agentic-dev 0.1.0 → 0.2.0

package/infra/terraform/openstack/modules/environment_host/main.tf

@@ -0,0 +1,143 @@
+locals {
+  effective_network_id = trimspace(var.network_id) != "" ? trimspace(var.network_id) : (
+    var.create_network ? openstack_networking_network_v2.environment[0].id : ""
+  )
+
+  effective_subnet_id = trimspace(var.subnet_id) != "" ? trimspace(var.subnet_id) : (
+    var.create_network ? openstack_networking_subnet_v2.environment[0].id : ""
+  )
+
+  service_ingress_rules = flatten([
+    for port in var.exposed_tcp_ports : [
+      for cidr in var.service_allowed_cidrs : {
+        key  = "${port}-${replace(cidr, "/", "_")}"
+        port = port
+        cidr = cidr
+      }
+    ]
+  ])
+
+  ssh_ingress_rules = [
+    for cidr in var.ssh_allowed_cidrs : {
+      key  = replace(cidr, "/", "_")
+      cidr = cidr
+    }
+  ]
+}
+
+resource "openstack_networking_network_v2" "environment" {
+  count = var.create_network ? 1 : 0
+
+  name           = var.network_name
+  admin_state_up = true
+}
+
+resource "openstack_networking_subnet_v2" "environment" {
+  count = var.create_network ? 1 : 0
+
+  name       = var.subnet_name
+  network_id = openstack_networking_network_v2.environment[0].id
+  cidr       = var.subnet_cidr
+  ip_version = 4
+}
+
+resource "openstack_networking_router_v2" "environment" {
+  count = var.create_router && var.create_network && trimspace(var.external_network_id) != "" ? 1 : 0
+
+  name                = var.router_name
+  admin_state_up      = true
+  external_network_id = var.external_network_id
+}
+
+resource "openstack_networking_router_interface_v2" "environment" {
+  count = length(openstack_networking_router_v2.environment) > 0 ? 1 : 0
+
+  router_id = openstack_networking_router_v2.environment[0].id
+  subnet_id = openstack_networking_subnet_v2.environment[0].id
+}
+
+data "openstack_images_image_v2" "host" {
+  name = var.image_name
+}
+
+data "openstack_compute_flavor_v2" "host" {
+  name = var.flavor_name
+}
+
+resource "openstack_networking_secgroup_v2" "host" {
+  name        = "${var.name}-secgroup"
+  description = "Security group for ${var.name} docker host"
+}
+
+resource "openstack_networking_secgroup_rule_v2" "ssh" {
+  for_each = { for rule in local.ssh_ingress_rules : rule.key => rule }
+
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = "tcp"
+  port_range_min    = 22
+  port_range_max    = 22
+  remote_ip_prefix  = each.value.cidr
+  security_group_id = openstack_networking_secgroup_v2.host.id
+}
+
+resource "openstack_networking_secgroup_rule_v2" "service" {
+  for_each = { for rule in local.service_ingress_rules : rule.key => rule }
+
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = "tcp"
+  port_range_min    = each.value.port
+  port_range_max    = each.value.port
+  remote_ip_prefix  = each.value.cidr
+  security_group_id = openstack_networking_secgroup_v2.host.id
+}
+
+resource "openstack_networking_port_v2" "host" {
+  name               = "${var.name}-port"
+  network_id         = local.effective_network_id
+  admin_state_up     = true
+  security_group_ids = [openstack_networking_secgroup_v2.host.id]
+
+  dynamic "fixed_ip" {
+    for_each = local.effective_subnet_id != "" ? [local.effective_subnet_id] : []
+    content {
+      subnet_id = fixed_ip.value
+    }
+  }
+}
+
+resource "openstack_compute_instance_v2" "host" {
+  name              = var.name
+  image_id          = data.openstack_images_image_v2.host.id
+  flavor_id         = data.openstack_compute_flavor_v2.host.id
+  key_pair          = trimspace(var.keypair_name) != "" ? var.keypair_name : null
+  availability_zone = trimspace(var.availability_zone) != "" ? var.availability_zone : null
+  config_drive      = true
+  user_data = templatefile("${path.module}/templates/docker-host-user-data.sh.tftpl", {
+    environment_name           = var.name
+    repo_clone_url             = var.repo_clone_url
+    repo_ref                   = var.repo_ref
+    compose_file               = var.compose_file
+    compose_env_filename       = var.compose_env_filename
+    compose_env_content_base64 = base64encode(var.compose_env_content)
+    deploy_compose_on_boot     = var.deploy_compose_on_boot ? "true" : "false"
+  })
+
+  network {
+    port = openstack_networking_port_v2.host.id
+  }
+}
+
+resource "openstack_networking_floatingip_v2" "host" {
+  count = var.assign_floating_ip && trimspace(var.floating_ip_pool) != "" ? 1 : 0
+
+  pool = var.floating_ip_pool
+}
+
+resource "openstack_networking_floatingip_associate_v2" "host" {
+  count = length(openstack_networking_floatingip_v2.host) > 0 ? 1 : 0
+
+  floating_ip = openstack_networking_floatingip_v2.host[0].address
+  port_id     = openstack_networking_port_v2.host.id
+}

