nginx+docker+certbot

--------------------------- Nginx+wordprss+mysql+certbot provisioned via terraform from userdata-------------------------



#### Userdata ####

#!/bin/bash

echo "ClientAliveInterval 60" >> /etc/ssh/sshd_config
echo "LANG=en_US.utf-8" >> /etc/environment
echo "LC_ALL=en_US.utf-8" >> /etc/environment
service sshd restart

yum install docker -y
systemctl restart docker.service
systemctl enable docker.service
usermod -aG docker ec2-user
su - ec2-user


docker network create wp-net
docker volume create mysql-vol
docker volume create wp-vol


docker image pull mysql:8-debian
docker image pull wordpress:latest
docker image pull nginx:alpine


docker container run \
-d \
--name mysql-server \
--restart always \
--network wp-net \
-v mysql-vol:/var/lib/mysql/ \
-e MYSQL_ROOT_PASSWORD="root@123" \
-e MYSQL_DATABASE="wordpress" \
-e MYSQL_USER="wpuser" \
-e MYSQL_PASSWORD="wpuser@123" \
mysql:8-debian

docker container run \
--name wordpress \
--restart always \
--network wp-net \
-d \
-v wp-vol:/var/www/html/ \
-e WORDPRESS_DB_HOST="mysql-server" \
-e WORDPRESS_DB_USER="wpuser" \
-e WORDPRESS_DB_PASSWORD="wpuser@123" \
-e WORDPRESS_DB_NAME="wordpress" \
wordpress:latest

cat <<'EOF' >> /home/ec2-user/default.conf
server {
    listen       80;
    listen  [::]:80;
    server_name  ${domain_name};
    root   /var/www/html;
    index index.php;
    location / {
        proxy_pass http://wordpress:80;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }
   location ~ .php$ {
        proxy_pass http://wordpress:80;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
    }
}
EOF


docker container run \
--name nginx \
--network wp-net \
-d \
-p 80:80 -p 443:443 \
-v /home/ec2-user/default.conf:/etc/nginx/conf.d/default.conf/ \
nginx:alpine

docker container exec nginx sh -c "apk update && apk add certbot certbot-nginx --no-cache; certbot --nginx -d ${domain_name} --non-interactive --agree-tos -m admin@${hosted_zone}; exit"
docker container restart nginx



#### main.tf from built-in templatefile function  ####

provider "aws" {
  region     = var.region
  access_key = var.access_key
  secret_key = var.secret_key
  default_tags {

    tags = {
      Name         = "${var.project_name}-${var.project_env}"
      project_name = var.project_name
      project_env  = var.project_env

    }


  }
}



resource "aws_security_group" "sg" {
  name_prefix = "${var.project_name}-${var.project_env}-"
  description = "Allow ssh"

  ingress {
    from_port        = 22
    to_port          = 22
    protocol         = "tcp"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
  ingress {
    from_port        = 80
    to_port          = 80
    protocol         = "tcp"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
  ingress {
    from_port        = 443
    to_port          = 443
    protocol         = "tcp"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  egress {
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
  lifecycle {
    create_before_destroy = true
  }

}


resource "aws_instance" "project" {
  ami                    = var.ami_id
  instance_type          = var.instance_type
  key_name               = var.key_name
  vpc_security_group_ids = [aws_security_group.sg.id]
  user_data = templatefile("userdata.tmpl", { domain_name = var.domain_name, hosted_zone = var.hosted_zone })
}

data "aws_route53_zone" "fetch" {
  name = var.hosted_zone
}

resource "aws_route53_record" "www" {
  zone_id = data.aws_route53_zone.fetch.id
  name    = var.domain_name
  type    = "A"
  ttl     = 5
  records = [aws_instance.project.public_ip]
}