infra: refactor Terraform into reusable customer-instance module
Breaking changes:
- infra/main.tf, variables.tf, outputs.tf, terraform.tfvars.example removed
- Single-file monolith replaced by reusable module + example
New structure:
- infra/modules/customer-instance/ — the module:
- main.tf: VMs, disks, firewall, Secret Manager, dedicated VM SA
- variables.tf: prod_instance + dev_instances flexible schema
- outputs.tf: IPs, SA email, JWT secret reference
- startup-script.sh.tpl: bootstraps VM, fetches secrets, runs compose,
adds Watchtower for auto-upgrade
- infra/examples/minimal/ — OSS self-host quickstart using the module
Supports:
- Per-customer GCP project isolation
- Branch-aware dev VMs via dev_instances list (any image_tag)
- Persistent /data disk (rebuild-safe)
- OS Login (no per-user SSH keys)
- Caddy TLS mode (opt-in via tls_mode="caddy" + domain)
- Watchtower auto-upgrade (opt-in via upgrade_mode="auto")
This commit is contained in:
ZdenekSrotyr
parent
0dd8b13d62
commit
a2c05a5d97
9 changed files with 408 additions and 307 deletions
54
infra/examples/minimal/main.tf
Normal file
54
infra/examples/minimal/main.tf
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
# Minimal example: single-VM Agnes deploy.
|
||||
# Pro OSS self-hoster, co chce prod VM bez dev, bez TLS.
|
||||
terraform {
|
||||
required_version = ">= 1.5"
|
||||
required_providers {
|
||||
google = {
|
||||
source = "hashicorp/google"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "google" {
|
||||
project = var.gcp_project_id
|
||||
region = "europe-west1"
|
||||
}
|
||||
|
||||
variable "gcp_project_id" {
|
||||
description = "GCP project ID (must have billing enabled)"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "admin_email" {
|
||||
description = "Email for first admin user"
|
||||
type = string
|
||||
}
|
||||
|
||||
module "agnes" {
|
||||
source = "../../modules/customer-instance"
|
||||
|
||||
gcp_project_id = var.gcp_project_id
|
||||
customer_name = "self-hosted"
|
||||
seed_admin_email = var.admin_email
|
||||
|
||||
prod_instance = {
|
||||
name = "agnes"
|
||||
machine_type = "e2-small"
|
||||
data_disk_gb = 30
|
||||
image_tag = "stable"
|
||||
upgrade_mode = "auto"
|
||||
tls_mode = "none"
|
||||
domain = ""
|
||||
}
|
||||
|
||||
dev_instances = []
|
||||
|
||||
# Customize below for your setup
|
||||
data_source = "keboola"
|
||||
}
|
||||
|
||||
output "agnes_ip" {
|
||||
description = "SSH in via: ssh <user>@<ip>; UI at http://<ip>:8000"
|
||||
value = module.agnes.prod_ip
|
||||
}
|
||||
170
infra/main.tf
170
infra/main.tf
|
|
@ -1,170 +0,0 @@
|
|||
terraform {
|
||||
required_version = ">= 1.5"
|
||||
|
||||
backend "gcs" {
|
||||
bucket = "agnes-terraform-state"
|
||||
prefix = "instances"
|
||||
}
|
||||
|
||||
required_providers {
|
||||
google = {
|
||||
source = "hashicorp/google"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = "~> 3.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "google" {
|
||||
project = var.project_id
|
||||
region = var.region
|
||||
zone = var.zone
|
||||
}
|
||||
|
||||
# --- Auto-generated secrets ---
|
||||
|
||||
resource "random_password" "jwt_secret" {
|
||||
length = 48
|
||||
special = false
|
||||
}
|
||||
|
||||
# --- Network ---
|
||||
|
||||
resource "google_compute_firewall" "data_analyst" {
|
||||
name = "${var.instance_name}-allow-web"
|
||||
network = "default"
|
||||
|
||||
allow {
|
||||
protocol = "tcp"
|
||||
ports = ["22", "80", "443", "8000"]
|
||||
}
|
||||
|
||||
source_ranges = ["0.0.0.0/0"]
|
||||
target_tags = [var.instance_name]
|
||||
}
|
||||
|
||||
# --- Static IP ---
|
||||
|
||||
resource "google_compute_address" "data_analyst" {
|
||||
name = "${var.instance_name}-ip"
|
||||
region = var.region
|
||||
}
|
