Module 12 #12
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -106,6 +106,14 @@ $ docker run --env-file .env todo-app:test e2e_tests | |
|
|
||
| # Deploying the application | ||
|
|
||
| The application is deployed with azure and is accessible at https://prod-charlie-devops-to-do.azurewebsites.net/ | ||
|
There was a problem hiding this comment. Not sure if you changed your plan, but I was actually able to access it at: |
||
|
|
||
| New deployments are automatically triggered when commits are made to the main branch. | ||
|
|
||
| # Terraform | ||
|
|
||
| Running terraform locally requires that an access secret is first loaded from the keyvault. This can be done as follows: | ||
| ```bash | ||
| $ az login | ||
| $ export ARM_ACCESS_KEY=$(az keyvault secret show --name terraform-backend-key --vault-name to-do-app --query value -o tsv) | ||
| ``` | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| terraform { | ||
| required_providers { | ||
| azurerm = { | ||
| source = "hashicorp/azurerm" | ||
| version = ">= 2.49" | ||
| } | ||
| } | ||
| backend "azurerm" { | ||
| resource_group_name = "SoftwirePilot_CharlieCumber_ProjectExercise" | ||
| storage_account_name = "tfstater1khr" | ||
| container_name = "tfstate" | ||
| key = "terraform.tfstate" | ||
| } | ||
| } | ||
|
|
||
| provider "azurerm" { | ||
| features {} | ||
| } | ||
|
|
||
| data "azurerm_resource_group" "main" { | ||
| name = "SoftwirePilot_CharlieCumber_ProjectExercise" | ||
| } | ||
|
|
||
| resource "azurerm_app_service_plan" "main" { | ||
| name = "${var.prefix}terraformed-asp" | ||
| location = data.azurerm_resource_group.main.location | ||
| resource_group_name = data.azurerm_resource_group.main.name | ||
| kind = "Linux" | ||
| reserved = true | ||
| sku { | ||
| tier = "Basic" | ||
| size = "B1" | ||
| } | ||
| } | ||
|
|
||
| resource "azurerm_cosmosdb_account" "main" { | ||
| name = "${var.prefix}charlie-devops-cosmosdb-account" | ||
| resource_group_name = data.azurerm_resource_group.main.name | ||
| kind = "MongoDB" | ||
| location = data.azurerm_resource_group.main.location | ||
| geo_location { | ||
| location = data.azurerm_resource_group.main.location | ||
| failover_priority = 0 | ||
| } | ||
| consistency_policy { | ||
| consistency_level = "Session" | ||
| } | ||
| offer_type = "Standard" | ||
| capabilities { | ||
| name = "EnableServerless" | ||
| } | ||
| capabilities { | ||
| name = "EnableMongo" | ||
| } | ||
| lifecycle { | ||
| prevent_destroy = true | ||
| } | ||
| } | ||
|
|
||
| resource "azurerm_cosmosdb_mongo_database" "main" { | ||
| name = "${var.prefix}charlie-devops-cosmos-mongo-db" | ||
| resource_group_name = data.azurerm_resource_group.main.name | ||
| account_name = azurerm_cosmosdb_account.main.name | ||
| } | ||
|
|
||
| resource "azurerm_app_service" "main" { | ||
| name = "charlie-devops-to-do-terraform" | ||
|
There was a problem hiding this comment. It's good practice to prefix everything, that way you can tell what's terraformed and can have multiple instances of the infrastructure. |
||
| location = data.azurerm_resource_group.main.location | ||
| resource_group_name = data.azurerm_resource_group.main.name | ||
| app_service_plan_id = azurerm_app_service_plan.main.id | ||
| site_config { | ||
| app_command_line = "" | ||
| linux_fx_version = "DOCKER|charliecumber/todo-app:latest" | ||
| } | ||
| app_settings = { | ||
| MONGODB_CONNECTION_STRING = "mongodb://${azurerm_cosmosdb_account.main.name}:${azurerm_cosmosdb_account.main.primary_key}@${azurerm_cosmosdb_account.main.name}.mongo.cosmos.azure.com:10255" | ||
| MONGODB_DATABASE_NAME = var.MONGODB_DATABASE_NAME | ||
| DOCKER_REGISTRY_SERVER_URL = "https://index.docker.io/v1" | ||
| DOCKER_ENABLE_CI = true | ||
| AUTH_CLIENT_ID = var.AUTH_CLIENT_ID | ||
| AUTH_CLIENT_SECRET = var.AUTH_CLIENT_SECRET | ||
