Page MenuHomePhabricator
Differential D12711

[terraform] Introduce secondary keyserver service
ClosedPublic
Actions

Authored by will on Jul 9 2024, 7:32 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Feb 28, 3:32 PM
Unknown Object (File)
Thu, Feb 27, 2:07 PM
Unknown Object (File)
Thu, Feb 27, 2:03 PM
Unknown Object (File)
Sat, Feb 22, 6:20 AM
Unknown Object (File)
Sat, Feb 22, 6:20 AM
Unknown Object (File)
Sat, Feb 22, 6:20 AM
Unknown Object (File)
Sat, Feb 22, 6:20 AM
Unknown Object (File)
Sat, Feb 22, 6:20 AM
View All Files
Subscribers
ashoat
tomek

Details

Reviewers
varun
bartek
Commits
rCOMMbd10a05ecdaf: [terraform] Introduce secondary keyserver service
Summary

This introduces the secondary keyserver service. The task is mostly identical to the primary except COMM_NODE_ROLE being set to
secondary.

Depends on D12710

Test Plan

I added a temporary keyserver route that printed true/false for whether it was primary. Load balancer properly distributed traffic
to both primary and secondary requests and was able to curl https://wyilio.com/role to get both true and false responses

Diff Detail

Repository
rCOMM Comm
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

will created this revision.Jul 9 2024, 7:32 PM
Herald added subscribers: tomek, ashoat. · View Herald TranscriptJul 9 2024, 7:32 PM
will added inline comments.Jul 9 2024, 7:35 PM
services/terraform/self-host/keyserver_primary.tf
3 ↗(On Diff #42191)

Like the primary service. Will not land until I've built and changed this to an official commapp image

Harbormaster completed remote builds in B30252: Diff 42191.Jul 9 2024, 7:47 PM
will requested review of this revision.Jul 9 2024, 7:47 PM
will added a child revision: D12724: [keyserver] add `aws` proxy type for self-hosted keyservers.Jul 11 2024, 4:19 AM
will updated this revision to Diff 42357.Jul 16 2024, 11:39 AM

create secondary resources after primary

Harbormaster failed remote builds in B30394: Diff 42357!Jul 16 2024, 11:53 AM
will updated this revision to Diff 42363.Jul 16 2024, 3:01 PM

rebase

Harbormaster completed remote builds in B30400: Diff 42363.Jul 16 2024, 3:18 PM
bartek requested changes to this revision.Jul 17 2024, 12:49 AM
bartek added inline comments.
keyserver_secondary.tf
1 ↗(On Diff #42363)

Wait, isn't the keyserver_secondary.tf accidentally copied to repo root?

This revision now requires changes to proceed.Jul 17 2024, 12:49 AM
will updated this revision to Diff 42384.Jul 17 2024, 6:18 AM

remove copy of keyserver_secondary.tf from root

will added a comment.Jul 17 2024, 6:19 AM

@bartek thanks for catching that

Harbormaster completed remote builds in B30412: Diff 42384.Jul 17 2024, 6:35 AM
bartek accepted this revision.Jul 17 2024, 8:48 AM
This revision is now accepted and ready to land.Jul 17 2024, 8:48 AM
will updated this revision to Diff 42417.Jul 17 2024, 2:41 PM

rebase

Harbormaster completed remote builds in B30441: Diff 42417.Jul 17 2024, 3:07 PM
will updated this revision to Diff 42420.Jul 17 2024, 3:08 PM

rebase

Harbormaster completed remote builds in B30444: Diff 42420.Jul 17 2024, 3:28 PM
will updated this revision to Diff 42429.Jul 17 2024, 4:05 PM

rebase

Harbormaster failed remote builds in B30448: Diff 42429!Jul 17 2024, 4:09 PM
will updated this revision to Diff 42431.Jul 17 2024, 4:23 PM

rebase

Harbormaster completed remote builds in B30450: Diff 42431.Jul 17 2024, 4:40 PM
Closed by commit rCOMMbd10a05ecdaf: [terraform] Introduce secondary keyserver service (authored by will). · Explain WhyJul 17 2024, 7:01 PM
This revision was automatically updated to reflect the committed changes.
will added a commit: rCOMMbd10a05ecdaf: [terraform] Introduce secondary keyserver service.

