mirror of
https://github.com/cdr/code-server.git
synced 2025-12-09 01:45:44 +01:00
b8094ac6a0
This commit adds complete Terraform infrastructure as code for deploying code-server on both EC2 and EKS platforms with enterprise-grade security and SAML/OIDC authentication. Features: - EC2 deployment with Auto Scaling Groups and Application Load Balancer - EKS deployment with managed node groups and AWS Load Balancer Controller - Private network setup with VPC, private subnets, and NAT gateways - SAML/OIDC authentication using OAuth2 Proxy - Security hardening: - KMS encryption for data at rest - TLS encryption in transit - IAM roles with least privilege - Security groups with minimal access - VPC Flow Logs - IMDSv2 enforcement - Auto-scaling capabilities for both EC2 and EKS - CloudWatch logging and monitoring - Automated deployment scripts Terraform Modules: - modules/vpc: VPC with public/private subnets, NAT, and VPC endpoints - modules/security: Security groups, IAM roles, and KMS keys - modules/ec2: EC2 Auto Scaling deployment with ALB - modules/eks: EKS cluster with managed node groups and addons Deployments: - deployments/ec2: EC2 deployment configuration - deployments/eks: EKS deployment configuration with Kubernetes manifests Documentation: - README.md: Comprehensive deployment and operations guide - QUICK-START.md: Quick reference for fast deployment - SAML-SETUP-GUIDE.md: Step-by-step IdP configuration guide Scripts: - scripts/deploy-ec2.sh: Automated EC2 deployment - scripts/deploy-eks.sh: Automated EKS deployment - scripts/destroy-ec2.sh: EC2 cleanup - scripts/destroy-eks.sh: EKS cleanup
117 lines
3.5 KiB
HCL
117 lines
3.5 KiB
HCL
# EC2 Deployment Configuration for Code-Server
|
|
# This file creates all necessary infrastructure to deploy code-server on EC2
|
|
|
|
terraform {
|
|
required_version = ">= 1.0"
|
|
|
|
required_providers {
|
|
aws = {
|
|
source = "hashicorp/aws"
|
|
version = "~> 5.0"
|
|
}
|
|
random = {
|
|
source = "hashicorp/random"
|
|
version = "~> 3.5"
|
|
}
|
|
}
|
|
|
|
# Uncomment and configure for remote state storage
|
|
# backend "s3" {
|
|
# bucket = "your-terraform-state-bucket"
|
|
# key = "code-server/ec2/terraform.tfstate"
|
|
# region = "us-east-1"
|
|
# encrypt = true
|
|
# dynamodb_table = "terraform-state-lock"
|
|
# }
|
|
}
|
|
|
|
provider "aws" {
|
|
region = var.aws_region
|
|
|
|
default_tags {
|
|
tags = {
|
|
Project = "code-server"
|
|
Environment = var.environment
|
|
ManagedBy = "Terraform"
|
|
Deployment = "EC2"
|
|
}
|
|
}
|
|
}
|
|
|
|
locals {
|
|
name_prefix = "${var.project_name}-${var.environment}"
|
|
cluster_name = "${local.name_prefix}-eks" # Used for VPC subnet tagging
|
|
|
|
common_tags = {
|
|
Project = var.project_name
|
|
Environment = var.environment
|
|
ManagedBy = "Terraform"
|
|
Deployment = "EC2"
|
|
}
|
|
}
|
|
|
|
# VPC Module
|
|
module "vpc" {
|
|
source = "../../modules/vpc"
|
|
|
|
name_prefix = local.name_prefix
|
|
vpc_cidr = var.vpc_cidr
|
|
public_subnet_cidrs = var.public_subnet_cidrs
|
|
private_subnet_cidrs = var.private_subnet_cidrs
|
|
aws_region = var.aws_region
|
|
cluster_name = local.cluster_name
|
|
enable_nat_gateway = true
|
|
single_nat_gateway = var.single_nat_gateway
|
|
enable_vpc_endpoints = true
|
|
enable_flow_logs = true
|
|
flow_logs_retention_days = 30
|
|
|
|
tags = local.common_tags
|
|
}
|
|
|
|
# Security Module
|
|
module "security" {
|
|
source = "../../modules/security"
|
|
|
|
name_prefix = local.name_prefix
|
|
vpc_id = module.vpc.vpc_id
|
|
allowed_cidr_blocks = var.allowed_cidr_blocks
|
|
ssh_allowed_cidr_blocks = var.ssh_allowed_cidr_blocks
|
|
|
|
tags = local.common_tags
|
|
}
|
|
|
|
# EC2 Module for Code-Server
|
|
module "code_server_ec2" {
|
|
source = "../../modules/ec2"
|
|
|
|
name_prefix = local.name_prefix
|
|
vpc_id = module.vpc.vpc_id
|
|
subnet_ids = module.vpc.private_subnet_ids
|
|
alb_subnet_ids = var.internal_alb ? module.vpc.private_subnet_ids : module.vpc.public_subnet_ids
|
|
security_group_id = module.security.code_server_ec2_security_group_id
|
|
alb_security_group_id = module.security.alb_security_group_id
|
|
iam_instance_profile_name = module.security.code_server_ec2_instance_profile_name
|
|
kms_key_arn = module.security.kms_key_arn
|
|
aws_region = var.aws_region
|
|
|
|
instance_type = var.instance_type
|
|
ebs_volume_size = var.ebs_volume_size
|
|
min_instances = var.min_instances
|
|
max_instances = var.max_instances
|
|
desired_instances = var.desired_instances
|
|
code_server_version = var.code_server_version
|
|
certificate_arn = var.certificate_arn
|
|
internal_alb = var.internal_alb
|
|
enable_autoscaling = var.enable_autoscaling
|
|
|
|
# OAuth2 Proxy Configuration
|
|
oauth2_client_id = var.oauth2_client_id
|
|
oauth2_client_secret = var.oauth2_client_secret
|
|
oauth2_issuer_url = var.oauth2_issuer_url
|
|
oauth2_redirect_url = var.oauth2_redirect_url
|
|
oauth2_cookie_secret = var.oauth2_cookie_secret
|
|
oauth2_allowed_emails = var.oauth2_allowed_emails
|
|
|
|
tags = local.common_tags
|
|
}
|