module-service-teampass-fargate

This module creates a https://github.com/nilsteampassnet/TeamPass [TeamPass] service on Fargate. The module will spawn TeamPass tasks over an existing ECS cluster with Fargate as execution mode, along with the required database and networking elements.

Due to the limitation of the software, a customized docker has been created to carry out this migration with all the existing configuration

upon this module is executed, the database will be initialized with "CHANGEME" as the root user password. This password must be changed in the RDS console and the password must be stored in the rds_root_pwd SSM Parameter.

Also, you need change other variables especific from TeamPass migration in SSM Parameter as:

- tp_db_pwd: (hash of original password from migration) It´s referenced in TeamPass
- tp_seckey: (salt key of original salt key from migration) It´s referenced in TeamPass
- tp_bck_script_passkey: (bck script passkey of original bck script passkey from migration) It´s referenced in TeamPass
- tp_bck_script_key: (bck script key of original bck script key from migration) It´s referenced in TeamPass
- tp_csrfp_token: (bck csrfp token of original bck csrfp token from migration) It´s referenced in TeamPass

Also, you need change variables LDAP & SMTP passwords from TeamPass migration in SSM Parameter as:

- tp_ldap_bind_passwd: It´s referenced in TeamPass
- tp_email_auth_pwd: It´s referenced in TeamPass

Given the situation that it is a migration of an exist application. Once it is mounted, it is necessary to connect to the RDS and import a dump of the original database for its migration

Usage examples

Simple example

module "teampass" {
  source = "git::https://gitlab.vectoritcgroup.com/vectordigital/iac/terraform/modules/aws/compute/module-service-teampass-fargate.git?ref=vX.Y.Z"

  prefix     = var.prefix
  aws_region = var.aws_region
  name       = var.name

  vpc_id = module.vpc.vpc_id

  rds_instance_count    = 1
  rds_instance_type     = "db.t3.small"
  rds_subnet_group_name = module.vpc.db_subnet_group

  alb_certificate_arn = aws_acm_certificate.acm.arn
  alb_public_subnets  = module.vpc.public_subnets

  service_private_subnets                    = module.vpc.private_subnets
  service_ecs_cluster_arn                    = module.ecs.cluster_arn
  service_desired_count                      = 2
  service_deployment_minimum_healthy_percent = 50

  teampass_vars = {
    TP_LDAP_SUFFIX : "@dc=ldap,DC=vectorim,DC=net"
    TP_LDAP_DOMAIN_DN : "DC=vectorim,DC=net"
    TP_LDAP_DOMAIN_CONTROLER : "dc01-test.vectorim.net,dc02-test.vectorim.net"
    TP_LDAP_SEARCH_BASE : "DC=vectorim,DC=net"
    TP_LDAP_BIND_DN : "CN=Administrator,CN=Users,DC=vectorim,DC=net"
    TP_CUSTOM_LOGO  = "https://intranet.vectoritcgroup.com/wp-content/uploads/2017/01/signature-logo-vector-itc-2x.png"
    TP_CPASSMAN_URL = module.teampass.alb_dns_name
  }

  tags = {
    "Project"     = "test"
    "Environment" = "basic"
  }
}

Module argument reference

Modules

Name Source Version

alb

git::https://gitlab.vectoritcgroup.com/vectordigital/iac/terraform/modules/aws/networking/module-base-alb.git

v0.1.0

alb-https-forward-rule

git::https://gitlab.vectoritcgroup.com/vectordigital/iac/terraform/modules/aws/networking/module-base-alb-listener-rule.git

v0.1.0

efs

git::https://gitlab.vectoritcgroup.com/vectordigital/iac/terraform/modules/aws/storage/module-base-efs.git

v0.1.0

fargate

git::https://gitlab.vectoritcgroup.com/vectordigital/iac/terraform/modules/aws/compute/module-base-ecs-fargate-service.git

v0.2.0

rds-cluster

git::https://gitlab.vectoritcgroup.com/vectordigital/iac/terraform/modules/aws/database/module-base-rds-aurora-cluster.git

v0.1.0

rds-instances

git::https://gitlab.vectoritcgroup.com/vectordigital/iac/terraform/modules/aws/database/module-base-rds-aurora-cluster-instance.git

v0.1.0

sg-alb

git::https://gitlab.vectoritcgroup.com/vectordigital/iac/terraform/modules/aws/networking/module-base-sg.git

v0.2.2

sg-efs

git::https://gitlab.vectoritcgroup.com/vectordigital/iac/terraform/modules/aws/networking/module-base-sg.git

v0.2.2

sg-rds

git::https://gitlab.vectoritcgroup.com/vectordigital/iac/terraform/modules/aws/networking/module-base-sg.git

v0.2.2

sg-service

git::https://gitlab.vectoritcgroup.com/vectordigital/iac/terraform/modules/aws/networking/module-base-sg.git

v0.2.2

Resources

Name Type

aws_iam_role.this

resource

aws_iam_role_policy.this

resource

aws_route53_record.service

resource

aws_ssm_parameter.rds_root_pwd

resource

aws_ssm_parameter.tp_bck_script_key

resource

aws_ssm_parameter.tp_bck_script_passkey

resource

aws_ssm_parameter.tp_csrfp_token

resource

aws_ssm_parameter.tp_db_pwd

resource

aws_ssm_parameter.tp_email_auth_pwd

resource

aws_ssm_parameter.tp_ldap_bind_passwd

resource

aws_ssm_parameter.tp_seckey

resource

Inputs

Name Description Type Default Required

alb_allowed_sources

A map of description and source CIDR blocks to be allowed in the ALB security group

map(list(string))

