Merge branch 'main' into chore/update-service-hub-bots

.github/workflows/lint.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.2
 
       - name: Setup Terraform
         uses: hashicorp/[email protected]

.modules/service/module.tf

@@ -1,4 +1,6 @@
 data "tfe_outputs" "infrastructure" {
   organization = "home_assistant"
   workspace    = "infrastructure"
-}
+}
+
+data "aws_region" "current" {}

.modules/service/policy.tf

@@ -10,7 +10,7 @@ data "aws_iam_policy_document" "ecs-role-policy" {
 }
 
 resource "aws_iam_role" "ecs-execution" {
-  name               = "${var.service_name}-ExecutionRole-role"
+  name               = "${var.service_name}-${data.aws_region.current.name}-ExecutionRole-role"
   assume_role_policy = data.aws_iam_policy_document.ecs-role-policy.json
 }
 
@@ -46,11 +46,11 @@ data "aws_iam_policy_document" "task-assume-role" {
 }
 
 resource "aws_iam_role" "task-execution" {
-  name               = "${var.service_name}-TaskRole-role"
+  name               = "${var.service_name}-${data.aws_region.current.name}-TaskRole-role"
   assume_role_policy = data.aws_iam_policy_document.task-assume-role.json
 }
 
 resource "aws_iam_role_policy" "task-role" {
   policy = data.aws_iam_policy_document.task-policy.json
   role   = aws_iam_role.task-execution.id
-}
+}

assist/main.tf

@@ -7,11 +7,12 @@ terraform {
     }
   }
 
+  required_version = "= 1.9.8"
 
   required_providers {
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = "~> 4"
+      version = "~> 4.0"
     }
   }
 }

community/dns.tf

@@ -5,7 +5,7 @@ data "cloudflare_zone" "dns_zone" {
 resource "cloudflare_record" "community" {
   zone_id = data.cloudflare_zone.dns_zone.id
   name    = "community"
-  value   = aws_eip.discourse.public_ip
+  content = aws_eip.discourse.public_ip
   type    = "A"
   proxied = true
 }

community/ec2.tf

@@ -9,5 +9,5 @@ resource "aws_instance" "discourse" {
 
 resource "aws_eip" "discourse" {
   instance = aws_instance.discourse.id
-  vpc      = true
+  domain   = "vpc"
 }

community/main.tf

@@ -7,15 +7,17 @@ terraform {
     }
   }
 
+  required_version = "= 1.9.8"
+
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 4.0"
+      version = "~> 5.0"
     }
 
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = "~> 3.0"
+      version = "~> 4.0"
     }
   }
 }

infrastructure/certificate.tf

@@ -22,7 +22,7 @@ resource "cloudflare_record" "dns_instance_validation" {
 
   zone_id = data.cloudflare_zone.dns_zone.id
   name    = each.value.name
-  value   = trimsuffix(each.value.record, ".")
+  content = trimsuffix(each.value.record, ".")
   type    = each.value.type
   ttl     = 1
   proxied = false

infrastructure/region/network.tf

@@ -32,7 +32,7 @@ resource "aws_route_table" "public" {
 resource "aws_eip" "nat" {
   count = 2
 
-  vpc = true
+  domain = "vpc"
 
   tags = {
     Region = data.aws_region.current.name

infrastructure/versions.tf

@@ -1,14 +1,15 @@
 terraform {
-  required_version = "= 1.7.5"
+  required_version = "= 1.9.8"
+
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 4.0"
+      version = "~> 5.0"
     }
 
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = "~> 3.0"
+      version = "~> 4.0"
     }
   }
 }

ohf-public-assets/bucket.tf

@@ -0,0 +1,5 @@
+resource "cloudflare_r2_bucket" "ohf_public_assets" {
+  account_id = var.CLOUDFLARE_ACCOUNT_ID
+  name       = "ohf-public-assets"
+  location   = "ENAM"
+}

ohf-public-assets/main.tf

@@ -0,0 +1,18 @@
+terraform {
+  cloud {
+    organization = "home_assistant"
+
+    workspaces {
+      name = "ohf-public-assets"
+    }
+  }
+
+  required_version = "= 1.10.0"
+
+  required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 4.0"
+    }
+  }
+}