package/infra/terraform/openstack/modules/environment_host/outputs.tf

@@ -0,0 +1,25 @@
+output "network_id" {
+  description = "Effective network id used by the environment host"
+  value       = local.effective_network_id
+}
+
+output "subnet_id" {
+  description = "Effective subnet id used by the environment host"
+  value       = local.effective_subnet_id
+}
+
+output "router_id" {
+  description = "Created router id when create_router=true"
+  value       = length(openstack_networking_router_v2.environment) > 0 ? openstack_networking_router_v2.environment[0].id : ""
+}
+
+output "instance" {
+  description = "Environment host summary"
+  value = {
+    id           = openstack_compute_instance_v2.host.id
+    name         = openstack_compute_instance_v2.host.name
+    fixed_ip     = try(openstack_compute_instance_v2.host.network[0].fixed_ip_v4, "")
+    floating_ip  = try(openstack_networking_floatingip_v2.host[0].address, "")
+    compose_file = var.compose_file
+  }
+}

package/infra/terraform/openstack/modules/environment_host/templates/docker-host-user-data.sh.tftpl

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+export DEBIAN_FRONTEND=noninteractive
+
+apt-get update
+apt-get install -y ca-certificates curl git
+
+install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+chmod a+r /etc/apt/keyrings/docker.asc
+
+. /etc/os-release
+echo \
+  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
+  $${VERSION_CODENAME} stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
+
+apt-get update
+apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+systemctl enable docker
+systemctl start docker
+
+%{ if repo_clone_url != "" && deploy_compose_on_boot == "true" ~}
+mkdir -p /opt/templates
+cd /opt/templates
+
+if [ ! -d repo ]; then
+  git clone "${repo_clone_url}" repo
+fi
+
+cd repo
+git fetch --all --tags
+git checkout "${repo_ref}"
+
+cat <<'ENVEOF' > "${compose_env_filename}"
+${base64decode(compose_env_content_base64)}
+ENVEOF
+
+docker compose --env-file "${compose_env_filename}" -f "${compose_file}" up -d --build
+%{ endif ~}

package/infra/terraform/openstack/modules/environment_host/variables.tf

@@ -0,0 +1,145 @@
+variable "availability_zone" {
+  description = "Optional availability zone for the environment host"
+  type        = string
+  default     = ""
+}
+
+variable "create_network" {
+  description = "Create a dedicated network and subnet for this environment"
+  type        = bool
+  default     = false
+}
+
+variable "network_name" {
+  description = "Environment network name"
+  type        = string
+}
+
+variable "subnet_name" {
+  description = "Environment subnet name"
+  type        = string
+}
+
+variable "subnet_cidr" {
+  description = "Environment subnet CIDR"
+  type        = string
+}
+
+variable "create_router" {
+  description = "Create a router and attach the created subnet to the external network"
+  type        = bool
+  default     = false
+}
+
+variable "router_name" {
+  description = "Environment router name"
+  type        = string
+}
+
+variable "external_network_id" {
+  description = "External network id used by the router gateway"
+  type        = string
+  default     = ""
+}
+
+variable "network_id" {
+  description = "Existing network id to reuse when create_network=false"
+  type        = string
+  default     = ""
+
+  validation {
+    condition     = var.create_network || trimspace(var.network_id) != ""
+    error_message = "network_id must be set when create_network=false."
+  }
+}
+
+variable "subnet_id" {
+  description = "Existing subnet id to reuse when create_network=false"
+  type        = string
+  default     = ""
+}
+
+variable "service_allowed_cidrs" {
+  description = "CIDR list allowed to reach published application ports"
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
+variable "ssh_allowed_cidrs" {
+  description = "CIDR list allowed to reach SSH on the environment host"
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
+variable "name" {
+  description = "Environment host name"
+  type        = string
+}
+
+variable "image_name" {
+  description = "OpenStack image name"
+  type        = string
+}
+
+variable "flavor_name" {
+  description = "OpenStack flavor name"
+  type        = string
+}
+
+variable "keypair_name" {
+  description = "OpenStack keypair name"
+  type        = string
+  default     = ""
+}
+
+variable "assign_floating_ip" {
+  description = "Allocate and associate a floating IP"
+  type        = bool
+  default     = false
+}
+
+variable "floating_ip_pool" {
+  description = "Floating IP pool name"
+  type        = string
+  default     = ""
+}
+
+variable "exposed_tcp_ports" {
+  description = "TCP ports exposed by the environment stack"
+  type        = list(number)
+  default     = []
+}
+
+variable "repo_clone_url" {
+  description = "Optional repository clone URL for boot-time deployment"
+  type        = string
+  default     = ""
+}
+
+variable "repo_ref" {
+  description = "Git ref used for boot-time deployment"
+  type        = string
+  default     = "main"
+}
+
+variable "compose_file" {
+  description = "Compose file path relative to the cloned repo"
+  type        = string
+}
+
+variable "compose_env_filename" {
+  description = "Compose env file name written on the host"
+  type        = string
+}
+
+variable "compose_env_content" {
+  description = "Full env file content used for compose boot deployment"
+  type        = string
+  default     = ""
+}
+
+variable "deploy_compose_on_boot" {
+  description = "Clone the repo and run docker compose on first boot"
+  type        = bool
+  default     = false
+}

package/infra/terraform/openstack/modules/environment_host/versions.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_providers {
+    openstack = {
+      source = "terraform-provider-openstack/openstack"
+    }
+  }
+}

package/infra/terraform/openstack/prod/.terraform.lock.hcl

@@ -0,0 +1,24 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/terraform-provider-openstack/openstack" {
+  version     = "2.1.0"
+  constraints = "~> 2.1"
+  hashes = [
+    "h1:2TcmfEzBOGQPALErrXTaL6v+k/WAL40adao4izRYmdw=",
+    "zh:113661750398bf21c8fe36aade9fb6f5eb82b5bcd3bcd30bd37ac805d83398f4",
+    "zh:1b3c26347b9cd61e413ee93c2f422cc3278a77f55fd3516eaabb3e2a85f65281",
+    "zh:1b751bbf1e4152829a643b532fd3f5967a2e89a41fac381257e0b41665be3306",
+    "zh:1b967bbfd9b344419c0e0df0c3a15fcbd731e91f19a18955a55aace8d9ec039a",
+    "zh:1bc0fc7c0a21e568db043b654501ce668ba19bf7628d37a7d2aaa512fd6e5aeb",
+    "zh:425cbf61757d4b503e7bf0f409ea59835ca3afbd2432d56ad552c2e5d234a572",
+    "zh:67d4f059cb4d73bf6c060313ec32962c4e5bd8dc7be2542a6f2098ab32575cd9",
+    "zh:7fe841ac5b68a4f52fb3cf45070828f3845de44746679d434e4349f3c23e3ef2",
+    "zh:ac1ed4c6ef0b6a3410568a05d3f9933d184497f065988503c43da0b2f0786ab2",
+    "zh:c5c0d14c86fabd9ab6a5d555e6a8d511942665fb5fa948dd452b0d1934068344",
+    "zh:c9ae5c210192275185d6823566a9421983e8e64c2665a4cae00b92dd0706bd19",
+    "zh:ee9865ccc053e7f345e532654fb628d1cf1e81cd2e929643c1691bebffcf7b98",
+    "zh:f3416d2f666095e740522c4964e436470bb9ec17bd53aaae8169ad93297d07bd",
+    "zh:fbca85457dd49e17168989d64f7cfc4a519d55ef4e00e89cea2859e87ad87f83",
+  ]
+}

package/infra/terraform/openstack/prod/README.md

@@ -0,0 +1,18 @@
+# OpenStack PROD
+
+PROD 전용 Terraform root다.
+
+사용:
+
+```bash
+cd infra/terraform/openstack/prod
+cp terraform.tfvars.example terraform.tfvars
+terraform init
+terraform validate
+terraform plan
+```
+
+메모:
+
+- 기본 compose 파일은 `infra/compose/prod.yml`이다.
+- cloud-init 자동 기동을 쓰려면 `compose_env_content`에 `infra/compose/.env.prod` 전체를 넣는다.

