From cffa7abaece166bef3c4360e8a38296865fbfc58 Mon Sep 17 00:00:00 2001 From: vickytechkey Date: Fri, 7 Aug 2026 10:31:25 +0530 Subject: [PATCH] refactor: simplify instance user data and update infrastructure configuration for ap-south-2 migration --- .github/workflows/deploy.yml | 49 --------------- aws_cdk/cdk.context.json | 35 ++++++++++- aws_cdk/lib/aws_cdk-stack.ts | 119 +++-------------------------------- 3 files changed, 41 insertions(+), 162 deletions(-) delete mode 100644 .github/workflows/deploy.yml diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml deleted file mode 100644 index 5eb3ab3..0000000 --- a/.github/workflows/deploy.yml +++ /dev/null @@ -1,49 +0,0 @@ -name: Deploy AWS CDK Stack - -on: - push: - branches: - - main - -permissions: - id-token: write # Required for OIDC role assumption - contents: read - -jobs: - deploy: - runs-on: ubuntu-latest - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Set up Node.js - uses: actions/setup-node@v4 - with: - node-version: '22' - cache: 'npm' - cache-dependency-path: 'aws_cdk/package-lock.json' - - - name: Install dependencies - run: | - cd aws_cdk - npm ci - - - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - aws-region: ${{ secrets.AWS_REGION || 'ap-south-1' }} - - - name: Bootstrap CDK Environment - run: | - cd aws_cdk - npx cdk bootstrap aws://${{ secrets.AWS_ACCOUNT_ID }}/${{ secrets.AWS_REGION || 'ap-south-1' }} - - - name: Deploy CDK Stack - run: | - cd aws_cdk - npx cdk deploy --require-approval never - env: - CDK_DEFAULT_ACCOUNT: ${{ secrets.AWS_ACCOUNT_ID }} - CDK_DEFAULT_REGION: ${{ secrets.AWS_REGION || 'ap-south-1' }} diff --git a/aws_cdk/cdk.context.json b/aws_cdk/cdk.context.json index 0967ef4..042a622 100644 --- a/aws_cdk/cdk.context.json +++ b/aws_cdk/cdk.context.json @@ -1 +1,34 @@ -{} +{ + "vpc-provider:account=764709663363:filter.isDefault=true:region=ap-south-2:returnAsymmetricSubnets=true": { + "vpcId": "vpc-0d03dd80d367f6aad", + "vpcCidrBlock": "172.31.0.0/16", + "ownerAccountId": "764709663363", + "availabilityZones": [], + "subnetGroups": [ + { + "name": "Public", + "type": "Public", + "subnets": [ + { + "subnetId": "subnet-00a6428f5e757acfe", + "cidr": "172.31.0.0/20", + "availabilityZone": "ap-south-2a", + "routeTableId": "rtb-0216fb8441861f4d8" + }, + { + "subnetId": "subnet-031d8c6c7343d74c6", + "cidr": "172.31.32.0/20", + "availabilityZone": "ap-south-2b", + "routeTableId": "rtb-0216fb8441861f4d8" + }, + { + "subnetId": "subnet-006f070818cf6d7d7", + "cidr": "172.31.16.0/20", + "availabilityZone": "ap-south-2c", + "routeTableId": "rtb-0216fb8441861f4d8" + } + ] + } + ] + } +} diff --git a/aws_cdk/lib/aws_cdk-stack.ts b/aws_cdk/lib/aws_cdk-stack.ts index 9c7baf8..859c35c 100644 --- a/aws_cdk/lib/aws_cdk-stack.ts +++ b/aws_cdk/lib/aws_cdk-stack.ts @@ -58,7 +58,7 @@ export class AwsCdkStack extends cdk.Stack { ), securityGroup, role, - keyName: 'vignesh_tipro', + keyName: 'vignesh_tipro_apsouth2', detailedMonitoring: true, blockDevices: [ { @@ -74,114 +74,23 @@ export class AwsCdkStack extends cdk.Stack { instance.addUserData( // Ensure folder structures exist 'mkdir -p /home/ubuntu/basic_requirements', - 'mkdir -p /home/ubuntu/wireguard', 'mkdir -p /home/ubuntu/build_tools', - // 4.1 Write and run installation for basic requirements (Docker, Python 3, etc.) + // 4.1 Write and run installation for basic requirements (Python 3, pip, venv, git, build-essential) 'cat <<\'EOF\' > /home/ubuntu/basic_requirements/install.sh', '#!