Revision Contents
Changeset List

PathSize
services/
terraform/
self-host/
18 lines
keyserver_secondary.tf
keyserver_primary.tf
96 lines

Diff 42448

View Options

services/terraform/self-host/keyserver_primary.tf

locals {
mariadb_database_name = local.local_with_default_environment_vars.COMM_DATABASE_DATABASE
mariadb_username = local.local_with_default_environment_vars.COMM_DATABASE_USER
mariadb_password = local.local_with_default_environment_vars.COMM_DATABASE_PASSWORD
mariadb_port = jsondecode(local.local_with_default_environment_vars.COMM_DATABASE_PORT)
}
# MariaDB Security Group # MariaDB Security Group
resource "aws_security_group" "keyserver_mariadb_security_group" { resource "aws_security_group" "keyserver_mariadb_security_group" {
name = "keyserver-mariadb-sg" name = "keyserver-mariadb-sg"
description = "Allow inbound traffic on port 3307 and all outbound traffic" description = "Allow inbound traffic on port 3307 and all outbound traffic"
vpc_id = local.vpc_id vpc_id = local.vpc_id
# Inbound rules # Inbound rules
ingress { ingress {
from_port = 3307 from_port = local.mariadb_port
to_port = 3307 to_port = local.mariadb_port
protocol = "tcp" protocol = "tcp"
security_groups = [aws_security_group.keyserver_service.id] security_groups = [aws_security_group.keyserver_service.id]
} }
ingress { ingress {
from_port = 3307 from_port = local.mariadb_port
to_port = 3307 to_port = local.mariadb_port
protocol = "tcp" protocol = "tcp"
cidr_blocks = ["${var.allowed_ip}/32"] cidr_blocks = ["${var.allowed_ip}/32"]
} }
# Outbound rules # Outbound rules
egress { egress {
from_port = 0 from_port = 0
to_port = 0 to_port = 0
Show All 9 Linesresource "aws_db_instance" "mariadb" {
storage_type = "gp3" storage_type = "gp3"
db_name = "mariadb" db_name = "mariadb"
identifier = "mariadb-instance" identifier = "mariadb-instance"
engine = "mariadb" engine = "mariadb"
engine_version = "10.11" engine_version = "10.11"
instance_class = "db.m6g.large" instance_class = "db.m6g.large"
db_subnet_group_name = aws_db_subnet_group.public_db_subnet_group.name db_subnet_group_name = aws_db_subnet_group.public_db_subnet_group.name
vpc_security_group_ids = [aws_security_group.keyserver_mariadb_security_group.id] vpc_security_group_ids = [aws_security_group.keyserver_mariadb_security_group.id]
username = var.mariadb_username username = local.mariadb_username
password = var.mariadb_password password = local.mariadb_password
parameter_group_name = aws_db_parameter_group.mariadb_parameter_group.name parameter_group_name = aws_db_parameter_group.mariadb_parameter_group.name
storage_encrypted = true storage_encrypted = true
publicly_accessible = true publicly_accessible = true
port = 3307 port = local.mariadb_port
skip_final_snapshot = true skip_final_snapshot = true
} }
# MariaDB Parameter Group # MariaDB Parameter Group
resource "aws_db_parameter_group" "mariadb_parameter_group" { resource "aws_db_parameter_group" "mariadb_parameter_group" {
name = "mariadb-parameter-group" name = "mariadb-parameter-group"
family = "mariadb10.11" family = "mariadb10.11"
▲ Show 20 Lines • Show All 41 Lines • ▼ Show 20 Linesresource "aws_db_parameter_group" "mariadb_parameter_group" {
} }
} }
resource "null_resource" "create_comm_database" { resource "null_resource" "create_comm_database" {
depends_on = [aws_db_instance.mariadb, aws_security_group.keyserver_mariadb_security_group] depends_on = [aws_db_instance.mariadb, aws_security_group.keyserver_mariadb_security_group]
provisioner "local-exec" { provisioner "local-exec" {
command = <<EOT command = <<EOT
mysql --user=${var.mariadb_username} \ mysql --user=${local.mariadb_username} \
--port=3307 \ --port=${local.mariadb_port} \
--host=${aws_db_instance.mariadb.address} \ --host=${aws_db_instance.mariadb.address} \
--execute="CREATE DATABASE IF NOT EXISTS comm;" \ --execute="CREATE DATABASE IF NOT EXISTS ${local.mariadb_database_name};" \
--password=${var.mariadb_password} --password=${local.mariadb_password}
EOT EOT
} }
} }
View Options

