Tf ec2 ssh elastic ip setup

.github/workflows/terraform-deploy.yml

@@ -0,0 +1,146 @@
+name: Terraform Deploy
+
+on:
+  push:
+    branches: [main, staging, develop]
+
+  workflow_dispatch:
+    inputs:
+      import:
+        description: 'Import existing resources into Terraform state'
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write
+
+# ───────────────────────────────────────────────
+# DEVELOPMENT JOB
+# ───────────────────────────────────────────────
+jobs:
+  deploy-development:
+    name: Deploy Infrastructure (development)
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/develop'
+    strategy:
+      fail-fast: false
+      matrix:
+        # env:   [development, staging, production]
+        stack: [backend, frontend]
+    environment: development
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::${{ secrets.IAM_INFRA_ROLE_ID }}:role/flagging-infra-ci
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Verify AWS access
+        run: aws sts get-caller-identity
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Set paths
+        id: paths
+        run: |
+          echo "env_dir=environments/development/${{ matrix.stack }}" >> $GITHUB_OUTPUT
+          echo "s3_key=environments/development/${{ matrix.stack }}/terraform.tfstate" >> $GITHUB_OUTPUT
+
+      - name: Terraform Init
+        run: |
+          terraform -chdir=${{ steps.paths.outputs.env_dir }} init -reconfigure \
+            -backend-config="bucket=${{ secrets.S3_BUCKET_NAME }}" \
+            -backend-config="key=${{ steps.paths.outputs.s3_key }}" \
+            -backend-config="region=${{ secrets.AWS_REGION }}" \
+            -backend-config="encrypt=true"
+
+      - name: Terraform Plan & Apply
+        run: |
+          terraform -chdir=${{ steps.paths.outputs.env_dir }} plan -out=tfplan
+          terraform -chdir=${{ steps.paths.outputs.env_dir }} apply -auto-approve tfplan
+        env:
+          TF_VAR_allowed_ssh_cidrs: ${{ secrets.ALLOWED_SSH_CIDRS }}
+          TF_VAR_allowed_api_cidrs: ${{ secrets.ALLOWED_API_CIDRS }}
+          TF_VAR_allowed_cms_cidrs: ${{ secrets.ALLOWED_CMS_CIDRS }}
+          TF_VAR_ghcr_token: ${{ secrets.GHCR_PAT }}
+          TF_VAR_admin_key: ${{ matrix.stack == 'backend' && secrets.ADMIN_KEY_DEV || '' }}
+          TF_VAR_sa_password: ${{ matrix.stack == 'backend' && secrets.SA_PASSWORD_DEV || '' }}
+          TF_VAR_redis_password: ${{ matrix.stack == 'backend' && secrets.REDIS_PASSWORD_DEV || '' }}
+
+# ───────────────────────────────────────────────
+# STAGING JOB
+# ───────────────────────────────────────────────
+  deploy-staging:
+    name: Deploy Infrastructure (staging)
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/staging'
+    strategy:
+      fail-fast: false
+      matrix:
+        stack: [backend, frontend]
+    environment: staging
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::${{ secrets.IAM_INFRA_ROLE_ID }}:role/flagging-infra-ci
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform Plan
+        run: |
+          terraform -chdir=environments/staging/${{ matrix.stack }} init -reconfigure \
+            -backend-config="bucket=${{ secrets.S3_BUCKET_NAME }}" \
+            -backend-config="key=environments/staging/${{ matrix.stack }}/terraform.tfstate" \
+            -backend-config="region=${{ secrets.AWS_REGION }}" \
+            -backend-config="encrypt=true"
+          terraform -chdir=environments/staging/${{ matrix.stack }} plan -no-color
+
+# ───────────────────────────────────────────────
+# PRODUCTION JOB
+# ───────────────────────────────────────────────
+  deploy-production:
+    name: Deploy Infrastructure (production)
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main'
+    strategy:
+      fail-fast: false
+      matrix:
+        stack: [backend, frontend]
+    environment: production
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::${{ secrets.IAM_INFRA_ROLE_ID }}:role/flagging-infra-ci
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform Plan
+        run: |
+          terraform -chdir=environments/production/${{ matrix.stack }} init -reconfigure \
+            -backend-config="bucket=${{ secrets.S3_BUCKET_NAME }}" \
+            -backend-config="key=environments/production/${{ matrix.stack }}/terraform.tfstate" \
+            -backend-config="region=${{ secrets.AWS_REGION }}" \
+            -backend-config="encrypt=true"
+          terraform -chdir=environments/production/${{ matrix.stack }} plan -no-color

