generated from ministryofjustice/template-repository
-
Notifications
You must be signed in to change notification settings - Fork 20
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* feat: add sfs ecs service * Update alfresco.tf * rename to remove _info * Update alfresco.tf * Update alfresco.tf * Update alfresco.tf * Update alfresco.tf * Update alfresco.tf * Update alfresco.tf * Update alfresco.tf
- Loading branch information
1 parent
9a8d4d7
commit b37ab74
Showing
9 changed files
with
285 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
4 changes: 2 additions & 2 deletions
4
terraform/environments/delius-core/modules/components/oracle_db_instance/dns.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
264 changes: 264 additions & 0 deletions
264
terraform/environments/delius-core/modules/delius_environment/alfresco.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,264 @@ | ||
| module "alfresco_efs" { | ||
| source = "../helpers/efs" | ||
|
|
||
| name = "alfresco" | ||
| env_name = var.env_name | ||
| creation_token = "${var.env_name}-sfs" | ||
|
|
||
| kms_key_arn = var.account_config.kms_keys.general_shared | ||
| throughput_mode = "elastic" | ||
| provisioned_throughput_in_mibps = null | ||
| tags = var.tags | ||
| enable_platform_backups = false | ||
|
|
||
| vpc_id = var.account_config.shared_vpc_id | ||
| subnet_ids = var.account_config.private_subnet_ids | ||
| vpc_cidr = var.account_config.shared_vpc_cidr | ||
| account_info = var.account_info | ||
| } | ||
|
|
||
|
|
||
| module "alfresco_sfs_ecs" { | ||
| source = "../helpers/delius_microservice" | ||
|
|
||
| name = "alfresco-sfs" | ||
| env_name = var.env_name | ||
|
|
||
| container_cpu = 2048 | ||
| container_memory = 4096 | ||
|
|
||
| container_vars_default = { | ||
| "scheduler.content.age.millis" = 518400000 # 6 days | ||
| "scheduler.cleanup.interval" = 259200000 # 3 days | ||
| } | ||
|
|
||
| container_vars_env_specific = {} | ||
|
|
||
| container_secrets_default = {} | ||
| container_secrets_env_specific = {} | ||
|
|
||
| desired_count = 1 | ||
| deployment_minimum_healthy_percent = 0 | ||
| deployment_maximum_percent = 200 | ||
|
|
||
| container_port_config = [ | ||
| { | ||
| containerPort = 8099 | ||
| protocol = "tcp" | ||
| } | ||
| ] | ||
|
|
||
| microservice_lb = aws_lb.alfresco_sfs | ||
| microservice_lb_https_listener_arn = aws_lb_listener.alfresco_sfs_listener_https.arn | ||
|
|
||
| alb_listener_rule_host_header = "alf-sfs.${var.env_name}.${var.account_config.dns_suffix}" | ||
|
|
||
| target_group_protocol_version = "HTTP1" | ||
|
|
||
|
|
||
| alb_health_check = { | ||
| path = "/" | ||
| healthy_threshold = 5 | ||
| interval = 30 | ||
| protocol = "HTTP" | ||
| unhealthy_threshold = 5 | ||
| matcher = "200-499" | ||
| timeout = 10 | ||
| grace_period_seconds = 180 | ||
| } | ||
|
|
||
| ecs_cluster_arn = module.ecs.ecs_cluster_arn | ||
| cluster_security_group_id = aws_security_group.cluster.id | ||
|
|
||
| bastion_sg_id = module.bastion_linux.bastion_security_group | ||
| tags = var.tags | ||
|
|
||
| platform_vars = var.platform_vars | ||
| container_image = "ghcr.io/ministryofjustice/hmpps-delius-alfresco-shared-file-store:2.1.2-4" | ||
| account_config = var.account_config | ||
|
|
||
| account_info = var.account_info | ||
|
|
||
| ignore_changes_service_task_definition = true | ||
|
|
||
| extra_task_exec_role_policies = { | ||
| efs = data.aws_iam_policy_document.alfresco_efs_access_policy | ||
| } | ||
|
|
||
| providers = { | ||
| aws.core-vpc = aws.core-vpc | ||
| aws.core-network-services = aws.core-network-services | ||
| } | ||
|
|
||
| log_error_pattern = "%${join("|", local.ldap_formatted_error_codes)}%" | ||
| sns_topic_arn = aws_sns_topic.delius_core_alarms.arn | ||
| enable_platform_backups = false | ||
| frontend_lb_arn_suffix = aws_lb.alfresco_sfs.arn_suffix | ||
|
|
||
| efs_volumes = [ | ||
| { | ||
| host_path = null | ||
| name = "sfs" | ||
| efs_volume_configuration = [{ | ||
| file_system_id = module.alfresco_efs.fs_id | ||
| root_directory = "/" | ||
| transit_encryption = "ENABLED" | ||
| transit_encryption_port = 2049 | ||
| authorization_config = [{ | ||
| access_point_id = module.alfresco_efs.access_point_id | ||
| iam = "DISABLED" | ||
| }] | ||
| }] | ||
| } | ||
| ] | ||
|
|
||
| mount_points = [{ | ||
| sourceVolume = "sfs" | ||
| containerPath = "/tmp/Alfresco" | ||
