gallego/but3-iac
1
0
Fork 0
forked from pierront/but3-iac
Code Pull Requests Activity

test

Browse Source
This commit is contained in:
Julian GALLEGO
2025-12-04 11:16:29 +01:00
parent 47814729f3
commit b81682e58e
12 changed files with 176 additions and 296 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
terraform/environments/dev/main.tf
View File

@@ -15,23 +15,23 @@ provider "google" {
module "network" { module "network" {
source = "../../modules/network" source = "../../modules/network"
project_name = var.project_name project_name = var.project_name
region = var.region region = var.region
frontend_cidr = var.frontend_cidr frontend_cidr = var.frontend_cidr
backend_cidr = var.backend_cidr backend_cidr = var.backend_cidr
database_cidr = var.database_cidr database_cidr = var.database_cidr
ssh_source_ranges = var.ssh_source_ranges ssh_source_ranges = var.ssh_source_ranges
} }
module "compute" { module "compute" {
source = "../modules/compute" source = "../../modules/compute"
instance_type = "e2-medium" instance_type = var.instance_type
zone = var.zone zone = var.zone
frontend_subnet_id = module.network.subnet_ids["frontend"] frontend_subnet_id = module.network.subnets.frontend
backend_subnet_id = module.network.subnet_ids["backend"] backend_subnet_id = module.network.subnets.backend
database_subnet_id = module.network.subnet_ids["database"] database_subnet_id = module.network.subnets.database
} }
module "iam" { module "iam" {
source = "../modules/iam" source = "../../modules/iam"
project_id = var.project_id project_id = var.project_id
} }

34
terraform/environments/dev/outputs.tf
View File

@@ -1,25 +1,13 @@
output "frontend_ip" { output "ip_internes" {
value = module.compute.frontend_ip value = module.compute.ip_internes
} }
output "backend_ip" { output "ip_public_frontend" {
value = module.compute.backend_ip value = module.compute.ip_public_frontend
} }
output "database_ip" { output "nom_instances" {
value = module.compute.database_ip value = module.compute.nom_instances
}
output "instance_names" {
value = module.compute.instance_names
}
output "vpc_id" {
value = module.network.vpc_id
}
output "subnet_ids" {
value = module.network.subnet_ids
} }
output "service_account_email" { output "service_account_email" {
@@ -27,6 +15,14 @@ output "service_account_email" {
} }
output "service_account_key" { output "service_account_key" {
value = module.iam.service_account_key
sensitive = true sensitive = true
value = module.iam.service_account_key
}
output "vpc" {
value = module.network.vpc
}
output "subnets" {
value = module.network.subnets
} }

68
terraform/environments/dev/variables.tf
View File

@@ -1,70 +1,54 @@
variable "project_id" {
type = string
description = "ID du projet GCP."
default = "ok"
}
variable "instance_type" {
type = string
description = "Type de machine pour les instances."
default = "e2-small"
}
variable "zone" {
type = string
description = "Zone GCP où déployer les instances."
default = "europe-west9-b"
}
variable "frontend_subnet_id" {
type = string
description = "ID du sous réseau frontend."
default = ""
}
variable "backend_subnet_id" {
type = string
description = "ID du sous-réseau backend."
default = ""
}
variable "database_subnet_id" {
type = string
description = "ID du sous-réseau database."
default = ""
}
variable "project_name" { variable "project_name" {
description = "Nom du projet"
type = string type = string
description = "Nom du projet." default = "My First Project"
default = "ok"
} }
variable "region" { variable "region" {
description = "Region du projet"
type = string type = string
description = "Région où seront déployées les ressources réseau." default = "europe-west9"
default = "europe-west9-b"
} }
variable "frontend_cidr" { variable "frontend_cidr" {
description = "CIDR for frontend subnet"
type = string type = string
description = "CIDR du sous-réseau frontend."
default = "10.0.1.0/24" default = "10.0.1.0/24"
} }
variable "backend_cidr" { variable "backend_cidr" {
description = "CIDR for backend subnet"
type = string type = string
description = "CIDR du sous-réseau backend."
default = "10.0.2.0/24" default = "10.0.2.0/24"
} }
variable "database_cidr" { variable "database_cidr" {
description = "CIDR for database subnet"
type = string type = string
description = "CIDR du sous-réseau base de données."
default = "10.0.3.0/24" default = "10.0.3.0/24"
} }
variable "ssh_source_ranges" { variable "ssh_source_ranges" {
description = ""
type = string type = string
description = "Plages d’adresses autorisées pour l’accès SSH."
default = "0.0.0.0/0" default = "0.0.0.0/0"
} }
variable "project_id" {
description = "ID du projet"
type = string
default = "learned-iris-359617"
}
variable "instance_type" {
description = "type de l'instance"
type = string
default = "e2-small"
}
variable "zone" {
description = "Nom de la zone"
type = string
default = "europe-west9-b"
}