||||
|
||||
# --- Startup script ---
|
||||
|
||||
locals {
|
||||
startup_script = <<-SCRIPT
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
exec > /var/log/startup.log 2>&1
|
||||
|
||||
echo "=== Installing Docker ==="
|
||||
if ! command -v docker &> /dev/null; then
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
usermod -aG docker ${var.ssh_user}
|
||||
fi
|
||||
|
||||
# Install docker compose plugin
|
||||
if ! docker compose version &> /dev/null; then
|
||||
apt-get update && apt-get install -y docker-compose-plugin
|
||||
fi
|
||||
|
||||
echo "=== Cloning repository ==="
|
||||
APP_DIR="/opt/data-analyst"
|
||||
if [ ! -d "$APP_DIR" ]; then
|
||||
git clone https://github.com/keboola/agnes-the-ai-analyst.git "$APP_DIR"
|
||||
cd "$APP_DIR"
|
||||
git checkout main
|
||||
else
|
||||
cd "$APP_DIR"
|
||||
git pull origin main || true
|
||||
fi
|
||||
|
||||
echo "=== Creating .env ==="
|
||||
cat > "$APP_DIR/.env" << 'ENVEOF'
|
||||
JWT_SECRET_KEY=${random_password.jwt_secret.result}
|
||||
DATA_DIR=/data
|
||||
DATA_SOURCE=${var.keboola_token != "" ? "keboola" : "local"}
|
||||
KEBOOLA_STORAGE_TOKEN=${var.keboola_token}
|
||||
KEBOOLA_STACK_URL=${var.keboola_stack_url}
|
||||
KEBOOLA_PROJECT_ID=${var.keboola_project_id}
|
||||
SEED_ADMIN_EMAIL=${var.admin_email}
|
||||
LOG_LEVEL=info
|
||||
ENVEOF
|
||||
# Strip leading whitespace from heredoc
|
||||
sed -i 's/^ //' "$APP_DIR/.env"
|
||||
chmod 600 "$APP_DIR/.env"
|
||||
|
||||
echo "=== Creating instance.yaml ==="
|
||||
mkdir -p "$APP_DIR/config"
|
||||
cat > "$APP_DIR/config/instance.yaml" << YAMLEOF
|
||||
instance:
|
||||
name: "${var.instance_name}"
|
||||
subtitle: "Data Analytics Platform"
|
||||
server:
|
||||
host: "${google_compute_address.data_analyst.address}"
|
||||
hostname: "${var.domain != "" ? var.domain : google_compute_address.data_analyst.address}"
|
||||
port: 8000
|
||||
auth:
|
||||
allowed_domain: ""
|
||||
data_source:
|
||||
type: "${var.keboola_token != "" ? "keboola" : "local"}"
|
||||
YAMLEOF
|
||||
|
||||
echo "=== Creating data directory ==="
|
||||
mkdir -p /data/state /data/analytics /data/extracts
|
||||
chown -R 1000:1000 /data
|
||||
|
||||
echo "=== Starting Docker Compose ==="
|
||||
cd "$APP_DIR"
|
||||
docker compose pull 2>/dev/null || true
|
||||
docker compose build
|
||||
docker compose up -d
|
||||
|
||||
echo "=== Startup complete ==="
|
||||
docker compose ps
|
||||
SCRIPT
|
||||
}
|
||||
|
||||
# --- VM Instance ---
|
||||
|
||||
resource "google_compute_instance" "data_analyst" {
|
||||
name = var.instance_name
|
||||
machine_type = var.machine_type
|
||||
zone = var.zone
|
||||
|
||||
tags = [var.instance_name]
|
||||
|
||||
boot_disk {
|
||||
initialize_params {
|
||||
image = "ubuntu-os-cloud/ubuntu-2404-lts-amd64"
|
||||
size = var.disk_size_gb
|
||||
type = "pd-ssd"
|
||||
}
|
||||
}
|
||||
|
||||
network_interface {
|
||||
network = "default"
|
||||
access_config {
|
||||
nat_ip = google_compute_address.data_analyst.address
|
||||
}
|
||||
}
|
||||
|
||||
metadata = {
|
||||
ssh-keys = "${var.ssh_user}:${file(pathexpand(var.ssh_public_key_path))}"
|
||||
}
|
||||
|
||||
metadata_startup_script = local.startup_script
|
||||
|
||||
service_account {
|
||||
scopes = ["cloud-platform"]
|
||||
}
|
||||
|
||||
labels = {
|
||||
app = "data-analyst"
|
||||
managed = "terraform"
|
||||
}
|
||||
}
|
||||
163
infra/modules/customer-instance/main.tf
Normal file
163
infra/modules/customer-instance/main.tf
Normal file
|
|
@ -0,0 +1,163 @@
|
|||
terraform {
|
||||
required_version = ">= 1.5"
|
||||
required_providers {
|
||||
google = {
|
||||
source = "hashicorp/google"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = "~> 3.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
