From 4de62d73341fbd5a5aa6adf35fee8ba05f1aeac0 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sat, 28 Sep 2024 19:15:56 +0200 Subject: [PATCH] Add infrastructure bucket for storing assets --- .github/workflows/ansible-apply.yaml | 13 +- .github/workflows/terraform-iac-apply.yaml | 39 ++++++ .github/workflows/terraform-iac-validate.yaml | 47 +++++++ ansible/playbook_encryption.yml | 118 ++++++++++++++++++ ansible/requirements.yml | 1 - ansible/sectool.env | 1 + repository.vault | 2 +- terraform/iac/.vault | 1 + terraform/iac/backend.tf | 7 ++ terraform/iac/buckets.tf | 52 ++++++++ terraform/iac/config.tf | 5 + terraform/iac/contabo.tf | 3 + terraform/iac/provider.tf | 52 ++++++++ terraform/iac/sectool.env | 13 ++ terraform/iac/terraform.rc | 0 terraform/iac/variables.tf | 65 ++++++++++ terraform/k8sapps/backend.tf | 23 +--- 17 files changed, 414 insertions(+), 28 deletions(-) create mode 100644 .github/workflows/terraform-iac-apply.yaml create mode 100644 .github/workflows/terraform-iac-validate.yaml create mode 100644 ansible/playbook_encryption.yml create mode 100644 terraform/iac/.vault create mode 100644 terraform/iac/backend.tf create mode 100644 terraform/iac/buckets.tf create mode 100644 terraform/iac/config.tf create mode 100644 terraform/iac/contabo.tf create mode 100644 terraform/iac/provider.tf create mode 100644 terraform/iac/sectool.env create mode 100644 terraform/iac/terraform.rc create mode 100644 terraform/iac/variables.tf diff --git a/.github/workflows/ansible-apply.yaml b/.github/workflows/ansible-apply.yaml index 0de8c31..066c28c 100644 --- a/.github/workflows/ansible-apply.yaml +++ b/.github/workflows/ansible-apply.yaml @@ -80,9 +80,10 @@ jobs: SSH_AUTH_SOCK: /tmp/ssh_agent.sock run: | cd ansible - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_hardening.yml --skip-tags roles::cis::suid - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_microk8s.yml - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_gitea.yml - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_nextcloud.yml - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_wordpress.yml - sectool exec ansible-playbook -u $ANSIBLE_USER -i inventory/hosts playbook_m3uproxy.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_hardening.yml --skip-tags roles::cis::suid + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_wordpress.yml + sectool exec ansible-playbook -u $ANSIBLE_USER playbook_m3uproxy.yml diff --git a/.github/workflows/terraform-iac-apply.yaml b/.github/workflows/terraform-iac-apply.yaml new file mode 100644 index 0000000..5626332 --- /dev/null +++ b/.github/workflows/terraform-iac-apply.yaml @@ -0,0 +1,39 @@ +name: Terraform Apply + +on: + push: + branches: + - main + paths: + - "terraform/iac/**" + - .github/workflows/terraform-iac-apply.yaml + +jobs: + terraform-apply: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + + - name: Setup Terraform + uses: hashicorp/setup-terraform@v1 + with: + terraform_version: 1.9.6 + + - name: Setup Sectool + uses: a13labs/setup-sectool@v1 + + - name: Terraform Init + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + cd terraform/iac + sectool exec terraform init + + - name: Terraform Apply + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + cd terraform/iac + sectool exec terraform apply --auto-approve diff --git a/.github/workflows/terraform-iac-validate.yaml b/.github/workflows/terraform-iac-validate.yaml new file mode 100644 index 0000000..818e230 --- /dev/null +++ b/.github/workflows/terraform-iac-validate.yaml @@ -0,0 +1,47 @@ +name: Terraform Validate + +on: + pull_request: + branches: + - main + paths: + - "terraform/iac/**" + - .github/workflows/terraform-iac-validate.yaml + types: + - opened + - synchronize + - reopened +jobs: + terraform-validate: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + + - name: Setup Terraform + uses: hashicorp/setup-terraform@v1 + with: + terraform_version: 1.9.6 + + - name: Setup Sectool + uses: a13labs/setup-sectool@v1 + + - name: Terraform Init + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + cd terraform/iac + sectool exec terraform init + + - name: Terraform Plan + env: + VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }} + run: | + cd terraform/iac + sectool exec -n terraform plan -out=tfplan + + - name: Show Terraform Plan + run: | + cd terraform/iac + terraform show tfplan diff --git a/ansible/playbook_encryption.yml b/ansible/playbook_encryption.yml new file mode 100644 index 0000000..b646585 --- /dev/null +++ b/ansible/playbook_encryption.yml @@ -0,0 +1,118 @@ +--- +- name: Create LUKS encrypted file system with key file fetched from HTTP server + hosts: contabo + become: yes + vars: + disk_image_path: /a13labs.img + disk_image_size: 1G + luks_device_name: luks_device + mount_point: /a13labs + key_file_path: /root/luks_keyfile + key_file_url: https://a13labs-infra-{{ lookup('env','BUCKET_SUFFIX') }}.s3.fr-par.scw.cloud + key_fetch_service: fetch-a13labs-key.service + + tasks: + - name: Install cryptsetup and curl + apt: + name: + - cryptsetup + - curl + state: present + when: ansible_os_family == 'Debian' + + - name: Create disk image + ansible.builtin.command: fallocate -l {{ disk_image_size }} {{ disk_image_path }} + args: + creates: "{{ disk_image_path }}" + register: disk_image + + - name: Create encrypted volume + when: disk_image is changed + block: + - name: Get mac address + ansible.builtin.shell: | + set -o pipefail + ip link show eth0 | awk '/ether/ {print $2}' + args: + executable: /bin/bash + register: mac_address + changed_when: false + + - name: Sanitize mac address + set_fact: + mac_address_sanitized: "{{ mac_address.stdout | regex_replace('[:]', '%3A') }}" + changed_when: false + + - name: Create bucket URL + set_fact: + key_file_url: "{{ key_file_url }}/keys/{{ mac_address_sanitized }}.key" + changed_when: false + + - name: Download key file from HTTP server + ansible.builtin.uri: + url: "{{ key_file_url }}" + dest: "{{ key_file_path }}" + mode: '0600' + args: + creates: "{{ key_file_path }}" + + - name: Set up LUKS encryption with key file + ansible.builtin.command: cryptsetup -q luksFormat {{ disk_image_path }} {{ key_file_path }} + + - name: Open LUKS device with key file + ansible.builtin.command: cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }} + register: luks_device + + - name: Delete key file + ansible.builtin.file: + path: "{{ key_file_path }}" + state: absent + + - name: Create file system + ansible.builtin.command: mkfs.ext4 /dev/mapper/{{ luks_device_name }} + + - name: Create mount point + file: + path: "{{ mount_point }}" + state: directory + + - name: Mount the file system + ansible.builtin.command: mount /dev/mapper/{{ luks_device_name }} {{ mount_point }} + + - name: Ensure the file system is mounted + mount: + path: "{{ mount_point }}" + src: /dev/mapper/{{ luks_device_name }} + fstype: ext4 + state: mounted + + - name: Create systemd service to fetch key file and open LUKS device + copy: + dest: /etc/systemd/system/{{ key_fetch_service }} + content: | + [Unit] + Description=Fetch LUKS key file from HTTP server and open LUKS device + After=network-online.target + Before=cryptsetup.target + + [Service] + Type=oneshot + ExecStartPre=/usr/bin/curl -o {{ key_file_path }} {{ key_file_url }} + ExecStart=/usr/bin/cryptsetup luksOpen {{ disk_image_path }} {{ luks_device_name }} -d {{ key_file_path }} + ExecStartPost=/bin/rm -f {{ key_file_path }} + + [Install] + WantedBy=multi-user.target + + - name: Reload systemd daemon + ansible.builtin.command: systemctl daemon-reload + + - name: Enable the key fetch service + ansible.builtin.command: systemctl enable {{ key_fetch_service }} + + - name: Add entry to /etc/fstab + lineinfile: + path: /etc/fstab + line: "/dev/mapper/{{ luks_device_name }} {{ mount_point }} ext4 defaults 0 2" + create: yes + diff --git a/ansible/requirements.yml b/ansible/requirements.yml index 115ff93..a6b0fd8 100644 --- a/ansible/requirements.yml +++ b/ansible/requirements.yml @@ -2,4 +2,3 @@ collections: - ansible.posix - community.general - - community.libvirt diff --git a/ansible/sectool.env b/ansible/sectool.env index f960350..85c7294 100644 --- a/ansible/sectool.env +++ b/ansible/sectool.env @@ -5,3 +5,4 @@ MAXMIND_LICENSE_KEY=$MAXMIND_LICENSE_KEY USER_PASSWORD_SALT=$USER_PASSWORD_SALT USER_PASSWORD_OPERATOR=$USER_PASSWORD_OPERATOR ANSIBLE_FORCE_COLOR=True +BUCKET_SUFFIX=$BUCKET_SUFFIX diff --git a/repository.vault b/repository.vault index 66be9f3..030cb64 100644 --- a/repository.vault +++ b/repository.vault @@ -1 +1 @@ -lZE/F/Ng+kqQG65u5afRAODt626sHUV/sS13AsWpx6AlWOf40hrq9QNnkjAq1fF8FVctnyY+ltBjwc7fAmvqlwWmbVclahnwQFbgjQ24c6IYuMMmULEy9PN6iPBFH1EstA8lrSVNCz+AN1NR0yxctAMMv7/XoAo6e6nOsn3Ko5F4M57L8QSdoEI/Giz2UvVm46teibFDivnfgjKji3oWO5xIcy7ggZsDF4pYZLci3THfgonoBPZUxyehVl/uyarT0k0LIUD6QUCNXaxxQXa2rDsgyoglLOUZRvitdoThXJsW4VjKYD/joJdR1bELwJ41Nh6IPcWsUSJrEJHhr3IEBMk6DKkC96Ie1kOvW8GkHOKkmFdZkhr2gj9ol6xB8XD/x6K6hZnW/BdJnD3F1JX05km3UHW4uSgvrN1l4x1nNZ5w84BQ/mw1M90ZoiCDjFBtQUOIYciFMQTkbUNnnvDigRXzLhcqxEMJnZ1saz6YXA86WDTxNU5AlOAiwtn4MpO7obXOaiclscB1smpFosjVUqKPpuJrNC5RehhXYVsSdqLk5nRYokv866/RQmXOXzNeig9DrJvj0+Da5kcQ12gWEKr6gSG4O8QLcUcP+YnDtPOaq6OpzEzVmYB9XboOZQyumiUn3QL0jwINBwbNM2GLvXHt5Mmhd16dcHbabZAqLzHRy5T2bh8jhcgRVORem9IOVOSIhCnv7szt+mfEzem5ipUx8dQljOFodNRf5YiJHuWS4yEsbsvV4dLdIqWwMasA1YsOjzRnu5w0AJjd5mo3v9zFW/1kop+tFcsPbglr/Tm9uH9a7D1gZnkZLlUILhC+edRPde5upIyQkrdm7WLECkXsBqQz3QhbcD9BW2krFgvdjyDJYGSpFnXXtsOoo/+NnQd+IRiSe2aevVQH6MrUqfeQ0l/Wxi2cpxTIMLhKnmkRkrSqOn3/EpVL62eJPCmW4OSyCISexIxVvsx72WhvlAMLDXfPxC7zTObUtlrd3w+kzIF8K3ZduRUHWwtCSSekhzTJ3JZyGxKZ88sPfUtk7n1J/lmFVCmHmkuU+Rw21PEVPepPL1tkBURk12uH/+uyRFfR7zFEXXC39nXyKN/Yxa+z0Tdhj2mynLbuZ6ygwfEqXM1hyScqTh1J4z6CDLMelE+kEgvNxG1n8fXC75KPsaxzsqwqlo90CDNNrs2loJrxm3kQcqXxowy/sLtupHpdufEPP6hHnPptqsndmiNiqZjLgmCGuMR3KZBxrv2nsmwdnT4V/aDf80m3lRSuhjZD4zhRIhxsIRKlMjjAi7qgeHFBrOS61J/VVwtzxgLZFfEnPM8M3nf3wh/gAEzTa1uWiJxO26UDUymoW18YWOoIQDn0vjN3acLtGcy+mbjHYWHoJ2So0hjuDJ6ItGKfvrqDwjKX6grGXi955JhVPdR4wh6K+zoYqNS0uFVXc4hJZnr9R7xfPE5QjjNQqJLCZzgkX0sA28qL/5lzzr7XNkfotz0muyvO5OvfBJdcYyjTg5A7fZT0OvbM1dc8pmXzU1+dZnf/ByVemm81rBGBxhlcLIszqGhQzL9Is6dWzHChLA5moQSlKDvcjgUhuB/nV2FKi6kXqp5xU07i1kcbG6b4JL2fA4+ad71odxmE8SYmXt3PZFqJJIAmdVIAXdHeUQZlaA/wEbB9RdlD7XrGVc30BnYg2UA5AO2ijPECuScsZ+QmGBU/pzgp5mLZ691CyvnS9YtDuK3t1c1aNAOMpw9ZLmY5DINzmXuKtLHCw/HCUAH8+Zj94IXJKWYl1CmcxWH2prTDdbjOv5FpckQq04YCykx9qEr8tlq+LBkYB5r7DzzZfemb9YPKapqDXOTJVYBZP35QWPd2xHJVSE9KnYUpgfPxrYpEeJRBvPODOt1pxu+HOiiljSB3H5WBPlS91w1TcQZCE0g9VL+ERmoCOOso0PSI9F2LquLPA6sVlcxMXP9ouZ5BkkSxrOkc/3iLrINHaXRHirfNJLzDePe+xxLJCzXVDeFqUzd8iZO71E5fiGBzwpefnBnfa/bEF/SXfiFl491rYx8Wrur11QmaiHpMPdTsF1YknrE9HU4eYu3wT+7GgeIpX0KN3iT2RFPj9BztT5JBj8LefK3KSzRqc4E3Oak6WEfulkAOguOPJI3FOoXod/trve2kiReSTJlCEcK1FtOStE9yN0vRLM8= \ No newline at end of file +bCt1NV1R5FDMa9kEhZTJVefbnHPE4zqzKrfwqkqxoO1JVIkMsnAQCr79i4TeMme4wRop+GX08GkJQq5gp8nLSnz5r+y+RckUVTuA1LMg4mEuwVkQ8lyy9lMY3K/KHtzjRAfR2zlOZ+V02BelHos1KApzdoMfWg5SsLqntvxkexXiZH7Z6BahniWLldC3mE9lBwuTU8epJS0v9ngerj+MMK9DwSHvPHrCs6iGbHVo18iboO561mnvLVV6YOQ7ub3oTwYmGaYmWvn+vRVpFQmLw7Cp9T2IwLdadgcLoKrbzLf6ee8wo0IBW765d16krBh1L7p2tpHcyIUE9gTCkylXVApX3oslQlgtzMoTOaWZ6hmjP0rD8kzn6XceFcpx1dEOd5a9j+tb4EIP0HJoFVdGb/MQnmmumyla+aGJY0VtHbx3b2TICvgwr45RUHRKDI1UgA02rXKeklfcXvoOpq5kweV4DxckElzLjGohZHESWdbY1y2knMVIuCImRv01jbP1rwrwdKt1LGlWBX5OsOujS5qxBeHZNqnKrLbn1mkM1k5PtCnfLfn0NINA/lEs