brigitte/but3-iac
1
0
Fork 0
forked from pierront/but3-iac
Code Pull Requests Activity

marche ptn

Browse Source
This commit is contained in:
Wilfried BRIGITTE
2025-12-03 16:34:43 +01:00
parent 370e3e3aa2
commit eebd1ba3d3
15 changed files with 184 additions and 350 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
terraform/environements/dev/main.tf
View File

@@ -1,42 +0,0 @@
# Provider Google
provider "google" {
project = var.project_id
region = var.region
zone = var.zone
}
# Module IAM
module "iam" {
source = "../../modules/iam"
project_id = var.project_id
}
# Module Compute
module "compute" {
source = "../../modules/compute"
instance_type = var.instance_type
zone = var.zone
frontend_subnet_id = var.frontend_subnet_id
backend_subnet_id = var.backend_subnet_id
database_subnet_id = var.database_subnet_id
}
# Exemple de création d'un template pour Ansible
data "template_file" "ansible_inventory" {
template = <<EOT
[frontend]
${module.compute.frontend_internal_ip} ansible_user=YOUR_SSH_USER
[backend]
${module.compute.backend_internal_ip} ansible_user=YOUR_SSH_USER
[database]
${module.compute.database_internal_ip} ansible_user=YOUR_SSH_USER
EOT
}
# Optionnel : écrire le fichier sur le disque
resource "local_file" "ansible_inventory" {
content = data.template_file.ansible_inventory.rendered
filename = "${path.module}/inventory.ini"
}

35
terraform/environements/dev/outputs.tf
View File

@@ -1,35 +0,0 @@
# Outputs du module Compute
output "frontend_internal_ip" {
value = module.compute.frontend_internal_ip
}
output "backend_internal_ip" {
value = module.compute.backend_internal_ip
}
output "database_internal_ip" {
value = module.compute.database_internal_ip
}
output "frontend_public_ip" {
value = module.compute.frontend_public_ip
}
output "instance_names" {
value = module.compute.instance_names
}
# Outputs du module IAM
output "service_account_email" {
value = module.iam.service_account_email
}
output "service_account_key" {
value = module.iam.service_account_key
sensitive = true
}
# Output du fichier Ansible généré
output "ansible_inventory_file" {
value = local_file.ansible_inventory.filename
}

41
terraform/environements/dev/variables.tf
View File

@@ -1,41 +0,0 @@
# Variables pour le projet GCP
variable "project_id" {
description = "ID du projet GCP"
type = string
default = "mon-projet-gcp-dev"
}
variable "region" {
description = "Région GCP"
type = string
default = "europe-west1"
}
variable "zone" {
description = "Zone GCP"
type = string
default = "europe-west1-b"
}
# Variables pour les subnets
variable "frontend_subnet_id" {
description = "ID du subnet frontend"
type = string
}
variable "backend_subnet_id" {
description = "ID du subnet backend"
type = string
}
variable "database_subnet_id" {
description = "ID du subnet database"
type = string
}
# Type d'instance par défaut
variable "instance_type" {
description = "Type d'instance pour Compute"
type = string
default = "e2-medium"
}

28
terraform/environments/dev/main.tf Normal file
View File

@@ -0,0 +1,28 @@
# À vous de :
# 1. Configurer le provider google
# 2. Appeler les trois modules avec les bonnes variables
# 3. Créer le fichier de configuration Ansible (template)
terraform {
required_providers {
google = {
source = "hashicorp/google"
version = "~> 6.12.0"
}
}
}
provider "google" {
project = var.project_id
region = var.region
}
module "network" {
source = "../../modules/network"
project_name = var.project_name
region = var.region
frontend_cidr = var.frontend_cidr
backend_cidr = var.backend_cidr
database_cidr = var.database_cidr
ssh_source_ranges = var.ssh_source_ranges
}

