Init Pipeline

.github/workflows/terraform-apply.yml

@@ -0,0 +1,80 @@
+name: "Terraform Apply"
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  TF_CLOUD_ORGANIZATION: "zwell-test"
+  TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
+  AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
+  AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
+  BUILD_VERSION: "${{ github.sha }}"
+  TF_WORKSPACE: "static-hosting"
+  CONFIG_DIRECTORY: "./terraform/"
+  AWS_DEFAULT_REGION: "us-west-2"
+
+jobs:
+  # builds and pushes image to ecr
+  terraform:
+    name: "Terraform Apply"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+        # Gets the most current config (tf.plan) for org + workspace combo
+      - name: Upload Configuration
+        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.0.0
+        id: apply-upload
+        with:
+          workspace: ${{ env.TF_WORKSPACE }}
+          directory: ${{ env.CONFIG_DIRECTORY }}
+
+        # runs changes in terrafrom/ against current state to create a tf.plan
+        # tarraform plan
+      - name: Create Apply Run
+        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.0.0
+        id: apply-run
+        env:
+          TF_VAR_image_tag: "\"${{ env.BUILD_VERSION }}\""
+        with:
+          workspace: ${{ env.TF_WORKSPACE }}
+          configuration_version: ${{ steps.apply-upload.outputs.configuration_version_id }}
+
+        # terraform apply the plan
+      - name: Apply
+        uses: hashicorp/tfc-workflows-github/actions/apply-run@v1.0.0
+        if: fromJSON(steps.apply-run.outputs.payload).data.attributes.actions.IsConfirmable
+        id: apply
+        with:
+          run: ${{ steps.apply-run.outputs.run_id }}
+          comment: "Apply Run from GitHub Actions CI ${{ github.sha }}"
+
+  # Once uplaoding current build and not squashing, move before tf apply
+  # bucket needs to be there first...
+  s3:
+    name: "Push to s3"
+    needs: terraform
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+
+      - name: Upload assets to s3
+        shell: bash
+        run: |
+          aws s3 cp ./index.html s3://dev.app.zwellhome.com/index.html
+          aws s3 cp ./404.html s3://dev.app.zwellhome.com/404.html
+
+

.github/workflows/terraform-plan.yml

@@ -0,0 +1,52 @@
+name: "tf plan"
+on:
+  pull_request:
+
+env:
+  TF_CLOUD_ORGANIZATION: "zwell-test"
+  TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
+  TF_WORKSPACE: "static-hosting"
+  CONFIG_DIRECTORY: "./terraform/"
+
+jobs:
+  # Add jobs in to run checks
+  # linting
+  # unit test
+
+  terraform:
+    name: "tf plan devtest"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+        # uploads/initiates a configuration in terraform
+        # akin to terraform init
+      - name: Upload Configuration
+        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.0.0
+        id: plan-upload
+        with:
+          workspace: ${{ env.TF_WORKSPACE }}
+          directory: ${{ env.CONFIG_DIRECTORY }}
+          speculative: true
+
+        # runs changes in terrafrom/ against current state to create a tf.plan
+        # tarraform plan
+      - name: Create Plan Run
+        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.0.0
+        id: plan-run
+        with:
+          workspace: ${{ env.TF_WORKSPACE }}
+          configuration_version: ${{ steps.plan-upload.outputs.configuration_version_id }}
+          plan_only: true
+
+        # Gets the plan and logs it in pipeline for debugging
+      - name: Get Plan Output
+        uses: hashicorp/tfc-workflows-github/actions/plan-output@v1.0.0
+        id: plan-output
+        with:
+          plan: ${{ fromJSON(steps.plan-run.outputs.payload).data.relationships.plan.data.id }}
+

404.html

@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+  <p>zwell's 404</p>
+</html>

index.html

@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+  <p>Welcome to dev.app.zwell.com</p>
+</html>

terraform/main.tf

@@ -0,0 +1,66 @@
+resource "aws_s3_bucket" "zwell-static-hosting-bucket" {
+  bucket = "dev.app.zwellhome.com"
+}
+
+resource "aws_s3_bucket_website_configuration" "www_bucket" {
+  bucket = aws_s3_bucket.zwell-static-hosting-bucket.id
+
+  index_document {
+    suffix = "index.html"
+  }
+
+  error_document {
+    key = "404.html"
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "bucket_access_block" {
+  bucket = aws_s3_bucket.zwell-static-hosting-bucket.id
+
+  block_public_acls   = false
+  block_public_policy = false
+}
+
+resource "aws_s3_bucket_policy" "bucket_policy" {
+  bucket = aws_s3_bucket.zwell-static-hosting-bucket.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect    = "Allow"
+        Principal = "*"
+        Action = [
+          "s3:GetObject"
+        ]
+        Resource = [
+          "${aws_s3_bucket.zwell-static-hosting-bucket.arn}/*"
+        ]
+        Condition = {
+          IpAdress = {
+            "aws:SourceIp "= [
+              "173.245.48.0/20",
+              "103.21.244.0/22",
+              "103.22.200.0/22",
+              "103.31.4.0/22",
+              "141.101.64.0/18",
+              "108.162.192.0/18",
+              "190.93.240.0/20",
+              "188.114.96.0/20",
+              "197.234.240.0/22",
+              "198.41.128.0/17",
+              "162.158.0.0/15",
+              "104.16.0.0/13",
+              "104.24.0.0/14",
+              "172.64.0.0/13",
+              "131.0.72.0/22"
+            ]
+          }
+        }
+      }
+    ]
+  })
+}
+
+# IP Adresses are cloudflare's proxy ips
+# https://www.cloudflare.com/ips-v4/#

terraform/provider.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+
+  required_version = "~> 1.7"
+}
+
+provider "aws" {
+  region = "us-west-2"
+}