Skip to content

Commit 58c65ae

Browse files
LamSutLamSut
committed
nginx on windows
1 parent fa173b7 commit 58c65ae

File tree

7 files changed

+192
-44
lines changed

7 files changed

+192
-44
lines changed

‎.terraform.lock.hcl

+19
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎ec2/main.tf

+62-5
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ resource "aws_instance" "amazon" {
2626
}
2727

2828
provisioner "local-exec" {
29-
command = "ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -u ec2-user --key-file ${var.private_key_path} -T 300 -i '${self.public_ip},' playbooks/nginx.yaml"
29+
command = "ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -u ec2-user --key-file ${var.private_key_path} -T 300 -i '${self.public_ip},' playbooks/nginx/nginx-linux.yaml"
3030
}
3131

3232
tags = {
@@ -61,7 +61,7 @@ resource "aws_instance" "ubuntu" {
6161
}
6262

6363
provisioner "local-exec" {
64-
command = "ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -u ubuntu --key-file ${var.private_key_path} -T 300 -i '${self.public_ip},' playbooks/nginx.yaml"
64+
command = "ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -u ubuntu --key-file ${var.private_key_path} -T 300 -i '${self.public_ip},' playbooks/nginx/nginx-linux.yaml"
6565
}
6666

6767
tags = {
@@ -74,13 +74,70 @@ resource "aws_instance" "windows" {
7474

7575
ami = var.ami_free_windows
7676
instance_type = var.instance_type_free
77+
key_name = var.private_key_name
7778

78-
key_name = var.private_key_name
79-
80-
subnet_id = var.public_subnet[2]
79+
subnet_id = var.public_subnet[0]
8180
vpc_security_group_ids = [var.security_group["sg_windows"]]
8281

82+
user_data = <<EOF
83+
<powershell>
84+
New-NetFirewallRule -DisplayName "WinRM HTTPS" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 5986
85+
New-NetFirewallRule -DisplayName "Allow HTTP" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 80
86+
New-NetFirewallRule -DisplayName "Allow HTTPS" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 443
87+
winrm quickconfig -q
88+
winrm set winrm/config/service '@{AllowUnencrypted="true"}'
89+
winrm set winrm/config/service/auth '@{Basic="true"}'
90+
winrm set winrm/config/winrs '@{MaxMemoryPerShellMB="1024"}'
91+
$cert = New-SelfSignedCertificate -DnsName (hostname) -CertStoreLocation Cert:\LocalMachine\My
92+
winrm create winrm/config/Listener?Address=*+Transport=HTTPS "@{Hostname=`"$(hostname)`"; CertificateThumbprint=`"$($cert.Thumbprint)`"}"
93+
net localgroup "Remote Management Users" Administrator /add
94+
Restart-Service winrm
95+
</powershell>
96+
EOF
97+
8398
tags = {
8499
Name = "B2111933 Windows"
85100
}
86101
}
102+
103+
resource "null_resource" "wait_for_windows" {
104+
count = length(aws_instance.windows)
105+
depends_on = [aws_instance.windows]
106+
107+
provisioner "local-exec" {
108+
command = <<EOT
109+
echo "Waiting for Windows startup (60s)..."
110+
sleep 60
111+
while ! nc -z ${aws_instance.windows[count.index].public_ip} 5986; do
112+
echo "Waiting for Windows to be ready..."
113+
sleep 10
114+
done
115+
echo "Windows is ready!"
116+
EOT
117+
}
118+
}
119+
120+
resource "null_resource" "get_windows_password" {
121+
count = length(aws_instance.windows)
122+
depends_on = [null_resource.wait_for_windows]
123+
124+
provisioner "local-exec" {
125+
command = "aws ec2 get-password-data --instance-id ${aws_instance.windows[count.index].id} --priv-launch-key ${var.private_key_path} --output text | tr -d '\r\n' > ./keys/${aws_instance.windows[count.index].id}.txt"
126+
}
127+
}
128+
129+
resource "null_resource" "ansible_windows" {
130+
count = length(aws_instance.windows)
131+
depends_on = [null_resource.get_windows_password]
132+
133+
provisioner "local-exec" {
134+
interpreter = ["/bin/bash", "-c"]
135+
command = <<EOT
136+
echo "Running Ansible with password: $(awk '{print $2}' ./keys/${aws_instance.windows[count.index].id}.txt | tr -d '\r')"
137+
ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook \
138+
-u Administrator --connection=winrm \
139+
--extra-vars "ansible_winrm_server_cert_validation=ignore ansible_winrm_password=$(awk '{print $2}' ./keys/${aws_instance.windows[count.index].id}.txt | tr -d '\r')" \
140+
-T 600 -i '${aws_instance.windows[count.index].public_ip},' playbooks/nginx/nginx-windows.yaml
141+
EOT
142+
}
143+
}