+VDK84RMmzz+s9rAyGNkTJpnbjfU2xhy0IQrXRJf+DGpCkhKRjzBLLnzwfeB5Ki6tjfFygphhkKMAofQ3wlpQ8ppMt93eZ5LONQg3ttdja41uPnPV68dgGhv92Rtx+ByisEhsoIAu2wJZ+jKPTCiVpru46dQDEwf7rGFu+RXK94LG7wg6YA2yJz3QooHcAPFvxaKCfnrfB9oY/qbElueZyvZr1unfE4BigHIfPkf4gRDVq8GiqRiypP+/Cxio1Wc3sLLJkOQmHW0+ZDeoqxHEsRfjHbb00FP+7QtFG2v7wJNH6FZxpDz/vRpoZRe2BlPKLQKbAXVWQHFXgP4Q9NikrQ3o32yMpTeUgSTv8lwk1dvUijEDEweudti3RWAlG6LOj5pYp8z4DY04s8Hz6ZEmYji1LPDl6jsRbjOM1bpZTjORLmYza757KhzMHPbjwUtR+sVfnIjUODVtdOnzRMRzBNufQPat+uHlZ/AxB3Gq+6AX46q6fC/moKu7d5vO2tVgZr8rQuYYa6hclkilp5Tt/WEXQB6EQ1VzDnMAe4AfQVJwNkjw/NXfTSvzro2qreHLNyLbxtgHOEOP1E7lvQqcSM9zm9DUhPx61LDe3WkRBoPcKZr0Lx8LvAwpENNOLyIZ7k5BcJNlhMbO4BPH3HRrDGIM+Bg9x2HkbDaLeBi9A7F2ueACXH+6a/ZqBG8jGBKbcXm3AqHqgYXKNhAwV2NmdV2awePEJ5byb4x2/2flrE4kO3LGIz98KXzBugJsY9+0Ox3V6X6jdHXkG29A5JdcfszhtsBVFQyk73GwZtMJxpTC8QJjykaKx/6lPm5QghbTXxDIHzEPFenUdssLx6JMJRcPWuKDXkK9pRkYamcEgxSjtCHRJI/luhWvSniPka4b5oGssl+VtQXmkpk9ntALUA+2zhhn5Us1AVNkDlPcGxAL+20Kx5K7gJ9RNAYznlZvRAYH4gKjNNOZiu52X4XSTKMaNgvK1bfM66UcslbviEfbUs0IGTT6wf1HrKKENoSb/EdP50hCWV+vOPUYxENS16J+oX2Xw2rz2EYeg0nWVsl2PXctuXlTf4HaVMKdm5XV7uNmla9hchRCUYh6C5jS763HZI0DVgGMPcxraImG0yaBZVT3NEZPeGqplrDrTcesCvGgybgSSjbvVhcMMN7WjlhQeuTvJQhvw8DhYgEyaKnX46DoEm3LKGu6TrA2m2VI7J1BwRAauu7yU0aHkJZ9FfeVZTzKcUy/1Cp+3mW1czego1PPA7TIPkaqT5QCJDB6Jlbk5yEEw1yA/z7H4k/y2h4HSVpG9m9+8ASTvHXwTuvTtvqJp3Xw+e6tXzF8eNXiki7/y3psxfROY3hsidsLg/kAYcOPhYmyQ8vb+gawATbgIf2gp6zRIjBXXmJ5chUzzszP9uxm/va/UE9o2Ntp8907sogYq2xOMPIP9NP30x9YRxsxvYKuzJD6fgEtWLdzy4G77mbsGT3Lajv4I8JKIKTjmOR+ah0GN9xadueTlVVqPXAaSYM40pKXPN9LcVCdYgQj3msV56hFRL0qOKs4gIiqvWD3bgE3bvQdkEThY2XhZ9U0DtIyvIW5Lw+EapzWfFY3TEVzzjxJN0f5lwoRnIOmIO9lJKKN/4ZOAPidZoCfz3HeRtzTRNZyY6WE7STtA05wI/zoV/K6SEeLyod02XfLFIa4TaoZoVpC+g/Kr7bG8TC30eDc31AhhN0Tfj/ID47t4oD6jeS2+3z1Ztn/Kfu63c8oCKp0trDV4SAsWs4qHPDrTDH2aJ6GlZZaaJuw5EBwAPuWqEVdJfr368XUYU506ToCOH3BMtuAuONoiR/wT/W5uei4K3kf+zvC2cOz8vAV+AIRY3yQK3mKg0b33CSE+GtcTpfBP+Q9PvPWL3JuhAap2pqXdEMDYfmV9Jn0h8izOFErVP/odPrvD9J51GenR0EVmsPq7p/DmmQHT7HF5GADEDHdkrwesBurAB5/M63l9WIzXQA8LIX6ksMy5ZLCEfg6IYNKoX/H6c9XXakSEQ6riZdBAXVzoozXEDmHankTPGurD6TEy1H2oFtBiYAB1PCaTJfPOC3iSaGClyQ7baTBTz7IrheaNKy/WT6dk8c7SYToidad3Bx+64zKpNwHP2/KjIUXJqZHSc1BaBdDk1fDHREHLlkHsq2A3rDSYYvhcG8gLLjkfD3lupLWO0kzfoynb/dCdn2HNVUog+/ \ No newline at end of file diff --git a/terraform/iac/.vault b/terraform/iac/.vault new file mode 100644 index 0000000..7007d14 --- /dev/null +++ b/terraform/iac/.vault @@ -0,0 +1 @@ +../../repository.vault \ No newline at end of file diff --git a/terraform/iac/backend.tf b/terraform/iac/backend.tf new file mode 100644 index 0000000..9848ece --- /dev/null +++ b/terraform/iac/backend.tf @@ -0,0 +1,7 @@ +terraform { + backend "s3" { + bucket = "a13labs.infra" + key = "a13labs-iac.tfstate" + region = "us-east-1" + } +} diff --git a/terraform/iac/buckets.tf b/terraform/iac/buckets.tf new file mode 100644 index 