.github/workflows/terraform-validate.yml

@@ -0,0 +1,116 @@
+name: Terraform Validation
+
+on:
+  pull_request:
+    branches: [main, staging, develop]
+
+  workflow_dispatch: {}
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write
+
+jobs:
+  terraform-validation:
+    name: Validate Terraform configuration
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        stack: [backend, frontend]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform Format Check
+        run: terraform fmt -check -recursive
+
+      - name: Terraform Init (development env)
+        working-directory: environments/development/${{ matrix.stack }}
+        run: terraform init -backend=false
+
+      - name: Terraform Validate
+        working-directory: environments/development/${{ matrix.stack }}
+        run: terraform validate
+
+      - name: Terraform Lint
+        uses: terraform-linters/setup-tflint@v6
+        with:
+          tflint_version: v0.52.0
+
+      - name: Run TFLint in stack dir
+        working-directory: environments/development/${{ matrix.stack }}
+        run: |
+          tflint --init
+          tflint
+
+      - name: Summary
+        run: echo "Terraform syntax and lint checks completed successfully."
+
+  terraform-plan:
+    name: Terraform Plan (${{ matrix.stack }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        stack: [backend, frontend]
+    needs: terraform-validation
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v5
+        with:
+          role-to-assume: arn:aws:iam::${{ secrets.IAM_INFRA_ROLE_ID }}:role/flagging-infra-ci
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform Init (with backend)
+        working-directory: environments/development/${{ matrix.stack }}
+        run: terraform init -backend-config=backend.hcl
+
+      - name: Terraform Plan (${{ matrix.stack }})
+        id: plan
+        working-directory: environments/development/${{ matrix.stack }}
+        env:
+          TF_VAR_admin_key: ${{ matrix.stack == 'backend' && secrets.ADMIN_KEY_DEV || '' }}
+          TF_VAR_sa_password: ${{ matrix.stack == 'backend' && secrets.SA_PASSWORD_DEV || '' }}
+          TF_VAR_redis_password: ${{ matrix.stack == 'backend' && secrets.REDIS_PASSWORD_DEV || '' }}
+          TF_VAR_ghcr_token: ${{ secrets.GHCR_PAT }}
+          TF_VAR_allowed_ssh_cidrs: ${{ secrets.ALLOWED_SSH_CIDRS }}
+          TF_VAR_allowed_api_cidrs: ${{ secrets.ALLOWED_API_CIDRS }}
+          TF_VAR_allowed_cms_cidrs: ${{ secrets.ALLOWED_CMS_CIDRS }}
+          TF_LOG: DEBUG
+        run: terraform plan -no-color -out=tfplan
+
+
+      - name: Save Plan Output
+        working-directory: environments/development/${{ matrix.stack }}
+        run: terraform show -no-color tfplan > plan-${{ matrix.stack }}.txt
+
+      - name: Upload Plan as Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: terraform-plan ${{ matrix.stack }}
+          path: environments/development/${{ matrix.stack }}/plan-${{ matrix.stack }}.txt
+
+      - name: Comment Plan on PR
+        uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          header: "Terraform Plan – ${{ matrix.stack }}"
+          path: environments/development/${{ matrix.stack }}/plan-${{ matrix.stack }}.txt
+
+      - name: Force unlock on failure
+        if: failure()
+        working-directory: environments/development/${{ matrix.stack }}
+        run: |
+          echo "Attempting to remove Terraform lock..."
+          terraform force-unlock -force $(terraform show -json | jq -r '.lock.id') || true

.gitignore

@@ -1,5 +1,6 @@
 # Local .terraform directories
 .terraform/
+.terraform.lock.hcl
 