| SECRET_KEY = var.SECRET_KEY | ||
| OAUTHLIB_INSECURE_TRANSPORT = 1 | ||
| } | ||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| output "cd_webhook" { | ||
| value = "https://${azurerm_app_service.main.site_credential[0].username}:${azurerm_app_service.main.site_credential[0].password}@${azurerm_app_service.main.name}.scm.azurewebsites.net/docker/hook" | ||
|
There was a problem hiding this comment. We should mark this output as sensitive since it contains a password - that way Terraform will avoid logging it unless explicitly told to |
||
| } | ||
|
Comment on lines
+1
to
+3
There was a problem hiding this comment. Should be marked as You can change the password in the Azure portal, go to the App Service -> Container settings (Classic) -> FTPS credentials -> Application scope and reset the password. |
||
|
|
||
| output "webapp_url" { | ||
| value = "https://${azurerm_app_service.main.default_site_hostname}" | ||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| resource "random_string" "resource_code" { | ||
|
There was a problem hiding this comment. We wouldn't usually track the storage account for the terraform state in terraform - you can't safely create the account until there's somewhere to store state, and obviously you can't create the state until the storage account exists. If you now tried to rename one of these resources, causing a destroy/recreate, then we'd lose the existing state. Curious to know if you disagree and there is some clever workaround/solution for this |
||
| length = 5 | ||
| special = false | ||
| upper = false | ||
| } | ||
|
|
||
| resource "azurerm_storage_account" "tfstate" { | ||
| name = "tfstate${random_string.resource_code.result}" | ||
|
There was a problem hiding this comment. You don't normally manage Terraform's backend state with Terraform. It means you can't recreate everything with one terraform apply, and can't use workspaces for different environments. If you delete this file you'll need to remove these objects from the state so Terraform doesn't destroy them, e.g. |
||
| resource_group_name = data.azurerm_resource_group.main.name | ||
| location = data.azurerm_resource_group.main.location | ||
| account_tier = "Standard" | ||
| account_replication_type = "LRS" | ||
| allow_blob_public_access = true | ||
| } | ||
|
|
||
| resource "azurerm_storage_container" "tfstate" { | ||
| name = "tfstate" | ||
| storage_account_name = azurerm_storage_account.tfstate.name | ||
| container_access_type = "blob" | ||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| variable "prefix" { | ||
| description = "The prefix used for all resources in this environment" | ||
| default = "prod-" | ||
| } | ||
|
|
||
| variable "location" { | ||
| description = "The Azure location where all resources in this deployment should be created" | ||
| default = "uksouth" | ||
| } | ||
|
|
||
| variable "AUTH_CLIENT_ID" { | ||
| description = "GitHub client ID for authentication." | ||
| } | ||
|
|
||
| variable "AUTH_CLIENT_SECRET" { | ||
| description = "GitHub client secret for authentication." | ||
|
There was a problem hiding this comment. As with the outputs, we should mark any sensitive input variables as such to avoid them potentially being printed out in logging anywhere |
||
| } | ||
|
|
||
| variable "SECRET_KEY" { | ||
| description = "The Azure secret key" | ||
| } | ||
|
Comment on lines
+15
to
+21
There was a problem hiding this comment. These should both be marked as (Also the SECRET_KEY is for signing Flask's session cookies, not really Azure related) |
||
|
|
||
| variable "MONGODB_DATABASE_NAME" { | ||
| description = "Name of default database" | ||
| default = "main" | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
https://charlie-devops-to-do-terraform.azurewebsites.net/