compose.tf

data "aws_ami" "amzn" {
  most_recent = true

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  filter {
    name   = "root-device-type"
    values = ["ebs"]
  }

  owners = ["137112412989"] # Amazon
}

data "aws_iam_policy_document" "compose" {
  statement {
    sid = ""

    actions = [
      "sts:AssumeRole",
    ]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }

    effect = "Allow"
  }
}

locals {
  solr_data_device_name = "/dev/sdh"
}

resource "aws_iam_policy" "this_bucket_policy" {
  name   = "${local.namespace}-compose-bucket-access"
  policy = data.aws_iam_policy_document.this_bucket_access.json
}

resource "aws_iam_instance_profile" "compose" {
  name = "${local.namespace}-compose-profile"
  role = aws_iam_role.compose.name
}

resource "aws_iam_role" "compose" {
  name               = "${local.namespace}-compose-role"
  assume_role_policy = data.aws_iam_policy_document.compose.json
}

data "aws_iam_policy_document" "compose_api_access" {
  statement {
    effect = "Allow"
    actions = [
      "ec2:DescribeInstances",
      "elasticfilesystem:*",
      "elastictranscoder:List*",
      "elastictranscoder:Read*",
      "elastictranscoder:CreatePreset",
      "elastictranscoder:ListPresets",
      "elastictranscoder:ReadPreset",
      "elastictranscoder:ListJobs",
      "elastictranscoder:CreateJob",
      "elastictranscoder:ReadJob",
      "elastictranscoder:CancelJob",
      "s3:*",
      "ses:SendEmail",
      "ses:SendRawEmail",
      "cloudwatch:PutMetricData",
      "ssm:Get*",
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:PutLogEvents",
      "logs:PutRetentionPolicy",
    ]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "compose_api_access" {
  name   = "${local.namespace}-compose-api-access"
  policy = data.aws_iam_policy_document.compose_api_access.json
}

resource "aws_iam_role_policy_attachment" "compose_api_access" {
  role       = aws_iam_role.compose.name
  policy_arn = aws_iam_policy.compose_api_access.arn
}

resource "aws_iam_role_policy_attachment" "compose_ecr" {
  role       = aws_iam_role.compose.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
}

resource "aws_security_group" "compose" {
  name        = "${local.namespace}-compose"
  description = "Compose Host Security Group"
  vpc_id      = module.vpc.vpc_id
  tags        = local.common_tags
}

resource "aws_security_group_rule" "compose_web" {
  security_group_id = aws_security_group.compose.id
  type              = "ingress"
  from_port         = "80"
  to_port           = "80"
  protocol          = "tcp"
  cidr_blocks       = [var.vpc_cidr_block]
}

resource "aws_security_group_rule" "compose_streaming" {
  security_group_id = aws_security_group.compose.id
  type              = "ingress"
  from_port         = "8880"
  to_port           = "8880"
  protocol          = "tcp"
  cidr_blocks       = [var.vpc_cidr_block]
}

resource "aws_security_group_rule" "compose_ssh" {
  security_group_id = aws_security_group.compose.id
  type              = "ingress"
  from_port         = "22"
  to_port           = "22"
  protocol          = "tcp"
  cidr_blocks       = setunion([var.vpc_cidr_block], var.ssh_cidr_blocks)
}

resource "aws_security_group_rule" "compose_egress" {
  security_group_id = aws_security_group.compose.id
  type              = "egress"
  from_port         = "0"
  to_port           = "0"
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
}

resource "aws_security_group_rule" "allow_this_redis_access" {
  security_group_id        = aws_security_group.redis.id
  type                     = "ingress"
  from_port                = aws_elasticache_cluster.redis.cache_nodes[0].port
  to_port                  = aws_elasticache_cluster.redis.cache_nodes[0].port
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.compose.id
}

resource "aws_security_group" "public_ip" {
  name        = "${local.namespace}-ssh-public-ip"
  description = "SSH Public IP Security Group"
  tags        = local.common_tags
  vpc_id      = module.vpc.vpc_id
}

resource "aws_security_group_rule" "ssh_public_ip" {
  for_each = toset(length(var.ssh_cidr_blocks) > 0 ? ["1"] : [])
  type = "ingress"
  description = "Allow SSH direct to public IP"
  cidr_blocks = var.ssh_cidr_blocks
  ipv6_cidr_blocks = []
  from_port   = 22
  to_port     = 22
  protocol    = "tcp"
  security_group_id = aws_security_group.public_ip.id
}

resource "aws_instance" "compose" {
  ami                         = data.aws_ami.amzn.id
  instance_type               = var.compose_instance_type
  key_name                    = var.ec2_keyname == "" ? null : var.ec2_keyname
  subnet_id                   = module.vpc.public_subnets[0]
  associate_public_ip_address = true
  availability_zone           = var.availability_zone
  iam_instance_profile        = aws_iam_instance_profile.compose.name
  tags = merge(
    local.common_tags,
    {
      "Name" = "${local.namespace}-compose"
    },
  )