0
terraform/environments/dev/outputs.tf Normal file
View File

43
terraform/environments/dev/variables.tf Normal file
View File

@@ -0,0 +1,43 @@
# définissez toutes les variables nécessaires avec des valeurs par défaut appropriées.
variable "project_name" {
description = "Nom du projet"
type = string
default = "My First Project"
}
variable "region" {
description = "Region du projet"
type = string
default = "europe-west9"
}
variable "frontend_cidr" {
description = "CIDR for frontend subnet"
type = string
default = "10.0.1.0/24"
}
variable "backend_cidr" {
description = "CIDR for backend subnet"
type = string
default = "10.0.2.0/24"
}
variable "database_cidr" {
description = "CIDR for database subnet"
type = string
default = "10.0.3.0/24"
}
variable "ssh_source_ranges" {
description = ""
type = string
default = "0.0.0.0/0"
}
variable "project_id" {
description = "ID du projet"
type = string
default = "glossy-handler-478713-i1"
}

87
terraform/modules/compute/main.tf
View File

@@ -1,71 +1,22 @@
resource "google_compute_instance" "frontend" {
name = "frontend"
machine_type = var.instance_type
zone = var.zone
# À vous de créer :
boot_disk {
initialize_params {
image = "debian-cloud/debian-11"
size = 10
}
}
# 1. Instance frontend :
# - Image : debian-11
# - Disque : 10GB
# - IP publique
# - Tags : frontend, ssh
# - OS Login enabled
network_interface {
subnetwork = var.frontend_subnet_id
access_config {} # IP publique
}
# 2. Instance backend :
# - Image : debian-11
# - Disque : 10GB
# - Pas d'IP publique (interne seulement)
# - Tags : backend, ssh
# - OS Login enabled
metadata = {
enable-oslogin = "TRUE"
}
tags = ["frontend", "ssh"]
}
resource "google_compute_instance" "backend" {
name = "backend"
machine_type = var.instance_type
zone = var.zone
boot_disk {
initialize_params {
image = "debian-cloud/debian-11"
size = 10
}
}
network_interface {
subnetwork = var.backend_subnet_id
# Pas d'IP publique
}
metadata = {
enable-oslogin = "TRUE"
}
tags = ["backend", "ssh"]
}
resource "google_compute_instance" "database" {
name = "database"
machine_type = var.instance_type
zone = var.zone
boot_disk {
initialize_params {
image = "debian-cloud/debian-11"
size = 20
}
}
network_interface {
subnetwork = var.database_subnet_id
# Pas d'IP publique
}
metadata = {
enable-oslogin = "TRUE"
}
tags = ["database", "ssh"]
}
# 3. Instance database :
# - Image : debian-11
# - Disque : 20GB
# - Pas d'IP publique
# - Tags : database, ssh
# - OS Login enabled

27
terraform/modules/compute/outputs.tf
View File

@@ -1,23 +1,4 @@
output "frontend_internal_ip" {
value = google_compute_instance.frontend.network_interface[0].network_ip
}
output "backend_internal_ip" {
value = google_compute_instance.backend.network_interface[0].network_ip
}
output "database_internal_ip" {
value = google_compute_instance.database.network_interface[0].network_ip
}
output "frontend_public_ip" {
value = google_compute_instance.frontend.network_interface[0].access_config[0].nat_ip
}
output "instance_names" {
value = [
google_compute_instance.frontend.name,
google_compute_instance.backend.name,
google_compute_instance.database.name
]
}
# À vous d'exposer :
# 1. Les IPs internes de toutes les instances
# 2. L'IP publique du frontend
# 3. Les noms des instances

32
terraform/modules/compute/variables.tf
View File

@@ -1,26 +1,6 @@
variable "instance_type" {
description = "Type de machine pour les instances"
type = string
default = "e2-medium"
}
variable "zone" {
description = "Zone où seront déployées les instances"
type = string
default = "europe-west1-b"
}
variable "frontend_subnet_id" {
description = "ID du subnet pour le frontend"
type = string
}
variable "backend_subnet_id" {
description = "ID du subnet pour le backend"
type = string
}
variable "database_subnet_id" {
description = "ID du subnet pour la base de données"
type = string
}
# À vous de définir les variables pour :
# - instance_type
# - zone
# - frontend_subnet_id
# - backend_subnet_id
# - database_subnet_id