locals {
|
||||
# Normalize all instances into a single list so for_each is uniform across prod + dev.
|
||||
all_instances = concat(
|
||||
[merge(var.prod_instance, { role = "prod" })],
|
||||
[for d in var.dev_instances : merge(d, {
|
||||
role = "dev"
|
||||
disk_size_gb = 30
|
||||
data_disk_gb = 20
|
||||
upgrade_mode = "auto"
|
||||
tls_mode = "caddy"
|
||||
domain = ""
|
||||
})]
|
||||
)
|
||||
}
|
||||
|
||||
# --- Secrets ---
|
||||
|
||||
resource "google_secret_manager_secret" "jwt" {
|
||||
secret_id = "agnes-${var.customer_name}-jwt-secret"
|
||||
project = var.gcp_project_id
|
||||
replication {
|
||||
auto {}
|
||||
}
|
||||
}
|
||||
|
||||
resource "random_password" "jwt" {
|
||||
length = 48
|
||||
special = false
|
||||
}
|
||||
|
||||
resource "google_secret_manager_secret_version" "jwt" {
|
||||
secret = google_secret_manager_secret.jwt.id
|
||||
secret_data = random_password.jwt.result
|
||||
}
|
||||
|
||||
# --- VM service account (dedikovaný, jen read Secret Manageru) ---
|
||||
|
||||
resource "google_service_account" "vm" {
|
||||
account_id = "agnes-${var.customer_name}-vm"
|
||||
display_name = "Agnes VM runtime SA (${var.customer_name})"
|
||||
project = var.gcp_project_id
|
||||
}
|
||||
|
||||
resource "google_project_iam_member" "vm_secrets" {
|
||||
project = var.gcp_project_id
|
||||
role = "roles/secretmanager.secretAccessor"
|
||||
member = "serviceAccount:${google_service_account.vm.email}"
|
||||
}
|
||||
|
||||
# --- Network ---
|
||||
|
||||
resource "google_compute_firewall" "web" {
|
||||
name = "agnes-${var.customer_name}-allow-web"
|
||||
project = var.gcp_project_id
|
||||
network = "default"
|
||||
|
||||
allow {
|
||||
protocol = "tcp"
|
||||
ports = ["22", "80", "443", "8000"]
|
||||
}
|
||||
|
||||
source_ranges = ["0.0.0.0/0"]
|
||||
target_tags = ["agnes-${var.customer_name}"]
|
||||
}
|
||||
|
||||
# --- Persistent data disks + VMs (prod + dev) ---
|
||||
|
||||
resource "google_compute_disk" "data" {
|
||||
for_each = { for inst in local.all_instances : inst.name => inst }
|
||||
|
||||
name = "${each.value.name}-data"
|
||||
project = var.gcp_project_id
|
||||
zone = var.zone
|
||||
size = each.value.data_disk_gb
|
||||
type = "pd-ssd"
|
||||
}
|
||||
|
||||
resource "google_compute_address" "ip" {
|
||||
for_each = { for inst in local.all_instances : inst.name => inst }
|
||||
|
||||
name = "${each.value.name}-ip"
|
||||
project = var.gcp_project_id
|
||||
region = var.region
|
||||
}
|
||||
|
||||
resource "google_compute_instance" "vm" {
|
||||
