Skip to content

Commit 85790d6

Browse files
anarwalanarwal
committed
add s3 bucket for backup and switch to using vpc_security_group for ec2 instances
1 parent 57a50f3 commit 85790d6

File tree

9 files changed

+58
-27
lines changed

9 files changed

+58
-27
lines changed

‎README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ module "gitlab" {
4242
gitlab_lfs_s3_bucket_name = var.gitlab_lfs_s3_bucket_name
4343
gitlab_packages_s3_bucket_name = var.gitlab_packages_s3_bucket_name
4444
gitlab_registry_s3_bucket_name = var.gitlab_registry_s3_bucket_name
45+
gitlab_backup_s3_bucket_name = var.gitlab_backup_s3_bucket_name
46+
gitlab_kms_alias = var.gitlab_kms_alias
4547
}
4648
```
4749

@@ -59,6 +61,7 @@ module "gitlab" {
5961
| gitlab_lfs_s3_bucket_name | Name of Gitlab LFS S3 bucket | `string`| "" | yes |
6062
| gitlab_packages_s3_bucket_name | Name of Gitlab Packages S3 bucket | `string`| "" | yes |
6163
| gitlab_registry_s3_bucket_name | Name of Gitlab Registry S3 bucket | `string`| "" | yes |
64+
| gitlab_backup_s3_bucket_name | Name of Gitlab Backup S3 bucket | `string`| "" | yes |
6265
| dns_name | Domain name for which the certificate should be issued | `string`| "" | yes |
6366
| domain_name | ALB record53 entry domain name | `string`| "" | yes |
6467
| public_subnet_id | List of public subnet IDs to attach | `list` | `<list>` | yes |
@@ -73,7 +76,7 @@ module "gitlab" {
7376
| gitlab_alb_ideal_timeout | Time in seconds that the connection is allowed to be idle. | `number`| `60` | no |
7477
| gitlab_application_ami | AMI of gitlab application to be used with Gitlab instance. | `string`| "" | yes |
7578
| zone_id | ID of the hosted zone to contain Route53 record. | `string`| "" | yes |
76-
| alias | Display name of KMS Key alias. Name must start with the word `alias` followed by a forward slash | `string`| `alias/gitlab-kms` | no |
79+
| gitlab_kms_alias | Display name of KMS Key alias. Name must start with the word `alias` followed by a forward slash | `string`| "" | yes |
7780
| enable_key_rotation | Specifies whether key rotation is enabled | `bool` | `true` | no |
7881
| ssh_key_name | SSH key for ec2 ssh | `string`| "" | yes |
7982

‎module/single-node-omnibus/bastion.tf‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
resource "aws_instance" "bastion" {
2-
instance_type = "t2.micro"
3-
subnet_id = data.aws_subnet.public_selected.id
4-
security_groups = [aws_security_group.external_ssh.id]
5-
key_name = var.ssh_key_name
6-
ami = data.aws_ami.centos.id
7-
volume_tags = { "Name" = format("%s-bastion-ebs", module.gitlab_label.name), "Environment" = module.gitlab_label.stage}
8-
tags = { "Name" = format("%s-bastion", module.gitlab_label.name), "Environment" = module.gitlab_label.stage}
2+
instance_type = "t2.micro"
3+
subnet_id = data.aws_subnet.public_selected.id
4+
vpc_security_group_ids = [aws_security_group.external_ssh.id]
5+
key_name = var.ssh_key_name
6+
ami = data.aws_ami.centos.id
7+
volume_tags = { "Name" = format("%s-bastion-ebs", module.gitlab_label.name), "Environment" = module.gitlab_label.stage}
8+
tags = { "Name" = format("%s-bastion", module.gitlab_label.name), "Environment" = module.gitlab_label.stage}
99
}
1010

1111
resource "aws_eip" "bastion" {