services/terraform/self-host/keyserver_secondary.tf

locals {
mariadb_database_name = local.local_with_default_environment_vars.COMM_DATABASE_DATABASE
mariadb_username = local.local_with_default_environment_vars.COMM_DATABASE_USER
mariadb_password = local.local_with_default_environment_vars.COMM_DATABASE_PASSWORD
mariadb_port = jsondecode(local.local_with_default_environment_vars.COMM_DATABASE_PORT)
}
# MariaDB Security Group # MariaDB Security Group
resource "aws_security_group" "keyserver_mariadb_security_group" { resource "aws_security_group" "keyserver_mariadb_security_group" {
name = "keyserver-mariadb-sg" name = "keyserver-mariadb-sg"
description = "Allow inbound traffic on port 3307 and all outbound traffic" description = "Allow inbound traffic on port 3307 and all outbound traffic"
vpc_id = local.vpc_id vpc_id = local.vpc_id
# Inbound rules # Inbound rules
ingress { ingress {
from_port = 3307 from_port = local.mariadb_port
to_port = 3307 to_port = local.mariadb_port
protocol = "tcp" protocol = "tcp"
security_groups = [aws_security_group.keyserver_service.id] security_groups = [aws_security_group.keyserver_service.id]
} }
ingress { ingress {
from_port = 3307 from_port = local.mariadb_port
to_port = 3307 to_port = local.mariadb_port
protocol = "tcp" protocol = "tcp"
cidr_blocks = ["${var.allowed_ip}/32"] cidr_blocks = ["${var.allowed_ip}/32"]
} }
# Outbound rules # Outbound rules
egress { egress {
from_port = 0 from_port = 0
to_port = 0 to_port = 0
Show All 9 Linesresource "aws_db_instance" "mariadb" {
storage_type = "gp3" storage_type = "gp3"
db_name = "mariadb" db_name = "mariadb"
identifier = "mariadb-instance" identifier = "mariadb-instance"
engine = "mariadb" engine = "mariadb"
engine_version = "10.11" engine_version = "10.11"
instance_class = "db.m6g.large" instance_class = "db.m6g.large"
db_subnet_group_name = aws_db_subnet_group.public_db_subnet_group.name db_subnet_group_name = aws_db_subnet_group.public_db_subnet_group.name
vpc_security_group_ids = [aws_security_group.keyserver_mariadb_security_group.id] vpc_security_group_ids = [aws_security_group.keyserver_mariadb_security_group.id]
username = var.mariadb_username username = local.mariadb_username
password = var.mariadb_password password = local.mariadb_password
parameter_group_name = aws_db_parameter_group.mariadb_parameter_group.name parameter_group_name = aws_db_parameter_group.mariadb_parameter_group.name
storage_encrypted = true storage_encrypted = true
publicly_accessible = true publicly_accessible = true
port = 3307 port = local.mariadb_port
skip_final_snapshot = true skip_final_snapshot = true
} }
# MariaDB Parameter Group # MariaDB Parameter Group
resource "aws_db_parameter_group" "mariadb_parameter_group" { resource "aws_db_parameter_group" "mariadb_parameter_group" {
name = "mariadb-parameter-group" name = "mariadb-parameter-group"
family = "mariadb10.11" family = "mariadb10.11"
▲ Show 20 Lines • Show All 41 Lines • ▼ Show 20 Linesresource "aws_db_parameter_group" "mariadb_parameter_group" {
} }
} }
resource "null_resource" "create_comm_database" { resource "null_resource" "create_comm_database" {
depends_on = [aws_db_instance.mariadb, aws_security_group.keyserver_mariadb_security_group] depends_on = [aws_db_instance.mariadb, aws_security_group.keyserver_mariadb_security_group]
provisioner "local-exec" { provisioner "local-exec" {
command = <<EOT command = <<EOT
mysql --user=${var.mariadb_username} \ mysql --user=${local.mariadb_username} \
--port=3307 \ --port=${local.mariadb_port} \
--host=${aws_db_instance.mariadb.address} \ --host=${aws_db_instance.mariadb.address} \
--execute="CREATE DATABASE IF NOT EXISTS comm;" \ --execute="CREATE DATABASE IF NOT EXISTS ${local.mariadb_database_name};" \
--password=${var.mariadb_password} --password=${local.mariadb_password}
EOT EOT
} }
} }