47
terraform/modules/iam/main.tf
View File

@@ -1,42 +1,5 @@
# Création du compte de service Terraform
resource "google_service_account" "terraform" {
account_id = "terraform-sa"
display_name = "Terraform Service Account"
project = var.project_id
}
# Création de la clé pour le compte de service
resource "google_service_account_key" "terraform_key" {
service_account_id = google_service_account.terraform.name
keepers = {
# Permet de régénérer la clé si besoin
project = var.project_id
}
}
# Attribution de rôles IAM
# Exemples de rôles pour pouvoir gérer Compute, IAM et OS Login
resource "google_project_iam_member" "compute_admin" {
project = var.project_id
role = "roles/compute.admin"
member = "serviceAccount:${google_service_account.terraform.email}"
}
resource "google_project_iam_member" "iam_admin" {
project = var.project_id
role = "roles/iam.serviceAccountAdmin"
member = "serviceAccount:${google_service_account.terraform.email}"
}
resource "google_project_iam_member" "oslogin" {
project = var.project_id
role = "roles/compute.osLogin"
member = "serviceAccount:${google_service_account.terraform.email}"
}
# Configuration d'OS Login avec clé SSH
resource "google_compute_project_metadata_item" "enable_oslogin" {
project = var.project_id
key = "enable-oslogin"
value = "TRUE"
}
# À vous de créer :
# 1. Un compte de service pour Terraform
# 2. Une clé pour ce compte de service
# 3. Les rôles IAM nécessaires
# 4. La configuration OS Login avec votre clé SSH

11
terraform/modules/iam/outputs.tf
View File

@@ -1,8 +1,3 @@
output "service_account_email" {
value = google_service_account.terraform.email
}
output "service_account_key" {
value = google_service_account_key.terraform_key.private_key
sensitive = true
}
# À vous d'exposer :
# 1. L'email du compte de service
# 2. La clé du compte de service (sensitive = true)

6
terraform/modules/iam/variables.tf
View File

@@ -1,4 +1,2 @@
variable "project_id" {
description = "ID du projet GCP"
type = string
}
# À vous de définir :
# - project_id (string)

