✨(terraform) add terraform configuration

In a near future, we want to store ashley medias and static files on
AWS. We want to use Terraform to setup the required AWS resources for
each environment.

Author: madmatah

.gitignore

@@ -42,6 +42,7 @@ ENV/
 env.bak/
 venv.bak/
 env.d/development/crowdin
+env.d/terraform
 
 # Logs
 *.log
@@ -65,3 +66,8 @@ node_modules
 # SASS
 .sass-cache
 
+# Terraform
+.terraform
+*.tfstate
+*.tfstate.backup
+/terraform/state.tf

Makefile

@@ -61,7 +61,8 @@ default: help
 
 bootstrap: ## Prepare Docker images for the project
 bootstrap: \
-  env.d/development/crowdin \
+	env.d/development/crowdin \
+	env.d/terraform \
 	build \
 	build-front \
 	migrate
@@ -276,6 +277,11 @@ i18n-generate-and-upload: \
   crowdin-upload
 .PHONY: i18n-generate-and-upload
 
+# -- Terraform
+
+env.d/terraform:
+	cp env.d/terraform.dist env.d/terraform
+
 # -- Misc
 help:
 	@grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'

bin/state

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+# Run Terraform commands on the create_state_bucket project in the Hashicorp
+# docker container, passing our environment variables
+
+
+# Run Terraform commands in the Hashicorp docker container via docker compose
+DOCKER_USER="$(id -u):$(id -g)" \
+    docker-compose run --rm terraform-state "$@"

bin/terraform

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+# Run Terraform commands in the Hashicorp docker container via docker compose
+# shellcheck disable=SC2068
+DOCKER_USER="$(id -u):$(id -g)" \
+    docker-compose run --rm terraform "$@"

docker-compose.yml

@@ -52,3 +52,19 @@ services:
     user: "${DOCKER_USER:-1000}"
     volumes:
       - .:/app
+
+  terraform:
+    image: hashicorp/terraform:0.15.3
+    env_file: env.d/terraform
+    user: ${DOCKER_USER:-1000}
+    working_dir: /app
+    volumes:
+      - ./terraform:/app
+
+  terraform-state:
+    image: hashicorp/terraform:0.15.3
+    env_file: env.d/terraform
+    user: ${DOCKER_USER:-1000}
+    working_dir: /app
+    volumes:
+      - ./terraform/create_state_bucket:/app

env.d/terraform.dist

@@ -0,0 +1,8 @@
+# AWS admin credentials
+AWS_ACCESS_KEY_ID=yourAwsAccesKeyId
+AWS_SECRET_ACCESS_KEY=YourAwsSecretAccessKey
+AWS_DEFAULT_REGION=eu-west-1
+
+# In this map, you should set the domain name of your ashley application,
+# per environment (key = terraform workspace, value = domain name)
+TF_VAR_app_domain={ production = "ashley.education" }

terraform/.terraform.lock.hcl

@@ -0,0 +1,101 @@
+
+locals {
+  static_origin_id = "ashley-static-origin"
+  s3_media_origin_id = "ashley-media-origin"
+}
+
+# Create an origin access identity that will allow CloudFront to access S3
+# See bucket policies in s3.tf or documentation for more details:
+# https://www.terraform.io/docs/providers/aws/r/cloudfront_origin_access_identity.html
+resource "aws_cloudfront_origin_access_identity" "ashley_oai" {
+  comment = "ashley origin for the ${terraform.workspace} environment"
+}
+
+resource "aws_cloudfront_distribution" "ashley_cloudfront_distribution" {
+  # Origin for static distribution
+  origin {
+    domain_name = lookup(var.app_domain, terraform.workspace)
+    origin_id   = local.static_origin_id
+
+    custom_origin_config {
+      http_port = 80
+      https_port = 443
+      origin_protocol_policy = "https-only"
+      origin_ssl_protocols = ["SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2"]
+    }
+  }
+  # Origin for the media S3 bucket
+  origin {
+    domain_name = aws_s3_bucket.ashley_media.bucket_domain_name
+    origin_id   = local.s3_media_origin_id
+
+    s3_origin_config {
+      origin_access_identity = aws_cloudfront_origin_access_identity.ashley_oai.cloudfront_access_identity_path
+    }
+  }
+
+  enabled         = true
+  is_ipv6_enabled = true
+  wait_for_deployment = false
+
+  # Allow public access by default, served by static bucket
+  default_cache_behavior {
+    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
+    cached_methods   = ["GET", "HEAD", "OPTIONS"]
+    target_origin_id = local.static_origin_id
+
+    forwarded_values {
+      query_string = true
+      headers = ["Access-Control-Request-Headers", "Access-Control-Request-Method", "Authorization", "Origin"]
+
+      cookies {
+        forward = "none"
+      }
+    }
+
+    min_ttl                = 0
+    default_ttl            = 3600
+    max_ttl                = 86400
+    compress               = true
+    viewer_protocol_policy = "redirect-to-https"
+  }
+
+  # Media bucket: allow public access
+  ordered_cache_behavior {
+    path_pattern     = "/media/*"
+    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
+    cached_methods   = ["GET", "HEAD", "OPTIONS"]
+    target_origin_id = local.s3_media_origin_id
+
+    forwarded_values {
+      query_string = false
+      headers = ["Access-Control-Request-Headers", "Access-Control-Request-Method", "Authorization", "Origin"]
+
+      cookies {
+        forward = "none"
+      }
+    }
+
+    min_ttl                = 0
+    default_ttl            = 3600
+    max_ttl                = 86400
+    compress               = true
+    viewer_protocol_policy = "redirect-to-https"
+  }
+
+  price_class = lookup(var.cloudfront_price_class, terraform.workspace, "PriceClass_100")
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  tags = {
+    Environment = terraform.workspace
+  }
+
+  viewer_certificate {
+    cloudfront_default_certificate = true
+  }
+}

terraform/cloudfront.tf

@@ -0,0 +1,11 @@
+resource "aws_dynamodb_table" "terraform-state-locks" {
+  name           = "ashley_terraform_state_locks"
+  read_capacity  = 1
+  write_capacity = 1
+  hash_key       = "LockID"
+
+  attribute {
+    name = "LockID"
+    type = "S"
+  }
+}