infra: add Terraform main infrastructure - VPC, subnets, EC2, security groups, IAM

infra/terraform/ec2.tf

@@ -0,0 +1,95 @@
+# ──────────────────────────────────────────────
+# Data Source — Latest Amazon Linux 2023 AMI
+# ──────────────────────────────────────────────
+data "aws_ami" "amazon_linux_2023" {
+  most_recent = true
+  owners      = ["amazon"]
+
+  filter {
+    name   = "name"
+    values = ["al2023-ami-2023.*-x86_64"]
+  }
+
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
+  }
+}
+
+# ──────────────────────────────────────────────
+# EC2 Instance
+# ──────────────────────────────────────────────
+resource "aws_instance" "app" {
+  ami                    = data.aws_ami.amazon_linux_2023.id
+  instance_type          = "t3.micro"
+  subnet_id              = aws_subnet.public.id
+  vpc_security_group_ids = [aws_security_group.nginx.id]
+  iam_instance_profile   = aws_iam_instance_profile.ec2_profile.name
+
+  user_data = <<-EOF
+    #!/bin/bash
+    set -e
+
+    # Update system
+    dnf update -y
+
+    # Install Docker
+    dnf install -y docker
+    systemctl enable docker
+    systemctl start docker
+
+    # Wait for Docker to be fully ready
+    sleep 10
+
+    # Add ec2-user to docker group
+    usermod -aG docker ec2-user
+
+    # Ensure SSM Agent is running (pre-installed on AL2023)
+    systemctl enable amazon-ssm-agent
+    systemctl start amazon-ssm-agent
+
+    # Authenticate to ECR
+    aws ecr get-login-password --region ${var.aws_region} | \
+      docker login --username AWS --password-stdin \
+      ${var.aws_account_id}.dkr.ecr.${var.aws_region}.amazonaws.com
+
+    # Pull images from ECR
+    docker pull ${var.aws_account_id}.dkr.ecr.${var.aws_region}.amazonaws.com/task-backend:latest
+    docker pull ${var.aws_account_id}.dkr.ecr.${var.aws_region}.amazonaws.com/task-frontend:latest
+
+    # Run backend
+    docker run -d \
+      --name task-backend \
+      --restart unless-stopped \
+      -p 3000:3000 \
+      ${var.aws_account_id}.dkr.ecr.${var.aws_region}.amazonaws.com/task-backend:latest
+
+    # Wait for backend to be ready
+    sleep 5
+
+    # Run frontend
+    docker run -d \
+      --name task-frontend \
+      --restart unless-stopped \
+      -p 80:80 \
+      --link task-backend:backend \
+      ${var.aws_account_id}.dkr.ecr.${var.aws_region}.amazonaws.com/task-frontend:latest
+  EOF
+
+  root_block_device {
+    volume_size           = 20
+    volume_type           = "gp3"
+    encrypted             = true
+    delete_on_termination = true
+  }
+
+  metadata_options {
+    http_tokens = "required"
+  }
+
+  tags = {
+    Name        = "${var.project_name}-app-server"
+    Project     = var.project_name
+    Environment = var.environment
+  }
+}

infra/terraform/iam.tf

@@ -0,0 +1,52 @@
+# ──────────────────────────────────────────────
+# IAM Role — EC2 instance identity
+# ──────────────────────────────────────────────
+resource "aws_iam_role" "ec2_role" {
+  name = "${var.project_name}-ec2-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Principal = {
+          Service = "ec2.amazonaws.com"
+        }
+        Action = "sts:AssumeRole"
+      }
+    ]
+  })
+
+  tags = {
+    Name        = "${var.project_name}-ec2-role"
+    Project     = var.project_name
+    Environment = var.environment
+  }
+}
+
+# ──────────────────────────────────────────────
+# Policy Attachments
+# ──────────────────────────────────────────────
+resource "aws_iam_role_policy_attachment" "ssm" {
+  role       = aws_iam_role.ec2_role.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+}
+
+resource "aws_iam_role_policy_attachment" "ecr" {
+  role       = aws_iam_role.ec2_role.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
+}
+
+# ──────────────────────────────────────────────
+# Instance Profile
+# ──────────────────────────────────────────────
+resource "aws_iam_instance_profile" "ec2_profile" {
+  name = "${var.project_name}-ec2-profile"
+  role = aws_iam_role.ec2_role.name
+
+  tags = {
+    Name        = "${var.project_name}-ec2-profile"
+    Project     = var.project_name
+    Environment = var.environment
+  }
+}