for_each = { for inst in local.all_instances : inst.name => inst }
|
||||
|
||||
name = each.value.name
|
||||
project = var.gcp_project_id
|
||||
machine_type = each.value.machine_type
|
||||
zone = var.zone
|
||||
tags = ["agnes-${var.customer_name}"]
|
||||
|
||||
boot_disk {
|
||||
initialize_params {
|
||||
image = "ubuntu-os-cloud/ubuntu-2404-lts-amd64"
|
||||
size = each.value.disk_size_gb
|
||||
type = "pd-ssd"
|
||||
}
|
||||
}
|
||||
|
||||
attached_disk {
|
||||
source = google_compute_disk.data[each.key].self_link
|
||||
device_name = "data"
|
||||
}
|
||||
|
||||
network_interface {
|
||||
network = "default"
|
||||
access_config {
|
||||
nat_ip = google_compute_address.ip[each.key].address
|
||||
}
|
||||
}
|
||||
|
||||
metadata = {
|
||||
enable-oslogin = "TRUE"
|
||||
}
|
||||
|
||||
metadata_startup_script = templatefile("${path.module}/startup-script.sh.tpl", {
|
||||
customer_name = var.customer_name
|
||||
image_repo = var.image_repo
|
||||
image_tag = each.value.image_tag
|
||||
upgrade_mode = each.value.upgrade_mode
|
||||
tls_mode = each.value.tls_mode
|
||||
domain = each.value.domain
|
||||
data_source = var.data_source
|
||||
keboola_stack_url = var.keboola_stack_url
|
||||
seed_admin_email = var.seed_admin_email
|
||||
role = each.value.role
|
||||
})
|
||||
|
||||
service_account {
|
||||
email = google_service_account.vm.email
|
||||
scopes = ["cloud-platform"]
|
||||
}
|
||||
|
||||
labels = {
|
||||
app = "agnes"
|
||||
customer = var.customer_name
|
||||
role = each.value.role
|
||||
managed = "terraform"
|
||||
}
|
||||
|
||||
# Změna startup scriptu nemění běžící VM (script běží jen na boot).
|
||||
# Pro aplikaci změn je potřeba VM restartovat nebo recreate.
|
||||
lifecycle {
|
||||
ignore_changes = [metadata_startup_script]
|
||||
}
|
||||
}
|
||||
19
infra/modules/customer-instance/outputs.tf
Normal file
19
infra/modules/customer-instance/outputs.tf
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
output "instance_ips" {
|
||||
description = "Mapa { name => external IP }"
|
||||
value = { for k, v in google_compute_address.ip : k => v.address }
|
||||
}
|
||||
|
||||
output "prod_ip" {
|
||||
description = "External IP prod instance"
|
||||
value = google_compute_address.ip[var.prod_instance.name].address
|
||||
}
|
||||
|
||||
output "vm_service_account" {
|
||||
description = "Email VM SA (pro další IAM bindings, např. BigQuery)"
|
||||
value = google_service_account.vm.email
|
||||
}
|
||||
|
||||
output "jwt_secret_name" {
|
||||
description = "Plný název JWT secretu v Secret Manageru"
