Skip to main content

Deploying a Web Server on UpCloud using Terraform Modules

In my earlier post, I shared an example of deploying UpCloud infrastructure using Terraform from scratch. In this post, I want to share how to deploy the infrastructure using available Terraform modules to speed up the set-up process, especially for common use cases like preparing a web server.

For instance, our need is to deploy a website with some conditions as follows.

  • The website can be accessed through HTTPS. If the request is HTTP, it will be redirected to HTTPS.
  • There are 2 domains, web1.yourdomain.com and web2.yourdomain.com. But, users should be redirected to "web2" if they are visiting "web1".

There are 4 main modules that we need to set up the environment.

  1. Private network. It allows the load balancer to connect with the server and pass the traffic.
  2. Server. It is used to host the website.
  3. Load balancer. It includes backend and frontend configuration.
  4. Dynamic certificate. It is required to allow an HTTPS connection.

Before we configure the main modules. We should set some variables used in the configuration in the variables.tf file. Then, we create a terraform.tfvars file that contains the values for those variables.

# variables.tf
variable "upcloud_username" {
  description = "UpCloud username"
  type = string
}

variable "upcloud_password" {
  description = "UpCloud password"
  type = string
}

variable "zone" {
  description = "UpCloud zone"
  type = string
  default = "sg-sin1"
}

variable "public_keys" {
    description = "List of public keys for server access"
    type = list(string)
}

# terraform.tfvars
upcloud_username = "xxx"
upcloud_password = "xxx"
zone = "sg-sin1"
public_keys = [ 
    "ssh-ed25519 AAAAxxx",
    "ssh-ed25519 AAAAxxx"
]

Firstly, we set up the private network as the code below.

# main.tf
provider "upcloud" {
  username = var.upcloud_username
  password = var.upcloud_password
}

module "private_network" {
  source  = "lukibsubekti/network-private/upcloud"
  version = "1.0.2"

  router_name = "my-router"
  network_name = "my-network"
  zone = var.zone
  network = {
    subnet = "10.0.10.0/24"
    is_dhcp = true
    family = "IPv4"
    is_dhcp_default_route = false
    gateway_address = "10.0.10.1"
  }
}

Next, we set up the web server. In this example, we just run an Nginx server which will host a default HTML page on port 80. The login method uses public keys.

# main.tf
module "web_server" {
  source  = "lukibsubekti/web-server/upcloud"
  version = "1.0.1"

  zone = var.zone
  hostname = "my-web-server"
  plan = "DEV-1xCPU-2GB"
  os = "ubuntu-22.04"
  private_network = {
    network_id = module.private_network.network_id
    ip_address = "10.0.10.123"
  }
  login = {
    send_password = "none"
    keys = var.public_keys
  }
  user_data = <<-EOF
    #!/bin/bash
    sudo apt-get update
    sudo apt-get install -y nginx
    EOF
}

Now, we configure the load balancer. We define a single backend server and several frontend rules to direct or serve requests based on conditions we set.

# main.tf
locals {
  web1 = "web1.yourdomain.com"
  web2 = "web2.yourdomain.com"
}

module "loadbalancer" {
  source  = "lukibsubekti/loadbalancer-static/upcloud"
  version = "1.0.2"

  zone = var.zone
  name = "my-loadbalancer"
  private_network = {
    name = "private-net"
    id = module.private_network.network_id
  }

  backends = {
    "my-website" = [
      {
        ip = module.web_server.networks.private.ip_address
        port = 80
      }
    ]
  }

  frontends = {
    "my-http" = {
      mode = "http"
      port = 80
      default_backend = "my-website"
    }
    "my-https" = {
      mode = "http"
      port = 443
      default_backend = "my-website"
    }
  }

  rules = {
    # redirect HTTP traffic to HTTPS
    "my-rule1" = {
      frontend = "my-http"
      priority = 100
      matching_condition = "or"
      matchers = {
        request_header = [
          {
            method = "starts"
            name = "Host"
            value = local.web1
            ignore_case = true
          },
          {
            method = "starts"
            name = "Host"
            value = local.web2
            ignore_case = true
          }
        ]
      }
      actions = {
        http_redirect = {
            scheme = "https"
        }
        set_forwarded_headers = {
          active = true
        }
      }
    }

    # redirect HTTPS traffic from web1 to web2
    "my-rule2" = {
      frontend = "my-https"
      priority = 90
      matchers = {
        request_header = [
          {
            method = "starts"
            name = "Host"
            value = local.web1
            ignore_case = true
          }
        ]
      }
      actions = {
        http_redirect = {
            location = "https://${local.web2}"
        }
        set_forwarded_headers = {
          active = true
        }
      }
    }

    # handle HTTPS traffic for web2
    "my-rule3" = {
      frontend = "my-https"
      priority = 80
      matchers = {
        request_header = [
          {
            method = "starts"
            name = "Host"
            value = local.web2
            ignore_case = true
          }
        ]
      }
      actions = {
        use_backend = {
            backend_name = "my-website"
        }
        set_forwarded_headers = {
          active = true
        }
      }
    }
  }
}

We also need to output some values including the server IP address and the load balancer DNS name. We set it in output.tf file.

# output.tf
output "server_networks" {
  value = module.web_server.networks
  description = "Server networks"
}

output "loadbalancer_networks" {
  value = module.loadbalancer.networks_map
  description = "Load balancer networks"
}

Before we can configure the dynamic certificate, we should apply the current configuration to get the load balancer DNS name which will be added to our DNS record. It is necessary so that the certificate can be verified and generated by the certificate provider.

