What I did during COVID-19

data "aws_availability_zones" "available" {
    state = "available" # gets us the availability zonse we can use that are available to our account
}

data "aws_caller_identity" "current" {} # gives us our account information. This helps us build unique resources.

data "aws_region" "current" {} # sets the region we are in.

locals {
    name = "${var.environment}-${var.name}" # sets a local name for use later
    env_dns_prefix = var.environment != "master" ? "${var.environment}." : "" # sets a prefix for various environments that we use later for individual dev environemnts, staging and production
    image_tag = var.environment == "master" ? "latest" : "staging" # sets the image tag for use later
    common_tags = { # common tags we can use for all of the different resources that support tags
        Name                                  = local.name
        Purpose                               = "gettestedcovid19 infra"
        environment                           = var.environment
    }
}

module "saas_vpc" {
  source = "terraform-aws-modules/vpc/aws"

  name = local.name # using our local name set above
  cidr = var.vpc_cidr # we set a variable for a CIDR range and use it here

  azs             = ["${data.aws_availability_zones.available.names[0]}", "${data.aws_availability_zones.available.names[1]}", "${data.aws_availability_zones.available.names[2]}"] # this is our first use of a data source. In this case we use it to set the AZs we want to use
  private_subnets = [cidrsubnet(var.vpc_cidr, 3, 0), cidrsubnet(var.vpc_cidr, 3, 1), cidrsubnet(var.vpc_cidr, 3, 2)] # terraform has some built in functions. In this case we are using cidrsubnet to calculate the subnets for our public and private subnets in the vpc. More information found at https://www.terraform.io/docs/configuration/functions/cidrsubnet.html
  public_subnets  = [cidrsubnet(var.vpc_cidr, 3, 3), cidrsubnet(var.vpc_cidr, 3, 4), cidrsubnet(var.vpc_cidr, 3, 5)]

  enable_dns_hostnames = true # this is telling the VPC we want DNS hostnames. AWS can generate the hostnames for instances if this is enabled. I use it because it is a nice feature
  enable_nat_gateway   = true # NAT gateway is a feature AWS added a few years ago to manage the instance that provides internet access to the private subnet.  Previously you had to do this yourself
  single_nat_gateway   = true # Usually you want a NAT gateway in each public subnet to manage its own private subnet but the impact of the NAT going down is minimal

  tags = local.common_tags # sets the common tags we talked about before
}

module "fargate" {
  source  = "git@github.com:patrickpierson/terraform-aws-fargate.git" # my fork of this module
  name = "gtcv"
  environment = "${var.environment}"
  vpc_create = false # this module can create its own vpc but we are not using it
  vpc_external_id = module.saas_vpc.vpc_id # if it doesn't create its own vpc you specify which vpc to use here

  vpc_external_public_subnets_ids = module.saas_vpc.public_subnets # same as above, specify the subnets to use
  vpc_external_private_subnets_ids = module.saas_vpc.private_subnets
  default_action = "${local.env_dns_prefix}get-tested-covid19.org" # I added this in my fork. This was to allow the ALB to have a default action to send it to the correct target

  services = { # defining the services
    www = {
      task_definition = "service-templates/webserver-${local.image_tag}.json" # specifies which service template to use for the task definition
      container_port  = 3000 # the port the container is on
      cpu             = "256" # cpu resources
      memory          = "512" # memory resources
      replicas        = 1 # starting replica count. this changes with alarms later
      logs_retention_days      = 14 # number of days the cloudwatch logs store days
      health_check_interval = 30 # number of seconds between health checks
      health_check_path     = "/" # path to check for health
      acm_certificate_arn = "arn:aws:acm:us-east-1:${data.aws_caller_identity.current.account_id}:certificate/0713fcea-afdb-4d36-9804-f0ec4a221857" # Amazon Certificate generated outside of Terraform, provides the TLS cert for the ALB to use
      auto_scaling_max_replicas = 50 # max number of replicas for this task. This will allow us to handle 200,000 users
      auto_scaling_requests_per_target = 4000 # alarm metric that gets set to scale up the number of replicas
      host = "${local.env_dns_prefix}get-tested-covid19.org" # the host this target group will be sent from the ALB
    }
    api = {
      task_definition = "service-templates/api-${local.image_tag}.json"
      container_port  = 5000
      cpu             = "256"
      memory          = "512"
      replicas        = 1
      registry_retention_count = 15
      logs_retention_days      = 14
      health_check_interval = 30
      health_check_path     = "/ping"
      acm_certificate_arn = "arn:aws:acm:us-east-1:${data.aws_caller_identity.current.account_id}:certificate/0713fcea-afdb-4d36-9804-f0ec4a221857"
      auto_scaling_max_replicas = 50
      auto_scaling_requests_per_target = 4000
      host = "${local.env_dns_prefix}api.get-tested-covid19.org"
    }
  }
}

module "db" {
  source  = "terraform-aws-modules/rds-aurora/aws" # source is from the Terraform registry
  version = "~> 2.0"

  name                            = local.name

  engine                          = "aurora-postgresql" # sets the RDS engine we want
  engine_version                  = "11.6" # sets the RDS engine version number we want

  vpc_id                          = module.saas_vpc.vpc_id # sets the VPC we created already
  subnets                         = module.saas_vpc.private_subnets # sets the private subnets we want to use

  replica_count                   = 1 # right now we only need one replica
  allowed_cidr_blocks             = ["10.200.0.0/21"] # currently allowing the whole vpc but this could be scaled down
  instance_type                   = "db.t3.medium" # RDS instance size
  storage_encrypted               = true # setting the flag for encryption at rest
  apply_immediately               = true # RDS has a nice feature that changes to RDS can be applied during mataince windows. We are not using that
  monitoring_interval             = 10 # setting the granularity
  performance_insights_enabled    = true # enabeling additional metrics

  db_parameter_group_name         = local.name
  db_cluster_parameter_group_name = local.name

  enabled_cloudwatch_logs_exports = ["postgresql"]

  tags                            = local.common_tags
}

module "bastion" {
  source  = "philips-software/bastion/aws"
  version = "2.0.0"
  enable_bastion = true # this was weird to me. I am not sure what it does but figured we could set it to false and the bastion would go away until needed

  environment = var.environment
  project     = local.name

  aws_region = var.aws_region
  key_name   = "bastion" # outside of Terraform I setup a key name called bastion and saved it to S3 for devs to use
  subnet_id  = element(module.saas_vpc.public_subnets, 0) # this sets the bastion to use only one public subnet
  vpc_id     = module.saas_vpc.vpc_id
  tags = local.common_tags
}

data "template_file" "connection_txt" {
  template = file("${path.module}/templates/connection.txt.tpl")

  vars = { # these vars are the various pieces of information that pull from the bastion and rds modules
    environment                     = var.environment
    rds_cluster_endpoint            = module.db.this_rds_cluster_endpoint
    rds_cluster_instance_endpoints  = module.db.this_rds_cluster_instance_endpoints[0]
    rds_cluster_reader_endpoint     = module.db.this_rds_cluster_reader_endpoint
    rds_cluster_master_username     = module.db.this_rds_cluster_master_username
    rds_cluster_master_password     = module.db.this_rds_cluster_master_password
    bastion_public_ip               = module.bastion.public_ip
  }
}

resource "local_file" "connection_txt" {
  sensitive_content = data.template_file.connection_txt.rendered
  filename = "./connection.txt" # generates the local file of connection.txt for the dev to use
}