50
terraform/modules/compute/main.tf
View File

@@ -1,23 +1,8 @@
############################################
# FONCTION COMMUNE POUR OS LOGIN
############################################
resource "google_compute_project_metadata_item" "enable_oslogin" { resource "google_compute_instance" "vm_frontend" {
project = var.project_id name = "vm-frontend"
key = "enable-oslogin"
value = "TRUE"
}
############################################
# 1. INSTANCE FRONTEND
############################################
resource "google_compute_instance" "frontend" {
project = var.project_id
name = "frontend-instance"
machine_type = var.instance_type machine_type = var.instance_type
zone = var.zone zone = var.zone
tags = ["frontend", "ssh"]
boot_disk { boot_disk {
initialize_params { initialize_params {
@@ -27,26 +12,21 @@ resource "google_compute_instance" "frontend" {
} }
network_interface { network_interface {
subnetwork = var.frontend_subnet_id
access_config {} # IP publique access_config {} # IP publique
subnetwork = var.frontend_subnet_id
} }
tags = ["frontend", "ssh"]
metadata = { metadata = {
enable-oslogin = "TRUE" enable-oslogin = "TRUE"
} }
} }
############################################ resource "google_compute_instance" "vm_backend" {
# 2. INSTANCE BACKEND name = "vm-backend"
############################################
resource "google_compute_instance" "backend" {
project = var.project_id
name = "backend-instance"
machine_type = var.instance_type machine_type = var.instance_type
zone = var.zone zone = var.zone
tags = ["backend", "ssh"]
boot_disk { boot_disk {
initialize_params { initialize_params {
@@ -57,24 +37,19 @@ resource "google_compute_instance" "backend" {
network_interface { network_interface {
subnetwork = var.backend_subnet_id subnetwork = var.backend_subnet_id
# Pas d'IP publique → aucun access_config
} }
tags = ["backend", "ssh"]
metadata = { metadata = {
enable-oslogin = "TRUE" enable-oslogin = "TRUE"
} }
} }
############################################ resource "google_compute_instance" "vm_database" {
# 3. INSTANCE DATABASE name = "vm-database"
############################################
resource "google_compute_instance" "database" {
project = var.project_id
name = "database-instance"
machine_type = var.instance_type machine_type = var.instance_type
zone = var.zone zone = var.zone
tags = ["database", "ssh"]
boot_disk { boot_disk {
initialize_params { initialize_params {
@@ -85,9 +60,10 @@ resource "google_compute_instance" "database" {
network_interface { network_interface {
subnetwork = var.database_subnet_id subnetwork = var.database_subnet_id
# Pas d'IP publique
} }
tags = ["database", "ssh"]
metadata = { metadata = {
enable-oslogin = "TRUE" enable-oslogin = "TRUE"
} }