| readOnly = false | ||
| }] | ||
|
|
||
| ecs_service_egress_security_group_ids = [ | ||
| { | ||
| ip_protocol = "-1" | ||
| cidr_ipv4 = "0.0.0.0/0" | ||
| description = "Allow all outbound traffic to any IPv4 address" | ||
| } | ||
| ] | ||
|
|
||
| nlb_ingress_security_group_ids = [ | ||
| { | ||
| port = 8099 | ||
| ip_protocol = "tcp" | ||
| cidr_ipv4 = var.account_config.shared_vpc_cidr | ||
| description = "Allow inbound traffic from VPC" | ||
| }, | ||
| { | ||
| port = 8099 | ||
| ip_protocol = "udp" | ||
| cidr_ipv4 = var.account_config.shared_vpc_cidr | ||
| description = "Allow inbound traffic from VPC" | ||
| }, | ||
| { | ||
| port = 8099 | ||
| ip_protocol = "tcp" | ||
| cidr_ipv4 = var.account_info.cp_cidr | ||
| description = "Allow inbound LDAP traffic from CP" | ||
| }, | ||
| { | ||
| port = 8099 | ||
| ip_protocol = "udp" | ||
| cidr_ipv4 = var.account_info.cp_cidr | ||
| description = "Allow inbound LDAP traffic from CP" | ||
| }, | ||
| { | ||
| port = 2049 | ||
| ip_protocol = "tcp" | ||
| referenced_security_group_id = module.ldap.efs_sg_id | ||
| description = "EFS ingress" | ||
| } | ||
| ] | ||
|
|
||
| ecs_service_ingress_security_group_ids = [ | ||
| { | ||
| port = 8099 | ||
| ip_protocol = "tcp" | ||
| cidr_ipv4 = var.account_config.shared_vpc_cidr | ||
| description = "Allow inbound traffic from VPC" | ||
| }, | ||
| { | ||
| port = 8099 | ||
| ip_protocol = "udp" | ||
| cidr_ipv4 = var.account_config.shared_vpc_cidr | ||
| description = "Allow inbound traffic from VPC" | ||
| }, | ||
| { | ||
| port = 8099 | ||
| ip_protocol = "tcp" | ||
| cidr_ipv4 = var.account_info.cp_cidr | ||
| description = "Allow inbound web traffic from CP" | ||
| }, | ||
| { | ||
| port = 8099 | ||
| ip_protocol = "udp" | ||
| cidr_ipv4 = var.account_info.cp_cidr | ||
| description = "Allow inbound web traffic from CP" | ||
| }, | ||
| { | ||
| port = 2049 | ||
| ip_protocol = "tcp" | ||
| referenced_security_group_id = module.ldap.efs_sg_id | ||
| description = "EFS ingress" | ||
| } | ||
| ] | ||
| } | ||
|
|
||
| data "aws_iam_policy_document" "alfresco_efs_access_policy" { | ||
| statement { | ||
| actions = [ | ||
| "elasticfilesystem:ClientRootAccess", | ||
| "elasticfilesystem:ClientWrite", | ||
| "elasticfilesystem:ClientMount" | ||
| ] | ||
| resources = [ | ||
| module.ldap.efs_fs_arn | ||
| ] | ||
| effect = "Allow" | ||
| } | ||
| } | ||
|
|
||
| resource "aws_security_group" "alfresco_sfs_alb" { | ||
| name = "${var.env_name}-alfresco-sfs-alb" | ||
| description = "controls access to and from alfresco sfs load balancer" | ||
| vpc_id = var.account_config.shared_vpc_id | ||
| tags = local.tags | ||
| lifecycle { | ||
| create_before_destroy = true | ||
| } | ||
| } | ||
|
|
||
| resource "aws_vpc_security_group_ingress_rule" "alfresco_sfs_alb" { | ||
| for_each = toset([var.account_info.cp_cidr, var.account_config.shared_vpc_cidr]) | ||
| security_group_id = aws_security_group.alfresco_sfs_alb.id | ||
| description = "Access into alb over https" | ||
| from_port = "443" | ||
| to_port = "443" | ||
| ip_protocol = "tcp" | ||
| cidr_ipv4 = each.key | ||
| } | ||
|
|
||
| resource "aws_vpc_security_group_egress_rule" "alfresco_sfs_alb" { | ||
| security_group_id = aws_security_group.alfresco_sfs_alb.id | ||
| description = "egress from alb to ecs cluster" | ||
| ip_protocol = "-1" | ||
| cidr_ipv4 = var.account_config.shared_vpc_cidr | ||
| } | ||
|
|
||
| # internal application load balancer | ||
| resource "aws_lb" "alfresco_sfs" { | ||
| name = "${var.app_name}-${var.env_name}-alfresco-sfs-alb" | ||
| internal = true | ||
| load_balancer_type = "application" | ||
| security_groups = [aws_security_group.alfresco_sfs_alb.id] | ||
| subnets = var.account_config.private_subnet_ids | ||
|
|
||
| enable_deletion_protection = false | ||
| drop_invalid_header_fields = true | ||
| } | ||
|
|
||
|
|
||
| resource "aws_lb_listener" "alfresco_sfs_listener_https" { | ||
| load_balancer_arn = aws_lb.alfresco_sfs.id | ||
| port = 443 | ||
| protocol = "HTTPS" | ||
| certificate_arn = local.certificate_arn | ||
| ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01" | ||
|
|
||
| default_action { | ||
| type = "fixed-response" | ||
| fixed_response { | ||
| content_type = "text/plain" | ||
| status_code = "404" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters