Skip to content

A template repository for provisioning Cloud ☁️ and Local 💻 powered by Terraform, Ansible, and Docker 🐳

License

Notifications You must be signed in to change notification settings

mazgi/template.containerized-provisioning-project

Repository files navigation

template.containerized-provisioning-project

use-multiple-platforms use-one-platform

This repository is a template for provisioning your Cloud and Local environment using Terraform and Ansible.

How to Use

Docker and Docker Compose are needed. If you want to provision only local environments, that's all.

However, if you want to provision a cloud environment, you need permission that can administer for at least one cloud: AWS, Azure, or Google Cloud.
And you need to set up the repository following steps.

Step 1. Write out your IDs and credentials in the .env file.

You should write your account IDs and credentials depending on your need, such as AWS, Azure, and Google Cloud, in the .env file as follows.

# UID=1234
# GID=1234
# DOCKER_GID=2345
PROJECT_UNIQUE_ID=my-unique-b78e
_TERRAFORM_BACKEND_TYPE=azurerm
TF_VAR_allowed_ipaddr_list=["203.0.113.0/24"]
#
# <AWS>
AWS_ACCESS_KEY_ID=AKXXXXXXXX
AWS_ACCOUNT_ID=123456789012
# AWS_DEFAULT_REGION=us-east-1
AWS_SECRET_ACCESS_KEY=AWxxxxxxxx00000000
# </AWS>
#
# <Azure>
# AZURE_DEFAULT_LOCATION=centralus
ARM_CLIENT_ID=xxxxxxxx-0000-0000-0000-xxxxxxxxxxxx
ARM_CLIENT_SECRET=********
ARM_SUBSCRIPTION_ID=yyyyyyyy-0000-0000-0000-yyyyyyyyyyyy
ARM_TENANT_ID=zzzzzzzz-0000-0000-0000-zzzzzzzzzzzz
# </Azure>
#
# <Google>
# GCP_DEFAULT_REGION=us-central1
CLOUDSDK_CORE_PROJECT=my-proj-b78e
# </Google>

ℹ️ If you are using Linux, write out UID, GID, and GID for the docker group, into the .env file to let that as exported on Docker Compose as environment variables.

test $(uname -s) = 'Linux' && {
  echo -e "DOCKER_GID=$(getent group docker | cut -d : -f 3)"
  echo -e "GID=$(id -g)"
  echo -e "UID=$(id -u)"
} >> .env || :

ℹ️ In addition, if you use Google Cloud, you should place the key file for Google Cloud Service Account as config/credentials/google-cloud-keyfile.provisioning-owner.json.

Environment Variable Names

Environment variable names and uses are as follows.

Name Required on Linux Value
UID Yes This ID number is used as UID for your Docker user, so this ID becomes the owner of all files and directories created by the container.
GID Yes The same as the above UID.
DOCKER_GID Yes This ID number is used to provide permission to read and write your docker socket on your local machine from your container.
Name Required with Terraform Value
PROJECT_UNIQUE_ID Yes An ID to indicate your environment.
The value is used for the name of the Object Storage bucket or Storage Account for Terraform backend.
_TERRAFORM_BACKEND_TYPE Yes Acceptable values are azurerm, gcs, s3, and none.
TF_VAR_allowed_ipaddr_list no IP address ranges you want access to your cloud environment.
AWS
Name Required with AWS Value
AWS_ACCOUNT_ID Yes A 12-digit AWS Account ID you want to provision.
The S3 bucket is created in this account to store the tfstate file if you choose the S3 backend.
AWS_ACCESS_KEY_ID Yes An AWS Access Key for the IAM user that is used to create the S3 bucket to store tfstate file and apply all in your AWS environment.
AWS_SECRET_ACCESS_KEY Yes
AWS_DEFAULT_REGION no
Azure

You are able to generate Azure Service Principal according to the how-to-create-azure-service-principal.md.

Name Required with Azure Value
ARM_TENANT_ID Yes A UUID to indicate Azure Tenant.
ARM_SUBSCRIPTION_ID Yes A UUID to indicate Azure Subscription you want to provision.
The Resource Group, Storage Account, and Blob Container are created in this subscription to store the tfstate file if you choose the AzureRM backend.
ARM_CLIENT_ID Yes
ARM_CLIENT_SECRET Yes
AZURE_DEFAULT_LOCATION no
Google Cloud
Name Required with Azure Value
CLOUDSDK_CORE_PROJECT Yes A string Project ID to indicate Google Cloud Project you want to provision, Not Project name or Project number.
The Cloud Storage Bucket is created in this project to store the tfstate file if you choose the GCS backend.
See also https://cloud.google.com/resource-manager/docs/creating-managing-projects
GCP_DEFAULT_REGION no

Step 2. Define your service in the docker-compose.yml

You are able to update and define the provisioning service to your need in the docker-compose.yml.

services:
  provisioning:
    <<: *provisioning-base

Make sure your config.

docker compose config

Now, you are able to provision your environment as follows. 🎉

docker compose build
docker compose up
docker compose exec provisioning terraform apply
docker compose down

Step 3. Set secrets for GitHub Actions

The gh command helps set secrets.

gh secret set --app actions --env-file .env
cat config/credentials/google-cloud-keyfile.provisioning-owner.json\
 | gh secret set GOOGLE_SA_KEY --app=actions

About

A template repository for provisioning Cloud ☁️ and Local 💻 powered by Terraform, Ansible, and Docker 🐳

Topics

Resources

License

Stars

Watchers

Forks