35
terraform/modules/compute/outputs.tf
View File

@@ -1,19 +1,24 @@
output "frontend_ip" { # À vous d'exposer :
value = google_compute_instance.frontend.network_interface[0].access_config[0].nat_ip # 1. Les IPs internes de toutes les instances
} # 2. L'IP publique du frontend
# 3. Les noms des instances
output "backend_ip" { output "ip_internes" {
value = google_compute_instance.backend.network_interface[0].network_ip
}
output "database_ip" {
value = google_compute_instance.database.network_interface[0].network_ip
}
output "instance_names" {
value = { value = {
frontend = google_compute_instance.frontend.name frontend = google_compute_instance.vm_frontend.network_interface[0].network_ip
backend = google_compute_instance.backend.name backend = google_compute_instance.vm_backend.network_interface[0].network_ip
database = google_compute_instance.database.name database = google_compute_instance.vm_database.network_interface[0].network_ip
}
}
output "ip_public_frontend" {
value = google_compute_instance.vm_frontend.network_interface[0].access_config[0].nat_ip
}
output "nom_instances" {
value = {
frontend = google_compute_instance.vm_frontend.name
backend = google_compute_instance.vm_backend.name
database = google_compute_instance.vm_database.name
} }
} }

30
terraform/modules/compute/variables.tf
View File

@@ -1,35 +1,25 @@
variable "project_id" {
type = string
description = "ID du projet GCP."
default = "ok"
}
variable "instance_type" { variable "instance_type" {
type = string description = "type de l'instance"
description = "Type de machine pour les instances." type = string
default = "e2-small"
} }
variable "zone" { variable "zone" {
type = string description = "Nom de la zone"
description = "Zone GCP où déployer les instances." type = string
default = "europe-west9-b"
} }
variable "frontend_subnet_id" { variable "frontend_subnet_id" {
type = string description = "id du frontend"
description = "ID du sous réseau frontend." type = string
default = ""
} }
variable "backend_subnet_id" { variable "backend_subnet_id" {
type = string description = "id du backend"
description = "ID du sous-réseau backend." type = string
default = ""
} }
variable "database_subnet_id" { variable "database_subnet_id" {
type = string description = "id du database"
description = "ID du sous-réseau database." type = string
default = ""
} }

53
terraform/modules/iam/main.tf
View File

@@ -1,51 +1,28 @@
############################################
# 1. COMPTE DE SERVICE TERRAFORM
############################################
resource "google_service_account" "terraform_sa" { resource "google_service_account" "service_account" {
account_id = "terraform-sa" account_id = "terraform"
display_name = "Terraform Service Account" display_name = "terraform"
project = var.project_id
} }
############################################ resource "google_service_account_key" "mykey" {
# 2. CLÉ DU COMPTE DE SERVICE service_account_id = google_service_account.service_account.name
############################################ public_key_type = "TYPE_X509_PEM_FILE"
resource "google_service_account_key" "terraform_sa_key" {
service_account_id = google_service_account.terraform_sa.name
} }
############################################ resource "google_project_iam_binding" "custom_service_account" {
# 3. RÔLES IAM project = var.project_id
############################################ role = "roles/viewer"
# Liste des rôles nécessaires au déploiement members = [
locals { "serviceAccount:${google_service_account.service_account.email}",
terraform_roles = [
"roles/compute.admin",
"roles/iam.serviceAccountUser",
"roles/iam.serviceAccountAdmin",
"roles/storage.admin",
"roles/compute.networkAdmin",
"roles/compute.securityAdmin"
] ]
} }
resource "google_project_iam_member" "terraform_sa_roles" { data "google_client_openid_userinfo" "me" {
for_each = toset(local.terraform_roles)
project = var.project_id
role = each.value
member = "serviceAccount:${google_service_account.terraform_sa.email}"
} }
############################################ resource "google_os_login_ssh_public_key" "cache" {
# 4. OS LOGIN + CLÉ SSH user = data.google_client_openid_userinfo.me.email
############################################
resource "google_os_login_ssh_public_key" "oslogin_ssh_key" {
project = var.project_id project = var.project_id
user = google_service_account.terraform_sa.email key = file("~/.ssh/id_ed25519.pub")
key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwvtrSp4IaaEFQ3u9xcyKKlWpucIeZFyXguamjg3+MOwBZmHBptnNd1i/2hv4q+ezA1Jq1SEqZ4uNeKB9P76Q43Nv+pqYkPxm8lfueU/ZrEomjpseEZEHipHyD5WQd+idrbrHqqcISkIktyyFvSEbDELqfe4+IvvR1zvsHXA/onisJ6lCwoDKSXwFp/wWhuzEILpzE5EGXsX4E/lbieWradVLDbvF0QNDBlcYc1zfuYQ8BG4rKcvw7xwqr243UzPBKWndd63IqbNOBfi8V1jqj96mP6kddohxl+Caz5lsh66Pp97GDnSAn9jNk8HAI3Ws0K540PSII5AqgdRJEbuI1Y0saUP3p1uDkysosYSqJU/SAxux00E/2/rLfdvaf7czEwHECAvEcLdvmceOqHJrKh2pSgb5MZ1oq3E6jMvCAiJNT0n6i+iRalGarl46CY6rQakEq3d84pgt7lH1mN3ZstKWJocppFMZRaCPdwgtTwbBTDPJm8TZ85QbtfyZumZU= julian_gallego180105_gmail_com"
} }

