From db91b58b0b7258b4ffea2509fd4e5fd97b0a0f49 Mon Sep 17 00:00:00 2001 From: Scott Lowe Date: Sat, 9 Sep 2017 10:43:55 -0600 Subject: [PATCH] Work on Swarm/AWS infrastructure setup Fine-tune the Terraform configurations. Rework the Docker Compose file for deploying containers onto the swarm cluster. Environment is still non-functional. Signed-off-by: Scott Lowe --- traefik/compute.tf | 2 +- traefik/docker-stack.yml | 79 ++++++++++++++++++---------------------- traefik/security.tf | 55 ++++++++++++++++++++++++++++ 3 files changed, 92 insertions(+), 44 deletions(-) diff --git a/traefik/compute.tf b/traefik/compute.tf index 8c08464..4e47371 100644 --- a/traefik/compute.tf +++ b/traefik/compute.tf @@ -3,7 +3,7 @@ resource "aws_instance" "manager" { ami = "${data.aws_ami.f26_atomic_ami.id}" instance_type = "${var.mgr_flavor}" key_name = "${var.keypair}" - vpc_security_group_ids = ["${aws_security_group.web_sg.id}"] + vpc_security_group_ids = ["${aws_security_group.mgmt_sg.id}"] subnet_id = "${aws_subnet.traefik_pub_subnet.id}" depends_on = ["aws_internet_gateway.traefik_gw"] tags { diff --git a/traefik/docker-stack.yml b/traefik/docker-stack.yml index d36bcae..babc567 100644 --- a/traefik/docker-stack.yml +++ b/traefik/docker-stack.yml @@ -1,53 +1,46 @@ version: "3" services: - wordpress: - image: wordpress:php7.1-apache - ports: - - 8080:80 + proxy: + image: traefik + command: --web --docker --logLevel=DEBUG networks: - - common - depends_on: - - dbcluster - deploy: - replicas: 2 - update_config: - parallelism: 2 - delay: 10s - restart_policy: - condition: on-failure - environment: - WORDPRESS_DB_HOST: "dbcluster" - WORDPRESS_DB_NAME: "wordpress" - WORDPRESS_DB_USER: "wp" - WORDPRESS_DB_PASSWORD: "changemetoo" - dbcluster: - image: toughiq/mariadb-cluster - networks: - - common - deploy: - replicas: 1 - update_config: - parallelism: 2 - delay: 10s - restart_policy: - condition: on-failure - environment: - DB_SERVICE_NAME: dbcluster - MYSQL_ROOT_PASSWORD: changeme - MYSQL_DATABASE: wordpress - MYSQL_USER: wp - MYSQL_PASSWORD: changemetoo - visualizer: - image: dockersamples/visualizer:stable + - webgateway ports: - - "8888:8080" - stop_grace_period: 1m30s + - "80:80" + - "8080:8080" volumes: - - "/var/run/docker.sock:/var/run/docker.sock" + - /var/run/docker.sock:/var/run/docker.sock + - /dev/null:/traefik.toml deploy: placement: constraints: [node.role == manager] - + web-dev: + image: "slowe/flask-demo-app:1.0" + networks: + - webgateway + ports: + - "5000:5000" + labels: + - "traefik.backend=web-dev" + - "traefik.frontend.rule=Host:web-dev.learningtools.local" + deploy: + replicas: 2 + placement: + constraints: [node.role == worker] + web-prod: + image: "slowe/flask-demo-app:1.0" + networks: + - webgateway + ports: + - "5001:5001" + labels: + - "traefik.backend=web-prod" + - "traefik.frontend.rule=Host:web-prod.learningtools.local" + deploy: + replicas: 2 + placement: + constraints: [node.role == worker] networks: - common: + webgateway: + driver: bridge diff --git a/traefik/security.tf b/traefik/security.tf index 77bf7ad..908fe81 100644 --- a/traefik/security.tf +++ b/traefik/security.tf @@ -40,3 +40,58 @@ resource "aws_security_group" "web_sg" { area = "security" } } + +# Create a security group to allow inbound Docker management traffic +resource "aws_security_group" "mgmt_sg" { + vpc_id = "${aws_vpc.traefik_vpc.id}" + name = "mgmt_sg" + description = "Security group for inbound Docker management traffic" + ingress { + from_port = "0" + to_port = "0" + protocol = "-1" + cidr_blocks = ["${aws_vpc.traefik_vpc.cidr_block}"] + } + ingress { + from_port = "8080" + to_port = "8080" + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] + } + ingress { + from_port = "80" + to_port = "80" + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] + } + ingress { + from_port = "22" + to_port = "22" + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] + } + ingress { + from_port = "2376" + to_port = "2377" + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] + } + ingress { + from_port = "3376" + to_port = "3377" + protocol = "tcp" + cidr_blocks = ["0.0.0.0/0"] + } + egress { + from_port = "0" + to_port = "0" + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } + tags { + Name = "mgmt_sg" + tool = "terraform" + demo = "traefik" + area = "security" + } +}