|
||||
value = google_secret_manager_secret.jwt.name
|
||||
}
|
||||
100
infra/modules/customer-instance/startup-script.sh.tpl
Normal file
100
infra/modules/customer-instance/startup-script.sh.tpl
Normal file
|
|
@ -0,0 +1,100 @@
|
|||
#!/bin/bash
|
||||
# Agnes VM startup script — templated by Terraform.
|
||||
# Idempotent — spustí se při každém boot.
|
||||
set -euo pipefail
|
||||
exec > /var/log/agnes-startup.log 2>&1
|
||||
|
||||
CUSTOMER_NAME="${customer_name}"
|
||||
IMAGE_REPO="${image_repo}"
|
||||
IMAGE_TAG="${image_tag}"
|
||||
UPGRADE_MODE="${upgrade_mode}"
|
||||
TLS_MODE="${tls_mode}"
|
||||
DOMAIN="${domain}"
|
||||
DATA_SOURCE="${data_source}"
|
||||
KEBOOLA_STACK_URL="${keboola_stack_url}"
|
||||
SEED_ADMIN_EMAIL="${seed_admin_email}"
|
||||
ROLE="${role}"
|
||||
|
||||
echo "=== [Agnes $CUSTOMER_NAME $ROLE] Startup at $(date) ==="
|
||||
|
||||
# --- 1. Docker (install if missing) ---
|
||||
if ! command -v docker &>/dev/null; then
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
fi
|
||||
if ! docker compose version &>/dev/null; then
|
||||
apt-get update && apt-get install -y docker-compose-plugin
|
||||
fi
|
||||
|
||||
# --- 2. Persistent data disk mount ---
|
||||
DATA_DEV="/dev/disk/by-id/google-data"
|
||||
DATA_MNT="/data"
|
||||
if [ -b "$DATA_DEV" ]; then
|
||||
if ! blkid "$DATA_DEV" | grep -q ext4; then
|
||||
mkfs.ext4 -F "$DATA_DEV"
|
||||
fi
|
||||
mkdir -p "$DATA_MNT"
|
||||
mountpoint -q "$DATA_MNT" || mount -o discard,defaults "$DATA_DEV" "$DATA_MNT"
|
||||
grep -qF "$DATA_DEV" /etc/fstab || echo "$DATA_DEV $DATA_MNT ext4 discard,defaults,nofail 0 2" >> /etc/fstab
|
||||
mkdir -p "$DATA_MNT/state" "$DATA_MNT/analytics" "$DATA_MNT/extracts"
|
||||
fi
|
||||
|
||||
# --- 3. App directory + docker-compose files from public repo ---
|
||||
APP_DIR="/opt/agnes"
|
||||
mkdir -p "$APP_DIR"
|
||||
cd "$APP_DIR"
|
||||
|
||||
# Fetch minimal docker-compose from public repo (main branch — stable)
|
||||
curl -fsSL "https://raw.githubusercontent.com/keboola/agnes-the-ai-analyst/main/docker-compose.yml" -o docker-compose.yml
|
||||
curl -fsSL "https://raw.githubusercontent.com/keboola/agnes-the-ai-analyst/main/docker-compose.prod.yml" -o docker-compose.prod.yml
|
||||
|
||||
# TLS overlay (Caddy + Let's Encrypt) — jen pokud potřeba
|
||||
if [ "$TLS_MODE" = "caddy" ] && [ -n "$DOMAIN" ]; then
|
||||
curl -fsSL "https://raw.githubusercontent.com/keboola/agnes-the-ai-analyst/main/Caddyfile" -o Caddyfile 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# --- 4. Fetch secrets from Secret Manager ---
|
||||
KEBOOLA_TOKEN=""
|
||||
if [ "$DATA_SOURCE" = "keboola" ]; then
|
||||
KEBOOLA_TOKEN=$(gcloud secrets versions access latest --secret=keboola-storage-token 2>/dev/null || echo "")
|
||||
fi
|
||||
JWT_KEY=$(gcloud secrets versions access latest --secret=agnes-$${CUSTOMER_NAME}-jwt-secret)
