| 1 | variable "digital_ocean_token" { |
| 2 | description = "Digital Ocean API token" |
| 3 | type = string |
| 4 | sensitive = true |
| 5 | } |
| 6 | |
| 7 | provider "digitalocean" { |
| 8 | token = var.digital_ocean_token |
| 9 | } |
| 10 | |
| 11 | resource "tls_private_key" "kamal_deploy" { |
| 12 | algorithm = "RSA" |
| 13 | rsa_bits = 4096 |
| 14 | } |
| 15 | |
| 16 | resource "digitalocean_ssh_key" "kamal_deploy" { |
| 17 | name = "insidertrades-directory-kamal-deploy-key" |
| 18 | public_key = tls_private_key.kamal_deploy.public_key_openssh |
| 19 | } |
| 20 | |
| 21 | resource "digitalocean_droplet" "web_droplet" { |
| 22 | image = "ubuntu-22-04-x64" |
| 23 | name = "insidertrades-directory-web-production" |
| 24 | region = "nyc1" |
| 25 | size = "s-1vcpu-1gb" |
| 26 | ssh_keys = [digitalocean_ssh_key.kamal_deploy.fingerprint] |
| 27 | |
| 28 | provisioner "remote-exec" { |
| 29 | inline = [ |
| 30 | "sudo apt update", |
| 31 | "sudo apt install -y -o DPkg::Lock::Timeout=60 docker.io", |
| 32 | "sudo systemctl start docker", |
| 33 | "sudo systemctl enable docker" |
| 34 | ] |
| 35 | } |
| 36 | backups = true |
| 37 | |
| 38 | monitoring = true |
| 39 | |
| 40 | connection { |
| 41 | type = "ssh" |
| 42 | user = "root" |
| 43 | private_key = tls_private_key.kamal_deploy.private_key_pem |
| 44 | host = self.ipv4_address |
| 45 | } |
| 46 | |
| 47 | tags = [ |
| 48 | "insidertrades-directory", |
| 49 | "production", |
| 50 | "web" |
| 51 | ] |
| 52 | } |
| 53 | |
| 54 | resource "digitalocean_volume" "web_storage" { |
| 55 | region = "nyc1" |
| 56 | name = "insidertrades-directory-web-storage" |
| 57 | size = 30 |
| 58 | initial_filesystem_type = "ext4" |
| 59 | description = "30GB volume for web application storage" |
| 60 | } |
| 61 | |
| 62 | resource "digitalocean_volume_attachment" "web_storage_volume_attachment" { |
| 63 | droplet_id = "${digitalocean_droplet.web_droplet.id}" |
| 64 | volume_id = "${digitalocean_volume.web_storage.id}" |
| 65 | } |
| 66 | |
| 67 | resource "digitalocean_firewall" "web_firewall" { |
| 68 | name = "insidertrades-directory-web-firewall-production" |
| 69 | |
| 70 | droplet_ids = [digitalocean_droplet.web_droplet.id] |
| 71 | |
| 72 | inbound_rule { |
| 73 | protocol = "tcp" |
| 74 | port_range = "22" |
| 75 | source_addresses = ["0.0.0.0/0", "::/0"] |
| 76 | } |
| 77 | |
| 78 | inbound_rule { |
| 79 | protocol = "tcp" |
| 80 | port_range = "80" |
| 81 | source_addresses = ["0.0.0.0/0", "::/0"] |
| 82 | } |
| 83 | |
| 84 | inbound_rule { |
| 85 | protocol = "tcp" |
| 86 | port_range = "443" |
| 87 | source_addresses = ["0.0.0.0/0", "::/0"] |
| 88 | } |
| 89 | |
| 90 | inbound_rule { |
| 91 | protocol = "icmp" |
| 92 | source_addresses = ["0.0.0.0/0", "::/0"] |
| 93 | } |
| 94 | |
| 95 | # Allow all outbound traffic |
| 96 | outbound_rule { |
| 97 | protocol = "tcp" |
| 98 | port_range = "1-65535" |
| 99 | destination_addresses = ["0.0.0.0/0", "::/0"] |
| 100 | } |
| 101 | |
| 102 | outbound_rule { |
| 103 | protocol = "udp" |
| 104 | port_range = "1-65535" |
| 105 | destination_addresses = ["0.0.0.0/0", "::/0"] |
| 106 | } |
| 107 | |
| 108 | outbound_rule { |
| 109 | protocol = "icmp" |
| 110 | destination_addresses = ["0.0.0.0/0", "::/0"] |
| 111 | } |
| 112 | } |
| 113 | |
| 114 | output "ip_address" { |
| 115 | description = "Public IP address of the web server" |
| 116 | value = digitalocean_droplet.web_droplet.ipv4_address |
| 117 | } |
| 118 | |
| 119 | output "ssh_private_key" { |
| 120 | description = "Private SSH key for Kamal deployment (keep secure!)" |
| 121 | value = tls_private_key.kamal_deploy.private_key_pem |
| 122 | sensitive = true |
| 123 | } |