forked from coder/coder
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathaws-rds.tf
More file actions
170 lines (141 loc) · 3.91 KB
/
aws-rds.tf
File metadata and controls
170 lines (141 loc) · 3.91 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
# RDS PostgreSQL instance for Coder persistent storage
# Variables
variable "vpc_id" {
description = "VPC ID where resources will be created"
type = string
default = null # Will use default VPC if not specified
}
variable "subnet_ids" {
description = "List of subnet IDs for RDS (private subnets recommended)"
type = list(string)
default = null # Will auto-discover if not specified
}
variable "db_username" {
description = "Database username"
type = string
default = "coder"
}
variable "db_password" {
description = "Database password"
type = string
sensitive = true
}
# Data sources to get default VPC and subnets if not provided
data "aws_vpc" "default" {
count = var.vpc_id == null ? 1 : 0
default = true
}
data "aws_subnets" "default" {
count = var.subnet_ids == null ? 1 : 0
filter {
name = "vpc-id"
values = [local.vpc_id]
}
}
locals {
vpc_id = var.vpc_id != null ? var.vpc_id : data.aws_vpc.default[0].id
subnet_ids = var.subnet_ids != null ? var.subnet_ids : data.aws_subnets.default[0].ids
}
# DB subnet group
resource "aws_db_subnet_group" "coder_db_subnet_group" {
name = "coder-db-subnet-group"
subnet_ids = local.subnet_ids
tags = {
Name = "Coder DB subnet group"
}
}
# Security group for RDS
resource "aws_security_group" "coder_rds_sg" {
name_prefix = "coder-rds-"
vpc_id = local.vpc_id
ingress {
from_port = 5432
to_port = 5432
protocol = "tcp"
security_groups = [aws_security_group.coder_ecs_sg.id]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = {
Name = "Coder RDS Security Group"
}
}
# Security group for ECS (to be referenced in ECS service)
resource "aws_security_group" "coder_ecs_sg" {
name_prefix = "coder-ecs-"
vpc_id = local.vpc_id
ingress {
from_port = 3000
to_port = 3000
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
tags = {
Name = "Coder ECS Security Group"
}
}
# RDS PostgreSQL instance
resource "aws_db_instance" "coder_postgres" {
identifier = "coder-postgres"
# Engine configuration
engine = "postgres"
engine_version = "15"
instance_class = "db.t3.micro"
# Storage configuration
allocated_storage = 20
max_allocated_storage = 100
storage_type = "gp2"
storage_encrypted = true
# Database configuration
db_name = "coder"
username = var.db_username
password = var.db_password
port = 5432
# Network configuration
db_subnet_group_name = aws_db_subnet_group.coder_db_subnet_group.name
vpc_security_group_ids = [aws_security_group.coder_rds_sg.id]
publicly_accessible = false
# Backup configuration
backup_retention_period = 7
backup_window = "03:00-04:00"
maintenance_window = "sun:04:00-sun:05:00"
# Operational configuration
skip_final_snapshot = false
final_snapshot_identifier = "coder-postgres-final-snapshot"
deletion_protection = true
tags = {
Name = "Coder PostgreSQL Database"
}
}
# Outputs
output "rds_endpoint" {
description = "RDS instance endpoint"
value = aws_db_instance.coder_postgres.endpoint
}
output "rds_port" {
description = "RDS instance port"
value = aws_db_instance.coder_postgres.port
}
output "database_url" {
description = "PostgreSQL connection URL for Coder"
value = "postgresql://${var.db_username}:${var.db_password}@${aws_db_instance.coder_postgres.endpoint}/coder"
sensitive = true
}
output "ecs_security_group_id" {
description = "Security group ID for ECS service"
value = aws_security_group.coder_ecs_sg.id
}
output "rds_security_group_id" {
description = "Security group ID for RDS instance"
value = aws_security_group.coder_rds_sg.id
}