmq_image}:${var.application_tag}" essential = true portMappings = [ { @@ -250,7 +249,7 @@ resource "aws_ecs_task_definition" "doccano" { }, { name = "nginx" - image = "954006452010.dkr.ecr.us-east-1.amazonaws.com/doccano-nginx:latest" #"quay.io/pcdc/doccano:fe_20240813" + image = "quay.io/pcdc/doccano:${var.application_tag}" #"quay.io/pcdc/doccano:fe_20240813" essential = true entryPoint = ["/bin/sh", "-c"] command = ["envsubst < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf && nginx -g 'daemon off;'"] diff --git a/terraform/modules/ecs/variables.tf b/terraform/modules/ecs/variables.tf index ff366c0522..cb5e1ed611 100644 --- a/terraform/modules/ecs/variables.tf +++ b/terraform/modules/ecs/variables.tf @@ -17,6 +17,29 @@ variable "container_port" { default = 8080 } +variable "doccano_image" { + default = "quay.io/pcdc/doccano" +} + +variable "application_tag" { + default = "latest" +} + +variable "rabbitmq_image" { + default = "rabbitmq" +} + +variable "cpu" { + description = "Default cpu amount for task" + default = "512" +} + +variable "memory" { + description = "Default memory amount for task" + default = "1024" +} + + variable "efs_access_point_static_files" { } From 26d0902c2fb2891c27a122cddb5cb1da5e7a5d85 Mon Sep 17 00:00:00 2001 From: bashirmatov Date: Wed, 11 Jun 2025 16:57:31 -0500 Subject: [PATCH 5/6] update module release version and Cert ARN --- terraform/dev/main.tf | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/terraform/dev/main.tf b/terraform/dev/main.tf index 497b77a70d..6d6bb35645 100644 --- a/terraform/dev/main.tf +++ b/terraform/dev/main.tf @@ -18,7 +18,7 @@ module "doccano_ecs" { } module "doccano_efs" { - source = "git::ssh://git@github.com/chicagopcdc/terraform_modules.git//aws/efs?ref=0.4.2" + source = "git::ssh://git@github.com/chicagopcdc/terraform_modules.git//aws/efs?ref=0.5.0" vpc_id = var.vpc_id efs_name = var.app_name subnet_ids = var.private_subnet_ids @@ -64,15 +64,16 @@ module "doccano_efs" { } module "doccano_alb" { - source = "git::ssh://git@github.com/chicagopcdc/terraform_modules.git//aws/alb?ref=0.4.2" + source = "git::ssh://git@github.com/chicagopcdc/terraform_modules.git//aws/alb?ref=0.5.0" environment = var.environment app_name = "doccano" vpc_id = var.vpc_id subnet_ids = var.private_subnet_ids + acm_cert_arn = "arn:aws:acm:us-east-1:471835990085:certificate/c1cebe37-738d-4766-a635-bc23d3e8caa7" # } module "rds" { - source = "git::ssh://git@github.com/chicagopcdc/terraform_modules.git//aws/rds?ref=0.4.2" + source = "git::ssh://git@github.com/chicagopcdc/terraform_modules.git//aws/rds?ref=0.5.0" rds_security_groups = module.doccano_ecs.ecs_tasks_sg vpc_id = var.vpc_id subnet_ids = var.private_subnet_ids From 0f561d3e5d25f56d5bdf5e7c9facdd1be16047d0 Mon Sep 17 00:00:00 2001 From: grugna Date: Wed, 18 Jun 2025 12:25:37 -0500 Subject: [PATCH 6/6] update nginx config.default --- docker/nginx/default.conf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docker/nginx/default.conf b/docker/nginx/default.conf index 3a5aa77a57..ec65788aec 100644 --- a/docker/nginx/default.conf +++ b/docker/nginx/default.conf @@ -12,7 +12,7 @@ server { } location /v1/ { - proxy_pass http://localhost:8000/v1/; + proxy_pass http://backend:8000/v1/; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_redirect off; @@ -20,7 +20,7 @@ server { } location /admin/ { - proxy_pass http://localhost:8000/admin/; + proxy_pass http://backend:8000/admin/; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_redirect off; @@ -32,7 +32,7 @@ server { } location /swagger/ { - proxy_pass http://localhost:8000/swagger/; + proxy_pass http://backend:8000/swagger/; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_redirect off;