Refactor Ansible actions to improve host inventory handling

.github/workflows/terraform-aws-iac-apply.yml

@@ -0,0 +1,34 @@
+name: Terraform IAC Apply
+
+on:
+  schedule:
+    - cron: "0 1 * * 0"
+  push:
+    branches:
+      - main
+    paths:
+      - "terraform/aws-iac/**"
+jobs:
+  terraform-apply:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup environment
+        uses: ./.github/actions/setup-env
+
+
+      - name: Setup Terraform environment
+        uses: ./.github/actions/setup-terraform-env
+  
+      - name: Terraform Init
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          cd terraform/aws-iac
+          sectool exec terraform init
+          sectool exec terraform apply --auto-approve

.github/workflows/terraform-aws-iac-validate-on-pr.yml

@@ -0,0 +1,37 @@
+name: Terraform AWS IAC Validate on Pull Request
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "terraform/aws-iac/**"
+    types:
+      - opened
+      - synchronize
+      - reopened
+jobs:
+  terraform-validate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup environment
+        uses: ./.github/actions/setup-env
+
+      - name: Setup Terraform environment
+        uses: ./.github/actions/setup-terraform-env
+
+      - name: Terraform Init and Validate
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          cd terraform/iac
+          sectool exec terraform init
+          sectool exec terraform validate
+          sectool exec terraform fmt -check
+          sectool exec terraform plan

.github/workflows/terraform-iac-validate-on-pr.yml

@@ -44,6 +44,7 @@ jobs:
       - name: Terraform Init and Validate
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          SYSTEM_ID: ${{ steps.get-host-info.outputs.system-id }}
         run: |
           cd terraform/iac
           export TF_VAR_system_id=$SYSTEM_ID

ansible/roles/login/tasks/main.yml

@@ -14,13 +14,13 @@
   loop: "{{ login_users }}"
 
 - name: Disable password expiration
-  command: chage -M -1 "{{ item.username }}"
+  ansible.builtin.command: chage -M -1 "{{ item.username }}"
   become: yes
   when: item.password_expiration is defined and not item.password_expiration
   loop: "{{ login_users }}"
 
 - name: Disable password login
-  command: passwd -d "{{ item.username }}"
+  ansible.builtin.command: passwd -d "{{ item.username }}"
   become: yes
   when: item.password_disabled is defined and item.password_disabled
   loop: "{{ login_users }}"

terraform/aws-iac/.vault

@@ -0,0 +1 @@
+../../repository.vault

terraform/aws-iac/backend.tf

@@ -0,0 +1,7 @@
+terraform {
+  backend "s3" {
+    bucket = "a13labs.infra"
+    key    = "aws-alarms.tfstate"
+    region = "us-east-1"
+  }
+}

terraform/aws-iac/billing.tf

@@ -0,0 +1,34 @@
+resource "aws_cloudwatch_metric_alarm" "billing_alarm" {
+
+  alarm_name          = "billing_alarm"
+  comparison_operator = "GreaterThanThreshold"
+  metric_name         = "EstimatedCharges"
+  namespace           = "AWS/Billing"
+  evaluation_periods  = "1"
+  period              = "21600"
+  statistic           = "Maximum"
+  threshold           = local.billing_alarm_limit
+  alarm_description   = "Billing alarm"
+
+  alarm_actions = [aws_sns_topic.billing_alarm_topic.arn]
+
+  tags = {
+    Name        = "billing_alarm_topic_cf"
+    CreatedBy   = "terraform"
+    Environment = "aws-alarms"
+  }
+}
+
+# The SNS topic with email subscriptions
+# https://medium.com/@raghuram.arumalla153/aws-sns-topic-subscription-with-email-protocol-using-terraform-ed05f4f19b73
+resource "aws_sns_topic" "billing_alarm_topic" {
+  name = "billing_alarm_topic"
+  provisioner "local-exec" {
+    command = "sh ${path.module}/scripts/sns_subscription.sh"
+    environment = {
+      AWS_DEFAULT_REGION = var.region
+      sns_arn            = self.arn
+      sns_emails         = local.billing_alarm_emails
+    }
+  }
+}

terraform/aws-iac/config.tf

@@ -0,0 +1,5 @@
+locals {
+  region               = "us-east-1"
+  billing_alarm_limit  = 40
+  billing_alarm_emails = "c.alexandre.pires@gmail.com"
+}

terraform/aws-iac/outputs.tf

@@ -0,0 +1,17 @@
+# 
+# Copyright 2019 Alexandre Pires (alexandre.pires@mov.ai)
+# 
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+# 
+#        http://www.apache.org/licenses/LICENSE-2.0
+# 
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+# 
+# File: outputs.tf
+

terraform/aws-iac/provider.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">1.9"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~>5.70"
+    }
+  }
+}
+
+# Configure the AWS Provider
+provider "aws" {
+  region = var.region
+}

terraform/aws-iac/scripts/sns_subscription.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+
+for email in $sns_emails; do
+  echo $email
+  aws sns subscribe --topic-arn "$sns_arn" --protocol email --notification-endpoint "$email"
+done

terraform/aws-iac/sectool.env

@@ -0,0 +1,2 @@
+AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY
+AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY

terraform/aws-iac/variables.tf

@@ -0,0 +1,4 @@
+variable "region" {
+  description = "AWS Default region"
+  default     = "us-east-1"
+}

terraform/aws-iac/vars/main.tfvars

@@ -0,0 +1 @@
+

terraform/aws-iac/versions.tf

@@ -0,0 +1,3 @@
+terraform {
+  required_version = ">= 0.13"
+}

terraform/iac/config.tf

@@ -2,6 +2,5 @@ locals {
   instance_ips = [
     "${data.contabo_instance.microk8s.ip_config[0].v4[0].ip}/32",
   ]
-  instance_mac_addr = replace(data.contabo_instance.microk8s.mac_address, ":", "_")
   alexpires_me_zone = "alexpires.me"
 }

terraform/iac/provider.tf

@@ -2,26 +2,6 @@
 terraform {
   required_version = "~>1.8"
   required_providers {
-    random = {
-      source  = "hashicorp/random"
-      version = "~>3.4"
-    }
-    null = {
-      source  = "hashicorp/null"
-      version = "~>3.2"
-    }
-    external = {
-      source  = "hashicorp/external"
-      version = "~>2.2"
-    }
-    time = {
-      source  = "hashicorp/time"
-      version = "~>0.9"
-    }
-    kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = "~>2.18"
-    }
     scaleway = {
       source  = "scaleway/scaleway"
       version = "~>2.13"

terraform/iac/registry.tf

@@ -0,0 +1,5 @@
+resource "scaleway_registry_namespace" "a13labs" {
+  name        = "a13labs"
+  description = "A13Labs container registry"
+  is_public   = false
+}

terraform/k8sapps/backend.tf

@@ -1,7 +1,7 @@
 terraform {
   backend "s3" {
     bucket = "a13labs.infra"
-    key    = "scaleway-apps.tfstate"
+    key    = "alexpires.me-k8sapps.tfstate"
     region = "us-east-1"
   }
 }