15
terraform/modules/iam/outputs.tf
View File

@@ -1,18 +1,11 @@
############################################
# 1. EMAIL DU COMPTE DE SERVICE
############################################
output "service_account_email" { output "service_account_email" {
description = "Email du service account utilisé par Terraform." description = "Service account email."
value = google_service_account.terraform_sa.email value = google_service_account.service_account.email
} }
############################################
# 2. CLÉ DU COMPTE DE SERVICE
############################################
output "service_account_key" { output "service_account_key" {
description = "Clé privée du service account (JSON)." description = "Service account key."
value = google_service_account_key.terraform_sa_key.private_key
sensitive = true sensitive = true
value = google_service_account_key.mykey.private_key
} }

8
terraform/modules/iam/variables.tf
View File

@@ -1,5 +1,5 @@
variable "project_id" {
type = string
description = "ID du projet GCP."
}
variable "project_id" {
description = "ID du projet"
type = string
}

96
terraform/modules/network/main.tf
View File

@@ -1,51 +1,33 @@
############################################
# 1. VPC PERSONNALISÉ
############################################
resource "google_compute_network" "vpc" { resource "google_compute_network" "vpc_terraform" {
name = "${var.project_name}-vpc" name = "vpc-terraform"
auto_create_subnetworks = false auto_create_subnetworks = false
} }
provider "google" { resource "google_compute_subnetwork" "subnet_frontend" {
project = var.project_name name = "frontend"
region = var.region network = google_compute_network.vpc_terraform.id
}
############################################
# 2. SOUS-RÉSEAUX
############################################
resource "google_compute_subnetwork" "frontend" {
name = "${var.project_name}-frontend-subnet"
ip_cidr_range = var.frontend_cidr ip_cidr_range = var.frontend_cidr
region = var.region region = var.region
network = google_compute_network.vpc.id
} }
resource "google_compute_subnetwork" "backend" { resource "google_compute_subnetwork" "subnet_backend" {
name = "${var.project_name}-backend-subnet" name = "backend"
network = google_compute_network.vpc_terraform.id
ip_cidr_range = var.backend_cidr ip_cidr_range = var.backend_cidr
region = var.region region = var.region
network = google_compute_network.vpc.id
} }
resource "google_compute_subnetwork" "database" { resource "google_compute_subnetwork" "subnet_database" {
name = "${var.project_name}-database-subnet" name = "database"
network = google_compute_network.vpc_terraform.id
ip_cidr_range = var.database_cidr ip_cidr_range = var.database_cidr
region = var.region region = var.region
network = google_compute_network.vpc.id
} }
resource "google_compute_firewall" "allow_user_frontend" {
############################################ name = "allow-user-frontend"
# 3. FIREWALL RULES network = google_compute_network.vpc_terraform.id
############################################
# HTTP / HTTPS vers frontend
resource "google_compute_firewall" "frontend_http_https" {
name = "${var.project_name}-frontend-http-https"
network = google_compute_network.vpc.name
allow { allow {
protocol = "tcp" protocol = "tcp"
@@ -53,31 +35,12 @@ resource "google_compute_firewall" "frontend_http_https" {
} }
source_ranges = ["0.0.0.0/0"] source_ranges = ["0.0.0.0/0"]
target_tags = ["frontend"]
target_tags = ["frontend"]
} }
resource "google_compute_firewall" "allow_frontend_backend" {
# SSH depuis les IP autorisées name = "allow-frontend-backend"
resource "google_compute_firewall" "ssh_access" { network = google_compute_network.vpc_terraform.id
name = "${var.project_name}-ssh"
network = google_compute_network.vpc.name
allow {
protocol = "tcp"
ports = ["22"]
}
source_ranges = [var.ssh_source_ranges]
target_tags = ["frontend", "backend", "database"]
}
# Port 8000 du frontend vers backend
resource "google_compute_firewall" "frontend_to_backend" {
name = "${var.project_name}-frontend-to-backend"
network = google_compute_network.vpc.name
allow { allow {
protocol = "tcp" protocol = "tcp"
@@ -85,14 +48,25 @@ resource "google_compute_firewall" "frontend_to_backend" {
} }
source_tags = ["frontend"] source_tags = ["frontend"]
target_tags = ["backend"] target_tags = ["backend"]
} }
resource "google_compute_firewall" "allow_ssh_all" {
name = "allow-ssh-all"
network = google_compute_network.vpc_terraform.id
# Port 3306 du backend vers database allow {
resource "google_compute_firewall" "backend_to_database" { protocol = "tcp"
name = "${var.project_name}-backend-to-database" ports = ["22"]
network = google_compute_network.vpc.name }
source_ranges = ["0.0.0.0/0"]
target_tags = ["ssh"]
}
resource "google_compute_firewall" "allow_backend_database" {
name = "allow-backend-database"
network = google_compute_network.vpc_terraform.id
allow { allow {
protocol = "tcp" protocol = "tcp"
@@ -100,5 +74,5 @@ resource "google_compute_firewall" "backend_to_database" {
} }
source_tags = ["backend"] source_tags = ["backend"]
target_tags = ["database"] target_tags = ["database"]
} }

