Infrastructure and GHA for Backend API (#419)

* Infrastructure and GHA for Backend API * change wording to middleware from backend * get vault secrets ready * merge main * reconfigure cidr ranges * change from backend to middleware * change from backend to middleware * test building and publishing middleware image * cleanup * rm vault data source secrets * comment out vars * clean-up * rm middleware cicd * wip --------- Co-authored-by: Administrator <[email protected]>
CDCgov · Dec 3, 2024 · 3e66da6 · 3e66da6
1 parent e563caf
commit 3e66da6
Show file tree

Hide file tree

Showing 9 changed files with 135 additions and 37 deletions.
diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml
@@ -13,6 +13,9 @@ on:
       ocr-version:
         description: 'Create a version for this OCR API image'
         required: true
+      middleware-version:
+        description: 'Create a version for this middleware API image'
+        required: true
 
 permissions:
   contents: read
@@ -21,6 +24,33 @@ permissions:
   id-token: write
 
 jobs:
+  build-publish-middleware:
+    name: Build and Publish middleware
+    runs-on: ubuntu-latest
+    outputs:
+      docker_inspect: ${{ steps.image_check.outputs.docker_inspect }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Lowercase the repo name
+        run: echo "REPO=${GITHUB_REPOSITORY,,}" >>${GITHUB_ENV}
+      - name: Check if image exists
+        id: image_check
+        run: |
+          echo "docker_inspect=$(
+              docker manifest inspect ghcr.io/${{ env.REPO }}-middleware-api:${{ inputs.middleware-version }} > /dev/null ; echo $?
+            )" >> $GITHUB_OUTPUT
+      - name: Build and Push the middleware
+        if: ${{ steps.image_check.outputs.docker_inspect == 1 }}
+        uses: ./.github/actions/build-publish-api
+        with:
+          docker-registry: ghcr.io
+          docker-pw: ${{ secrets.GITHUB_TOKEN }}
+          docker-username: ${{ github.actor }}
+          docker-tag: ${{ inputs.middleware-version }}
+          dockerfile-path: ./backend/Dockerfile
+          docker-context-path: ./backend/
+          api-name: middleware-api
+
   build-publish-ocr:
     name: Build and Publish OCR
     runs-on: ubuntu-latest
@@ -36,7 +66,7 @@ jobs:
           echo "docker_inspect=$(
               docker manifest inspect ghcr.io/${{ env.REPO }}-ocr-api:${{ inputs.ocr-version }} > /dev/null ; echo $?
             )" >> $GITHUB_OUTPUT
-      - name: Build and Push backend
+      - name: Build and Push the OCR
         if: ${{ steps.image_check.outputs.docker_inspect == 1 }}
         uses: ./.github/actions/build-publish-api
         with:
@@ -62,7 +92,7 @@ jobs:
           frontend-build-path: ./frontend/dist/
           node-version: 20
 
-  environment-setup:
+  az-environment-setup:
     name: Setup Azure Environment
     runs-on: ubuntu-latest
     environment: ${{ inputs.deploy-env }}
@@ -83,11 +113,31 @@ jobs:
           azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
           app-name: reportvision
 
+  deploy-middleware:
+    name: Deploy middleware
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.deploy-env }}
+    needs: [build-publish-middleware, az-environment-setup]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: azure/login@v2
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      - name: Deploy middleware-API
+        uses: ./.github/actions/deploy-api
+        with:
+          deploy-env: ${{ inputs.deploy-env }}
+          docker-tag: ${{ inputs.middleware-version }}
+          docker-registry: ghcr.io
+          api-name: middleware-api
+
   deploy-ocr:
     name: Deploy OCR
     runs-on: ubuntu-latest
     environment: ${{ inputs.deploy-env }}
-    needs: [build-publish-ocr, environment-setup]
+    needs: [build-publish-ocr, az-environment-setup]
     steps:
       - uses: actions/checkout@v4
       - uses: azure/login@v2
@@ -107,7 +157,7 @@ jobs:
     name: Deploy Frontend
     runs-on: ubuntu-latest
     environment: ${{ inputs.deploy-env }}
-    needs: [build-frontend, environment-setup]
+    needs: [build-frontend, az-environment-setup]
     if: ${{ inputs.deploy-env != 'demo'}}
     steps:
       - uses: actions/checkout@v4

