refactor: simplify instance user data and update infrastructure configuration for ap-south-2 migration
This commit is contained in:
parent
3dedb1cc18
commit
cffa7abaec
3 changed files with 41 additions and 162 deletions
49
.github/workflows/deploy.yml
vendored
49
.github/workflows/deploy.yml
vendored
|
|
@ -1,49 +0,0 @@
|
|||
name: Deploy AWS CDK Stack
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
|
||||
permissions:
|
||||
id-token: write # Required for OIDC role assumption
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: '22'
|
||||
cache: 'npm'
|
||||
cache-dependency-path: 'aws_cdk/package-lock.json'
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
cd aws_cdk
|
||||
npm ci
|
||||
|
||||
- name: Configure AWS Credentials
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
||||
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||||
aws-region: ${{ secrets.AWS_REGION || 'ap-south-1' }}
|
||||
|
||||
- name: Bootstrap CDK Environment
|
||||
run: |
|
||||
cd aws_cdk
|
||||
npx cdk bootstrap aws://${{ secrets.AWS_ACCOUNT_ID }}/${{ secrets.AWS_REGION || 'ap-south-1' }}
|
||||
|
||||
- name: Deploy CDK Stack
|
||||
run: |
|
||||
cd aws_cdk
|
||||
npx cdk deploy --require-approval never
|
||||
env:
|
||||
CDK_DEFAULT_ACCOUNT: ${{ secrets.AWS_ACCOUNT_ID }}
|
||||
CDK_DEFAULT_REGION: ${{ secrets.AWS_REGION || 'ap-south-1' }}
|
||||
|
|
@ -1 +1,34 @@
|
|||
{}
|
||||
{
|
||||
"vpc-provider:account=764709663363:filter.isDefault=true:region=ap-south-2:returnAsymmetricSubnets=true": {
|
||||
"vpcId": "vpc-0d03dd80d367f6aad",
|
||||
"vpcCidrBlock": "172.31.0.0/16",
|
||||
"ownerAccountId": "764709663363",
|
||||
"availabilityZones": [],
|
||||
"subnetGroups": [
|
||||
{
|
||||
"name": "Public",
|
||||
"type": "Public",
|
||||
"subnets": [
|
||||
{
|
||||
"subnetId": "subnet-00a6428f5e757acfe",
|
||||
"cidr": "172.31.0.0/20",
|
||||
"availabilityZone": "ap-south-2a",
|
||||
"routeTableId": "rtb-0216fb8441861f4d8"
|
||||
},
|
||||
{
|
||||
"subnetId": "subnet-031d8c6c7343d74c6",
|
||||
"cidr": "172.31.32.0/20",
|
||||
"availabilityZone": "ap-south-2b",
|
||||
"routeTableId": "rtb-0216fb8441861f4d8"
|
||||
},
|
||||
{
|
||||
"subnetId": "subnet-006f070818cf6d7d7",
|
||||
"cidr": "172.31.16.0/20",
|
||||
"availabilityZone": "ap-south-2c",
|
||||
"routeTableId": "rtb-0216fb8441861f4d8"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -58,7 +58,7 @@ export class AwsCdkStack extends cdk.Stack {
|
|||
),
|
||||
securityGroup,
|
||||
role,
|
||||
keyName: 'vignesh_tipro',
|
||||
keyName: 'vignesh_tipro_apsouth2',
|
||||
detailedMonitoring: true,
|
||||
blockDevices: [
|
||||
{
|
||||
|
|
@ -74,114 +74,23 @@ export class AwsCdkStack extends cdk.Stack {
|
|||
instance.addUserData(
|
||||
// Ensure folder structures exist
|
||||
'mkdir -p /home/ubuntu/basic_requirements',
|
||||
'mkdir -p /home/ubuntu/wireguard',
|
||||
'mkdir -p /home/ubuntu/build_tools',
|
||||
|
||||
// 4.1 Write and run installation for basic requirements (Docker, Python 3, etc.)
|
||||
// 4.1 Write and run installation for basic requirements (Python 3, pip, venv, git, build-essential)
|
||||
'cat <<\'EOF\' > /home/ubuntu/basic_requirements/install.sh',
|
||||
'#!/bin/bash',
|
||||
'set -e',
|
||||
'apt-get update -y',
|
||||
'apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release wget python3 python3-pip python3-venv git',
|
||||
'mkdir -m 0755 -p /etc/apt/keyrings',
|
||||
'curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg',
|
||||
'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null',
|
||||
'apt-get update -y',
|
||||
'apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin',
|
||||
'systemctl enable docker',
|
||||
'systemctl start docker',
|
||||
'apt-get install -y ca-certificates curl gnupg lsb-release wget python3 python3-pip python3-venv git build-essential',
|
||||
'EOF',
|
||||
'chmod +x /home/ubuntu/basic_requirements/install.sh',
|
||||
'/home/ubuntu/basic_requirements/install.sh',
|
||||
|
||||
// 4.2 Set up Caddy, Wireguard, and Woodpecker CI
|
||||
'cat <<\'EOF\' > /home/ubuntu/wireguard/Caddyfile',
|
||||
'vpn.tipro.in {',
|
||||
' reverse_proxy wg-easy:51821',
|
||||
'}',
|
||||
'',
|
||||
'ci.tipro.in {',
|
||||
' # Restrict access to local, server IP, and VPN subnets',
|
||||