‎playbooks/index.html ‎playbooks/nginx/index.html

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22
<html>
33
<style>
44
body {
5-
background-color: black;
5+
background-color: darkblue;
66
color: white;
77
}
88
</style>
99

1010
<body>
11-
<h1>Ansible</h1>
11+
<h1>B2111933</h1>
1212
</body>
1313

1414
</html>

‎playbooks/nginx.yaml ‎playbooks/nginx/nginx-linux.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -55,4 +55,4 @@
5555
service:
5656
name: nginx
5757
state: started
58-
enabled: true
58+
enabled: true

‎playbooks/nginx/nginx-windows.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
- name: Install Nginx on Windows
2+
hosts: all
3+
gather_facts: yes
4+
vars:
5+
nginx_version: "1.27.4"
6+
tasks:
7+
- name: Install Nginx via Chocolatey
8+
win_chocolatey:
9+
name: nginx
10+
state: present
11+
12+
- name: Ensure the document root directory exists
13+
win_file:
14+
path: C:\tools\nginx-{{ nginx_version }}\html
15+
state: directory
16+
17+
- name: Copy index.html to the document root
18+
win_template:
19+
src: index.html
20+
dest: C:\tools\nginx-{{ nginx_version }}\html\index.html
21+
22+
- name: Start the Nginx service and set it to auto start
23+
win_service:
24+
name: nginx
25+
state: started
26+
start_mode: auto

‎vpc/main.tf

+46-18
Original file line numberDiff line numberDiff line change
@@ -106,26 +106,54 @@ resource "aws_security_group" "security_groups" {
106106
name = each.key
107107
description = each.value.description
108108
vpc_id = aws_vpc.b2111933_vpc.id
109+
}
109110

110-
dynamic "ingress" {
111-
for_each = each.value.ingress
112-
content {
113-
from_port = ingress.value.from_port
114-
to_port = ingress.value.to_port
115-
protocol = ingress.value.protocol
116-
cidr_blocks = ingress.value.cidr_blocks
117-
}
118-
}
111+
locals {
112+
sg_ingress = flatten([
113+
for sg_name, sg in var.security_groups_config : [
114+
for rule in sg.ingress : {
115+
sg_name = sg_name
116+
from_port = rule.from_port
117+
to_port = rule.to_port
118+
protocol = rule.protocol
119+
cidr_blocks = rule.cidr_blocks
120+
}
121+
]
122+
])
123+
124+
sg_egress = flatten([
125+
for sg_name, sg in var.security_groups_config : [
126+
for rule in sg.egress : {
127+
sg_name = sg_name
128+
from_port = rule.from_port
129+
to_port = rule.to_port
130+
protocol = rule.protocol
131+
cidr_blocks = rule.cidr_blocks
132+
}
133+
]
134+
])
135+
}
119136

