mirror of
https://github.com/cdr/code-server.git
synced 2026-04-22 23:11:35 +02:00
b8094ac6a0
This commit adds complete Terraform infrastructure as code for deploying code-server on both EC2 and EKS platforms with enterprise-grade security and SAML/OIDC authentication. Features: - EC2 deployment with Auto Scaling Groups and Application Load Balancer - EKS deployment with managed node groups and AWS Load Balancer Controller - Private network setup with VPC, private subnets, and NAT gateways - SAML/OIDC authentication using OAuth2 Proxy - Security hardening: - KMS encryption for data at rest - TLS encryption in transit - IAM roles with least privilege - Security groups with minimal access - VPC Flow Logs - IMDSv2 enforcement - Auto-scaling capabilities for both EC2 and EKS - CloudWatch logging and monitoring - Automated deployment scripts Terraform Modules: - modules/vpc: VPC with public/private subnets, NAT, and VPC endpoints - modules/security: Security groups, IAM roles, and KMS keys - modules/ec2: EC2 Auto Scaling deployment with ALB - modules/eks: EKS cluster with managed node groups and addons Deployments: - deployments/ec2: EC2 deployment configuration - deployments/eks: EKS deployment configuration with Kubernetes manifests Documentation: - README.md: Comprehensive deployment and operations guide - QUICK-START.md: Quick reference for fast deployment - SAML-SETUP-GUIDE.md: Step-by-step IdP configuration guide Scripts: - scripts/deploy-ec2.sh: Automated EC2 deployment - scripts/deploy-eks.sh: Automated EKS deployment - scripts/destroy-ec2.sh: EC2 cleanup - scripts/destroy-eks.sh: EKS cleanup
38 lines
1.4 KiB
Text
38 lines
1.4 KiB
Text
# Example Terraform Variables for EKS Deployment
|
|
# Copy this file to terraform.tfvars and fill in your values
|
|
|
|
aws_region = "us-east-1"
|
|
project_name = "code-server"
|
|
environment = "dev"
|
|
|
|
# VPC Configuration
|
|
vpc_cidr = "10.0.0.0/16"
|
|
public_subnet_cidrs = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
|
|
private_subnet_cidrs = ["10.0.11.0/24", "10.0.12.0/24", "10.0.13.0/24"]
|
|
single_nat_gateway = false # Set to true for cost optimization
|
|
|
|
# Security Configuration
|
|
allowed_cidr_blocks = ["10.0.0.0/8"] # Restrict to private network
|
|
ssh_allowed_cidr_blocks = [] # No SSH access (use SSM instead)
|
|
|
|
# EKS Configuration
|
|
kubernetes_version = "1.28"
|
|
endpoint_public_access = false # Set to true if you need public API access
|
|
public_access_cidrs = ["0.0.0.0/0"] # Restrict this if endpoint_public_access is true
|
|
|
|
# Node Group Configuration
|
|
node_instance_types = ["t3.medium"]
|
|
capacity_type = "ON_DEMAND" # or "SPOT" for cost optimization
|
|
node_disk_size = 50
|
|
min_nodes = 1
|
|
max_nodes = 3
|
|
desired_nodes = 2
|
|
|
|
# OAuth2 / SAML Configuration
|
|
deploy_oauth2_proxy = true
|
|
oauth2_client_id = "your-client-id-from-idp"
|
|
oauth2_client_secret = "your-client-secret-from-idp"
|
|
|
|
# Generate cookie secret with:
|
|
# python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'
|
|
oauth2_cookie_secret = "generate-random-secret-here"
|