/bin/bash', 'set -e', 'apt-get update -y', - 'apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release wget python3 python3-pip python3-venv git', - 'mkdir -m 0755 -p /etc/apt/keyrings', - 'curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg', - 'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null', - 'apt-get update -y', - 'apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin', - 'systemctl enable docker', - 'systemctl start docker', + 'apt-get install -y ca-certificates curl gnupg lsb-release wget python3 python3-pip python3-venv git build-essential', 'EOF', 'chmod +x /home/ubuntu/basic_requirements/install.sh', '/home/ubuntu/basic_requirements/install.sh', - // 4.2 Set up Caddy, Wireguard, and Woodpecker CI - 'cat <<\'EOF\' > /home/ubuntu/wireguard/Caddyfile', - 'vpn.tipro.in {', - ' reverse_proxy wg-easy:51821', - '}', - '', - 'ci.tipro.in {', - ' # Restrict access to local, server IP, and VPN subnets', - ' @blocked not remote_ip 13.205.93.190 127.0.0.1 ::1 10.8.0.0/24 10.252.1.0/24 172.16.0.0/12', - ' respond @blocked "Access Denied" 403', - ' reverse_proxy woodpecker-server:8000', - '}', - 'EOF', - '', - 'cat <<\'EOF\' > /home/ubuntu/wireguard/docker-compose.yml', - 'version: "3"', - 'services:', - ' wg-easy:', - ' image: weejewel/wg-easy', - ' container_name: wg-easy', - ' environment:', - ' - WG_HOST=13.205.93.190', - ' - PASSWORD=admin123', - ' volumes:', - ' - ./config:/etc/wireguard', - ' cap_add:', - ' - NET_ADMIN', - ' - SYS_MODULE', - ' sysctls:', - ' - net.ipv4.ip_forward=1', - ' - net.ipv4.conf.all.src_valid_mark=1', - ' restart: unless-stopped', - '', - ' woodpecker-server:', - ' image: woodpeckerci/woodpecker-server:v3', - ' container_name: woodpecker-server', - ' restart: unless-stopped', - ' ports:', - ' - "5000:8000"', - ' volumes:', - ' - woodpecker-data:/var/lib/woodpecker', - ' environment:', - ' - WOODPECKER_HOST=https://ci.tipro.in', - ' - WOODPECKER_OPEN=true', - ' - WOODPECKER_AGENT_SECRET=secret_agent_token_123', - ' # GitHub Integration settings', - ' - WOODPECKER_GITHUB=true', - ' - WOODPECKER_GITHUB_CLIENT=${GITHUB_CLIENT_ID:-replace_me}', - ' - WOODPECKER_GITHUB_SECRET=${GITHUB_CLIENT_SECRET:-replace_me}', - '', - ' woodpecker-agent:', - ' image: woodpeckerci/woodpecker-agent:v3', - ' container_name: woodpecker-agent', - ' restart: unless-stopped', - ' depends_on:', - ' - woodpecker-server', - ' volumes:', - ' - /var/run/docker.sock:/var/run/docker.sock', - ' environment:', - ' - WOODPECKER_SERVER=woodpecker-server:9000', - ' - WOODPECKER_SHARED_SECRET=secret_agent_token_123', - '', - ' caddy:', - ' image: caddy:latest', - ' container_name: caddy', - ' restart: unless-stopped', - ' ports:', - ' - "80:80"', - ' - "443:443"', - ' - "51820:51820/udp"', - ' volumes:', - ' - ./Caddyfile:/etc/caddy/Caddyfile', - ' - caddy_data:/data', - ' - caddy_config:/config', - '', - 'volumes:', - ' woodpecker-data:', - ' caddy_data:', - ' caddy_config:', - 'EOF', - 'cd /home/ubuntu/wireguard && docker compose up -d', - - // 4.3 Setup permissions for all user folders + // 4.2 Setup permissions for all user folders 'chown -R ubuntu:ubuntu /home/ubuntu/basic_requirements', - 'chown -R ubuntu:ubuntu /home/ubuntu/wireguard', 'chown -R ubuntu:ubuntu /home/ubuntu/build_tools', - // 4.5 Install CloudWatch Agent (ARM64 package for Graviton instance) + // 4.3 Install CloudWatch Agent (ARM64 package for Graviton instance) 'wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb', 'dpkg -i -E ./amazon-cloudwatch-agent.deb', 'mkdir -p /opt/aws/amazon-cloudwatch-agent/etc', @@ -203,20 +112,6 @@ export class AwsCdkStack extends cdk.Stack { ' "metrics_collection_interval": 60', ' }', ' }', - ' },', - ' "logs": {', - ' "logs_collected": {', - ' "files": {', - ' "collect_list": [', - ' {', - ' "file_path": "/var/lib/docker/containers/*/*.log",', - ' "log_group_name": "WireGuard-Logs",', - ' "log_stream_name": "{instance_id}",', - ' "retention_in_days": 7', - ' }', - ' ]', - ' }', - ' }', ' }', '}', 'EOF', @@ -225,7 +120,7 @@ export class AwsCdkStack extends cdk.Stack { // 5. Associate your pre-created Elastic IP using its Allocation ID new ec2.CfnEIPAssociation(this, 'internalsEIPAssociation', { - allocationId: 'eipalloc-06bea32c3a787c2b1', + allocationId: 'eipalloc-0d1630fa0633874cb', instanceId: instance.instanceId, }); @@ -283,7 +178,7 @@ export class AwsCdkStack extends cdk.Stack { // Outputs new cdk.CfnOutput(this, 'internalsPublicIP', { - value: '13.205.93.190', + value: '16.113.57.127', description: 'The Elastic IP address of your Mail Server', }); }