120-
dynamic "egress" {
121-
for_each = each.value.egress
122-
content {
123-
from_port = egress.value.from_port
124-
to_port = egress.value.to_port
125-
protocol = egress.value.protocol
126-
cidr_blocks = egress.value.cidr_blocks
127-
}
128-
}
137+
resource "aws_security_group_rule" "ingress_rules" {
138+
for_each = { for idx, rule in local.sg_ingress : "${rule.sg_name}-ingress-${idx}" => rule }
139+
140+
type = "ingress"
141+
security_group_id = aws_security_group.security_groups[each.value.sg_name].id
142+
from_port = each.value.from_port
143+
to_port = each.value.to_port
144+
protocol = each.value.protocol
145+
cidr_blocks = each.value.cidr_blocks
146+
}
147+
148+
resource "aws_security_group_rule" "egress_rules" {
149+
for_each = { for idx, rule in local.sg_egress : "${rule.sg_name}-egress-${idx}" => rule }
150+
151+
type = "egress"
152+
security_group_id = aws_security_group.security_groups[each.value.sg_name].id
153+
from_port = each.value.from_port
154+
to_port = each.value.to_port
155+
protocol = each.value.protocol
156+
cidr_blocks = each.value.cidr_blocks
129157
}
130158

131159
resource "aws_security_group_rule" "sg_icmp" {

‎vpc/variables.tf

+36-18
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,14 @@ variable "subnets" {
2222
cidr_block = "10.0.2.0/24"
2323
availability_zone = "us-east-1a"
2424
},
25-
{
26-
cidr_block = "10.0.3.0/24"
27-
availability_zone = "us-east-1a"
28-
},
29-
{
30-
cidr_block = "10.0.4.0/24"
31-
availability_zone = "us-east-1a"
32-
}
25+
# {
26+
# cidr_block = "10.0.3.0/24"
27+
# availability_zone = "us-east-1a"
28+
# },
29+
# {
30+
# cidr_block = "10.0.4.0/24"
31+
# availability_zone = "us-east-1a"
32+
# }
3333
]
3434
}
3535

@@ -47,14 +47,14 @@ variable "private_subnets" {
4747
cidr_block = "10.0.102.0/24"
4848
availability_zone = "us-east-1a"
4949
},
50-
{
51-
cidr_block = "10.0.103.0/24"
52-
availability_zone = "us-east-1a"
53-
},
54-
{
55-
cidr_block = "10.0.104.0/24"
56-
availability_zone = "us-east-1a"
57-
}
50+
# {
51+
# cidr_block = "10.0.103.0/24"
52+
# availability_zone = "us-east-1a"
53+
# },
54+
# {
55+
# cidr_block = "10.0.104.0/24"
56+
# availability_zone = "us-east-1a"
57+
# }
5858
]
5959
}
6060

@@ -75,7 +75,7 @@ variable "security_groups_config" {
7575
}))
7676
}))
7777
default = {
78-
"sg_linux" = {
78+
sg_linux = {
7979
description = "Security Group for Linux"
8080
ingress = [
8181
{
@@ -95,6 +95,12 @@ variable "security_groups_config" {
9595
to_port = 443
9696
protocol = "tcp"
9797
cidr_blocks = ["0.0.0.0/0"]
98+
},
99+
{
100+
from_port = -1
101+
to_port = -1
102+
protocol = "icmp"
103+
cidr_blocks = ["0.0.0.0/0"]
98104
}
99105
]
100106
egress = [
@@ -106,7 +112,7 @@ variable "security_groups_config" {
106112
}
107113
]
108114
},
109-
"sg_windows" = {
115+
sg_windows = {
110116
description = "Security Group for Windows"
111117
ingress = [
112118
{
@@ -126,6 +132,18 @@ variable "security_groups_config" {
126132
to_port = 3389
127133
protocol = "tcp"
128134
cidr_blocks = ["0.0.0.0/0"]
135+
},
136+
{
137+
from_port = 5986
138+
to_port = 5986
139+
protocol = "tcp"
140+
cidr_blocks = ["0.0.0.0/0"]
141+
},
142+
{
143+
from_port = -1
144+
to_port = -1
145+
protocol = "icmp"
146+
cidr_blocks = ["0.0.0.0/0"]
129147
}
130148
]
131149
egress = [

0 commit comments

Comments
 (0)