mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-08 15:41:15 +02:00
Chris Lu
a10607f90a
* terraform: add cloud-agnostic core renderer module Renders per-node weed argv, systemd units, config files, disk-mount and secret-fetch scripts, and cloud-init from an address map. Creates zero cloud resources. Flags verified against the weed binary: volume uses -mserver for the master list, gRPC is -port.grpc (auto http+10000), minFreeSpacePercent is a string, filer store via -defaultStoreDir. * terraform: add mTLS and JWT security module Generates the CA, per-component certs with distinct CNs, and JWT signing keys via the tls/random providers. Emits a core_security object plus PEMs for secret-store delivery. * terraform: add AWS deployment module and examples Reserves stable ENIs first, renders config via the core, then creates instances, prevent_destroy EBS data disks mounted at /data, and the cluster security group. With enable_security, generates certs/JWT, stores them in SSM SecureString, grants an instance role, and fetches them at boot so secrets stay out of user_data. Keyed for_each on every stateful tier. * terraform: add local cluster test harnesses run_local_cluster.sh and run_local_secure.sh render a cluster with the core and run real weed processes, asserting master quorum, volume registration, filer/s3 round-trips, mutual-TLS formation, and JWT enforcement. Use an isolated high port range with a guard so they never touch a cluster already running on the machine. The weed binary defaults to $(go env GOPATH)/bin/weed. * terraform: add CI workflow and README fmt/validate/tofu-test plus smoke jobs that build weed and run both harnesses. * terraform: guard against empty filesystem UUID in mount script An empty UUID made grep -q match any fstab line, skipping the fstab entry and breaking the mount. Fail fast when blkid returns no UUID. * terraform: sanitize cluster name in WEED_CLUSTER env keys Hyphens or spaces in cluster_name produced invalid systemd/bash env var names; map non-alphanumerics to underscores. * terraform: omit empty jwt.signing block from security.toml With enable_security and no JWT key, the template emitted [jwt.signing] key="". Gate the block on a non-empty key and cover it with a test. * terraform: mark core security input as sensitive The security object carries JWT signing keys; keep them out of plan output and known values. * terraform: enforce jwt_length minimum of 32 * terraform: note region/AZ coupling in HA example * terraform: guard WORKDIR before recursive delete in test harnesses * terraform: fix README fence language and test count * terraform: handle embedded s3 with no filer nodes Indexing sort(keys(var.filers))[0] errored at plan time when embedded S3 was enabled but no filers were defined; fall back to an empty config source. * terraform: scope kms:Decrypt to a configurable key arn Replace the hardcoded Resource="*" with a kms_key_arn variable (default "*") so production can restrict decrypt to a specific CMK. * terraform: encrypt EBS data volumes at rest Set encrypted = true on the volume/filer data disks and the all-in-one example disk. * terraform: protect filer instances from API termination Filers hold the leveldb2 metadata store, so they are stateful and get the same disable_api_termination as masters and volumes. * terraform: stop instance before detaching in all-in-one example * terraform: drop stale references to the removed plan doc * terraform: correct stale mount-step comment in aws module * terraform: mark Terraform support as experimental in README
134 lines
3.1 KiB
Terraform
134 lines
3.1 KiB
Terraform
# SeaweedFS all-in-one on a single AWS instance.
|
|
#
|
|
# Demonstrates the layered design directly: call the cloud-agnostic core to
|
|
# render cloud-init for a `weed server` node, then attach it to one instance
|
|
# with a protected data disk. No wrapper module needed for the simple case.
|
|
#
|
|
# tofu init && tofu validate
|
|
# tofu apply # requires AWS credentials + a weed AMI
|
|
|
|
terraform {
|
|
required_version = ">= 1.3.0"
|
|
required_providers {
|
|
aws = {
|
|
source = "hashicorp/aws"
|
|
version = ">= 5.40"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "aws" {
|
|
region = var.region
|
|
}
|
|
|
|
variable "region" {
|
|
type = string
|
|
default = "us-east-1"
|
|
}
|
|
variable "vpc_id" {
|
|
type = string
|
|
}
|
|
variable "subnet_id" {
|
|
type = string
|
|
}
|
|
variable "availability_zone" {
|
|
type = string
|
|
default = "us-east-1a"
|
|
}
|
|
variable "ami_id" {
|
|
type = string
|
|
}
|
|
variable "private_ip" {
|
|
type = string
|
|
default = "10.0.1.50"
|
|
}
|
|
|
|
module "core" {
|
|
source = "../../modules/core"
|
|
weed_binary = "/usr/bin/weed"
|
|
|
|
# disable the distributed tiers; run a single all-in-one process
|
|
master = { enabled = false }
|
|
volume = { enabled = false }
|
|
filer = { enabled = false }
|
|
|
|
all_in_one = {
|
|
enabled = true
|
|
nodes = { a0 = { address = var.private_ip, data_dir = "/data" } }
|
|
s3 = { enabled = true }
|
|
}
|
|
|
|
s3_identities = [{
|
|
name = "anonymous"
|
|
access_key = ""
|
|
secret_key = ""
|
|
actions = ["Read", "List"]
|
|
}]
|
|
}
|
|
|
|
resource "aws_network_interface" "aio" {
|
|
subnet_id = var.subnet_id
|
|
private_ips = [var.private_ip]
|
|
security_groups = [aws_security_group.aio.id]
|
|
tags = { Name = "seaweedfs-all-in-one" }
|
|
}
|
|
|
|
resource "aws_security_group" "aio" {
|
|
name_prefix = "seaweedfs-aio-"
|
|
vpc_id = var.vpc_id
|
|
lifecycle {
|
|
create_before_destroy = true
|
|
}
|
|
}
|
|
|
|
resource "aws_vpc_security_group_ingress_rule" "s3" {
|
|
security_group_id = aws_security_group.aio.id
|
|
cidr_ipv4 = "10.0.0.0/8"
|
|
ip_protocol = "tcp"
|
|
from_port = 8333
|
|
to_port = 8333
|
|
}
|
|
|
|
resource "aws_vpc_security_group_egress_rule" "all" {
|
|
security_group_id = aws_security_group.aio.id
|
|
cidr_ipv4 = "0.0.0.0/0"
|
|
ip_protocol = "-1"
|
|
}
|
|
|
|
resource "aws_instance" "aio" {
|
|
ami = var.ami_id
|
|
instance_type = "m5.large"
|
|
user_data = module.core.cloud_init_by_node["all-in-one-a0"]
|
|
|
|
network_interface {
|
|
network_interface_id = aws_network_interface.aio.id
|
|
device_index = 0
|
|
}
|
|
metadata_options {
|
|
http_tokens = "required"
|
|
}
|
|
tags = { Name = "seaweedfs-all-in-one", Role = "all-in-one" }
|
|
}
|
|
|
|
resource "aws_ebs_volume" "data" {
|
|
availability_zone = var.availability_zone
|
|
size = 200
|
|
type = "gp3"
|
|
encrypted = true
|
|
tags = { Name = "seaweedfs-all-in-one-data" }
|
|
lifecycle {
|
|
prevent_destroy = true
|
|
}
|
|
}
|
|
|
|
resource "aws_volume_attachment" "data" {
|
|
device_name = "/dev/xvdf"
|
|
volume_id = aws_ebs_volume.data.id
|
|
instance_id = aws_instance.aio.id
|
|
stop_instance_before_detaching = true
|
|
}
|
|
|
|
output "instance_id" {
|
|
value = aws_instance.aio.id
|
|
}
|