diff --git a/backend/Dockerfile b/backend/Dockerfile
@@ -0,0 +1,4 @@
+FROM amazoncorretto:17
+ENV HOME=/app
+RUN mkdir -p $HOME
+WORKDIR $HOME
diff --git a/ops/terraform/locals.tf b/ops/terraform/locals.tf
@@ -1,25 +1,29 @@
 locals {
-  environment = terraform.workspace
+  environment    = terraform.workspace
+  ocr-api        = "ocr"
+  middleware-api = "middleware"
   init = {
     environment = local.environment
     location    = "eastus2"
   }
   dev = {
     dev = {
-      vnetcidr      = "10.0.0.0/16"
-      appsubnetcidr = "10.0.1.0/24"
-      websubnetcidr = "10.0.2.0/24"
-      lbsubnetcidr  = "10.0.3.0/24"
-      dbsubnetcidr  = "10.0.4.0/24"
+      vnetcidr             = "10.0.0.0/16"
+      ocrsubnetcidr        = "10.0.1.0/24"
+      middlewaresubnetcidr = "10.0.2.0/24"
+      websubnetcidr        = "10.0.3.0/24"
+      lbsubnetcidr         = "10.0.4.0/24"
+      dbsubnetcidr         = "10.0.5.0/24"
     }
   }
   demo = {
     demo = {
-      vnetcidr      = "10.1.0.0/16"
-      appsubnetcidr = "10.1.1.0/24"
-      websubnetcidr = "10.1.2.0/24"
-      lbsubnetcidr  = "10.1.3.0/24"
-      dbsubnetcidr  = "10.1.4.0/24"
+      vnetcidr             = "10.1.0.0/16"
+      ocrsubnetcidr        = "10.1.1.0/24"
+      middlewaresubnetcidr = "10.1.2.0/24"
+      websubnetcidr        = "10.1.3.0/24"
+      lbsubnetcidr         = "10.1.4.0/24"
+      dbsubnetcidr         = "10.1.5.0/24"
     }
   }
 }
diff --git a/ops/terraform/main.tf b/ops/terraform/main.tf
@@ -9,16 +9,17 @@ locals {
 }
 
 module "networking" {
-  source         = "./modules/network"
-  name           = var.name
-  location       = data.azurerm_resource_group.rg.location
-  resource_group = data.azurerm_resource_group.rg.name
-  vnetcidr       = local.workspace["vnetcidr"]
-  websubnetcidr  = local.workspace["websubnetcidr"]
-  lbsubnetcidr   = local.workspace["lbsubnetcidr"]
-  appsubnetcidr  = local.workspace["appsubnetcidr"]
-  dbsubnetcidr   = local.workspace["dbsubnetcidr"]
-  env            = local.environment
+  source               = "./modules/network"
+  name                 = var.name
+  location             = data.azurerm_resource_group.rg.location
+  resource_group       = data.azurerm_resource_group.rg.name
+  vnetcidr             = local.workspace["vnetcidr"]
+  websubnetcidr        = local.workspace["websubnetcidr"]
+  lbsubnetcidr         = local.workspace["lbsubnetcidr"]
+  ocrsubnetcidr        = local.workspace["ocrsubnetcidr"]
+  middlewaresubnetcidr = local.workspace["middlewaresubnetcidr"]
+  dbsubnetcidr         = local.workspace["dbsubnetcidr"]
+  env                  = local.environment
 }
 
 module "securitygroup" {
@@ -58,13 +59,29 @@ module "storage" {
   web_subnet_id   = module.networking.websubnet_id
 }
 
+module "middleware_api" {
+  source         = "./modules/app_service"
+  service        = local.middleware-api
+  name           = var.name
+  location       = data.azurerm_resource_group.rg.location
+  resource_group = data.azurerm_resource_group.rg.name
+  app_subnet_id  = module.networking.middlewaresubnet_id
+
+  lb_subnet_id = module.networking.lbsubnet_id
+  env          = local.environment
+  vnet         = module.networking.network_name
+  sku_name     = var.sku_name
+  https_only   = true
+}
+
 module "ocr_api" {
   source         = "./modules/app_service"
+  service        = local.ocr-api
   name           = var.name
   location       = data.azurerm_resource_group.rg.location
   resource_group = data.azurerm_resource_group.rg.name
-  app_subnet_id  = module.networking.appsubnet_id
-  lb_subnet_id   = module.networking.lbsubnet_id
+  app_subnet_id  = module.networking.ocrsubnet_id
+  lb_subnet_id   = module.networking.middlewaresubnet_id
   env            = local.environment
   vnet           = module.networking.network_name
   sku_name       = var.sku_name
@@ -73,7 +90,7 @@ module "ocr_api" {
 