0000000..cd3ffba --- /dev/null +++ b/terraform/iac/buckets.tf @@ -0,0 +1,52 @@ +resource "scaleway_object_bucket" "infra_assets" { + name = "a13labs-infra-${var.bucket_suffix}" + project_id = var.scaleway_project_id + region = "fr-par" +} + +resource "scaleway_object_bucket_policy" "policy" { + bucket = scaleway_object_bucket.infra_assets.name + policy = jsonencode({ + Version = "2023-04-17", + Id = "AllowMachineDownload", + Statement = [ + { + Effect = "Allow" + Action = [ + "s3:ListBucket", + "s3:GetObject", + ] + Principal = "*" + Resource = [ + scaleway_object_bucket.infra_assets.name, + "${scaleway_object_bucket.infra_assets.name}/*", + ] + Condition = { + IpAddress = { + "aws:SourceIp" = local.instance_ips + } + }, + }, + { + Effect = "Allow" + Action = [ + "s3:*", + ] + Principal = { + SCW = "user_id:${var.scaleway_user_id}" + } + Resource = [ + scaleway_object_bucket.infra_assets.name, + "${scaleway_object_bucket.infra_assets.name}/*", + ] + }, + ] + }) +} + +resource "scaleway_object" "encryption_key" { + bucket = scaleway_object_bucket.infra_assets.id + key = "keys/${data.contabo_instance.microk8s.mac_address}.key" + + content_base64 = base64encode(var.encryption_key) +} diff --git a/terraform/iac/config.tf b/terraform/iac/config.tf new file mode 100644 index 0000000..e6e8092 --- /dev/null +++ b/terraform/iac/config.tf @@ -0,0 +1,5 @@ +locals { + instance_ips = [ + "${data.contabo_instance.microk8s.ip_config[0].v4[0].ip}/32", + ] +} diff --git a/terraform/iac/contabo.tf b/terraform/iac/contabo.tf new file mode 100644 index 0000000..a284a36 --- /dev/null +++ b/terraform/iac/contabo.tf @@ -0,0 +1,3 @@ +data "contabo_instance" "microk8s" { + id = "201912751" +} diff --git a/terraform/iac/provider.tf b/terraform/iac/provider.tf new file mode 100644 index 0000000..3a163b7 --- /dev/null +++ b/terraform/iac/provider.tf @@ -0,0 +1,52 @@ + +terraform { + required_version = "~>1.8" + required_providers { + random = { + source = "hashicorp/random" + version = "~>3.4" + } + null = { + source = "hashicorp/null" + version = "~>3.2" + } + external = { + source = "hashicorp/external" + version = "~>2.2" + } + time = { + source = "hashicorp/time" + version = "~>0.9" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = "~>2.18" + } + scaleway = { + source = "scaleway/scaleway" + version = "~>2.13" + } + contabo = { + source = "contabo/contabo" + version = "~>0.1" + } + } +} + + +provider "scaleway" { + zone = "fr-par-2" + region = "fr-par" + access_key = var.scaleway_access_key + secret_key = var.scaleway_secret_key + organization_id = var.scaleway_organization_id +} + + +# Configure your Contabo API credentials +provider "contabo" { + oauth2_client_id = var.contabo_client_id + oauth2_client_secret = var.contabo_client_secret + oauth2_user = var.contabo_api_user + oauth2_pass = var.contabo_api_password +} diff --git a/terraform/iac/sectool.env b/terraform/iac/sectool.env new file mode 100644 index 0000000..cf59094 --- /dev/null +++ b/terraform/iac/sectool.env @@ -0,0 +1,13 @@ +AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY +AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY +TF_VAR_scaleway_access_key=$SCALEWAY_ACCESS_KEY +TF_VAR_scaleway_secret_key=$SCALEWAY_SECRET_KEY +TF_VAR_scaleway_project_id=$SCALEWAY_PROJECT_ID +TF_VAR_scaleway_organization_id=$SCALEWAY_ORGANIZATION_ID +TF_VAR_scaleway_user_id=$SCALEWAY_USER_ID +TF_VAR_contabo_client_id=$CONTABO_CLIENT_ID +TF_VAR_contabo_client_secret=$CONTABO_CLIENT_SECRET +TF_VAR_contabo_api_password=$CONTABO_API_PASSWORD +TF_VAR_contabo_api_user=$CONTABO_USER_NAME +TF_VAR_bucket_suffix=$BUCKET_SUFFIX +TF_VAR_encryption_key=$ENCRYPT_KEY diff --git a/terraform/iac/terraform.rc b/terraform/iac/terraform.rc new file mode 100644 index 0000000..e69de29 diff --git a/terraform/iac/variables.tf b/terraform/iac/variables.tf new file mode 100644 index 0000000..582068b --- /dev/null +++ b/terraform/iac/variables.tf @@ -0,0 +1,65 @@ +variable "scaleway_access_key" { + description = "Scaleway Access key" + type = string + sensitive = true +} + +variable "scaleway_secret_key" { + description = "Scaleway Secret key" + type = string + sensitive = true +} + +variable "scaleway_project_id" { + description = "Scaleway Project Id" + type = string + sensitive = true +} + +variable "scaleway_organization_id" { + description = "Scaleway Organization Id" + type = string + sensitive = true +} + +variable "scaleway_user_id" { + description = "Scaleway User Id" + type = string + sensitive = true +} + + +variable "contabo_client_id" { + description = "Contabo Client ID" + type = string + sensitive = true +} + +variable "contabo_client_secret" { + description = "Contabo Client Secret" + type = string + sensitive = true +} + +variable "contabo_api_password" { + description = "Contabo API Password" + type = string + sensitive = true +} + +variable "contabo_api_user" { + description = "Contabo API User" + type = string +} + +variable "encryption_key" { + description = "Encryption key for sensitive data" + type = string + sensitive = true +} + +variable "bucket_suffix" { + description = "Suffix for bucket names" + type = string + sensitive = true +} diff --git a/terraform/k8sapps/backend.tf b/terraform/k8sapps/backend.tf index 38df914..5f133c7 100644 --- a/terraform/k8sapps/backend.tf +++ b/terraform/k8sapps/backend.tf @@ -1,24 +1,7 @@ -# -# Copyright 2019 Alexandre Pires (alexandre.pires@mov.ai) -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -# File: backend.tf - terraform { backend "s3" { - bucket = "a13labs.infra" - key = "scaleway-apps.tfstate" - region = "us-east-1" + bucket = "a13labs.infra" + key = "scaleway-apps.tfstate" + region = "us-east-1" } }