Initialize the module and apply the configuration.

terraform init
terraform apply

The server IP address

The public DNS name of the load balancer

Updated DNS record for our domain

After the DNS record is updated. We can apply the dynamic certificate configuration.

# main.tf
module "certs" {
    source = "lukibsubekti/certs-dynamic/upcloud"
    version = "1.0.0"

    name = "my-certs"
    hostnames = [
        local.web1,
        local.web2
    ]
    frontend_id = module.loadbalancer.frontends_map["my-https"].id
}

Reinitialize the module and apply the updated configuration.

terraform init
terraform apply

The certificate is verified

Lastly, we can verify the result by visiting http://web1.yourdomain.com that will be redirected to https://web2.yourdomain.com.

Comments

Popular posts from this blog

Rangkaian Sensor Infrared dengan Photo Dioda

Keunggulan photodioda dibandingkan LDR adalah photodioda lebih tidak rentan terhadap noise karena hanya menerima sinar infrared, sedangkan LDR menerima seluruh cahaya yang ada termasuk infrared. Rangkaian yang akan kita gunakan adalah seperti gambar di bawah ini. Pada saat intensitas Infrared yang diterima Photodiode besar maka tahanan Photodiode menjadi kecil, sedangkan jika intensitas Infrared yang diterima Photodiode kecil maka tahanan yang dimiliki photodiode besar. Jika  tahanan photodiode kecil  maka tegangan  V- akan kecil . Misal tahanan photodiode mengecil menjadi 10kOhm. Maka dengan teorema pembagi tegangan: V- = Rrx/(Rrx + R2) x Vcc V- = 10 / (10+10) x Vcc V- = (1/2) x 5 Volt V- = 2.5 Volt Sedangkan jika  tahanan photodiode besar  maka tegangan  V- akan besar  (mendekati nilai Vcc). Misal tahanan photodiode menjadi 150kOhm. Maka dengan teorema pembagi tegangan: V- = Rrx/(Rrx + R2) x Vcc V- = 150 / (150+10) x Vcc V- = (150/160) x 5

Configuring Swap Memory on Ubuntu Using Ansible

If we maintain a Linux machine with a low memory capacity while we are required to run an application with high memory consumption, enabling swap memory is an option. Ansible can be utilized as a helper tool to automate the creation of swap memory. A swap file can be allocated in the available storage of the machine. The swap file then can be assigned as a swap memory. Firstly, we should prepare the inventory file. The following snippet is an example, you must provide your own configuration. [server] 192.168.1.2 [server:vars] ansible_user=root ansible_ssh_private_key_file=~/.ssh/id_rsa Secondly, we need to prepare the task file that contains not only the tasks but also some variables and connection information. For instance, we set /swapfile  as the name of our swap file. We also set the swap memory size to 2GB and the swappiness level to 60. - hosts: server become: true vars: swap_vars: size: 2G swappiness: 60 For simplicity, we only check the exi

API Gateway Using KrakenD

The increasing demands of users for high-quality web services create the need to integrate various technologies into our application. This will cause the code base to grow larger, making maintenance more difficult over time. A microservices approach offers a solution, where the application is built by combining multiple smaller services, each with a distinct function. For example, one service handles authentication, another manages business functions, another maintains file uploads, and so on. These services communicate and integrate through a common channel. On the client side, users don't need to understand how the application is built or how it functions internally. They simply send a request to a single endpoint, and processes like authentication, caching, or database querying happen seamlessly. This is where an API gateway is effective. It handles user requests and directs them to the appropriate handler. There are several tools available for building an API gateway, su

Deliver SaaS According Twelve-Factor App

If you haven't heard of  the twelve-factor app , it gives us a recommendation or a methodology for developing SaaS or web apps structured into twelve items. The recommendation has some connections with microservice architecture and cloud-native environments which become more popular today. We can learn the details on its website . In this post, we will do a quick review of the twelve points. One Codebase Multiple Deployment We should maintain only one codebase for our application even though the application may be deployed into multiple environments like development, staging, and production. Having multiple codebases will lead to any kinds of complicated issues. Explicitly State Dependencies All the dependencies for running our application should be stated in the project itself. Many programming languages have a kind of file that maintains a list of the dependencies like package.json in Node.js. We should also be aware of the dependencies related to the pla

Beautiful Rain (JDorama)

Saya selalu tertarik dengan film-film inspirasional, baik movie atau pun serial drama. Akhir-akhir ini saya tertarik untuk menonton drama serial jepang. Saya googling dengan keyword "inspirational japan dorama" kemudian saya dapati sejumlah review  beberapa film bagus dari sejumlah netizen.  Salah satu yang kemudian saya tonton adalah Beautiful Rain . Setiap episode film ini selalu membuat saya sangat terharu sampai meneteskan air mata. :' Yah, ini mungkin saja karena saya yang terlalu melankolis. Hahaha. Ini sedikit review dari saya tentang film ini.

Manage Kubernetes Cluster using Rancher

Recently, I sought a simpler method to deploy and maintain Kubernetes clusters across various cloud providers. The goal was to use it for development purposes with the ability to manage the infrastructure and costs effortlessly. After exploring several options, I decided to experiment with Rancher. Rancher offers a comprehensive software stack for teams implementing container technology. It tackles both the operational and security hurdles associated with managing numerous Kubernetes clusters. Additionally, it equips DevOps teams with integrated tools essential for managing containerized workloads. Rancher also offers an open-source version, allowing free deployment within one's infrastructure. The Rancher platform can be deployed either as a Docker container or within a Kubernetes cluster utilizing the K3s engine. We can read the documentation on how to install Rancher on K3s using Helm . Rancher itself enables the creation and provisioning of Kubernetes clusters and