interactive-devops-interview/main.tf at main · olgsm/interactive-devops-interview · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
terraform {
  required_version = ">= 1.10"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }

  backend "s3" {
    bucket         = "devops-interview-template-tfstate"
    key            = "interview/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    use_lockfile   = true
  }
}

provider "aws" {
  region = var.region

  default_tags {
    tags = {
      Owner       = var.owner_email
      Project     = "devops-interview-template"
      Environment = "sandbox"
      ManagedBy   = "terraform"
    }
  }
}

data "aws_caller_identity" "current" {}

resource "random_id" "suffix" {
  byte_length = 4
}

resource "aws_s3_bucket" "models" {
  bucket = "${var.name_prefix}-models-${random_id.suffix.hex}"

  lifecycle {
    prevent_destroy = false
  }
}

resource "aws_s3_bucket_public_access_block" "models" {
  bucket = aws_s3_bucket.models.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_ecr_repository" "ollama" {
  name                 = "${var.name_prefix}-ollama"
  image_tag_mutability = "MUTABLE"

  image_scanning_configuration {
    scan_on_push = true
  }

  lifecycle {
    prevent_destroy = false
  }
}

resource "aws_instance" "interview_host" {
  ami                    = "ami-0360c520857e3138f" # Ubuntu 24.04 LTS
  instance_type          = var.instance_type
  subnet_id              = data.aws_subnet.public.id
  vpc_security_group_ids = [aws_security_group.interview_host.id]
  iam_instance_profile   = aws_iam_instance_profile.interview_host.name

  user_data = templatefile("${path.module}/scripts/bootstrap.sh", {
    s3_bucket       = aws_s3_bucket.models.id
    region          = var.region
    account_id      = data.aws_caller_identity.current.account_id
    ecr_repository  = aws_ecr_repository.ollama.repository_url
    challenges_yaml = templatefile("${path.module}/templates/all-challenges.yaml", {
      s3_bucket      = aws_s3_bucket.models.id
      ecr_repository = aws_ecr_repository.ollama.repository_url
    })
  })

  metadata_options {
    http_endpoint               = "enabled"
    http_tokens                 = "required"
    http_put_response_hop_limit = 2
    instance_metadata_tags      = "enabled"
  }

  root_block_device {
    volume_size = 30
    volume_type = "gp3"
    encrypted   = true
  }

  tags = {
    Name = "${var.name_prefix}-host"
  }
}

resource "aws_security_group" "interview_host" {
  name        = "${var.name_prefix}-host-sg"
  description = "Security group for interview host"
  vpc_id      = data.aws_vpc.main.id

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${var.name_prefix}-host-sg"
  }
}