 
{
  "ANY": [
    "0.0.0.0/0"
  ]
}

no

alb_certificate_arn

Certificate ARN to associate in Listener HTTPS from Load Balancer

string

n/a

yes

alb_custom_dns_hostname

The custom DNS hostname of this service (NOTE: this should match the CN specified in the ACM certificate)

string

""

no

alb_custom_dns_zone_id

The Route53 ZoneID where the alb_custom_dns_hostname will be created, if needed

string

""

no

alb_public_subnets

Public subnets to associate ALB

list(string)

n/a

yes

aws_region

AWS Region name where you deploy VPC

string

n/a

yes

name

The Service/Application for all resources

string

n/a

yes

prefix

The prefix to be attached to every resource name

string

n/a

yes

rds_instance_count

Number of instances to be deployed and attached to the specified aws_rds_cluster

number

2

no

rds_instance_type

Type of instances class for RDS

string

n/a

yes

rds_kms_key_id

The ARN for the KMS encryption key if one is set to the cluster.

string

""

no

rds_skip_final_snapshot

Allow create or not final snapshot for RDS Cluster

bool

false

no

rds_subnet_group_name

DB subnet groupp name to associate RDS Cluster and instances. This value is create in module VPC (db_subnet_group)

string

""

no

rds_subnet_group_subnets

A list of VPC subnet IDs where the RDS DB subnet group will be created. This variable is mutually exclusive with rds_subnet_group_name

list(string)

[]

no

service_container_path_to_mount_efs_files

Container Path files into docker container fargate to mount EFS volume

string

"/var/www/html/files"

no

service_container_path_to_mount_efs_upload

Container Path upload into docker container fargate to mount EFS volume

string

"/var/www/html/upload"

no

service_cpu_units

The number of cpu units the Amazon ECS container agent will reserve for the container. You can determine the number of CPU units that are available per Amazon EC2 instance type by multiplying the number of vCPUs listed for that instance type on the Amazon EC2 Instances detail page by 1024

number

512

no

service_deployment_minimum_healthy_percent

Minimum healthy percent provides a lower limit on the number of running tasks during a deployment enabling you to deploy without using additional cluster capacity

number

n/a

yes

service_desired_count

For replica services, set the number of instantiations of the specified task definition to place and keep running on your cluster

number

n/a

yes

service_ecs_cluster_arn

ECS Cluster ARN where deploy fargate service

string

n/a

yes

service_memory

The amount (in MiB) of memory to present to the container. If your container attempts to exceed the memory specified here, the container is killed

number

1024

no

service_private_subnets

Private subnets to associate ecs fargate service for deploy service into this subnets

list(string)

n/a

yes

service_root_directory_efs_files

Root directory in EFS to files mount point in ECS Fargate Service TeamPass

string

"/files"

no

service_root_directory_efs_upload

Root directory in EFS to upload mount point in ECS Fargate Service TeamPass

string

"/upload"

no

tags

Specific tags for all module resources

map(string)

n/a

yes

teampass_docker_image

The Docker container image that will be used in the service Task Definition

string

n/a

yes

teampass_ldap

A list of TeamPass Docker Configuration LDAP Variables to be passed

map(string)

{}

no

teampass_smtp

A list of TeamPass Docker Configuration SMTP variables to be passed

map(string)

{}

no

teampass_vars

A list of TeamPass Docker Environment Variables to be passed

map(string)

{}

no

tg_stickiness_cookie_duration

The time period, in seconds, during which requests from a client should be routed to the same target. After this time period expires, the load balancer-generated cookie is considered stale. The range is 1 second to 1 week (604800 seconds). Set to 0 to disable stickiness

number

3600

no

vpc_id

VPC id

string

n/a

yes

Outputs

Name Description

alb_dns_name

Load Balancer DNS Name

alb_listener_http_arn

Listener HTTP ARN

alb_listener_https_arn

Listener HTTPS ARN

alb_name

Load Balancer Name

alb_zone_id

Load Balancer zone Id

cloudwatch_log_group_name

Cloud Watch Log Group name for insert log application

ecs_target_group_name

Target group name associate to deploy service in Load Balancer

efs_arn

The Amazon Resource Name of the Elastic File System created along this service

efs_dns_name

The DNS name for the Elastic File System created along this service

efs_id

The ID that identifies the Elastic File System created along this service

efs_mount_target_dns_names

A list of the DNS names for the EFS Mount Targets created along this service

efs_mount_target_network_interface_ids

A list of the Network Interface IDs for the EFS Mount Targets created along this service

rds_cluster_endpoint

DNS Cluster ednpoint

rds_cluster_name

DNS Cluster ednpoint

rds_root_pwd_arn

ARN ssm paramater RDS root password

sg_rds

Security group id for RDS

sg_services

Security group id for ECS Services