add openhack files
This commit is contained in:
Ryan Peters
35
iac/terraform/appService.Test.ps1
Normal file
35
iac/terraform/appService.Test.ps1
Normal file
@ -0,0 +1,35 @@
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[string[]] $HostNames
|
||||
)
|
||||
|
||||
$TestCases = @()
|
||||
|
||||
$HostNames.ForEach{ $TestCases += @{HostName = $_ } }
|
||||
Describe 'Testing connection to Websites' {
|
||||
|
||||
It ' <HostName> over HTTPS' -ForEach $TestCases {
|
||||
try {
|
||||
$request = [System.Net.WebRequest]::Create("https://$HostName")
|
||||
$request.AllowAutoRedirect = $false
|
||||
$statusCode = [int]$request.GetResponse().StatusCode
|
||||
}
|
||||
catch [System.Net.WebException] {
|
||||
$statusCode = [int]$_.Exception.Response.StatusCode
|
||||
}
|
||||
$statusCode | Should -BeIn @(200, 404) -Because "the website requires HTTPS"
|
||||
}
|
||||
|
||||
It ' <HostName> over HTTP' -ForEach $TestCases {
|
||||
try {
|
||||
$request = [System.Net.WebRequest]::Create("http://$HostName")
|
||||
$request.AllowAutoRedirect = $false
|
||||
$statusCode = [int]$request.GetResponse().StatusCode
|
||||
}
|
||||
catch [System.Net.WebException] {
|
||||
$statusCode = [int]$_.Exception.Response.StatusCode
|
||||
}
|
||||
$statusCode | Should -BeIn (300..399) -Because "HTTP is not secure"
|
||||
}
|
||||
}
|
||||
73
iac/terraform/apps.tf
Normal file
73
iac/terraform/apps.tf
Normal file
@ -0,0 +1,73 @@
|
||||
############################################
|
||||
## DATABASE ##
|
||||
############################################
|
||||
|
||||
resource "null_resource" "db_schema" {
|
||||
depends_on = [
|
||||
azurerm_mssql_database.mssql_database
|
||||
]
|
||||
provisioner "local-exec" {
|
||||
command = "sqlcmd -U ${local.mssql_server_administrator_login} -P ${local.mssql_server_administrator_login_password} -S ${azurerm_mssql_server.mssql_server.fully_qualified_domain_name} -d ${local.mssql_database_name} -i ../../support/datainit/MYDrivingDB.sql -e"
|
||||
}
|
||||
}
|
||||
|
||||
resource "null_resource" "db_datainit" {
|
||||
depends_on = [
|
||||
null_resource.db_schema
|
||||
]
|
||||
provisioner "local-exec" {
|
||||
command = "cd ../../support/datainit; bash ./sql_data_init.sh -s ${azurerm_mssql_server.mssql_server.fully_qualified_domain_name} -u ${local.mssql_server_administrator_login} -p ${local.mssql_server_administrator_login_password} -d ${local.mssql_database_name}; cd ../../iac/terraform"
|
||||
}
|
||||
}
|
||||
|
||||
############################################
|
||||
## DOCKER for test ##
|
||||
############################################
|
||||
|
||||
resource "null_resource" "docker_simulator" {
|
||||
depends_on = [
|
||||
azurerm_container_registry.container_registry
|
||||
]
|
||||
provisioner "local-exec" {
|
||||
command = "az acr build --image devopsoh/simulator:latest --registry ${azurerm_container_registry.container_registry.login_server} --file ../../support/simulator/Dockerfile ../../support/simulator"
|
||||
}
|
||||
}
|
||||
|
||||
resource "null_resource" "docker_tripviewer" {
|
||||
provisioner "local-exec" {
|
||||
command = "az acr build --image devopsoh/tripviewer:latest --registry ${azurerm_container_registry.container_registry.login_server} --file ../../support/tripviewer/Dockerfile ../../support/tripviewer"
|
||||
}
|
||||
}
|
||||
|
||||
resource "null_resource" "docker_api-poi" {
|
||||
provisioner "local-exec" {
|
||||
command = "az acr build --image devopsoh/api-poi:${local.apipoi_base_image_tag} --registry ${azurerm_container_registry.container_registry.login_server} --build-arg build_version=${local.apipoi_base_image_tag} --file ../../apis/poi/web/Dockerfile ../../apis/poi/web"
|
||||
}
|
||||
}
|
||||
|
||||
resource "null_resource" "docker_api-trips" {
|
||||
provisioner "local-exec" {
|
||||
command = "az acr build --image devopsoh/api-trips:${local.apitrips_base_image_tag} --registry ${azurerm_container_registry.container_registry.login_server} --build-arg build_version=${local.apitrips_base_image_tag} --file ../../apis/trips/Dockerfile ../../apis/trips"
|
||||
}
|
||||
}
|
||||
|
||||
resource "null_resource" "docker_api-user-java" {
|
||||
provisioner "local-exec" {
|
||||
command = "az acr build --image devopsoh/api-user-java:${local.apiuserjava_base_image_tag} --registry ${azurerm_container_registry.container_registry.login_server} --build-arg build_version=${local.apiuserjava_base_image_tag} --file ../../apis/user-java/Dockerfile ../../apis/user-java"
|
||||
}
|
||||
}
|
||||
|
||||
resource "null_resource" "docker_api-userprofile" {
|
||||
provisioner "local-exec" {
|
||||
command = "az acr build --image devopsoh/api-userprofile:${local.apiuserprofile_base_image_tag} --registry ${azurerm_container_registry.container_registry.login_server} --build-arg build_version=${local.apiuserprofile_base_image_tag} --file ../../apis/userprofile/Dockerfile ../../apis/userprofile"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
143
iac/terraform/appservice_poi.tf
Normal file
143
iac/terraform/appservice_poi.tf
Normal file
@ -0,0 +1,143 @@
|
||||
############################################
|
||||
## APP SERVICE - API-POI ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_app_service" "app_service_api-poi" {
|
||||
depends_on = [
|
||||
null_resource.db_datainit,
|
||||
null_resource.docker_api-poi
|
||||
]
|
||||
name = local.app_service_api-poi_name
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
app_service_plan_id = azurerm_app_service_plan.app_service_plan.id
|
||||
https_only = true
|
||||
|
||||
identity {
|
||||
type = "SystemAssigned"
|
||||
}
|
||||
|
||||
app_settings = {
|
||||
"SQL_USER" = local.mssql_server_administrator_login
|
||||
"SQL_PASSWORD" = local.mssql_server_administrator_login_password
|
||||
# "SQL_PASSWORD" = "@Microsoft.KeyVault(VaultName=${azurerm_key_vault.key_vault.name};SecretName=${azurerm_key_vault_secret.key_vault_secret_sqlpassword.name})"
|
||||
"SQL_SERVER" = azurerm_mssql_server.mssql_server.fully_qualified_domain_name
|
||||
"SQL_DBNAME" = local.mssql_database_name
|
||||
"WEBSITES_PORT" = "8080"
|
||||
"DOCKER_REGISTRY_SERVER_URL" = local.docker_registry_server_url
|
||||
"DOCKER_REGISTRY_SERVER_USERNAME" = local.docker_registry_server_username
|
||||
"DOCKER_REGISTRY_SERVER_PASSWORD" = local.docker_registry_server_password
|
||||
"APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.application_insights.instrumentation_key
|
||||
"APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.application_insights.connection_string
|
||||
}
|
||||
|
||||
site_config {
|
||||
always_on = true
|
||||
http2_enabled = true
|
||||
ftps_state = "Disabled"
|
||||
health_check_path = "/api/healthcheck/poi"
|
||||
# acr_use_managed_identity_credentials = true
|
||||
linux_fx_version = "DOCKER|${azurerm_container_registry.container_registry.login_server}/devopsoh/api-poi:${local.apipoi_base_image_tag}"
|
||||
}
|
||||
|
||||
logs {
|
||||
http_logs {
|
||||
file_system {
|
||||
retention_in_days = 7
|
||||
retention_in_mb = 50
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags,
|
||||
app_settings["DOCKER_CUSTOM_IMAGE_NAME"],
|
||||
site_config[0].linux_fx_version
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# resource "azurerm_key_vault_access_policy" "key_vault_access_policy_api-poi" {
|
||||
# key_vault_id = azurerm_key_vault.key_vault.id
|
||||
# tenant_id = azurerm_app_service.app_service_api-poi.identity[0].tenant_id
|
||||
# object_id = azurerm_app_service.app_service_api-poi.identity[0].principal_id
|
||||
#
|
||||
# secret_permissions = [
|
||||
# "Get"
|
||||
# ]
|
||||
# }
|
||||
|
||||
# resource "azurerm_role_assignment" "cr_role_assignment_api-poi" {
|
||||
# scope = azurerm_container_registry.container_registry.id
|
||||
# role_definition_name = "AcrPull"
|
||||
# principal_id = azurerm_app_service.app_service_api-poi.identity[0].principal_id
|
||||
# }
|
||||
|
||||
resource "azurerm_app_service_slot" "app_service_api-poi_staging" {
|
||||
name = "staging"
|
||||
app_service_name = azurerm_app_service.app_service_api-poi.name
|
||||
app_service_plan_id = azurerm_app_service_plan.app_service_plan.id
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
https_only = true
|
||||
|
||||
identity {
|
||||
type = "SystemAssigned"
|
||||
}
|
||||
|
||||
app_settings = {
|
||||
"SQL_USER" = local.mssql_server_administrator_login
|
||||
"SQL_PASSWORD" = local.mssql_server_administrator_login_password
|
||||
"SQL_SERVER" = azurerm_mssql_server.mssql_server.fully_qualified_domain_name
|
||||
"SQL_DBNAME" = local.mssql_database_name
|
||||
"WEBSITES_PORT" = "8080"
|
||||
"DOCKER_REGISTRY_SERVER_URL" = local.docker_registry_server_url
|
||||
"DOCKER_REGISTRY_SERVER_USERNAME" = local.docker_registry_server_username
|
||||
"DOCKER_REGISTRY_SERVER_PASSWORD" = local.docker_registry_server_password
|
||||
"APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.application_insights_staging.instrumentation_key
|
||||
"APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.application_insights_staging.connection_string
|
||||
}
|
||||
|
||||
site_config {
|
||||
always_on = true
|
||||
http2_enabled = true
|
||||
ftps_state = "Disabled"
|
||||
health_check_path = "/api/healthcheck/poi"
|
||||
# acr_use_managed_identity_credentials = true
|
||||
linux_fx_version = "DOCKER|${azurerm_container_registry.container_registry.login_server}/devopsoh/api-poi:${local.apipoi_base_image_tag}"
|
||||
}
|
||||
|
||||
logs {
|
||||
http_logs {
|
||||
file_system {
|
||||
retention_in_days = 7
|
||||
retention_in_mb = 50
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags,
|
||||
app_settings["DOCKER_CUSTOM_IMAGE_NAME"],
|
||||
site_config[0].linux_fx_version
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# resource "azurerm_key_vault_access_policy" "key_vault_access_policy_api-poi_staging" {
|
||||
# key_vault_id = azurerm_key_vault.key_vault.id
|
||||
# tenant_id = azurerm_app_service_slot.app_service_api-poi_staging.identity[0].tenant_id
|
||||
# object_id = azurerm_app_service_slot.app_service_api-poi_staging.identity[0].principal_id
|
||||
#
|
||||
# secret_permissions = [
|
||||
# "Get"
|
||||
# ]
|
||||
# }
|
||||
|
||||
# resource "azurerm_role_assignment" "cr_role_assignment_api-poi_staging" {
|
||||
# scope = azurerm_container_registry.container_registry.id
|
||||
# role_definition_name = "AcrPull"
|
||||
# principal_id = azurerm_app_service_slot.app_service_api-poi_staging.identity[0].principal_id
|
||||
# }
|
||||
140
iac/terraform/appservice_trips.tf
Normal file
140
iac/terraform/appservice_trips.tf
Normal file
@ -0,0 +1,140 @@
|
||||
############################################
|
||||
## APP SERVICE - API-TRIPS ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_app_service" "app_service_api-trips" {
|
||||
depends_on = [
|
||||
null_resource.db_datainit,
|
||||
null_resource.docker_api-trips
|
||||
]
|
||||
name = local.app_service_api-trips_name
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
app_service_plan_id = azurerm_app_service_plan.app_service_plan.id
|
||||
https_only = true
|
||||
|
||||
identity {
|
||||
type = "SystemAssigned"
|
||||
}
|
||||
|
||||
app_settings = {
|
||||
"SQL_USER" = local.mssql_server_administrator_login
|
||||
"SQL_PASSWORD" = local.mssql_server_administrator_login_password
|
||||
"SQL_SERVER" = azurerm_mssql_server.mssql_server.fully_qualified_domain_name
|
||||
"SQL_DBNAME" = local.mssql_database_name
|
||||
"DOCKER_REGISTRY_SERVER_URL" = local.docker_registry_server_url
|
||||
"DOCKER_REGISTRY_SERVER_USERNAME" = local.docker_registry_server_username
|
||||
"DOCKER_REGISTRY_SERVER_PASSWORD" = local.docker_registry_server_password
|
||||
"APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.application_insights.instrumentation_key
|
||||
"APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.application_insights.connection_string
|
||||
}
|
||||
|
||||
site_config {
|
||||
always_on = true
|
||||
http2_enabled = true
|
||||
ftps_state = "Disabled"
|
||||
health_check_path = "/api/healthcheck/trips"
|
||||
# acr_use_managed_identity_credentials = true
|
||||
linux_fx_version = "DOCKER|${azurerm_container_registry.container_registry.login_server}/devopsoh/api-trips:${local.apitrips_base_image_tag}"
|
||||
}
|
||||
|
||||
logs {
|
||||
http_logs {
|
||||
file_system {
|
||||
retention_in_days = 7
|
||||
retention_in_mb = 50
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags,
|
||||
app_settings["DOCKER_CUSTOM_IMAGE_NAME"],
|
||||
site_config[0].linux_fx_version
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# resource "azurerm_key_vault_access_policy" "key_vault_access_policy_api-trips" {
|
||||
# key_vault_id = azurerm_key_vault.key_vault.id
|
||||
# tenant_id = azurerm_app_service.app_service_api-trips.identity[0].tenant_id
|
||||
# object_id = azurerm_app_service.app_service_api-trips.identity[0].principal_id
|
||||
#
|
||||
# secret_permissions = [
|
||||
# "Get"
|
||||
# ]
|
||||
# }
|
||||
|
||||
# resource "azurerm_role_assignment" "cr_role_assignment_api-trips" {
|
||||
# scope = azurerm_container_registry.container_registry.id
|
||||
# role_definition_name = "AcrPull"
|
||||
# principal_id = azurerm_app_service.app_service_api-trips.identity[0].principal_id
|
||||
# }
|
||||
|
||||
resource "azurerm_app_service_slot" "app_service_api-trips_staging" {
|
||||
name = "staging"
|
||||
app_service_name = azurerm_app_service.app_service_api-trips.name
|
||||
app_service_plan_id = azurerm_app_service_plan.app_service_plan.id
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
https_only = true
|
||||
|
||||
identity {
|
||||
type = "SystemAssigned"
|
||||
}
|
||||
|
||||
app_settings = {
|
||||
"SQL_USER" = local.mssql_server_administrator_login
|
||||
"SQL_PASSWORD" = local.mssql_server_administrator_login_password
|
||||
"SQL_SERVER" = azurerm_mssql_server.mssql_server.fully_qualified_domain_name
|
||||
"SQL_DBNAME" = local.mssql_database_name
|
||||
"DOCKER_REGISTRY_SERVER_URL" = local.docker_registry_server_url
|
||||
"DOCKER_REGISTRY_SERVER_USERNAME" = local.docker_registry_server_username
|
||||
"DOCKER_REGISTRY_SERVER_PASSWORD" = local.docker_registry_server_password
|
||||
"APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.application_insights_staging.instrumentation_key
|
||||
"APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.application_insights_staging.connection_string
|
||||
}
|
||||
|
||||
site_config {
|
||||
always_on = true
|
||||
http2_enabled = true
|
||||
ftps_state = "Disabled"
|
||||
health_check_path = "/api/healthcheck/trips"
|
||||
# acr_use_managed_identity_credentials = true
|
||||
linux_fx_version = "DOCKER|${azurerm_container_registry.container_registry.login_server}/devopsoh/api-trips:${local.apitrips_base_image_tag}"
|
||||
}
|
||||
|
||||
logs {
|
||||
http_logs {
|
||||
file_system {
|
||||
retention_in_days = 7
|
||||
retention_in_mb = 50
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags,
|
||||
app_settings["DOCKER_CUSTOM_IMAGE_NAME"],
|
||||
site_config[0].linux_fx_version
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# resource "azurerm_key_vault_access_policy" "key_vault_access_policy_api-trips_staging" {
|
||||
# key_vault_id = azurerm_key_vault.key_vault.id
|
||||
# tenant_id = azurerm_app_service_slot.app_service_api-trips_staging.identity[0].tenant_id
|
||||
# object_id = azurerm_app_service_slot.app_service_api-trips_staging.identity[0].principal_id
|
||||
#
|
||||
# secret_permissions = [
|
||||
# "Get"
|
||||
# ]
|
||||
# }
|
||||
|
||||
# resource "azurerm_role_assignment" "cr_role_assignment_api-trips_staging" {
|
||||
# scope = azurerm_container_registry.container_registry.id
|
||||
# role_definition_name = "AcrPull"
|
||||
# principal_id = azurerm_app_service_slot.app_service_api-trips_staging.identity[0].principal_id
|
||||
# }
|
||||
140
iac/terraform/appservice_userjava.tf
Normal file
140
iac/terraform/appservice_userjava.tf
Normal file
@ -0,0 +1,140 @@
|
||||
############################################
|
||||
## APP SERVICE - API-USER-JAVA ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_app_service" "app_service_api-userjava" {
|
||||
depends_on = [
|
||||
null_resource.db_datainit,
|
||||
null_resource.docker_api-user-java
|
||||
]
|
||||
name = local.app_service_api-userjava_name
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
app_service_plan_id = azurerm_app_service_plan.app_service_plan.id
|
||||
https_only = true
|
||||
|
||||
identity {
|
||||
type = "SystemAssigned"
|
||||
}
|
||||
|
||||
app_settings = {
|
||||
"SQL_USER" = local.mssql_server_administrator_login
|
||||
"SQL_PASSWORD" = local.mssql_server_administrator_login_password
|
||||
"SQL_SERVER" = azurerm_mssql_server.mssql_server.fully_qualified_domain_name
|
||||
"SQL_DBNAME" = local.mssql_database_name
|
||||
"DOCKER_REGISTRY_SERVER_URL" = local.docker_registry_server_url
|
||||
"DOCKER_REGISTRY_SERVER_USERNAME" = local.docker_registry_server_username
|
||||
"DOCKER_REGISTRY_SERVER_PASSWORD" = local.docker_registry_server_password
|
||||
"APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.application_insights.instrumentation_key
|
||||
"APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.application_insights.connection_string
|
||||
}
|
||||
|
||||
site_config {
|
||||
always_on = true
|
||||
http2_enabled = true
|
||||
ftps_state = "Disabled"
|
||||
health_check_path = "/api/healthcheck/user-java"
|
||||
# acr_use_managed_identity_credentials = true
|
||||
linux_fx_version = "DOCKER|${azurerm_container_registry.container_registry.login_server}/devopsoh/api-user-java:${local.apiuserjava_base_image_tag}"
|
||||
}
|
||||
|
||||
logs {
|
||||
http_logs {
|
||||
file_system {
|
||||
retention_in_days = 7
|
||||
retention_in_mb = 50
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags,
|
||||
app_settings["DOCKER_CUSTOM_IMAGE_NAME"],
|
||||
site_config[0].linux_fx_version
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# resource "azurerm_key_vault_access_policy" "key_vault_access_policy_api-userjava" {
|
||||
# key_vault_id = azurerm_key_vault.key_vault.id
|
||||
# tenant_id = azurerm_app_service.app_service_api-userjava.identity[0].tenant_id
|
||||
# object_id = azurerm_app_service.app_service_api-userjava.identity[0].principal_id
|
||||
#
|
||||
# secret_permissions = [
|
||||
# "Get"
|
||||
# ]
|
||||
# }
|
||||
|
||||
# resource "azurerm_role_assignment" "cr_role_assignment_api-userjava" {
|
||||
# scope = azurerm_container_registry.container_registry.id
|
||||
# role_definition_name = "AcrPull"
|
||||
# principal_id = azurerm_app_service.app_service_api-userjava.identity[0].principal_id
|
||||
# }
|
||||
|
||||
resource "azurerm_app_service_slot" "app_service_api-userjava_staging" {
|
||||
name = "staging"
|
||||
app_service_name = azurerm_app_service.app_service_api-userjava.name
|
||||
app_service_plan_id = azurerm_app_service_plan.app_service_plan.id
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
https_only = true
|
||||
|
||||
identity {
|
||||
type = "SystemAssigned"
|
||||
}
|
||||
|
||||
app_settings = {
|
||||
"SQL_USER" = local.mssql_server_administrator_login
|
||||
"SQL_PASSWORD" = local.mssql_server_administrator_login_password
|
||||
"SQL_SERVER" = azurerm_mssql_server.mssql_server.fully_qualified_domain_name
|
||||
"SQL_DBNAME" = local.mssql_database_name
|
||||
"DOCKER_REGISTRY_SERVER_URL" = local.docker_registry_server_url
|
||||
"DOCKER_REGISTRY_SERVER_USERNAME" = local.docker_registry_server_username
|
||||
"DOCKER_REGISTRY_SERVER_PASSWORD" = local.docker_registry_server_password
|
||||
"APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.application_insights_staging.instrumentation_key
|
||||
"APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.application_insights_staging.connection_string
|
||||
}
|
||||
|
||||
site_config {
|
||||
always_on = true
|
||||
http2_enabled = true
|
||||
health_check_path = "/api/healthcheck/user-java"
|
||||
ftps_state = "Disabled"
|
||||
# acr_use_managed_identity_credentials = true
|
||||
linux_fx_version = "DOCKER|${azurerm_container_registry.container_registry.login_server}/devopsoh/api-user-java:${local.apiuserjava_base_image_tag}"
|
||||
}
|
||||
|
||||
logs {
|
||||
http_logs {
|
||||
file_system {
|
||||
retention_in_days = 7
|
||||
retention_in_mb = 50
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags,
|
||||
app_settings["DOCKER_CUSTOM_IMAGE_NAME"],
|
||||
site_config[0].linux_fx_version
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# resource "azurerm_key_vault_access_policy" "key_vault_access_policy_api-userjava_staging" {
|
||||
# key_vault_id = azurerm_key_vault.key_vault.id
|
||||
# tenant_id = azurerm_app_service_slot.app_service_api-userjava_staging.identity[0].tenant_id
|
||||
# object_id = azurerm_app_service_slot.app_service_api-userjava_staging.identity[0].principal_id
|
||||
#
|
||||
# secret_permissions = [
|
||||
# "Get"
|
||||
# ]
|
||||
# }
|
||||
|
||||
# resource "azurerm_role_assignment" "cr_role_assignment_api-userjava_staging" {
|
||||
# scope = azurerm_container_registry.container_registry.id
|
||||
# role_definition_name = "AcrPull"
|
||||
# principal_id = azurerm_app_service_slot.app_service_api-userjava_staging.identity[0].principal_id
|
||||
# }
|
||||
140
iac/terraform/appservice_userprofile.tf
Normal file
140
iac/terraform/appservice_userprofile.tf
Normal file
@ -0,0 +1,140 @@
|
||||
############################################
|
||||
## APP SERVICE - API-USERPROFILE ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_app_service" "app_service_api-userprofile" {
|
||||
depends_on = [
|
||||
null_resource.db_datainit,
|
||||
null_resource.docker_api-userprofile
|
||||
]
|
||||
name = local.app_service_api-userprofile_name
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
app_service_plan_id = azurerm_app_service_plan.app_service_plan.id
|
||||
https_only = true
|
||||
|
||||
identity {
|
||||
type = "SystemAssigned"
|
||||
}
|
||||
|
||||
app_settings = {
|
||||
"SQL_USER" = local.mssql_server_administrator_login
|
||||
"SQL_PASSWORD" = local.mssql_server_administrator_login_password
|
||||
"SQL_SERVER" = azurerm_mssql_server.mssql_server.fully_qualified_domain_name
|
||||
"SQL_DBNAME" = local.mssql_database_name
|
||||
"DOCKER_REGISTRY_SERVER_URL" = local.docker_registry_server_url
|
||||
"DOCKER_REGISTRY_SERVER_USERNAME" = local.docker_registry_server_username
|
||||
"DOCKER_REGISTRY_SERVER_PASSWORD" = local.docker_registry_server_password
|
||||
"APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.application_insights.instrumentation_key
|
||||
"APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.application_insights.connection_string
|
||||
}
|
||||
|
||||
site_config {
|
||||
always_on = true
|
||||
http2_enabled = true
|
||||
health_check_path = "/api/healthcheck/user"
|
||||
ftps_state = "Disabled"
|
||||
# acr_use_managed_identity_credentials = true
|
||||
linux_fx_version = "DOCKER|${azurerm_container_registry.container_registry.login_server}/devopsoh/api-userprofile:${local.apiuserprofile_base_image_tag}"
|
||||
}
|
||||
|
||||
logs {
|
||||
http_logs {
|
||||
file_system {
|
||||
retention_in_days = 7
|
||||
retention_in_mb = 50
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags,
|
||||
app_settings["DOCKER_CUSTOM_IMAGE_NAME"],
|
||||
site_config[0].linux_fx_version
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# resource "azurerm_key_vault_access_policy" "key_vault_access_policy_api-userprofile" {
|
||||
# key_vault_id = azurerm_key_vault.key_vault.id
|
||||
# tenant_id = azurerm_app_service.app_service_api-userprofile.identity[0].tenant_id
|
||||
# object_id = azurerm_app_service.app_service_api-userprofile.identity[0].principal_id
|
||||
#
|
||||
# secret_permissions = [
|
||||
# "Get"
|
||||
# ]
|
||||
# }
|
||||
|
||||
# resource "azurerm_role_assignment" "cr_role_assignment_api-userprofile" {
|
||||
# scope = azurerm_container_registry.container_registry.id
|
||||
# role_definition_name = "AcrPull"
|
||||
# principal_id = azurerm_app_service.app_service_api-userprofile.identity[0].principal_id
|
||||
# }
|
||||
|
||||
resource "azurerm_app_service_slot" "app_service_api-userprofile_staging" {
|
||||
name = "staging"
|
||||
app_service_name = azurerm_app_service.app_service_api-userprofile.name
|
||||
app_service_plan_id = azurerm_app_service_plan.app_service_plan.id
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
https_only = true
|
||||
|
||||
identity {
|
||||
type = "SystemAssigned"
|
||||
}
|
||||
|
||||
app_settings = {
|
||||
"SQL_USER" = local.mssql_server_administrator_login
|
||||
"SQL_PASSWORD" = local.mssql_server_administrator_login_password
|
||||
"SQL_SERVER" = azurerm_mssql_server.mssql_server.fully_qualified_domain_name
|
||||
"SQL_DBNAME" = local.mssql_database_name
|
||||
"DOCKER_REGISTRY_SERVER_URL" = local.docker_registry_server_url
|
||||
"DOCKER_REGISTRY_SERVER_USERNAME" = local.docker_registry_server_username
|
||||
"DOCKER_REGISTRY_SERVER_PASSWORD" = local.docker_registry_server_password
|
||||
"APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.application_insights_staging.instrumentation_key
|
||||
"APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.application_insights_staging.connection_string
|
||||
}
|
||||
|
||||
site_config {
|
||||
always_on = true
|
||||
http2_enabled = true
|
||||
health_check_path = "/api/healthcheck/user"
|
||||
ftps_state = "Disabled"
|
||||
# acr_use_managed_identity_credentials = true
|
||||
linux_fx_version = "DOCKER|${azurerm_container_registry.container_registry.login_server}/devopsoh/api-userprofile:${local.apiuserprofile_base_image_tag}"
|
||||
}
|
||||
|
||||
logs {
|
||||
http_logs {
|
||||
file_system {
|
||||
retention_in_days = 7
|
||||
retention_in_mb = 50
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags,
|
||||
app_settings["DOCKER_CUSTOM_IMAGE_NAME"],
|
||||
site_config[0].linux_fx_version
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# resource "azurerm_key_vault_access_policy" "key_vault_access_policy_api-userprofile_staging" {
|
||||
# key_vault_id = azurerm_key_vault.key_vault.id
|
||||
# tenant_id = azurerm_app_service_slot.app_service_api-userprofile_staging.identity[0].tenant_id
|
||||
# object_id = azurerm_app_service_slot.app_service_api-userprofile_staging.identity[0].principal_id
|
||||
#
|
||||
# secret_permissions = [
|
||||
# "Get"
|
||||
# ]
|
||||
# }
|
||||
|
||||
# resource "azurerm_role_assignment" "cr_role_assignment_api-userprofile_staging" {
|
||||
# scope = azurerm_container_registry.container_registry.id
|
||||
# role_definition_name = "AcrPull"
|
||||
# principal_id = azurerm_app_service_slot.app_service_api-userprofile_staging.identity[0].principal_id
|
||||
# }
|
||||
145
iac/terraform/deploy.sh
Normal file
145
iac/terraform/deploy.sh
Normal file
@ -0,0 +1,145 @@
|
||||
#!/bin/bash
|
||||
|
||||
declare UNIQUER=""
|
||||
declare LOCATION=""
|
||||
declare RESOURCES_PREFIX=""
|
||||
declare -r USAGE_HELP="Usage: ./deploy.sh -l <LOCATION> [-u <UNIQUER> -r <RESOURCES_PREFIX>]"
|
||||
|
||||
_error() {
|
||||
echo "##[error] $@" 2>&1
|
||||
}
|
||||
|
||||
if [ $# -eq 0 ]; then
|
||||
_error "${USAGE_HELP}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Initialize parameters specified from command line
|
||||
while getopts ":l:u:r:" arg; do
|
||||
case "${arg}" in
|
||||
l) # Process -l (LOCATION)
|
||||
LOCATION="${OPTARG}"
|
||||
;;
|
||||
u) # Process -u (UNIQUER)
|
||||
UNIQUER="${OPTARG}"
|
||||
;;
|
||||
r) # Process -r (RESOURCES_PREFIX)
|
||||
RESOURCES_PREFIX="${OPTARG}"
|
||||
;;
|
||||
\?)
|
||||
_error "Invalid options found: -${OPTARG}."
|
||||
_error "${USAGE_HELP}" 2>&1
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
shift $((OPTIND - 1))
|
||||
|
||||
if [ ${#LOCATION} -eq 0 ]; then
|
||||
_error "Required LOCATION parameter is not set!"
|
||||
_error "${USAGE_HELP}" 2>&1
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check for programs
|
||||
if ! [ -x "$(command -v az)" ]; then
|
||||
_error "az is not installed!"
|
||||
exit 1
|
||||
elif ! [ -x "$(command -v jq)" ]; then
|
||||
_error "jq is not installed!"
|
||||
exit 1
|
||||
elif ! [ -x "$(command -v terraform)" ]; then
|
||||
_error "terraform is not installed!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -f "devvars.sh" ]; then
|
||||
. devvars.sh
|
||||
fi
|
||||
|
||||
azure_login() {
|
||||
_azuresp_json=$(cat azuresp.json)
|
||||
export ARM_CLIENT_ID=$(echo "${_azuresp_json}" | jq -r ".clientId")
|
||||
export ARM_CLIENT_SECRET=$(echo "${_azuresp_json}" | jq -r ".clientSecret")
|
||||
export ARM_SUBSCRIPTION_ID=$(echo "${_azuresp_json}" | jq -r ".subscriptionId")
|
||||
export ARM_TENANT_ID=$(echo "${_azuresp_json}" | jq -r ".tenantId")
|
||||
az login --service-principal --username "${ARM_CLIENT_ID}" --password "${ARM_CLIENT_SECRET}" --tenant "${ARM_TENANT_ID}"
|
||||
az account set --subscription "${ARM_SUBSCRIPTION_ID}"
|
||||
}
|
||||
|
||||
lint_terraform() {
|
||||
terraform fmt -check
|
||||
if [ $? -ne 0 ]; then
|
||||
_error "Terraform files are not properly formatted!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
init_terrafrom() {
|
||||
terraform init -backend-config=storage_account_name="${TFSTATE_STORAGE_ACCOUNT_NAME}" -backend-config=container_name="${TFSTATE_STORAGE_CONTAINER_NAME}" -backend-config=key="${TFSTATE_KEY}" -backend-config=resource_group_name="${TFSTATE_RESOURCES_GROUP_NAME}"
|
||||
}
|
||||
|
||||
init_terrafrom_local() {
|
||||
terraform init -backend=false
|
||||
}
|
||||
|
||||
validate_terraform() {
|
||||
terraform validate
|
||||
}
|
||||
|
||||
preview_terraform() {
|
||||
if [ ${#RESOURCES_PREFIX} -gt 0 ]; then
|
||||
terraform plan --detailed-exitcode -var="location=${LOCATION}" -var="resources_prefix=${RESOURCES_PREFIX}"
|
||||
elif [[ ${#RESOURCES_PREFIX} -eq 0 && ${#UNIQUER} -gt 0 ]]; then
|
||||
terraform plan --detailed-exitcode -var="location=${LOCATION}" -var="uniquer=${UNIQUER}"
|
||||
else
|
||||
terraform plan --detailed-exitcode -var="location=${LOCATION}"
|
||||
fi
|
||||
|
||||
return $?
|
||||
}
|
||||
|
||||
deploy_terraform() {
|
||||
local _tfplan_exit_code=${1}
|
||||
|
||||
if [ "${_tfplan_exit_code}" -eq 2 ]; then
|
||||
if [ ${#RESOURCES_PREFIX} -gt 0 ]; then
|
||||
terraform apply --auto-approve -var="location=${LOCATION}" -var="resources_prefix=${RESOURCES_PREFIX}"
|
||||
elif [[ ${#RESOURCES_PREFIX} -eq 0 && ${#UNIQUER} -gt 0 ]]; then
|
||||
terraform apply --auto-approve -var="location=${LOCATION}" -var="uniquer=${UNIQUER}"
|
||||
else
|
||||
terraform apply --auto-approve -var="location=${LOCATION}"
|
||||
fi
|
||||
fi
|
||||
# rm -rf .terraform && rm -rf .terraform.lock.hcl && rm -rf terraform.tfstate && rm -rf terraform.tfstate.backup
|
||||
}
|
||||
|
||||
destroy_terraform() {
|
||||
if [ ${#RESOURCES_PREFIX} -gt 0 ]; then
|
||||
terraform destroy --auto-approve -var="location=${LOCATION}" -var="resources_prefix=${RESOURCES_PREFIX}"
|
||||
elif [[ ${#RESOURCES_PREFIX} -eq 0 && ${#UNIQUER} -gt 0 ]]; then
|
||||
terraform destroy --auto-approve -var="location=${LOCATION}" -var="uniquer=${UNIQUER}"
|
||||
else
|
||||
terraform destroy --auto-approve -var="location=${LOCATION}"
|
||||
fi
|
||||
}
|
||||
|
||||
test_deploy() {
|
||||
local _hostnames="${1}"
|
||||
|
||||
sleep 30
|
||||
pwsh -Command ./smokeTest.ps1 -HostNames "${_hostnames}"
|
||||
}
|
||||
|
||||
azure_login
|
||||
|
||||
lint_terraform
|
||||
init_terrafrom
|
||||
# init_terrafrom_local
|
||||
validate_terraform
|
||||
preview_terraform
|
||||
deploy_terraform $?
|
||||
# destroy_terraform
|
||||
# deployment_output=$(terraform output -json)
|
||||
# hostnames=$(echo "${deployment_output}" | jq -r -c 'map(.value) | join(",")')
|
||||
# test_deploy "${hostnames}"
|
||||
12
iac/terraform/locals.defaults.tf
Normal file
12
iac/terraform/locals.defaults.tf
Normal file
@ -0,0 +1,12 @@
|
||||
|
||||
locals {
|
||||
_default = {
|
||||
base_image_tag = "changeme"
|
||||
name_prefix = "devopsoh"
|
||||
}
|
||||
_secrets = {
|
||||
bing_maps_key = "Ar6iuHZYgX1BrfJs6SRJaXWbpU_HKdoe7G-OO9b2kl3rWvcawYx235GGx5FPM76O"
|
||||
mssql_server_administrator_login = "demousersa"
|
||||
mssql_server_administrator_login_password = "demo!P@55w0rd123"
|
||||
}
|
||||
}
|
||||
45
iac/terraform/locals.tf
Normal file
45
iac/terraform/locals.tf
Normal file
@ -0,0 +1,45 @@
|
||||
resource "random_string" "uniquer" {
|
||||
length = 5
|
||||
special = false
|
||||
number = true
|
||||
lower = false
|
||||
upper = false
|
||||
}
|
||||
|
||||
data "external" "my_ip" {
|
||||
program = ["/bin/bash", "${path.module}/myip.sh"]
|
||||
}
|
||||
|
||||
locals {
|
||||
uniquer = var.uniquer != null ? var.uniquer : "${random_string.uniquer.id}"
|
||||
resources_prefix = var.resources_prefix != null ? var.resources_prefix : "${local._default.name_prefix}${local.uniquer}"
|
||||
team_name = local.resources_prefix
|
||||
location = var.location
|
||||
resource_group_name = "${local.resources_prefix}rg"
|
||||
|
||||
key_vault_name = "${local.resources_prefix}kv"
|
||||
container_registry_name = "${local.resources_prefix}cr"
|
||||
application_insights_name = "${local.resources_prefix}appi"
|
||||
mssql_server_name = "${local.resources_prefix}sql"
|
||||
mssql_server_administrator_login = var.mssql_server_administrator_login != null ? var.mssql_server_administrator_login : local._secrets.mssql_server_administrator_login
|
||||
mssql_server_administrator_login_password = var.mssql_server_administrator_login_password != null ? var.mssql_server_administrator_login_password : local._secrets.mssql_server_administrator_login_password
|
||||
mssql_firewall_rule_myip = data.external.my_ip.result["my_ip"]
|
||||
mssql_database_name = "mydrivingDB"
|
||||
bing_maps_key = local._secrets.bing_maps_key
|
||||
app_service_plan_name = "${local.resources_prefix}plan"
|
||||
app_service_tripviewer_name = "${local.resources_prefix}tripviewer"
|
||||
app_service_api-poi_name = "${local.resources_prefix}poi"
|
||||
app_service_api-trips_name = "${local.resources_prefix}trips"
|
||||
app_service_api-userjava_name = "${local.resources_prefix}userjava"
|
||||
app_service_api-userprofile_name = "${local.resources_prefix}userprofile"
|
||||
user_assigned_identity_name = "${local.resources_prefix}uami"
|
||||
container_group_simulator_name = "${local.resources_prefix}simulator"
|
||||
log_analytics_name = "${local.resources_prefix}log"
|
||||
apipoi_base_image_tag = var.apipoi_base_image_tag != null ? var.apipoi_base_image_tag : local._default.base_image_tag
|
||||
apitrips_base_image_tag = var.apitrips_base_image_tag != null ? var.apitrips_base_image_tag : local._default.base_image_tag
|
||||
apiuserjava_base_image_tag = var.apiuserjava_base_image_tag != null ? var.apiuserjava_base_image_tag : local._default.base_image_tag
|
||||
apiuserprofile_base_image_tag = var.apiuserprofile_base_image_tag != null ? var.apiuserprofile_base_image_tag : local._default.base_image_tag
|
||||
docker_registry_server_url = var.docker_registry_server_url != null ? var.docker_registry_server_url : "https://${azurerm_container_registry.container_registry.login_server}"
|
||||
docker_registry_server_username = var.docker_registry_server_username != null ? var.docker_registry_server_username : azurerm_container_registry.container_registry.admin_username
|
||||
docker_registry_server_password = var.docker_registry_server_password != null ? var.docker_registry_server_password : azurerm_container_registry.container_registry.admin_password
|
||||
}
|
||||
511
iac/terraform/main.tf
Normal file
511
iac/terraform/main.tf
Normal file
@ -0,0 +1,511 @@
|
||||
############################################
|
||||
## RESOURCE GROUP ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_resource_group" "resource_group" {
|
||||
name = local.resource_group_name
|
||||
location = local.location
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
############################################
|
||||
## CONTAINER REGISTRY ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_container_registry" "container_registry" {
|
||||
name = local.container_registry_name
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
sku = "Standard"
|
||||
admin_enabled = true
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
############################################
|
||||
## SQL SERVER ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_mssql_server" "mssql_server" {
|
||||
name = local.mssql_server_name
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
version = "12.0"
|
||||
administrator_login = local.mssql_server_administrator_login
|
||||
administrator_login_password = local.mssql_server_administrator_login_password
|
||||
minimum_tls_version = "1.2"
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "azurerm_mssql_firewall_rule" "mssql_firewall_rule_myip" {
|
||||
name = "SetupAccount"
|
||||
server_id = azurerm_mssql_server.mssql_server.id
|
||||
start_ip_address = local.mssql_firewall_rule_myip
|
||||
end_ip_address = local.mssql_firewall_rule_myip
|
||||
}
|
||||
|
||||
resource "azurerm_mssql_firewall_rule" "mssql_firewall_rule_azure" {
|
||||
name = "AzureAccess"
|
||||
server_id = azurerm_mssql_server.mssql_server.id
|
||||
start_ip_address = "0.0.0.0"
|
||||
end_ip_address = "0.0.0.0"
|
||||
}
|
||||
|
||||
############################################
|
||||
## SQL DATABASE ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_mssql_database" "mssql_database" {
|
||||
name = local.mssql_database_name
|
||||
server_id = azurerm_mssql_server.mssql_server.id
|
||||
collation = "SQL_Latin1_General_CP1_CI_AS"
|
||||
sku_name = "S0"
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
############################################
|
||||
## SQL DATABASE DIAGNOSTIC ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_monitor_diagnostic_setting" "monitor_diagnostic_setting_mssql_database" {
|
||||
name = "sqlDbDiag"
|
||||
target_resource_id = azurerm_mssql_database.mssql_database.id
|
||||
log_analytics_workspace_id = azurerm_log_analytics_workspace.log_analytics_workspace.id
|
||||
|
||||
log {
|
||||
category = "SQLInsights"
|
||||
enabled = true
|
||||
}
|
||||
log {
|
||||
category = "AutomaticTuning"
|
||||
enabled = true
|
||||
}
|
||||
log {
|
||||
category = "QueryStoreRuntimeStatistics"
|
||||
enabled = true
|
||||
}
|
||||
log {
|
||||
category = "QueryStoreWaitStatistics"
|
||||
enabled = true
|
||||
}
|
||||
log {
|
||||
category = "Errors"
|
||||
enabled = true
|
||||
}
|
||||
log {
|
||||
category = "DatabaseWaitStatistics"
|
||||
enabled = true
|
||||
}
|
||||
log {
|
||||
category = "Timeouts"
|
||||
enabled = true
|
||||
}
|
||||
log {
|
||||
category = "Blocks"
|
||||
enabled = true
|
||||
}
|
||||
log {
|
||||
category = "Deadlocks"
|
||||
enabled = true
|
||||
}
|
||||
log {
|
||||
category = "DevOpsOperationsAudit"
|
||||
enabled = true
|
||||
}
|
||||
log {
|
||||
category = "SQLSecurityAuditEvents"
|
||||
enabled = true
|
||||
}
|
||||
|
||||
metric {
|
||||
category = "Basic"
|
||||
enabled = true
|
||||
}
|
||||
metric {
|
||||
category = "InstanceAndAppAdvanced"
|
||||
enabled = true
|
||||
}
|
||||
metric {
|
||||
category = "WorkloadManagement"
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
|
||||
############################################
|
||||
## APP SERVICE PLAN ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_app_service_plan" "app_service_plan" {
|
||||
name = local.app_service_plan_name
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
kind = "linux"
|
||||
reserved = true
|
||||
|
||||
sku {
|
||||
tier = "PremiumV2"
|
||||
size = "P1v2"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
############################################
|
||||
## APP SERVICE - TRIPVIEWER ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_app_service" "app_service_tripviewer" {
|
||||
depends_on = [
|
||||
null_resource.docker_tripviewer
|
||||
]
|
||||
name = local.app_service_tripviewer_name
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
app_service_plan_id = azurerm_app_service_plan.app_service_plan.id
|
||||
https_only = true
|
||||
identity {
|
||||
type = "SystemAssigned"
|
||||
}
|
||||
|
||||
app_settings = {
|
||||
"BING_MAPS_KEY" = local.bing_maps_key
|
||||
"USER_ROOT_URL" = "https://${azurerm_app_service.app_service_api-userprofile.default_site_hostname}"
|
||||
"USER_JAVA_ROOT_URL" = "https://${azurerm_app_service.app_service_api-userjava.default_site_hostname}"
|
||||
"TRIPS_ROOT_URL" = "https://${azurerm_app_service.app_service_api-trips.default_site_hostname}"
|
||||
"POI_ROOT_URL" = "https://${azurerm_app_service.app_service_api-poi.default_site_hostname}"
|
||||
"STAGING_USER_ROOT_URL" = "https://${azurerm_app_service_slot.app_service_api-userprofile_staging.default_site_hostname}"
|
||||
"STAGING_USER_JAVA_ROOT_URL" = "https://${azurerm_app_service_slot.app_service_api-userjava_staging.default_site_hostname}"
|
||||
"STAGING_TRIPS_ROOT_URL" = "https://${azurerm_app_service_slot.app_service_api-trips_staging.default_site_hostname}"
|
||||
"STAGING_POI_ROOT_URL" = "https://${azurerm_app_service_slot.app_service_api-poi_staging.default_site_hostname}"
|
||||
"DOCKER_REGISTRY_SERVER_URL" = "https://${azurerm_container_registry.container_registry.login_server}"
|
||||
"APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.application_insights.instrumentation_key
|
||||
"APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.application_insights.connection_string
|
||||
}
|
||||
|
||||
site_config {
|
||||
always_on = true
|
||||
http2_enabled = true
|
||||
ftps_state = "Disabled"
|
||||
acr_use_managed_identity_credentials = true
|
||||
linux_fx_version = "DOCKER|${azurerm_container_registry.container_registry.login_server}/devopsoh/tripviewer:latest"
|
||||
}
|
||||
|
||||
logs {
|
||||
http_logs {
|
||||
file_system {
|
||||
retention_in_days = 7
|
||||
retention_in_mb = 50
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "azurerm_role_assignment" "cr_role_assignment_tripviewer" {
|
||||
scope = azurerm_container_registry.container_registry.id
|
||||
role_definition_name = "AcrPull"
|
||||
principal_id = azurerm_app_service.app_service_tripviewer.identity[0].principal_id
|
||||
}
|
||||
|
||||
resource "azurerm_key_vault_access_policy" "key_vault_access_policy_tripviewer" {
|
||||
key_vault_id = azurerm_key_vault.key_vault.id
|
||||
tenant_id = azurerm_app_service.app_service_tripviewer.identity[0].tenant_id
|
||||
object_id = azurerm_app_service.app_service_tripviewer.identity[0].principal_id
|
||||
|
||||
secret_permissions = [
|
||||
"Get"
|
||||
]
|
||||
}
|
||||
|
||||
############################################
|
||||
## APPLICATION INSIGHTS ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_application_insights" "application_insights" {
|
||||
name = local.application_insights_name
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
application_type = "web"
|
||||
}
|
||||
|
||||
resource "azurerm_application_insights" "application_insights_staging" {
|
||||
name = "${local.application_insights_name}staging"
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
application_type = "web"
|
||||
}
|
||||
|
||||
############################################
|
||||
## UAMI ##
|
||||
############################################
|
||||
|
||||
# resource "azurerm_user_assigned_identity" "user_assigned_identity" {
|
||||
# name = local.user_assigned_identity_name
|
||||
# resource_group_name = azurerm_resource_group.resource_group.name
|
||||
# location = azurerm_resource_group.resource_group.location
|
||||
# }
|
||||
|
||||
############################################
|
||||
## LOG ANALYTICS ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_log_analytics_workspace" "log_analytics_workspace" {
|
||||
name = local.log_analytics_name
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
sku = "PerGB2018"
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# resource "azurerm_log_analytics_solution" "log_analytics_solution_containerinsights" {
|
||||
# solution_name = "ContainerInsights"
|
||||
# location = azurerm_resource_group.resource_group.location
|
||||
# resource_group_name = azurerm_resource_group.resource_group.name
|
||||
# workspace_resource_id = azurerm_log_analytics_workspace.log_analytics_workspace.id
|
||||
# workspace_name = azurerm_log_analytics_workspace.log_analytics_workspace.name
|
||||
|
||||
# plan {
|
||||
# publisher = "Microsoft"
|
||||
# product = "OMSGallery/ContainerInsights"
|
||||
# }
|
||||
|
||||
# lifecycle {
|
||||
# ignore_changes = [
|
||||
# tags
|
||||
# ]
|
||||
# }
|
||||
# }
|
||||
|
||||
resource "azurerm_log_analytics_solution" "log_analytics_solution_containers" {
|
||||
solution_name = "Containers"
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
workspace_resource_id = azurerm_log_analytics_workspace.log_analytics_workspace.id
|
||||
workspace_name = azurerm_log_analytics_workspace.log_analytics_workspace.name
|
||||
|
||||
plan {
|
||||
publisher = "Microsoft"
|
||||
product = "OMSGallery/Containers"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "azurerm_log_analytics_solution" "log_analytics_solution_sqlassessment" {
|
||||
solution_name = "SQLAssessment"
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
workspace_resource_id = azurerm_log_analytics_workspace.log_analytics_workspace.id
|
||||
workspace_name = azurerm_log_analytics_workspace.log_analytics_workspace.name
|
||||
|
||||
plan {
|
||||
publisher = "Microsoft"
|
||||
product = "OMSGallery/SQLAssessment"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "azurerm_log_analytics_solution" "log_analytics_solution_azuresqlanalytics" {
|
||||
solution_name = "AzureSQLAnalytics"
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
workspace_resource_id = azurerm_log_analytics_workspace.log_analytics_workspace.id
|
||||
workspace_name = azurerm_log_analytics_workspace.log_analytics_workspace.name
|
||||
|
||||
plan {
|
||||
publisher = "Microsoft"
|
||||
product = "OMSGallery/AzureSQLAnalytics"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
############################################
|
||||
## CONTAINER GROUP - SIMULATOR ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_container_group" "container_group_simulator" {
|
||||
depends_on = [
|
||||
null_resource.docker_simulator
|
||||
# azurerm_role_assignment.cr_role_assignment_simulator
|
||||
]
|
||||
name = local.container_group_simulator_name
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
ip_address_type = "public"
|
||||
dns_name_label = local.container_group_simulator_name
|
||||
os_type = "Linux"
|
||||
|
||||
# identity {
|
||||
# type = "UserAssigned"
|
||||
# identity_ids = [
|
||||
# azurerm_user_assigned_identity.user_assigned_identity.id
|
||||
# ]
|
||||
# }
|
||||
|
||||
image_registry_credential {
|
||||
username = azurerm_container_registry.container_registry.admin_username
|
||||
password = azurerm_container_registry.container_registry.admin_password
|
||||
server = azurerm_container_registry.container_registry.login_server
|
||||
}
|
||||
|
||||
container {
|
||||
name = "simulator"
|
||||
image = "${azurerm_container_registry.container_registry.login_server}/devopsoh/simulator:latest"
|
||||
cpu = "1"
|
||||
memory = "2"
|
||||
|
||||
ports {
|
||||
port = 8080
|
||||
protocol = "TCP"
|
||||
}
|
||||
|
||||
environment_variables = {
|
||||
"SQL_USER" = local.mssql_server_administrator_login
|
||||
"SQL_SERVER" = azurerm_mssql_server.mssql_server.fully_qualified_domain_name
|
||||
"SQL_DBNAME" = local.mssql_database_name
|
||||
"TEAM_NAME" = local.team_name
|
||||
"USER_ROOT_URL" = "https://${azurerm_app_service.app_service_api-userprofile.default_site_hostname}"
|
||||
"USER_JAVA_ROOT_URL" = "https://${azurerm_app_service.app_service_api-userjava.default_site_hostname}"
|
||||
"TRIPS_ROOT_URL" = "https://${azurerm_app_service.app_service_api-trips.default_site_hostname}"
|
||||
"POI_ROOT_URL" = "https://${azurerm_app_service.app_service_api-poi.default_site_hostname}"
|
||||
}
|
||||
|
||||
secure_environment_variables = {
|
||||
"SQL_PASSWORD" = local.mssql_server_administrator_login_password
|
||||
}
|
||||
}
|
||||
|
||||
diagnostics {
|
||||
log_analytics {
|
||||
log_type = "ContainerInsights"
|
||||
workspace_id = azurerm_log_analytics_workspace.log_analytics_workspace.workspace_id
|
||||
workspace_key = azurerm_log_analytics_workspace.log_analytics_workspace.primary_shared_key
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# resource "azurerm_role_assignment" "cr_role_assignment_simulator" {
|
||||
# scope = azurerm_container_registry.container_registry.id
|
||||
# role_definition_name = "AcrPull"
|