 module "ocr_autoscale" {
   source             = "./modules/app_service_autoscale"
-  service            = "ocr"
+  service            = local.ocr-api
   name               = var.name
   location           = data.azurerm_resource_group.rg.location
   env                = local.environment

diff --git a/ops/terraform/modules/app_service/main.tf b/ops/terraform/modules/app_service/main.tf
@@ -3,15 +3,15 @@ locals {
 }
 
 resource "azurerm_service_plan" "asp" {
-  name                = "${var.name}-ocr-appserviceplan-${var.env}"
+  name                = "${var.name}-${var.service}-appserviceplan-${var.env}"
   location            = var.location
   os_type             = "Linux"
   resource_group_name = var.resource_group
   sku_name            = var.sku_name
 }
 
 resource "azurerm_linux_web_app" "linux_webapp" {
-  name                      = "${var.name}-ocr-${var.env}"
+  name                      = "${var.name}-${var.service}-${var.env}"
   https_only                = var.https_only
   location                  = var.location
   resource_group_name       = var.resource_group

diff --git a/ops/terraform/modules/app_service/variables.tf b/ops/terraform/modules/app_service/variables.tf
@@ -7,6 +7,7 @@ variable "app_subnet_id" {}
 variable "sku_name" {
   default = "S2"
 }
+variable "service" {}
 
 
 variable "https_only" {

diff --git a/ops/terraform/modules/network/main.tf b/ops/terraform/modules/network/main.tf
@@ -17,11 +17,11 @@ resource "azurerm_subnet" "web-subnet" {
   depends_on = [azurerm_virtual_network.vnet]
 }
 
-resource "azurerm_subnet" "app-subnet" {
-  name                 = "${var.name}-app-subnet-${var.env}"
+resource "azurerm_subnet" "ocr-subnet" {
+  name                 = "${var.name}-ocr-subnet-${var.env}"
   virtual_network_name = azurerm_virtual_network.vnet.name
   resource_group_name  = var.resource_group
-  address_prefixes     = [var.appsubnetcidr]
+  address_prefixes     = [var.ocrsubnetcidr]
 
   delegation {
     name = "delegation"
@@ -45,6 +45,22 @@ resource "azurerm_subnet" "lb-subnet" {
   depends_on = [azurerm_virtual_network.vnet]
 }
 
+resource "azurerm_subnet" "middleware-subnet" {
+  name                 = "${var.name}-middleware-subnet-${var.env}"
+  virtual_network_name = azurerm_virtual_network.vnet.name
+  resource_group_name  = var.resource_group
+  address_prefixes     = [var.middlewaresubnetcidr]
+
+  delegation {
+    name = "delegation"
+
+    service_delegation {
+      name    = "Microsoft.Web/serverFarms"
+      actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
+    }
+  }
+}
+
 
 resource "azurerm_subnet" "db-subnet" {
   name                 = "${var.name}-db-subnet-${var.env}"

diff --git a/ops/terraform/modules/network/outputs.tf b/ops/terraform/modules/network/outputs.tf
@@ -18,8 +18,13 @@ output "lbsubnet_id" {
   description = "Id of lbsubnet in the network"
 }
 
-output "appsubnet_id" {
-  value       = azurerm_subnet.app-subnet.id
+output "ocrsubnet_id" {
+  value       = azurerm_subnet.ocr-subnet.id
+  description = "Id of lbsubnet in the network"
+}
+
+output "middlewaresubnet_id" {
+  value       = azurerm_subnet.middleware-subnet.id
   description = "Id of lbsubnet in the network"
 }
 

diff --git a/ops/terraform/modules/network/variables.tf b/ops/terraform/modules/network/variables.tf
@@ -3,9 +3,10 @@ variable "name" {}
 variable "vnetcidr" {}
 variable "websubnetcidr" {}
 variable "lbsubnetcidr" {}
-variable "dbsubnetcidr" {}
-variable "appsubnetcidr" {}
+variable "ocrsubnetcidr" {}
 variable "env" {}
+variable "middlewaresubnetcidr" {}
+variable "dbsubnetcidr" {}
 
 variable "location" {
   default = "eastus2"