path: root/terraform/aws/backend/main.tf

terraform {
  backend "http" {}
}

variable "aws_access_key" {
  type = "string"
}

variable "aws_secret_key" {
  type = "string"
}

variable "aws_region" {
  type = "string"
}

variable "aws_vpc_id" {
  type = "string"
}

variable "aws_route_53_zone_id" {
  type = "string"
}

variable "ssh_public_key" {
  type = "string"
}

variable "ssh_private_key" {
  type = "string"
}

variable "guix_substitute_servers" {
  type = "map"
  default = {
    "https://berlin.guixsd.org"    = <<EOF
(entry
 (public-key
  (ecc
   (curve Ed25519)
   (q #8D156F295D24B0D9A86FA5741A840FF2D24F60F7B6C4134814AD55625971B394#)
  )
 )
 (tag
  (guix import)
 )
)
EOF
    "http://beid.cbaines.net"      = <<EOF
(entry
 (public-key
  (ecc
   (curve Ed25519)
   (q #50349E83123851A65A569304A12E512B698223A81E10BEEC5A3E56EDAEE5DAC1#)
  )
 )
 (tag
  (guix import)
 )
)
EOF
  }
}

variable "mini_environment_admin_guix_public_key" {
  type = "string"
}

variable "mini_environment_admin_public_ip_address" {
  type = "string"
}

variable "backend_slug" {
  type = "string"
}

locals {
  guix_daemon_substitute_servers = "${join(" ", keys(var.guix_substitute_servers))}"
}

provider "aws" {
  access_key = "${var.aws_access_key}"
  secret_key = "${var.aws_secret_key}"
  region  = "${var.aws_region}"
}

data "aws_route53_zone" "main" {
  zone_id = "${var.aws_route_53_zone_id}"
}

data "template_file" "guix_daemon_service" {
  template = "${file("${path.module}/guix-daemon.service.tpl")}"

  vars {
    substitute_servers = "${local.guix_daemon_substitute_servers}"
  }
}

data "aws_availability_zones" "available" {}


resource "aws_default_subnet" "main" {
  count = "${length(data.aws_availability_zones.available.names)}"
  availability_zone = "${data.aws_availability_zones.available.names[count.index]}"
}

resource "aws_efs_file_system" "main" {
  creation_token = "govuk_mini_environment_admin/${var.backend_slug}"

  tags {
    Name = "govuk_mini_environment_admin/${var.backend_slug}"
  }
}

resource "aws_efs_mount_target" "main" {
  count = "${length(data.aws_availability_zones.available.names)}"
  file_system_id = "${aws_efs_file_system.main.id}"
  subnet_id      = "${aws_default_subnet.main.*.id[count.index]}"

  security_groups = ["${aws_security_group.efs_mount_target.id}"]
}

resource "aws_key_pair" "deployer" {
  key_name = "govuk_mini_environment_admin/${var.backend_slug}/deployer"
  public_key = "${var.ssh_public_key}"
}

resource "aws_security_group" "public_webserver" {
  name        = "govuk_mini_environment_admin/${var.backend_slug}/public_webserver"
  description = "For instances running public facing web servers"
  vpc_id      = "${var.aws_vpc_id}"

  ingress {
    from_port       = 0
    to_port         = 80
    protocol        = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port       = 0
    to_port         = 443
    protocol        = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port       = 0
    to_port         = 8080
    protocol        = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port       = 0
    to_port         = 8443
    protocol        = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "ssh_access_from_mini_environment_admin" {
  name        = "govuk_mini_environment_admin/${var.backend_slug}/ssh_access_from_mini_environment_admin"
  description = "For instances that need SSH access for Terraform and Guix builds"
  vpc_id      = "${var.aws_vpc_id}"

  ingress {
    from_port = 0
    to_port = 22
    protocol = "tcp"
    cidr_blocks = ["${var.mini_environment_admin_public_ip_address}/32"]
  }
}

resource "aws_security_group" "guix_client" {
  name        = "govuk_mini_environment_admin/${var.backend_slug}/guix_client"
  description = "For instances with access to the guix_daemon instance"
  vpc_id      = "${var.aws_vpc_id}"

  egress {
    from_port = 0
    to_port = 0
    protocol = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "guix_daemon" {
  name        = "govuk_mini_environment_admin/${var.backend_slug}/guix_daemon"
  description = "For the guix_daemon instance."
  vpc_id      = "${var.aws_vpc_id}"

  ingress {
    from_port       = 44146
    to_port         = 44146
    protocol        = "tcp"
    security_groups = ["${aws_security_group.guix_client.id}"]
  }

  egress {
    from_port = 0
    to_port = 0
    protocol = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "efs_mount_target" {
  name        = "govuk_mini_environment_admin/${var.backend_slug}/efs_mount_target"
  description = "For the EFS File System mount targets"
  vpc_id      = "${var.aws_vpc_id}"

  ingress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    security_groups = [
      "${aws_security_group.guix_client.id}",
      "${aws_security_group.guix_daemon.id}",
    ]
  }
}

resource "aws_spot_instance_request" "main" {
  ami             = "ami-8fd760f6"
  instance_type   = "t2.xlarge"
  key_name        = "${aws_key_pair.deployer.key_name}"
  security_groups = [
    "${aws_security_group.guix_daemon.name}",
    "${aws_security_group.ssh_access_from_mini_environment_admin.name}"