|
||||
|
||||
cat > "$APP_DIR/.env" <<ENVEOF
|
||||
JWT_SECRET_KEY=$JWT_KEY
|
||||
DATA_DIR=$DATA_MNT
|
||||
DATA_SOURCE=$DATA_SOURCE
|
||||
KEBOOLA_STORAGE_TOKEN=$KEBOOLA_TOKEN
|
||||
KEBOOLA_STACK_URL=$KEBOOLA_STACK_URL
|
||||
SEED_ADMIN_EMAIL=$SEED_ADMIN_EMAIL
|
||||
LOG_LEVEL=info
|
||||
DOMAIN=$DOMAIN
|
||||
AGNES_TAG=$IMAGE_TAG
|
||||
ACME_EMAIL=admin@$${DOMAIN#*.}
|
||||
ENVEOF
|
||||
chmod 600 "$APP_DIR/.env"
|
||||
|
||||
# --- 5. Start Agnes ---
|
||||
COMPOSE_PROFILES_ARG=""
|
||||
if [ "$TLS_MODE" = "caddy" ] && [ -n "$DOMAIN" ]; then
|
||||
COMPOSE_PROFILES_ARG="--profile tls"
|
||||
fi
|
||||
|
||||
docker compose -f docker-compose.yml -f docker-compose.prod.yml $COMPOSE_PROFILES_ARG pull
|
||||
docker compose -f docker-compose.yml -f docker-compose.prod.yml $COMPOSE_PROFILES_ARG up -d
|
||||
|
||||
# --- 6. Watchtower (auto-pull new images) ---
|
||||
if [ "$UPGRADE_MODE" = "auto" ]; then
|
||||
# Odstraň starý watchtower pokud existuje (pro idempotenci)
|
||||
docker rm -f agnes-watchtower 2>/dev/null || true
|
||||
docker run -d \
|
||||
--name agnes-watchtower \
|
||||
--restart=unless-stopped \
|
||||
-v /var/run/docker.sock:/var/run/docker.sock \
|
||||
containrrr/watchtower \
|
||||
--interval 300 \
|
||||
--cleanup \
|
||||
--include-restarting
|
||||
fi
|
||||
|
||||
echo "=== [Agnes $CUSTOMER_NAME $ROLE] Startup complete at $(date) ==="
|
||||
docker compose ps
|
||||
72
infra/modules/customer-instance/variables.tf
Normal file
72
infra/modules/customer-instance/variables.tf
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
variable "gcp_project_id" {
|
||||
description = "GCP project ID kde bude instance nasazená"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "GCP region"
|
||||
type = string
|
||||
default = "europe-west1"
|
||||
}
|
||||
|
||||
variable "zone" {
|
||||
description = "GCP zone"
|
||||
type = string
|
||||
default = "europe-west1-b"
|
||||
}
|
||||
|
||||
variable "customer_name" {
|
||||
description = "Krátký identifikátor zákazníka (např. keboola, grpn). Použije se v prefixu resourců."
|
||||
type = string
|
||||
validation {
|
||||
condition = can(regex("^[a-z][a-z0-9-]{1,20}$", var.customer_name))
|
||||
error_message = "customer_name musí být lowercase, začínat písmenem, 2-21 znaků."
|
||||
}
|
||||
}
|
||||
|
||||
variable "prod_instance" {
|
||||
description = "Prod VM konfigurace"
|
||||
type = object({
|
||||
name = string
|
||||
machine_type = optional(string, "e2-small")
|
||||
disk_size_gb = optional(number, 30)
|
||||
data_disk_gb = optional(number, 50)
|
||||
image_tag = optional(string, "stable")
|
||||
upgrade_mode = optional(string, "auto")
|
||||
tls_mode = optional(string, "caddy")
|
||||
domain = optional(string, "")
|
||||
})
|
||||
}
|
||||
|
||||
variable "dev_instances" {
|
||||
description = "Seznam dev VMs. Prázdné pole = žádné dev VMs."
|
||||
type = list(object({
|
||||
name = string
|
||||
machine_type = optional(string, "e2-small")
|
||||
image_tag = optional(string, "dev")
|
||||
}))
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "seed_admin_email" {
|
||||
description = "Email prvního admin usera"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "data_source" {
|
||||
description = "Typ data source — keboola | bigquery | csv"
|
||||
type = string
|
||||
default = "keboola"
|
||||
}
|
||||
|
||||
variable "keboola_stack_url" {
|
||||
description = "Keboola Stack URL (pokud data_source = keboola)"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "image_repo" {
|
||||
description = "Docker image repo"
|
||||
type = string
|
||||
default = "ghcr.io/keboola/agnes-the-ai-analyst"
|
||||
}
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
output "instance_ip" {
|
||||
description = "Public IP address of the server"
|
||||
value = google_compute_address.data_analyst.address
|
||||
}
|
||||
|
||||
output "ssh_command" {
|
||||
description = "SSH command to connect"
|
||||
value = "ssh ${var.ssh_user}@${google_compute_address.data_analyst.address}"
|
||||
}
|
||||
|
||||
output "api_url" {
|
||||
description = "API URL"
|
||||
value = "http://${google_compute_address.data_analyst.address}:8000"
|
||||
}
|
||||
|
||||
output "web_url" {
|
||||
description = "Web UI URL"
|
||||
value = var.domain != "" ? "https://${var.domain}" : "http://${google_compute_address.data_analyst.address}:8000"
|
||||
}
|
||||
|
||||
output "swagger_url" {
|
||||
description = "Swagger API docs URL"
|
||||
value = "http://${google_compute_address.data_analyst.address}:8000/docs"
|
||||
}
|
||||
|
||||
output "bootstrap_command" {
|
||||
description = "Command to bootstrap first admin user"
|
||||
value = "curl -X POST http://${google_compute_address.data_analyst.address}:8000/auth/bootstrap -H 'Content-Type: application/json' -d '{\"email\":\"admin@keboola.com\",\"name\":\"Admin\"}'"
|
||||
}
|
||||
|
||||
output "cli_setup_commands" {
|
||||
description = "Commands to set up local CLI"
|
||||
value = <<-EOT
|
||||
da setup init --server http://${google_compute_address.data_analyst.address}:8000
|
||||
da setup bootstrap admin@keboola.com
|
||||
da setup test-connection
|
||||
da sync
|
||||
EOT
|
||||
}
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
# Copy to terraform.tfvars and fill in values
|
||||
project_id = "your-gcp-project"
|
||||
region = "europe-north1"
|
||||
zone = "europe-north1-a"
|
||||
machine_type = "e2-small" # 2 vCPU, 2GB RAM, ~$7/mo
|
||||
disk_size_gb = 30
|
||||
instance_name = "data-analyst"
|
||||
ssh_user = "deploy"
|
||||
ssh_public_key_path = "~/.ssh/id_ed25519.pub"
|
||||
|
||||
# JWT secret is auto-generated by Terraform (random_password)
|
||||
|
||||
# Keboola (optional — leave empty for sample data)
|
||||
keboola_token = ""
|
||||
keboola_stack_url = "https://connection.keboola.com"
|
||||
keboola_project_id = ""
|
||||
|
||||
# Domain (optional — leave empty for IP-only access)
|
||||
domain = ""
|
||||
|
|
@ -1,79 +0,0 @@
|
|||
variable "project_id" {
|
||||
description = "GCP project ID"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "GCP region"
|
||||
type = string
|
||||
default = "europe-west1"
|
||||
}
|
||||
|
||||
variable "zone" {
|
||||
description = "GCP zone"
|
||||
type = string
|
||||
default = "europe-west1-b"
|
||||
}
|
||||
|
||||
variable "machine_type" {
|
||||
description = "VM machine type"
|
||||
type = string
|
||||
default = "e2-small"
|
||||
}
|
||||
|
||||
variable "disk_size_gb" {
|
||||
description = "Boot disk size in GB"
|
||||
type = number
|
||||
default = 30
|
||||
}
|
||||
|
||||
variable "instance_name" {
|
||||
description = "Name for the VM instance"
|
||||
type = string
|
||||
default = "data-analyst"
|
||||
}
|
||||
|
||||
variable "ssh_user" {
|
||||
description = "SSH username"
|
||||
type = string
|
||||
default = "deploy"
|
||||
}
|
||||
|
||||
variable "ssh_public_key_path" {
|
||||
description = "Path to SSH public key file"
|
||||
type = string
|
||||
default = "~/.ssh/id_ed25519.pub"
|
||||
}
|
||||
|
||||
# App config (JWT secret auto-generated by Terraform)
|
||||
|
||||
variable "keboola_token" {
|
||||
description = "Keboola Storage API token"
|
||||
type = string
|
||||
sensitive = true
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "keboola_stack_url" {
|
||||
description = "Keboola Stack URL"
|
||||
type = string
|
||||
default = "https://connection.keboola.com"
|
||||
}
|
||||
|
||||
variable "keboola_project_id" {
|
||||
description = "Keboola project ID"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "admin_email" {
|
||||
description = "Admin email for initial seed (e.g., admin@company.com)"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "domain" {
|
||||
description = "Domain name for SSL (optional, empty = IP only)"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
Loading…
Reference in a new issue