Work on Swarm/AWS infrastructure setup

Fine-tune the Terraform configurations. Rework the Docker Compose file for deploying containers onto the swarm cluster.

Environment is still non-functional.

Signed-off-by: Scott Lowe <scott.lowe@scottlowe.org>

traefik/compute.tf

@@ -3,7 +3,7 @@ resource "aws_instance" "manager" {
     ami                     = "${data.aws_ami.f26_atomic_ami.id}"
     instance_type           = "${var.mgr_flavor}"
     key_name                = "${var.keypair}"
-    vpc_security_group_ids  = ["${aws_security_group.web_sg.id}"]
+    vpc_security_group_ids  = ["${aws_security_group.mgmt_sg.id}"]
     subnet_id               = "${aws_subnet.traefik_pub_subnet.id}"
     depends_on              = ["aws_internet_gateway.traefik_gw"]
     tags {

traefik/docker-stack.yml

@@ -1,53 +1,46 @@
 version: "3"
 
 services:
-  wordpress:
-    image: wordpress:php7.1-apache
-    ports:
-      - 8080:80
+  proxy:
+    image: traefik
+    command: --web --docker --logLevel=DEBUG
     networks:
-      - common
-    depends_on:
-      - dbcluster
-    deploy:
-      replicas: 2
-      update_config:
-        parallelism: 2
-        delay: 10s
-      restart_policy:
-        condition: on-failure
-    environment:
-      WORDPRESS_DB_HOST: "dbcluster"
-      WORDPRESS_DB_NAME: "wordpress"
-      WORDPRESS_DB_USER: "wp"
-      WORDPRESS_DB_PASSWORD: "changemetoo"
-  dbcluster:
-    image: toughiq/mariadb-cluster
-    networks:
-      - common
-    deploy:
-      replicas: 1
-      update_config:
-        parallelism: 2
-        delay: 10s
-      restart_policy:
-        condition: on-failure
-    environment:
-      DB_SERVICE_NAME: dbcluster 
-      MYSQL_ROOT_PASSWORD: changeme 
-      MYSQL_DATABASE: wordpress 
-      MYSQL_USER: wp 
-      MYSQL_PASSWORD: changemetoo 
-  visualizer:
-    image: dockersamples/visualizer:stable
+      - webgateway
     ports:
-      - "8888:8080"
-    stop_grace_period: 1m30s
+      - "80:80"
+      - "8080:8080"
     volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock"
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /dev/null:/traefik.toml
     deploy:
       placement:
         constraints: [node.role == manager]
-
+  web-dev:
+    image: "slowe/flask-demo-app:1.0"
+    networks:
+      - webgateway
+    ports:
+      - "5000:5000"
+    labels:
+      - "traefik.backend=web-dev"
+      - "traefik.frontend.rule=Host:web-dev.learningtools.local"
+    deploy:
+      replicas: 2
+      placement:
+        constraints: [node.role == worker]
+  web-prod:
+    image: "slowe/flask-demo-app:1.0"
+    networks:
+      - webgateway
+    ports:
+      - "5001:5001"
+    labels:
+      - "traefik.backend=web-prod"
+      - "traefik.frontend.rule=Host:web-prod.learningtools.local"
+    deploy:
+      replicas: 2
+      placement:
+        constraints: [node.role == worker]
 networks:
-  common:
+  webgateway:
+    driver: bridge

traefik/security.tf

@@ -40,3 +40,58 @@ resource "aws_security_group" "web_sg" {
         area                = "security"
     }
 }
+
+# Create a security group to allow inbound Docker management traffic
+resource "aws_security_group" "mgmt_sg" {
+    vpc_id                  = "${aws_vpc.traefik_vpc.id}"
+    name                    = "mgmt_sg"
+    description             = "Security group for inbound Docker management traffic"
+    ingress {
+        from_port           = "0"
+        to_port             = "0"
+        protocol            = "-1"
+        cidr_blocks         = ["${aws_vpc.traefik_vpc.cidr_block}"]
+    }
+    ingress {
+        from_port           = "8080"
+        to_port             = "8080"
+        protocol            = "tcp"
+        cidr_blocks         = ["0.0.0.0/0"]
+    }
+    ingress {
+        from_port           = "80"
+        to_port             = "80"
+        protocol            = "tcp"
+        cidr_blocks         = ["0.0.0.0/0"]
+    }
+    ingress {
+        from_port           = "22"
+        to_port             = "22"
+        protocol            = "tcp"
+        cidr_blocks         = ["0.0.0.0/0"]
+    }
+    ingress {
+        from_port           = "2376"
+        to_port             = "2377"
+        protocol            = "tcp"
+        cidr_blocks         = ["0.0.0.0/0"]
+    }
+    ingress {
+        from_port           = "3376"
+        to_port             = "3377"
+        protocol            = "tcp"
+        cidr_blocks         = ["0.0.0.0/0"]
+    }
+    egress {
+        from_port           = "0"
+        to_port             = "0"
+        protocol            = "-1"
+        cidr_blocks         = ["0.0.0.0/0"]
+    }
+    tags {
+        Name                = "mgmt_sg"
+        tool                = "terraform"
+        demo                = "traefik"
+        area                = "security"
+    }
+}