||||
# principal_id = azurerm_user_assigned_identity.user_assigned_identity.principal_id
|
||||
# }
|
||||
|
||||
############################################
|
||||
## KEY VAULT ##
|
||||
############################################
|
||||
|
||||
resource "azurerm_key_vault" "key_vault" {
|
||||
name = local.key_vault_name
|
||||
location = azurerm_resource_group.resource_group.location
|
||||
resource_group_name = azurerm_resource_group.resource_group.name
|
||||
tenant_id = data.azurerm_client_config.current.tenant_id
|
||||
sku_name = "standard"
|
||||
soft_delete_retention_days = 7
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
tags
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "azurerm_key_vault_access_policy" "key_vault_access_policy_sp" {
|
||||
key_vault_id = azurerm_key_vault.key_vault.id
|
||||
tenant_id = data.azurerm_client_config.current.tenant_id
|
||||
object_id = data.azurerm_client_config.current.object_id
|
||||
|
||||
certificate_permissions = [
|
||||
"Backup", "Create", "Delete", "DeleteIssuers", "Get", "GetIssuers", "Import", "List", "ListIssuers", "ManageContacts", "ManageIssuers", "Purge", "Recover", "Restore", "SetIssuers", "Update"
|
||||
]
|
||||
|
||||
key_permissions = [
|
||||
"Backup", "Create", "Decrypt", "Delete", "Encrypt", "Get", "Import", "List", "Purge", "Recover", "Restore", "Sign", "UnwrapKey", "Update", "Verify", "WrapKey"
|
||||
]
|
||||
|
||||
secret_permissions = [
|
||||
"Backup", "Delete", "Get", "List", "Purge", "Recover", "Restore", "Set"
|
||||
]
|
||||
|
||||
storage_permissions = [
|
||||
"Backup", "Delete", "DeleteSAS", "Get", "GetSAS", "List", "ListSAS", "Purge", "Recover", "RegenerateKey", "Restore", "Set", "SetSAS", "Update"
|
||||
]
|
||||
}
|
||||
|
||||
resource "azurerm_key_vault_secret" "key_vault_secret_sqlpassword" {
|
||||
name = "SQL-PASSWORD"
|
||||
value = local.mssql_server_administrator_login_password
|
||||
key_vault_id = azurerm_key_vault.key_vault.id
|
||||
|
||||
# tags = {
|
||||
# "CredentialId" = local.mssql_server_administrator_login,
|
||||
# "ProviderAddress" = azurerm_mssql_server.mssql_server.id,
|
||||
# "ValidityPeriodDays" = 30
|
||||
# }
|
||||
|
||||
# expiration_date = timeadd(timestamp(), "30m")
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value,
|
||||
expiration_date
|
||||
]
|
||||
}
|
||||
|
||||
# prevents race condition when the secret is getting created before the access policy, causing 401
|
||||
depends_on = [
|
||||
azurerm_key_vault_access_policy.key_vault_access_policy_sp
|
||||
]
|
||||
}
|
||||
4
iac/terraform/myip.sh
Normal file
4
iac/terraform/myip.sh
Normal file
@ -0,0 +1,4 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
MYIP="$(dig +short myip.opendns.com @resolver1.opendns.com -4)"
|
||||
echo $(jq -n --arg MYIP "$MYIP" '{"my_ip":$MYIP}')
|
||||
16
iac/terraform/outputs.tf
Normal file
16
iac/terraform/outputs.tf
Normal file
@ -0,0 +1,16 @@
|
||||
output "appServiceApiPoiHealthcheck" {
|
||||
description = "Hostname of API-POI"
|
||||
value = "${azurerm_app_service.app_service_api-poi.default_site_hostname}/api/healthcheck/poi"
|
||||
}
|
||||
output "appServiceApiTripsHealthcheck" {
|
||||
description = "Hostname of API-TRIPS"
|
||||
value = "${azurerm_app_service.app_service_api-trips.default_site_hostname}/api/healthcheck/trips"
|
||||
}
|
||||
output "appServiceApiUserJavaHealthcheck" {
|
||||
description = "Hostname of API-USER-JAVA"
|
||||
value = "${azurerm_app_service.app_service_api-userjava.default_site_hostname}/api/healthcheck/user-java"
|
||||
}
|
||||
output "appServiceApiUserprofileHealthcheck" {
|
||||
description = "Hostname of API-USERPROFILE"
|
||||
value = "${azurerm_app_service.app_service_api-userprofile.default_site_hostname}/api/healthcheck/user"
|
||||
}
|
||||
20
iac/terraform/providers.tf
Normal file
20
iac/terraform/providers.tf
Normal file
@ -0,0 +1,20 @@
|
||||
terraform {
|
||||
required_providers {
|
||||
azurerm = {
|
||||
source = "hashicorp/azurerm"
|
||||
version = "2.96.0"
|
||||
}
|
||||
}
|
||||
backend "azurerm" {
|
||||
}
|
||||
}
|
||||
|
||||
provider "azurerm" {
|
||||
features {
|
||||
key_vault {
|
||||
purge_soft_delete_on_destroy = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
data "azurerm_client_config" "current" {}
|
||||
34
iac/terraform/smokeTest.ps1
Normal file
34
iac/terraform/smokeTest.ps1
Normal file
@ -0,0 +1,34 @@
|
||||
param(
|
||||
[Parameter(Mandatory)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[string[]] $HostNames = @()
|
||||
)
|
||||
|
||||
if (!(Get-Module -Name Pester)) {
|
||||
Write-Host "Pester module does not exist. Installing ..."
|
||||
try {
|
||||
Install-Module Pester -AllowClobber -Force -Confirm:$False -SkipPublisherCheck
|
||||
}
|
||||
catch [Exception] {
|
||||
$_.message
|
||||
exit
|
||||
}
|
||||
}
|
||||
Import-Module Pester
|
||||
|
||||
$container = New-PesterContainer `
|
||||
-Path 'appService.Test.ps1' `
|
||||
-Data @{ HostNames = $HostNames }
|
||||
|
||||
$config = New-PesterConfiguration
|
||||
$config.Run.PassThru = $true
|
||||
$config.Run.Container = $container
|
||||
$config.TestResult.Enabled = $true
|
||||
$config.TestResult.OutputFormat = 'NUnitXml'
|
||||
$config.TestResult.OutputPath = 'testResultsNunit.xml'
|
||||
|
||||
$p = Invoke-Pester -Configuration $config
|
||||
$p | Export-JUnitReport -Path 'testResultsJunit.xml'
|
||||
|
||||
|
||||
|
||||
1
iac/terraform/test.txt
Normal file
1
iac/terraform/test.txt
Normal file
@ -0,0 +1 @@
|
||||
test
|
||||
72
iac/terraform/variables.tf
Normal file
72
iac/terraform/variables.tf
Normal file
@ -0,0 +1,72 @@
|
||||
variable "location" {
|
||||
description = ""
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "uniquer" {
|
||||
description = ""
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "resources_prefix" {
|
||||
description = ""
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "docker_registry_server_url" {
|
||||
description = ""
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "docker_registry_server_username" {
|
||||
description = ""
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "docker_registry_server_password" {
|
||||
description = ""
|
||||
type = string
|
||||
default = null
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "mssql_server_administrator_login" {
|
||||
description = ""
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "mssql_server_administrator_login_password" {
|
||||
description = ""
|
||||
type = string
|
||||
default = null
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "apipoi_base_image_tag" {
|
||||
description = ""
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "apitrips_base_image_tag" {
|
||||
description = ""
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "apiuserjava_base_image_tag" {
|
||||
description = ""
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "apiuserprofile_base_image_tag" {
|
||||
description = ""
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
Reference in New Issue
Block a user