‎module/single-node-omnibus/ec2.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ resource "aws_instance" "gitlab_application" {
22
ami = var.gitlab_application_ami
33
instance_type = "m4.xlarge"
44
subnet_id = data.aws_subnet.private_selected.id
5-
security_groups = flatten([aws_security_group.internal_ssh.id ,aws_security_group.internal_gitlab.id])
5+
vpc_security_group_ids = flatten([aws_security_group.internal_ssh.id ,aws_security_group.internal_gitlab.id])
66
key_name = var.ssh_key_name
77
user_data = data.template_cloudinit_config.config.rendered
88
associate_public_ip_address = false

‎module/single-node-omnibus/iam.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ EOF
6767
}
6868

6969
resource "aws_iam_role" "dlm_lifecycle_role" {
70-
name = "dlm-lifecycle-role"
70+
name = format("%s-role",module.gitlab_label.id)
7171

7272
assume_role_policy = <<EOF
7373
{
@@ -86,8 +86,8 @@ resource "aws_iam_role" "dlm_lifecycle_role" {
8686
EOF
8787
}
8888

89-
resource "aws_iam_role_policy" "dlm_lifecycle" {
90-
name = "dlm-lifecycle-policy"
89+
resource "aws_iam_role_policy" "dlm_lifecycle_policy" {
90+
name = format("%s-role-policy",module.gitlab_label.id)
9191
role = aws_iam_role.dlm_lifecycle_role.id
9292

9393
policy = <<EOF

‎module/single-node-omnibus/kms.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@ resource "aws_kms_key" "gitlab_kms_key" {
66
}
77

88
resource "aws_kms_alias" "gitlab_kms_key_alias" {
9-
name = coalesce(var.alias, format("alias/%v", module.gitlab_label.id))
9+
name = coalesce(var.gitlab_kms_alias, format("alias/%v", module.gitlab_label.id))
1010
target_key_id = aws_kms_key.gitlab_kms_key.key_id
1111
}

‎module/single-node-omnibus/local-resources.tf‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,18 +30,19 @@ data "template_file" "gitlab_application_user_data" {
3030
template = "${file("${path.module}/templates/gitlab_application_user_data.tpl")}"
3131

3232
vars = {
33-
git_data_disk = "${var.gitlab_data_disk_device_name}"
34-
git_data_disk_mount_point = "${var.git_data_directory}"
35-
s3_bucket_name = "${var.gitlab_artifactory_s3_bucket_name}"
33+
git_data_disk = var.gitlab_data_disk_device_name
34+
git_data_disk_mount_point = var.git_data_directory
35+
s3_bucket_name = var.gitlab_artifactory_s3_bucket_name
3636
s3_bucket_provider = "AWS"
3737
s3_bucket_region = "us-east-1"
38-
s3_bucket_user_access_key = "${aws_iam_access_key.s3_access_key.id}"
39-
s3_bucket_user_secret_key = "${aws_iam_access_key.s3_access_key.secret}"
40-
artifactory_s3_bucket_name = "${var.gitlab_artifactory_s3_bucket_name}"
41-
lfs_s3_bucket_name = "${var.gitlab_lfs_s3_bucket_name}"
42-
packages_s3_bucket_name = "${var.gitlab_packages_s3_bucket_name}"
43-
registry_s3_bucket_name = "${var.gitlab_registry_s3_bucket_name}"
44-
domain_name = "${var.domain_name}"
38+
s3_bucket_user_access_key = aws_iam_access_key.s3_access_key.id
39+
s3_bucket_user_secret_key = aws_iam_access_key.s3_access_key.secret
40+
artifactory_s3_bucket_name = var.gitlab_artifactory_s3_bucket_name
41+
lfs_s3_bucket_name = var.gitlab_lfs_s3_bucket_name
42+
packages_s3_bucket_name = var.gitlab_packages_s3_bucket_name
43+
registry_s3_bucket_name = var.gitlab_registry_s3_bucket_name
44+
backup_s3_bucket_name = var.gitlab_backup_s3_bucket_name
45+
domain_name = var.domain_name
4546
}
4647
}