package/infra/terraform/openstack/prod/main.tf

@@ -0,0 +1,49 @@
+module "environment_host" {
+  source = "../modules/environment_host"
+
+  availability_zone      = var.availability_zone
+  create_network         = var.create_network
+  network_name           = var.network_name
+  subnet_name            = var.subnet_name
+  subnet_cidr            = var.subnet_cidr
+  create_router          = var.create_router
+  router_name            = var.router_name
+  external_network_id    = var.external_network_id
+  network_id             = var.network_id
+  subnet_id              = var.subnet_id
+  service_allowed_cidrs  = var.service_allowed_cidrs
+  ssh_allowed_cidrs      = var.ssh_allowed_cidrs
+  name                   = var.name
+  image_name             = var.image_name
+  flavor_name            = var.flavor_name
+  keypair_name           = var.keypair_name
+  assign_floating_ip     = var.assign_floating_ip
+  floating_ip_pool       = var.floating_ip_pool
+  exposed_tcp_ports      = var.exposed_tcp_ports
+  repo_clone_url         = var.repo_clone_url
+  repo_ref               = var.repo_ref
+  compose_file           = "infra/compose/prod.yml"
+  compose_env_filename   = ".env.prod"
+  compose_env_content    = var.compose_env_content
+  deploy_compose_on_boot = var.deploy_compose_on_boot
+}
+
+output "network_id" {
+  description = "Effective network id used by the PROD host"
+  value       = module.environment_host.network_id
+}
+
+output "subnet_id" {
+  description = "Effective subnet id used by the PROD host"
+  value       = module.environment_host.subnet_id
+}
+
+output "router_id" {
+  description = "Created router id when create_router=true"
+  value       = module.environment_host.router_id
+}
+
+output "instance" {
+  description = "PROD host summary"
+  value       = module.environment_host.instance
+}

package/infra/terraform/openstack/prod/providers.tf

@@ -0,0 +1,15 @@
+provider "openstack" {
+  auth_url      = var.auth_url
+  region        = var.region
+  endpoint_type = var.interface
+  insecure      = var.insecure
+
+  user_name           = var.auth_type == "password" ? var.username : null
+  password            = var.auth_type == "password" ? var.password : null
+  tenant_name         = var.auth_type == "password" ? var.project_name : null
+  user_domain_name    = var.auth_type == "password" ? var.user_domain_name : null
+  project_domain_name = var.auth_type == "password" ? var.project_domain_name : null
+
+  application_credential_id     = var.auth_type == "application_credential" ? var.application_credential_id : null
+  application_credential_secret = var.auth_type == "application_credential" ? var.application_credential_secret : null
+}

package/infra/terraform/openstack/prod/terraform.tfvars.example

@@ -0,0 +1,55 @@
+auth_url      = "https://keystone.example.com:5000/v3"
+region        = "RegionOne"
+interface     = "public"
+auth_type     = "password"
+username      = "prodops"
+password      = "change-me"
+project_name  = "service-prod"
+user_domain_name    = "Default"
+project_domain_name = "Default"
+insecure      = false
+
+create_network      = true
+network_name        = "templates-prod-net"
+subnet_name         = "templates-prod-subnet"
+subnet_cidr         = "10.250.20.0/24"
+create_router       = true
+router_name         = "templates-prod-router"
+external_network_id = "public"
+
+service_allowed_cidrs = ["0.0.0.0/0"]
+ssh_allowed_cidrs     = ["203.0.113.10/32"]
+
+name               = "templates-prod"
+image_name         = "ubuntu-22.04"
+flavor_name        = "m1.large"
+keypair_name       = "prodops"
+assign_floating_ip = true
+floating_ip_pool   = "public"
+repo_clone_url     = "git@github.com:your-org/templates.git"
+repo_ref           = "main"
+deploy_compose_on_boot = true
+compose_env_content = <<-ENV
+  PROD_POSTGRES_DB=template
+  PROD_POSTGRES_USER=template
+  PROD_POSTGRES_PASSWORD=template
+  PROD_POSTGRES_PORT=25432
+  PROD_SERVER_HTTP_PORT=28000
+  PROD_SERVER_WORKERS=4
+  PROD_SERVER_APP_NAME=Template Server PROD
+  PROD_SERVER_ENVIRONMENT=production
+  PROD_SERVER_API_PREFIX=/api/v1
+  PROD_SERVER_DATABASE_BACKEND=postgres
+  PROD_SERVER_POSTGRES_URL=postgresql+psycopg://template:template@postgres:5432/template
+  PROD_SERVER_JWT_SECRET=change-me
+  PROD_SERVER_ACCESS_TOKEN_TTL_MINUTES=120
+  PROD_SERVER_CORS_ORIGINS=https://landing.example.com,https://platform.example.com,https://mobile.example.com,https://admin.example.com
+  PROD_CLIENT_LANDING_PORT=23000
+  PROD_CLIENT_PLATFORM_PORT=23001
+  PROD_CLIENT_MOBILE_PORT=23002
+  PROD_CLIENT_ADMIN_PORT=24000
+  PROD_CLIENT_LANDING_VITE_API_BASE_URL=https://api.example.com/api/v1
+  PROD_CLIENT_PLATFORM_VITE_API_BASE_URL=https://api.example.com/api/v1
+  PROD_CLIENT_MOBILE_VITE_API_BASE_URL=https://api.example.com/api/v1
+  PROD_CLIENT_ADMIN_VITE_API_BASE_URL=https://api.example.com/api/v1
+ENV