infra/terraform/outputs.tf

@@ -0,0 +1,29 @@
+output "vpc_id" {
+  description = "ID of the VPC"
+  value       = aws_vpc.main.id
+}
+
+output "public_subnet_id" {
+  description = "ID of the public subnet"
+  value       = aws_subnet.public.id
+}
+
+output "private_subnet_id" {
+  description = "ID of the private subnet"
+  value       = aws_subnet.private.id
+}
+
+output "ec2_instance_id" {
+  description = "EC2 instance ID — use this to connect via SSM"
+  value       = aws_instance.app.id
+}
+
+output "ec2_public_ip" {
+  description = "Public IP of the EC2 instance"
+  value       = aws_instance.app.public_ip
+}
+
+output "ec2_public_dns" {
+  description = "Public DNS of the EC2 instance"
+  value       = aws_instance.app.public_dns
+}

infra/terraform/security-group.tf

@@ -0,0 +1,69 @@
+# ──────────────────────────────────────────────
+# Security Group — Nginx (Public)
+# ──────────────────────────────────────────────
+resource "aws_security_group" "nginx" {
+  name        = "${var.project_name}-nginx-sg"
+  description = "Security group for Nginx reverse proxy"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    description = "HTTP from internet"
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "HTTPS from internet"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    description = "Allow all outbound"
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name        = "${var.project_name}-nginx-sg"
+    Project     = var.project_name
+    Environment = var.environment
+  }
+}
+
+# ──────────────────────────────────────────────
+# Security Group — Backend (Private)
+# ──────────────────────────────────────────────
+resource "aws_security_group" "backend" {
+  name        = "${var.project_name}-backend-sg"
+  description = "Security group for backend API - only accepts traffic from Nginx"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    description     = "Allow traffic from Nginx only"
+    from_port       = 3000
+    to_port         = 3000
+    protocol        = "tcp"
+    security_groups = [aws_security_group.nginx.id]
+  }
+
+  egress {
+    description = "Allow all outbound"
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name        = "${var.project_name}-backend-sg"
+    Project     = var.project_name
+    Environment = var.environment
+  }
+}

infra/terraform/vpc.tf

@@ -0,0 +1,78 @@
+# ──────────────────────────────────────────────
+# VPC
+# ──────────────────────────────────────────────
+resource "aws_vpc" "main" {
+  cidr_block           = var.vpc_cidr
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+
+  tags = {
+    Name        = "${var.project_name}-vpc"
+    Project     = var.project_name
+    Environment = var.environment
+  }
+}
+
+# ──────────────────────────────────────────────
+# Subnets
+# ──────────────────────────────────────────────
+resource "aws_subnet" "public" {
+  vpc_id                  = aws_vpc.main.id
+  cidr_block              = var.public_subnet_cidr
+  availability_zone       = "${var.aws_region}a"
+  map_public_ip_on_launch = true
+
+  tags = {
+    Name        = "${var.project_name}-public-subnet"
+    Project     = var.project_name
+    Environment = var.environment
+  }
+}
+
+resource "aws_subnet" "private" {
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = var.private_subnet_cidr
+  availability_zone = "${var.aws_region}a"
+
+  tags = {
+    Name        = "${var.project_name}-private-subnet"
+    Project     = var.project_name
+    Environment = var.environment
+  }
+}
+
+# ──────────────────────────────────────────────
+# Internet Gateway
+# ──────────────────────────────────────────────
+resource "aws_internet_gateway" "main" {
+  vpc_id = aws_vpc.main.id
+
+  tags = {
+    Name        = "${var.project_name}-igw"
+    Project     = var.project_name
+    Environment = var.environment
+  }
+}
+
+# ──────────────────────────────────────────────
+# Route Tables
+# ──────────────────────────────────────────────
+resource "aws_route_table" "public" {
+  vpc_id = aws_vpc.main.id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.main.id
+  }
+
+  tags = {
+    Name        = "${var.project_name}-public-rt"
+    Project     = var.project_name
+    Environment = var.environment
+  }
+}
+
+resource "aws_route_table_association" "public" {
+  subnet_id      = aws_subnet.public.id
+  route_table_id = aws_route_table.public.id
+}