4748

‎module/single-node-omnibus/s3.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,4 +88,27 @@ resource "aws_s3_bucket" "gitlab_registry_s3_bucket" {
8888
}
8989

9090
tags = merge(module.gitlab_label.tags, {"Bucket-Name" = format("%s-%s",module.gitlab_label.id, var.gitlab_registry_s3_bucket_name)})
91+
}
92+
93+
# ---------------------------------------------------------------------------------------------------------------------------------------------
94+
# Create Backup S3 bucket
95+
# ---------------------------------------------------------------------------------------------------------------------------------------------
96+
resource "aws_s3_bucket" "gitlab_backup_s3_bucket" {
97+
bucket = format("%s-%s",module.gitlab_label.id, var.gitlab_backup_s3_bucket_name)
98+
acl = "private"
99+
force_destroy = var.force_destroy_s3_bucket
100+
101+
server_side_encryption_configuration {
102+
rule {
103+
apply_server_side_encryption_by_default {
104+
sse_algorithm = "AES256"
105+
}
106+
}
107+
}
108+
109+
versioning {
110+
enabled = true
111+
}
112+
113+
tags = merge(module.gitlab_label.tags, {"Bucket-Name" = format("%s-%s",module.gitlab_label.id, var.gitlab_backup_s3_bucket_name)})
91114
}

‎module/single-node-omnibus/templates/gitlab_application_user_data.sh‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,5 +48,4 @@ registry['storage'] = {'s3' => {'accesskey' => '${s3_bucket_user_access_key}','s
4848
####! Docs: https://docs.gitlab.com/omnibus/settings/configuration.html#storing-git-data-in-an-alternative-directory
4949
git_data_dirs({'default' => { 'path' => '${git_data_disk_mount_point}'}}) " >> /etc/gitlab/gitlab.rb
5050

51-
5251
sudo gitlab-ctl reconfigure

‎module/single-node-omnibus/templates/gitlab_application_user_data.tpl‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ bootcmd:
55
- sudo mkdir -p /etc/gitlab/ssl
66
- sudo chmod 700 /etc/gitlab/ssl
77
- sudo openssl req -newkey rsa:2048 -nodes -keyout /etc/gitlab/ssl/gitlabssl.key -x509 -days 3650 -out /etc/gitlab/ssl/gitlabssl.crt -subj "/CN=${domain_name}"
8-
- sudo chmod 0400 /etc/gitlab/ssl/gitlabssl.*
8+
- sudo chmod 600 /etc/gitlab/ssl/gitlabssl.*
99
write_files:
1010
- content: |
1111
####! External_Url
@@ -42,8 +42,13 @@ write_files:
4242
####! For setting up different data storing directory
4343
####! Docs: https://docs.gitlab.com/omnibus/settings/configuration.html#storing-git-data-in-an-alternative-directory
4444
git_data_dirs({'default' => { 'path' => '${git_data_disk_mount_point}'}})
45+
####! Backup Settings
46+
####! Docs: https://docs.gitlab.com/omnibus/settings/backups.html
47+
gitlab_rails['backup_upload_connection'] = {'provider' => '${s3_bucket_provider}', 'region' => '${s3_bucket_region}', 'aws_access_key_id' => '${s3_bucket_user_access_key}', 'aws_secret_access_key' => '${s3_bucket_user_secret_key}'}
48+
gitlab_rails['backup_upload_remote_directory'] = "${backup_s3_bucket_name}"
4549
path: /etc/gitlab/gitlab.rb
4650
permissions: '0600'
4751
runcmd:
48-
- [ mount, ${git_data_disk}, ${git_data_disk_mount_point} ]
49-
- [ gitlab-ctl, reconfigure ]
52+
- [mount, ${git_data_disk}, ${git_data_disk_mount_point}]
53+
- [chown, -R, "git:git", ${git_data_disk_mount_point}]
54+
- [gitlab-ctl, reconfigure]

0 commit comments

Comments
 (0)