' @blocked not remote_ip 13.205.93.190 127.0.0.1 ::1 10.8.0.0/24 10.252.1.0/24 172.16.0.0/12',
|
||||
' respond @blocked "Access Denied" 403',
|
||||
' reverse_proxy woodpecker-server:8000',
|
||||
'}',
|
||||
'EOF',
|
||||
'',
|
||||
'cat <<\'EOF\' > /home/ubuntu/wireguard/docker-compose.yml',
|
||||
'version: "3"',
|
||||
'services:',
|
||||
' wg-easy:',
|
||||
' image: weejewel/wg-easy',
|
||||
' container_name: wg-easy',
|
||||
' environment:',
|
||||
' - WG_HOST=13.205.93.190',
|
||||
' - PASSWORD=admin123',
|
||||
' volumes:',
|
||||
' - ./config:/etc/wireguard',
|
||||
' cap_add:',
|
||||
' - NET_ADMIN',
|
||||
' - SYS_MODULE',
|
||||
' sysctls:',
|
||||
' - net.ipv4.ip_forward=1',
|
||||
' - net.ipv4.conf.all.src_valid_mark=1',
|
||||
' restart: unless-stopped',
|
||||
'',
|
||||
' woodpecker-server:',
|
||||
' image: woodpeckerci/woodpecker-server:v3',
|
||||
' container_name: woodpecker-server',
|
||||
' restart: unless-stopped',
|
||||
' ports:',
|
||||
' - "5000:8000"',
|
||||
' volumes:',
|
||||
' - woodpecker-data:/var/lib/woodpecker',
|
||||
' environment:',
|
||||
' - WOODPECKER_HOST=https://ci.tipro.in',
|
||||
' - WOODPECKER_OPEN=true',
|
||||
' - WOODPECKER_AGENT_SECRET=secret_agent_token_123',
|
||||
' # GitHub Integration settings',
|
||||
' - WOODPECKER_GITHUB=true',
|
||||
' - WOODPECKER_GITHUB_CLIENT=${GITHUB_CLIENT_ID:-replace_me}',
|
||||
' - WOODPECKER_GITHUB_SECRET=${GITHUB_CLIENT_SECRET:-replace_me}',
|
||||
'',
|
||||
' woodpecker-agent:',
|
||||
' image: woodpeckerci/woodpecker-agent:v3',
|
||||
' container_name: woodpecker-agent',
|
||||
' restart: unless-stopped',
|
||||
' depends_on:',
|
||||
' - woodpecker-server',
|
||||
' volumes:',
|
||||
' - /var/run/docker.sock:/var/run/docker.sock',
|
||||
' environment:',
|
||||
' - WOODPECKER_SERVER=woodpecker-server:9000',
|
||||
' - WOODPECKER_SHARED_SECRET=secret_agent_token_123',
|
||||
'',
|
||||
' caddy:',
|
||||
' image: caddy:latest',
|
||||
' container_name: caddy',
|
||||
' restart: unless-stopped',
|
||||
' ports:',
|
||||
' - "80:80"',
|
||||
' - "443:443"',
|
||||
' - "51820:51820/udp"',
|
||||
' volumes:',
|
||||
' - ./Caddyfile:/etc/caddy/Caddyfile',
|
||||
' - caddy_data:/data',
|
||||
' - caddy_config:/config',
|
||||
'',
|
||||
'volumes:',
|
||||
' woodpecker-data:',
|
||||
' caddy_data:',
|
||||
' caddy_config:',
|
||||
'EOF',
|
||||
'cd /home/ubuntu/wireguard && docker compose up -d',
|
||||
|
||||
// 4.3 Setup permissions for all user folders
|
||||
// 4.2 Setup permissions for all user folders
|
||||
'chown -R ubuntu:ubuntu /home/ubuntu/basic_requirements',
|
||||
'chown -R ubuntu:ubuntu /home/ubuntu/wireguard',
|
||||
'chown -R ubuntu:ubuntu /home/ubuntu/build_tools',
|
||||
|
||||
// 4.5 Install CloudWatch Agent (ARM64 package for Graviton instance)
|
||||
// 4.3 Install CloudWatch Agent (ARM64 package for Graviton instance)
|
||||
'wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb',
|
||||
'dpkg -i -E ./amazon-cloudwatch-agent.deb',
|
||||
'mkdir -p /opt/aws/amazon-cloudwatch-agent/etc',
|
||||
|
|
@ -203,20 +112,6 @@ export class AwsCdkStack extends cdk.Stack {
|
|||
' "metrics_collection_interval": 60',
|
||||
' }',
|
||||
' }',
|
||||
' },',
|
||||
' "logs": {',
|
||||
' "logs_collected": {',
|
||||
' "files": {',
|
||||
' "collect_list": [',
|
||||
' {',
|
||||
' "file_path": "/var/lib/docker/containers/*/*.log",',
|
||||
' "log_group_name": "WireGuard-Logs",',
|
||||
' "log_stream_name": "{instance_id}",',
|
||||
' "retention_in_days": 7',
|
||||
' }',
|
||||
' ]',
|
||||
' }',
|
||||
' }',
|
||||
' }',
|
||||
'}',
|
||||
'EOF',
|
||||
|
|
@ -225,7 +120,7 @@ export class AwsCdkStack extends cdk.Stack {
|
|||
|
||||
// 5. Associate your pre-created Elastic IP using its Allocation ID
|
||||
new ec2.CfnEIPAssociation(this, 'internalsEIPAssociation', {
|
||||
allocationId: 'eipalloc-06bea32c3a787c2b1',
|
||||
allocationId: 'eipalloc-0d1630fa0633874cb',
|
||||
instanceId: instance.instanceId,
|
||||
});
|
||||
|
||||
|
|
@ -283,7 +178,7 @@ export class AwsCdkStack extends cdk.Stack {
|
|||
|
||||
// Outputs
|
||||
new cdk.CfnOutput(this, 'internalsPublicIP', {
|
||||
value: '13.205.93.190',
|
||||
value: '16.113.57.127',
|
||||
description: 'The Elastic IP address of your Mail Server',
|
||||
});
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue