Paths

Table of Contentst

-
services/terraform/self-host/
-
terraform/
-
self-host/
-
keyserver_primary.tf
-
variables.tf

[terraform] add authoritative keyserver id as a user-specified variable
ClosedPublic
Actions

Authored by will on Jul 9 2024, 7:28 PM.

Details

Reviewers

varun
bartek

Commits

rCOMMd08760937f81: [terraform] add authoritative keyserver id as a user-specified variable

Summary

Introduce specifying the authoritative keyserver id as a terraform variable which translates to a keyserver environmental variable

Depends on D12709

Test Plan

In our prior testing, wasn't able to connect a debug native client without specifying the authoritative id to the keyserver.
With this configuration, was able to connect properly. Previously set this manually

Diff Detail

Repository

rCOMM Comm

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

will created this revision.Jul 9 2024, 7:28 PM

Herald added subscribers: tomek, ashoat. · View Herald TranscriptJul 9 2024, 7:28 PM

will added a child revision: D12711: [terraform] Introduce secondary keyserver service.Jul 9 2024, 7:32 PM

Harbormaster completed remote builds in B30251: Diff 42190.Jul 9 2024, 7:45 PM

will requested review of this revision.Jul 9 2024, 7:45 PM

ashoat added inline comments.Jul 10 2024, 10:24 AM

services/terraform/self-host/variables.tf
40–41 ↗	(On Diff #42190)	Should we rename this something like `authoritative_keyserver_user_id` for clarity? At the least, it would be helpful to clarify in the description that it's a user ID

will planned changes to this revision.Jul 11 2024, 12:32 PM

will added inline comments.

services/terraform/self-host/variables.tf
40–41 ↗	(On Diff #42190)	Yeah. I think that'd be helpful to the user. I'll also update the description as well Including in next rebase

review feedback

Harbormaster completed remote builds in B30401: Diff 42372.Jul 16 2024, 8:11 PM

bartek accepted this revision.Jul 17 2024, 12:45 AM

This revision is now accepted and ready to land.Jul 17 2024, 12:45 AM

make authoritative id variable a config json object

Harbormaster completed remote builds in B30443: Diff 42419.Jul 17 2024, 3:21 PM

Closed by commit rCOMMd08760937f81: [terraform] add authoritative keyserver id as a user-specified variable (authored by will). · Explain WhyJul 17 2024, 7:01 PM

This revision was automatically updated to reflect the committed changes.

will added a commit: rCOMMd08760937f81: [terraform] add authoritative keyserver id as a user-specified variable.

Revision Contents
Changeset List

Path

Size

services/

terraform/

self-host/

keyserver_primary.tf

4 lines

variables.tf

8 lines

Diff 42447

View Options

services/terraform/self-host/keyserver_primary.tf

		locals {
		mariadb_database_name = local.local_with_default_environment_vars.COMM_DATABASE_DATABASE
		mariadb_username = local.local_with_default_environment_vars.COMM_DATABASE_USER
		mariadb_password = local.local_with_default_environment_vars.COMM_DATABASE_PASSWORD
		mariadb_port = jsondecode(local.local_with_default_environment_vars.COMM_DATABASE_PORT)
		}

# MariaDB Security Group		# MariaDB Security Group
resource "aws_security_group" "keyserver_mariadb_security_group" {		resource "aws_security_group" "keyserver_mariadb_security_group" {
name = "keyserver-mariadb-sg"		name = "keyserver-mariadb-sg"
description = "Allow inbound traffic on port 3307 and all outbound traffic"		description = "Allow inbound traffic on port 3307 and all outbound traffic"
vpc_id = local.vpc_id		vpc_id = local.vpc_id

# Inbound rules		# Inbound rules
ingress {		ingress {
from_port = 3307		from_port = local.mariadb_port
to_port = 3307		to_port = local.mariadb_port
protocol = "tcp"		protocol = "tcp"
security_groups = [aws_security_group.keyserver_service.id]		security_groups = [aws_security_group.keyserver_service.id]
}		}

ingress {		ingress {
from_port = 3307		from_port = local.mariadb_port
to_port = 3307		to_port = local.mariadb_port
protocol = "tcp"		protocol = "tcp"
cidr_blocks = ["${var.allowed_ip}/32"]		cidr_blocks = ["${var.allowed_ip}/32"]
}		}

# Outbound rules		# Outbound rules
egress {		egress {
from_port = 0		from_port = 0
to_port = 0		to_port = 0
Show All 9 Lines	resource "aws_db_instance" "mariadb" {
storage_type = "gp3"		storage_type = "gp3"
db_name = "mariadb"		db_name = "mariadb"
identifier = "mariadb-instance"		identifier = "mariadb-instance"
engine = "mariadb"		engine = "mariadb"
engine_version = "10.11"		engine_version = "10.11"
instance_class = "db.m6g.large"		instance_class = "db.m6g.large"
db_subnet_group_name = aws_db_subnet_group.public_db_subnet_group.name		db_subnet_group_name = aws_db_subnet_group.public_db_subnet_group.name
vpc_security_group_ids = [aws_security_group.keyserver_mariadb_security_group.id]		vpc_security_group_ids = [aws_security_group.keyserver_mariadb_security_group.id]
username = var.mariadb_username		username = local.mariadb_username
password = var.mariadb_password		password = local.mariadb_password
parameter_group_name = aws_db_parameter_group.mariadb_parameter_group.name		parameter_group_name = aws_db_parameter_group.mariadb_parameter_group.name
storage_encrypted = true		storage_encrypted = true
publicly_accessible = true		publicly_accessible = true
port = 3307		port = local.mariadb_port
skip_final_snapshot = true		skip_final_snapshot = true
}		}

# MariaDB Parameter Group		# MariaDB Parameter Group
resource "aws_db_parameter_group" "mariadb_parameter_group" {		resource "aws_db_parameter_group" "mariadb_parameter_group" {
name = "mariadb-parameter-group"		name = "mariadb-parameter-group"
family = "mariadb10.11"		family = "mariadb10.11"

▲ Show 20 Lines • Show All 41 Lines • ▼ Show 20 Lines	resource "aws_db_parameter_group" "mariadb_parameter_group" {
}		}
}		}

resource "null_resource" "create_comm_database" {		resource "null_resource" "create_comm_database" {
depends_on = [aws_db_instance.mariadb, aws_security_group.keyserver_mariadb_security_group]		depends_on = [aws_db_instance.mariadb, aws_security_group.keyserver_mariadb_security_group]

provisioner "local-exec" {		provisioner "local-exec" {
command = <<EOT		command = <<EOT
mysql --user=${var.mariadb_username} \		mysql --user=${local.mariadb_username} \
--port=3307 \		--port=${local.mariadb_port} \
--host=${aws_db_instance.mariadb.address} \		--host=${aws_db_instance.mariadb.address} \
--execute="CREATE DATABASE IF NOT EXISTS comm;" \		--execute="CREATE DATABASE IF NOT EXISTS ${local.mariadb_database_name};" \
--password=${var.mariadb_password}		--password=${local.mariadb_password}
EOT		EOT
}		}
}		}