Skip to content

Commit 2724795

Browse files
dcassanegodcassanego
committed
cleaning up unneeded load balancer, making the certbot script more dynamic
1 parent 611c3c7 commit 2724795

7 files changed

+90
-225
lines changed

‎api_dns.tf

-93
This file was deleted.

‎api_ssl_endpoint.tf

-70
This file was deleted.

‎clones_dns.tf

-13
This file was deleted.

‎dle-logical-init.sh.tpl

+29-7
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,32 @@ set -x
44

55
sleep 20
66
#run certbot and copy files to envoy
7-
# to avoid restrinctions from letsencrypt like "There were too many requests of a given type :: Error creating new order :: too many certificates (5) already issued for this exact set of domains in the last 168 hours: demo-api-engine.aws.postgres.ai: see https://letsencrypt.org/docs/rate-limits/" follwing three lines were commented out and mocked up. In real implementation inline certs have to be removed and letsencrypt generated certs should be used
8-
#sudo certbot certonly --standalone -d demo-api-engine.aws.postgres.ai -m m@m.com --agree-tos -n
9-
#sudo cp /etc/letsencrypt/archive/demo-api-engine.aws.postgres.ai/fullchain1.pem /etc/envoy/certs/
10-
#sudo cp /etc/letsencrypt/archive/demo-api-engine.aws.postgres.ai/privkey1.pem /etc/envoy/certs/
7+
# to avoid restrinctions from letsencrypt like "There were too many requests of a given type ::
8+
# Error creating new order :: too many certificates (5) already issued for this exact set of domains
9+
# in the last 168 hours: demo-api-engine.aws.postgres.ai: see https://letsencrypt.org/docs/rate-limits/"
10+
# follwing three lines were commented out and mocked up. In real implementation inline certs have to be
11+
# removed and letsencrypt generated certs should be used
12+
13+
14+
# <START certbot generated cert>
15+
#
16+
#sudo certbot certonly --standalone -d ${dns_api_subdomain}.${dns_zone_name} -m m@m.com --agree-tos -n
17+
#sudo cp /etc/letsencrypt/live/${dns_api_subdomain}.${dns_zone_name}/fullchain.pem /etc/envoy/certs/fullchain1.pem
18+
#sudo cp /etc/letsencrypt/live/${dns_api_subdomain}.${dns_zone_name}/privkey.pem /etc/envoy/certs/privkey1.pem
19+
20+
# cat <<EOF > /etc/letsencrypt/renewal-hooks/deploy/envoy.deploy
21+
# #!/bin/bash
22+
# umask 0177
23+
# export DOMAIN=${dns_api_subdomain}.${dns_zone_name}
24+
# export DATA_DIR=/etc/envoy/certs/
25+
# cp /etc/letsencrypt/live/$DOMAIN/fullchain.pem $DATA_DIR/fullchain1.pem
26+
# cp /etc/letsencrypt/live/$DOMAIN/privkey.pem $DATA_DIR/privkey1.pem
27+
# EOF
28+
# sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/envoy.deploy
29+
#
30+
# # <END certbot generated cert>
31+
32+
1133
cat <<EOF > /etc/envoy/certs/fullchain1.pem
1234
-----BEGIN CERTIFICATE-----
1335
MIICqDCCAZACCQCquzpHNpqBcDANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtm
@@ -62,7 +84,7 @@ sudo systemctl enable envoy
6284
sudo systemctl start envoy
6385

6486
#create zfs pools
65-
disks=(${dle_disks})
87+
disks=(${dle_disks})
6688
for i in $${!disks[@]}; do
6789
sudo zpool create -f \
6890
-O compression=on \
@@ -71,11 +93,11 @@ for i in $${!disks[@]}; do
7193
-O logbias=throughput \
7294
-m /var/lib/dblab/dblab_pool_0$i\
7395
dblab_pool_0$i \
74-
$${disks[$i]}
96+
$${disks[$i]}
7597
done
7698

7799
#configure and start DLE
78-
mkdir ~/.dblab
100+
mkdir ~/.dblab
79101
cp /home/ubuntu/.dblab/config.example.logical_generic.yml ~/.dblab/server.yml
80102
sed -ri "s/^(\s*)(debug:.*$)/\1debug: ${dle_debug}/" ~/.dblab/server.yml
81103
sed -ri "s/^(\s*)(timetable:.*$)/\1timetable: \"${dle_retrieval_refresh_timetable}\"/" ~/.dblab/server.yml