85
terraform/modules/network/main.tf
View File

@@ -1,37 +1,43 @@
provider "google" {
project = var.project_name
region = var.region
}
# À vous de créer :
# 1. Un VPC personnalisé avec auto_create_subnetworks = false
# 2. Trois sous-réseaux (frontend, backend, database)
# 3. Règles de firewall :
# - HTTP/HTTPS vers frontend
# - SSH vers toutes les instances
# - Port 8000 de frontend vers backend
# - Port 3306 de backend vers database
resource "google_compute_network" "custom_vpc" {
name = "${var.project_name}-vpc"
# VPC
resource "google_compute_network" "vpc_terraform" {
name = "vpc-terraform"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "frontend" {
name = "${var.project_name}-frontend-subnet"
# Sous-réseau
resource "google_compute_subnetwork" "subnet_frontend" {
name = "frontend"
network = google_compute_network.vpc_terraform.id
ip_cidr_range = var.frontend_cidr
network = google_compute_network.custom_vpc.id
region = var.region
}
resource "google_compute_subnetwork" "backend" {
name = "${var.project_name}-backend-subnet"
resource "google_compute_subnetwork" "subnet_backend" {
name = "backend"
network = google_compute_network.vpc_terraform.id
ip_cidr_range = var.backend_cidr
network = google_compute_network.custom_vpc.id
region = var.region
}
resource "google_compute_subnetwork" "database" {
name = "${var.project_name}-database-subnet"
resource "google_compute_subnetwork" "subnet_database" {
name = "database"
network = google_compute_network.vpc_terraform.id
ip_cidr_range = var.database_cidr
network = google_compute_network.custom_vpc.id
region = var.region
}
resource "google_compute_firewall" "frontend_http_https" {
name = "${var.project_name}-frontend-http-https"
network = google_compute_network.custom_vpc.id
resource "google_compute_firewall" "allow_user_frontend" {
name = "allow-user-frontend"
network = google_compute_network.vpc_terraform.id
allow {
protocol = "tcp"
@@ -42,21 +48,9 @@ resource "google_compute_firewall" "frontend_http_https" {
target_tags = ["frontend"]
}
resource "google_compute_firewall" "ssh" {
name = "${var.project_name}-ssh"
network = google_compute_network.custom_vpc.id
allow {
protocol = "tcp"
ports = ["22"]
}
source_ranges = [var.ssh_source_ranges]
}
resource "google_compute_firewall" "frontend_to_backend" {
name = "${var.project_name}-frontend-to-backend"
network = google_compute_network.custom_vpc.id
resource "google_compute_firewall" "allow_frontend_backend" {
name = "allow-frontend-backend"
network = google_compute_network.vpc_terraform.id
allow {
protocol = "tcp"
@@ -64,12 +58,25 @@ resource "google_compute_firewall" "frontend_to_backend" {
}
source_tags = ["frontend"]
target_tags = ["backend"]
target_tags = ["backend"]
}
resource "google_compute_firewall" "backend_to_database" {
name = "${var.project_name}-backend-to-database"
network = google_compute_network.custom_vpc.id
resource "google_compute_firewall" "allow_ssh_all" {
name = "allow-ssh-all"
network = google_compute_network.vpc_terraform.id
allow {
protocol = "tcp"
ports = ["22"]
}
source_ranges = ["0.0.0.0/0"]
target_tags = ["ssh"]
}
resource "google_compute_firewall" "allow_backend_database" {
name = "allow-backend-database"
network = google_compute_network.vpc_terraform.id
allow {
protocol = "tcp"
@@ -77,5 +84,5 @@ resource "google_compute_firewall" "backend_to_database" {
}
source_tags = ["backend"]
target_tags = ["database"]
}
target_tags = ["database"]
}

24
terraform/modules/network/outputs.tf
View File

@@ -1,13 +1,15 @@
output "vpc_id" {
description = "ID du VPC créé"
value = google_compute_network.custom_vpc.id
# À vous d'exposer :
# 1. L'ID du VPC
# 2. Les IDs des sous-réseaux sous forme de map
output "vpc_terraform_output" {
value = google_compute_network.vpc_terraform.id
}
output "subnet_ids" {
description = "IDs des sous-réseaux"
value = {
frontend = google_compute_subnetwork.frontend.id
backend = google_compute_subnetwork.backend.id
database = google_compute_subnetwork.database.id
}
}
output "list_id" {
value = {
frontend = google_compute_subnetwork.subnet_frontend.id
backend = google_compute_subnetwork.subnet_backend.id
database = google_compute_subnetwork.subnet_database.id
}
}

26
terraform/modules/network/variables.tf
View File

@@ -1,33 +1,37 @@
# À vous de définir les variables pour :
# - project_name (string)
# - region (string)
# - frontend_cidr (string)
# - backend_cidr (string)
# - database_cidr (string)
# - ssh_source_ranges (string)
variable "project_name" {
description = "Nom du projet GCP"
description = "Nom du projet"
type = string
}
variable "region" {
description = "Région pour le VPC et les sous-réseaux"
type = string
}
variable "ssh_source_ranges" {
description = "Plages IP autorisées pour SSH"
description = "Region du projet"
type = string
}
variable "frontend_cidr" {
description = "CIDR for frontend subnet"
type = string
default = "10.0.1.0/24"
}
variable "backend_cidr" {
description = "CIDR for backend subnet"
type = string
default = "10.0.2.0/24"
}
variable "database_cidr" {
description = "CIDR for database subnet"
type = string
default = "10.0.3.0/24"
}
variable "ssh_source_ranges" {
description = ""
type = string
}