26
terraform/modules/network/outputs.tf
View File

@@ -1,22 +1,12 @@
############################################
# 1. ID du VPC
############################################
output "vpc_id" { output "vpc" {
description = "ID du VPC créé." value = google_compute_network.vpc_terraform.id
value = google_compute_network.vpc.id
} }
output "subnets" {
############################################ value = {
# 2. IDs des sous-réseaux (map) frontend = google_compute_subnetwork.subnet_frontend.id
############################################ backend = google_compute_subnetwork.subnet_backend.id
database = google_compute_subnetwork.subnet_database.id
output "subnet_ids" { }
description = "Map des IDs des sous-réseaux : frontend, backend, database."
value = {
frontend = google_compute_subnetwork.frontend.id
backend = google_compute_subnetwork.backend.id
database = google_compute_subnetwork.database.id
}
} }

19
terraform/modules/network/variables.tf
View File

@@ -1,35 +1,30 @@
variable "project_name" { variable "project_name" {
description = "Nom du projet"
type = string type = string
description = "Nom du projet."
default = "ok"
} }
variable "region" { variable "region" {
description = "Region du projet"
type = string type = string
description = "Région où seront déployées les ressources réseau."
default = "europe-west9-b"
} }
variable "frontend_cidr" { variable "frontend_cidr" {
description = "CIDR for frontend subnet"
type = string type = string
description = "CIDR du sous-réseau frontend."
default = "10.0.1.0/24"
} }
variable "backend_cidr" { variable "backend_cidr" {
description = "CIDR for backend subnet"
type = string type = string
description = "CIDR du sous-réseau backend."
default = "10.0.2.0/24"
} }
variable "database_cidr" { variable "database_cidr" {
description = "CIDR for database subnet"
type = string type = string
description = "CIDR du sous-réseau base de données."
default = "10.0.3.0/24"
} }
variable "ssh_source_ranges" { variable "ssh_source_ranges" {
description = ""
type = string type = string
description = "Plages d’adresses autorisées pour l’accès SSH."
default = "0.0.0.0/0"
} }