‎dns.tf

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/**
2+
* This file sets up all resources necessary to route incoming
3+
* HTTPS requests to the Load Balancer defined in api_ssl_endpoint.
4+
*
5+
* It assumes that the AWS account has a Route 53 hosted zone
6+
* and then provisions a sub-domain that will be used to point
7+
* to the load balancer
8+
*/
9+
10+
11+
data "aws_route53_zone" "dblab_zone" {
12+
name = var.dns_zone_name
13+
}
14+
15+
###
16+
# FIXME: Understand when this is and is not needed
17+
# This record was created manually within the Postgres.ai hosted zone
18+
# due to issues when attempting to validate the AWS issue certificate.
19+
# If this is necessary in all circumstances, then this Terraform
20+
# resource should be close to correct.
21+
#
22+
#resource "aws_route53_record" "dblab_subdomain_caa" {
23+
# name = var.dns_zone_name
24+
# type = "CAA"
25+
#
26+
# records = [
27+
# "0 issue \"amazon.com\"",
28+
# "0 issue \"amazontrust.com\"",
29+
# "0 issue \"awstrust.com\"",
30+
# "0 issue \"amazonaws.com\"",
31+
# "0 issue \"letsencrypt.org\""
32+
# ]
33+
#
34+
# zone_id = data.aws_route53_zone.dblab_zone.zone_id
35+
# ttl = "60"
36+
#}
37+
38+
resource "aws_route53_record" "dblab_subdomain" {
39+
name = var.dns_api_subdomain
40+
type = "CNAME"
41+
42+
# TODO -- Allocate an Elastic IP address for the instance rather than using the
43+
# default assigned public DNS which can rotate
44+
records = [
45+
aws_instance.aws_ec2.public_dns
46+
]
47+
48+
zone_id = data.aws_route53_zone.dblab_zone.zone_id
49+
ttl = "60"
50+
}

‎outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ output "ec2_public_dns" {
88
value = "${aws_instance.aws_ec2.public_dns}"
99
}
1010
output "public_dns_name" {
11-
value = "${join("", aws_route53_record.dblab_clones_subdomain.*.fqdn)}"
11+
value = "${join("", aws_route53_record.dblab_subdomain.*.fqdn)}"
1212
}
1313
output "dle_verification_token" {
1414
value = "${random_string.dle_token.result}"

‎security.tf

+10-41
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,3 @@
1-
resource "aws_security_group" "dle_api_sg" {
2-
ingress {
3-
cidr_blocks = "${var.allow_api_from_cidrs}"
4-
from_port = 443
5-
to_port = 443
6-
protocol = "tcp"
7-
}
8-
ingress {
9-
cidr_blocks = "${var.allow_api_from_cidrs}"
10-
from_port = 2345
11-
to_port = 2345
12-
protocol = "tcp"
13-
}
14-
ingress {
15-
cidr_blocks = "${var.allow_api_from_cidrs}"
16-
from_port = 2400
17-
to_port = 2400
18-
protocol = "tcp"
19-
}
20-
21-
egress {
22-
from_port = 0
23-
to_port = 0
24-
protocol = "-1"
25-
cidr_blocks = ["0.0.0.0/0"]
26-
}
27-
28-
tags = "${local.common_tags}"
29-
}
301

312
resource "aws_security_group" "dle_instance_sg" {
323
tags = "${local.common_tags}"
@@ -47,8 +18,7 @@ resource "aws_security_group_rule" "dle_instance_api" {
4718
from_port = 443
4819
to_port = 443
4920
protocol = "tcp"
50-
#source_security_group_id = aws_security_group.dle_api_sg.id
51-
cidr_blocks = "${var.allow_api_from_cidrs}"
21+
cidr_blocks = "${var.allow_api_from_cidrs}"
5222
}
5323

5424
resource "aws_security_group_rule" "joe_bot_api" {
@@ -57,18 +27,17 @@ resource "aws_security_group_rule" "joe_bot_api" {
5727
from_port = 444
5828
to_port = 444
5929
protocol = "tcp"
60-
#source_security_group_id = aws_security_group.dle_api_sg.id
61-
cidr_blocks = "${var.allow_api_from_cidrs}"
30+
cidr_blocks = "${var.allow_api_from_cidrs}"
6231
}
6332

64-
#resource "aws_security_group_rule" "dle_instance_http_cert_auth" {
65-
# security_group_id = aws_security_group.dle_instance_sg.id
66-
# type = "ingress"
67-
# from_port = 80
68-
# to_port = 80
69-
# protocol = "tcp"
70-
# cidr_blocks = ["0.0.0.0/0"]
71-
#}
33+
resource "aws_security_group_rule" "dle_instance_http_cert_auth" {
34+
security_group_id = aws_security_group.dle_instance_sg.id
35+
type = "ingress"
36+
from_port = 80
37+
to_port = 80
38+
protocol = "tcp"
39+
cidr_blocks = ["0.0.0.0/0"]
40+
}
7241

7342
resource "aws_security_group_rule" "dle_instance_clones" {
7443
security_group_id = aws_security_group.dle_instance_sg.id

0 commit comments

Comments
 (0)