ohf-public-assets/variables.tf

@@ -0,0 +1,4 @@
+variable "CLOUDFLARE_ACCOUNT_ID" {
+  description = "Cloudflare Account Id"
+  type        = string
+}

os-builds/main.tf

@@ -7,11 +7,12 @@ terraform {
     }
   }
 
+  required_version = "= 1.9.6"
 
   required_providers {
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = "~> 4"
+      version = "~> 4.0"
     }
   }
 }

static_dns/main.tf

@@ -7,10 +7,12 @@ terraform {
     }
   }
 
+  required_version = "= 1.9.6"
+
   required_providers {
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = "~> 3.0"
+      version = "~> 4.0"
     }
   }
 }

static_dns/record._checkdns.tf

@@ -2,7 +2,7 @@
 resource "cloudflare_record" "_checkdns" {
   zone_id = data.cloudflare_zone.dns_zone.id
   name    = "_checkdns"
-  value   = "1.1.1.1"
+  content = "1.1.1.1"
   type    = "A"
   ttl     = 1
   proxied = false

stun_server/main.tf

@@ -0,0 +1,34 @@
+terraform {
+  cloud {
+    organization = "home_assistant"
+
+    workspaces {
+      name = "stun_server"
+    }
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+module "us_east_1" {
+  source = "./region"
+
+  region    = "us-east-1"
+  image_tag = var.image_tag
+}
+
+module "eu_central_1" {
+  source = "./region"
+
+  region    = "eu-central-1"
+  image_tag = var.image_tag
+}
+
+module "ap_southeast_1" {
+  source = "./region"
+
+  region    = "ap-southeast-1"
+  image_tag = var.image_tag
+}

stun_server/outputs.tf

@@ -0,0 +1,8 @@
+output "endpoints" {
+  description = "Endpoints of the Stun server"
+  value = {
+    "us-east-1"      = module.us_east_1.stun_server_endpoint
+    "eu-central-1"   = module.eu_central_1.stun_server_endpoint
+    "ap-southeast-1" = module.ap_southeast_1.stun_server_endpoint
+  }
+}

stun_server/region/ecs.tf

@@ -0,0 +1,51 @@
+resource "aws_ecs_service" "stun-server-tcp" {
+  name                               = "${local.service_name}-tcp"
+  cluster                            = local.infrastructure_region_outputs.ecs_cluster
+  task_definition                    = module.stun_server_tcp.task_definition
+  desired_count                      = 1
+  deployment_minimum_healthy_percent = 100
+  deployment_maximum_percent         = 200
+  launch_type                        = "FARGATE"
+  depends_on                         = [aws_lb_listener.stun_80, aws_lb_listener.stun_3478]
+
+  network_configuration {
+    security_groups = [aws_security_group.stun_sg.id]
+    subnets         = local.infrastructure_region_outputs.private_subnets
+  }
+
+  load_balancer {
+    container_name   = "${local.service_name}-tcp"
+    container_port   = "3478"
+    target_group_arn = aws_lb_target_group.stun.arn
+  }
+
+  tags = {
+    region = data.aws_region.current.name
+  }
+}
+
+resource "aws_ecs_service" "stun-server-udp" {
+  name                               = "${local.service_name}-udp"
+  cluster                            = local.infrastructure_region_outputs.ecs_cluster
+  task_definition                    = module.stun_server_udp.task_definition
+  desired_count                      = 1
+  deployment_minimum_healthy_percent = 100
+  deployment_maximum_percent         = 200
+  launch_type                        = "FARGATE"
+  depends_on                         = [aws_lb_listener.stun_80, aws_lb_listener.stun_3478]
+
+  network_configuration {
+    security_groups = [aws_security_group.stun_sg.id]
+    subnets         = local.infrastructure_region_outputs.private_subnets
+  }
+
+  load_balancer {
+    container_name   = "${local.service_name}-udp"
+    container_port   = "3478"
+    target_group_arn = aws_lb_target_group.stun.arn
+  }
+
+  tags = {
+    region = data.aws_region.current.name
+  }
+}