  root_block_device {
    volume_size = var.compose_volume_size
    volume_type = "standard"
  }

  user_data = base64encode(templatefile("scripts/compose-init.sh", {
    ec2_public_key = var.ec2_public_key
    ec2_users = var.ec2_users
    solr_data_device_name = local.solr_data_device_name
    solr_backups_efs_id = aws_efs_file_system.solr_backups.id
    solr_backups_efs_dns_name = aws_efs_file_system.solr_backups.dns_name
    db_fcrepo_address = module.db_fcrepo.db_instance_address
    db_fcrepo_username = module.db_fcrepo.db_instance_username
    db_fcrepo_password = module.db_fcrepo.db_instance_password
    db_fcrepo_port = module.db_fcrepo.db_instance_port
    db_avalon_address = module.db_avalon.db_instance_address
    db_avalon_username = module.db_avalon.db_instance_username
    db_avalon_password = module.db_avalon.db_instance_password
    fcrepo_ocfl_bucket_access_key = length(var.fcrepo_ocfl_bucket_username) > 0 ? var.fcrepo_ocfl_bucket_access_key : values(aws_iam_access_key.fcrepo_ocfl_created_access)[0].id 
    fcrepo_ocfl_bucket_secret_key = length(var.fcrepo_ocfl_bucket_username) > 0 ? var.fcrepo_ocfl_bucket_secret_key : values(aws_iam_access_key.fcrepo_ocfl_created_access)[0].secret 
    fcrepo_ocfl_bucket_id = aws_s3_bucket.fcrepo_ocfl_bucket.id
    compose_log_group_name = aws_cloudwatch_log_group.compose_log_group.name
    derivatives_bucket_id = aws_s3_bucket.this_derivatives.id
    masterfiles_bucket_id = aws_s3_bucket.this_masterfiles.id
    preservation_bucket_id = aws_s3_bucket.this_preservation.id
    supplemental_files_bucket_id = aws_s3_bucket.this_supplemental_files.id
    avalon_ecr_repository_url = aws_ecr_repository.avalon.repository_url
    avalon_repo = var.avalon_repo
    avalon_docker_code_repo = var.avalon_docker_code_repo
    avalon_docker_code_branch = var.avalon_docker_code_branch
    avalon_docker_code_commit = var.avalon_docker_code_commit
    redis_host_name = aws_route53_record.redis.name
    aws_region = var.aws_region
    avalon_fqdn = length(var.alt_hostname) > 0 ? values(var.alt_hostname)[0].hostname : aws_route53_record.alb.fqdn
    streaming_fqdn = aws_route53_record.alb_streaming.fqdn
    elastictranscoder_pipeline_id = aws_elastictranscoder_pipeline.this_pipeline.id
    email_comments = var.email_comments
    email_notification = var.email_notification
    email_support = var.email_support
    avalon_admin = var.avalon_admin
    bib_retriever_protocol = var.bib_retriever_protocol
    bib_retriever_url = var.bib_retriever_url
    bib_retriever_query = var.bib_retriever_query
    bib_retriever_host = var.bib_retriever_host
    bib_retriever_port = var.bib_retriever_port
    bib_retriever_database = var.bib_retriever_database
    bib_retriever_attribute = var.bib_retriever_attribute
    bib_retriever_class = var.bib_retriever_class
    bib_retriever_class_require = var.bib_retriever_class_require
    extra_docker_environment_variables = var.extra_docker_environment_variables
  }))

  vpc_security_group_ids = [
    aws_security_group.compose.id,
    aws_security_group.db_client.id,
    aws_security_group.public_ip.id,
  ]

  user_data_replace_on_change = true
}

resource "aws_route53_record" "ec2_hostname" {
  zone_id = module.dns.public_zone_id
  name    = local.ec2_hostname
  type    = "A"
  ttl     = 30
  records = [aws_instance.compose.public_ip]
}

resource "null_resource" "install_docker_on_compose" {
  triggers = {
    host = aws_instance.compose.id
  }

  provisioner "local-exec" {
    command = "aws codebuild start-build --project-name ${aws_codebuild_project.docker.name} --region ${var.aws_region}"
  }
}

resource "aws_s3_bucket_policy" "compose-s3" {
  bucket = aws_s3_bucket.this_derivatives.id

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Id": "MYBUCKETPOLICY",
  "Statement": [
    {
      "Sid": "IPAllow",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::${aws_s3_bucket.this_derivatives.id}/*",
      "Condition": {
         "IpAddress": {"aws:SourceIp": "${aws_instance.compose.public_ip}"}
      }
    }
  ]
}
POLICY

}

resource "aws_cloudwatch_log_group" "compose_log_group" {
  name = local.namespace
}

resource "aws_volume_attachment" "compose_solr" {
  device_name = local.solr_data_device_name
  volume_id   = aws_ebs_volume.solr_data.id
  instance_id = aws_instance.compose.id
}

resource "aws_ebs_volume" "solr_data" {
  availability_zone = var.availability_zone
  size              = 20
}