  ]

  wait_for_fulfillment = true
  spot_price = "0.21"
  spot_type = "one-time"

  root_block_device {
    volume_size = "100"
  }

  depends_on = ["aws_efs_mount_target.main"]

  provisioner "file" {
    content = "${data.template_file.guix_daemon_service.rendered}"
    destination = "/home/ubuntu/guix-daemon.service"

    connection {
      type        = "ssh"
      user        = "ubuntu"
      private_key = "${var.ssh_private_key}"
    }
  }

  provisioner "file" {
    content = "(acl\n ${join("\n", values(var.guix_substitute_servers))}\n${var.mini_environment_admin_guix_public_key}\n)\n"
    destination = "/home/ubuntu/acl"

    connection {
      type        = "ssh"
      user        = "ubuntu"
      private_key = "${var.ssh_private_key}"
    }
  }

  provisioner "remote-exec" {
    inline = [
      "sudo apt-get update",
      "sudo apt-get update",
      "sudo apt-get -y install nfs-common cachefilesd nscd",
      "sudo tune2fs -o user_xattr /dev/xvda1",
      "sudo sed 's/#RUN/RUN/' -i /etc/default/cachefilesd",
      "sudo mkdir -p /mnt/efs",
      "echo \"${aws_efs_file_system.main.dns_name}:/ /mnt/efs nfs4 nfsvers=4.1,rsize=1048576,wsize=1048576,fsc,hard,timeo=600,retrans=2 0 0\" | sudo tee -a /etc/fstab",
      "sudo mount -a",
      <<EOF
if [ ! -d "/mnt/efs/gnu" ]; then
  cd /mnt/efs
  sudo wget https://alpha.gnu.org/gnu/guix/guix-binary-0.14.0.x86_64-linux.tar.xz
  sudo tar --warning=no-timestamp -xf guix-binary-0.14.0.x86_64-linux.tar.xz
  cd -
fi
EOF
      ,
      "sudo mkdir -p /gnu/store /var/guix",
      "echo \"${aws_efs_file_system.main.dns_name}:/var/guix /var/guix nfs4 nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 0 0\" | sudo tee -a /etc/fstab",
      "echo \"${aws_efs_file_system.main.dns_name}:/gnu/store /gnu/store nfs4 nfsvers=4.1,rsize=1048576,wsize=1048576,fsc,hard,timeo=600,retrans=2 0 0\" | sudo tee -a /etc/fstab",
      "sudo mount -a",
      "sudo mv /home/ubuntu/guix-daemon.service /etc/systemd/system/guix-daemon.service",
      "sudo mkdir /etc/guix",
      "sudo mv /home/ubuntu/acl /etc/guix/acl",
      "sudo groupadd --system guixbuild",
      <<EOF
for i in `seq -w 1 33`;
do
  sudo useradd -g guixbuild -G guixbuild           \
          -d /var/empty -s `which nologin`    \
          -c "Guix build user $i" --system    \
          guixbuilder$i;
done
EOF
      ,
      "sudo systemctl daemon-reload",
      "sudo systemctl enable guix-daemon.service",
      "sudo systemctl start guix-daemon.service",
      "mkdir -p ~/.config", # Make the ~/.config directory, to ensure it's owned by ubuntu
      # Setup the profile for the ubuntu user
      <<EOF
if [ ! -d "/var/guix/profiles/per-user/ubuntu" ]; then
  cp -r /var/guix/profiles/per-user/root/guix-profile-1-link /var/guix/profiles/per-user/ubuntu/
  ln -s /var/guix/profiles/per-user/ubuntu/guix-profile-1-link /var/guix/profiles/per-user/ubuntu/guix-profile
  /var/guix/profiles/per-user/ubuntu/guix-profile/bin/guix package -i guile bash
fi
ln -s /var/guix/profiles/per-user/ubuntu/guix-profile ~/.guix-profile
EOF
      ,
      # This is needed for things like guix copy to work
      <<EOF
echo 'GUIX_PROFILE=/home/ubuntu/.guix-profile; source /home/ubuntu/.guix-profile/etc/profile
export GDS_GUIX_GOVUK_PUPPET_BACKUPS_DIRECTORY=/mnt/efs/govuk-puppet-backups
' | cat - .bashrc > temp && mv temp .bashrc
EOF
    ]

    connection {
      type        = "ssh"
      user        = "ubuntu"
      private_key = "${var.ssh_private_key}"
    }
  }
}

resource "aws_route53_record" "main" {
  zone_id = "${data.aws_route53_zone.main.zone_id}"
  name    = "guix-daemon"
  type    = "A"
  ttl     = "60"
  records = ["${aws_spot_instance_request.main.public_ip}"]
}

# Outputs

output "backend_up" {
  value = "${length(aws_spot_instance_request.main.public_ip) != 0}"
}

output "deployer_key_pair_name" {
  value = "${aws_key_pair.deployer.key_name}"
}

output "guix_client_security_group_name" {
  value = "${aws_security_group.guix_client.name}"
}

output "public_webserver_security_group_name" {
  value = "${aws_security_group.public_webserver.name}"
}

output "ssh_access_from_mini_environment_admin_security_group_name" {
  value = "${aws_security_group.ssh_access_from_mini_environment_admin.name}"
}

output "guix_daemon_private_dns" {
  value = "${aws_spot_instance_request.main.private_dns}"
}

output "guix_daemon_public_dns" {
  value = "${aws_spot_instance_request.main.public_dns}"
}

output "efs_file_system_dns_name" {
  value = "${aws_efs_file_system.main.dns_name}"
}