 # .tfstate files
 *.tfstate

README.md

@@ -1 +1,110 @@
-# flagging-infrastructure
+# Feature Flags Infrastructure
+
+This repository manages the **cloud infrastructure** for the **Feature Flags Platform**, which includes:
+
+- The **backend API** (built with .NET)
+- The **frontend dashboard** (built with Vue.js)
+- Supporting services such as **Redis** and **SQL Server**
+
+All infrastructure is defined using **Terraform (Infrastructure as Code)** and deployed to **AWS**.
+
+---
+
+## Repository Structure
+```
+feature-flags-infra/
+├── .github/workflows/       # CI/CD automation for Terraform and deployments
+│
+├── bootstrap/               # One-time setup for remote Terraform state (S3 + DynamoDB to keep infrastructure state consistent)
+│
+├── environments/            # Per-environment Terraform configurations
+│   ├── development/         # Dev environment (testing, internal usage)
+│   ├── staging/             # Staging environment (QA, integration)
+│   └── production/          # Production environment (Production deployment)
+│
+├── modules/                 # Reusable Terraform modules
+│   ├── compose/             # Handles Docker Compose deployments on EC2
+│   ├── compute-ec2/         # Provisions EC2 instances and security groups
+│   ├── dns/                 # Manages DNS records, SSL certs, and optional load balancer
+│   ├── network/             # Creates VPCs, subnets, and networking resources
+│   └── secrets/             # Manages sensitive data
+│
+├── scripts/                 # Helper shell scripts for rendering, deployment, and SSM commands
+│
+└── templates/               # Template files (e.g., docker-compose.yaml) used for deployments
+```
+---
+
+## Key Concepts
+
+| **Component**      | **Description**                                                        |
+|--------------------|------------------------------------------------------------------------|
+| **Terraform**      | Used to define, provision, and manage AWS resources.                   |
+| **AWS EC2**        | Hosts Docker Compose deployments for API + Frontend containers.        |
+| **AWS SSM**        | Enables secure, keyless remote commands and configuration.             |
+| **Docker Compose** | Orchestrates multi-container setup (API, Frontend, Redis, SQL Server). |
+| **GitHub Actions** | Automates build, plan, and deploy workflows across environments.       |
+
+---
+
+## ⚙️ How It Works
+
+1. **API & Frontend Repositories**
+   - Build and push Docker images to **GitHub Container Registry (GHCR)**.
+   - Trigger a `repository_dispatch` event to this infrastructure repository.
+
+2. **Infrastructure Repository**
+   - Terraform provisions AWS resources per environment (**Development**, **Staging**, **Production**).
+   - AWS **SSM** executes deployment commands on EC2 instances such as:
+
+     ```text
+     docker compose pull && docker compose up -d
+     ```
+
+3. **Environment Isolation**
+   - Each environment has its own **Terraform state**, **variables**, and **resource set**.
+   - Promoting changes is done by merging `develop → staging → main`.
+
+---
+
+## Environments and branches
+
+| **Environment**  | **Branch** | **Purpose**  | **Trigger**                            |
+|------------------|------------|--------------|----------------------------------------|
+| 🧪 Development   | `develop`  | Active feature testing | On merge to `develop`        |
+| 🚀 Staging       | `staging`  | QA and pre-production testing | On merge to `staging` |
+| 🏆 Production    | `main`     | Live production deployment | On merge to `main`       |
+
+---
+
+## Typical Workflow
+
+### Bootstrap Terraform Remote State
+
+Used to create the S3 bucket and DynamoDB table for Terraform state management.
+
+```bash
+cd bootstrap
+terraform init
+terraform apply -auto-approve
+
+cd environments/development
+terraform init -backend-config=backend.hcl
+terraform apply -auto-approve
+```
+
+## Promote to Staging / Production
+
+Merge develop → staging → main
+
+GitHub Actions automatically runs terraform apply for each environment
+
+## Notes for Contributors
+
+Each environment is fully isolated and can be applied independently.
+
+Never commit AWS credentials — use GitHub OIDC authentication for Terraform.
+
+Keep module logic reusable; environment folders should only contain configuration.
+
+Use tags (e.g., Project, Env) on all resources for cost tracking and organization.