From 5579155afabacdc40a3d88472f61355e97d824e8 Mon Sep 17 00:00:00 2001 From: JoseNav <87873877+LiReXz@users.noreply.github.com> Date: Mon, 22 Jun 2026 18:42:29 +0200 Subject: [PATCH 1/4] Added certbot+nginx config in EC2 user_data --- terraform/ec2.tf | 66 +++++++++++++++++++++++++++++++++-------- terraform/networking.tf | 26 ++++++++++------ 2 files changed, 71 insertions(+), 21 deletions(-) diff --git a/terraform/ec2.tf b/terraform/ec2.tf index 1228e2c..3738e90 100644 --- a/terraform/ec2.tf +++ b/terraform/ec2.tf @@ -6,22 +6,64 @@ resource "aws_instance" "ranky-ec2" { key_name = aws_key_pair.ranky-ec2-keypair.key_name user_data = <<-EOF - #!/bin/bash - sudo yum update -y - sudo yum install docker -y - sudo systemctl start docker - sudo systemctl enable docker +#!/bin/bash +set -e - # Autenticarse con ECR - aws ecr get-login-password --region eu-west-2 | sudo docker login --username AWS --password-stdin ${var.AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo +yum update -y +# Docker +yum install -y docker +systemctl enable docker +systemctl start docker - # Tirar la imagen desde ECR - sudo docker pull ${var.AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest +sleep 5 - # Ejecutar la imagen - sudo docker run -d -p 8080:8080 --name ranky-app ${var.AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest - EOF +# AWS CLI +yum install -y awscli + +# NGINX +yum install -y nginx +systemctl enable nginx +systemctl start nginx + +# Certbot +sleep 20 +yum install -y certbot python3-certbot-nginx + +# ECR login +aws ecr get-login-password --region eu-west-2 \ +| docker login --username AWS --password-stdin ${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo + +# Pull image +docker pull ${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest + +# Run container SOLO LOCAL +docker run -d \ + --name ranky-app \ + -p 127.0.0.1:8080:8080 \ + --restart always \ + ${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest + +# NGINX reverse proxy +cat > /etc/nginx/conf.d/ranky.conf <<'EOF' +server { + listen 80; + server_name api.ranky.top; + + location / { + proxy_pass http://127.0.0.1:8080; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } +} +EOF + +nginx -t && systemctl restart nginx + +# Certbot (HTTPS) +certbot --nginx -d api.ranky.top --non-interactive --agree-tos -m mikel.garin@ranky.top + EOF iam_instance_profile = aws_iam_instance_profile.ranky-ec2-profile.name diff --git a/terraform/networking.tf b/terraform/networking.tf index a9d82d2..f106ca1 100644 --- a/terraform/networking.tf +++ b/terraform/networking.tf @@ -63,28 +63,32 @@ resource "aws_security_group" "ranky-sg-ec2" { name = "ranky-sg" description = "Security group for ranky ec2" - vpc_id = aws_vpc.ranky-vpc.id + vpc_id = aws_vpc.ranky-vpc.id + # SSH ingress { - from_port = 22 - to_port = 22 - protocol = "tcp" + from_port = 22 + to_port = 22 + protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } + + # HTTP (certbot) ingress { from_port = 80 to_port = 80 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } + + # HTTPS (Nginx + certbot final) ingress { - from_port = 8080 - to_port = 8080 + from_port = 443 + to_port = 443 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } - egress { from_port = 0 to_port = 0 @@ -92,7 +96,11 @@ resource "aws_security_group" "ranky-sg-ec2" { cidr_blocks = ["0.0.0.0/0"] } - depends_on = [ + tags = { + Name = "ranky-sg-ec2" + } + + depends_on = [ aws_vpc.ranky-vpc ] -} +} \ No newline at end of file From e4b4f127e717af890a1d1b2dccd192b197cbbc64 Mon Sep 17 00:00:00 2001 From: JoseNav <87873877+LiReXz@users.noreply.github.com> Date: Mon, 22 Jun 2026 18:50:15 +0200 Subject: [PATCH 2/4] Fix syntax --- terraform/ec2.tf | 110 +++++++++++++++++++++++------------------------ 1 file changed, 55 insertions(+), 55 deletions(-) diff --git a/terraform/ec2.tf b/terraform/ec2.tf index 3738e90..8bb6715 100644 --- a/terraform/ec2.tf +++ b/terraform/ec2.tf @@ -6,63 +6,63 @@ resource "aws_instance" "ranky-ec2" { key_name = aws_key_pair.ranky-ec2-keypair.key_name user_data = <<-EOF -#!/bin/bash -set -e - -yum update -y - -# Docker -yum install -y docker -systemctl enable docker -systemctl start docker - -sleep 5 - -# AWS CLI -yum install -y awscli - -# NGINX -yum install -y nginx -systemctl enable nginx -systemctl start nginx - -# Certbot -sleep 20 -yum install -y certbot python3-certbot-nginx - -# ECR login -aws ecr get-login-password --region eu-west-2 \ -| docker login --username AWS --password-stdin ${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo - -# Pull image -docker pull ${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest - -# Run container SOLO LOCAL -docker run -d \ - --name ranky-app \ - -p 127.0.0.1:8080:8080 \ - --restart always \ - ${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest - -# NGINX reverse proxy -cat > /etc/nginx/conf.d/ranky.conf <<'EOF' -server { - listen 80; - server_name api.ranky.top; - - location / { - proxy_pass http://127.0.0.1:8080; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - } -} -EOF + #!/bin/bash + set -e + + yum update -y + + # Docker + yum install -y docker + systemctl enable docker + systemctl start docker + + sleep 5 + + # AWS CLI + yum install -y awscli + + # NGINX + yum install -y nginx + systemctl enable nginx + systemctl start nginx + + # Certbot + sleep 20 + yum install -y certbot python3-certbot-nginx + + # ECR login + aws ecr get-login-password --region eu-west-2 \ + | docker login --username AWS --password-stdin ${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo + + # Pull image + docker pull ${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest + + # Run container SOLO LOCAL + docker run -d \ + --name ranky-app \ + -p 127.0.0.1:8080:8080 \ + --restart always \ + ${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest + + # NGINX reverse proxy (Cambiado a EON para evitar conflictos) + cat > /etc/nginx/conf.d/ranky.conf <<'EON' + server { + listen 80; + server_name api.ranky.top; + + location / { + proxy_pass http://127.0.0.1:8080; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } + } + EON -nginx -t && systemctl restart nginx + nginx -t && systemctl restart nginx -# Certbot (HTTPS) -certbot --nginx -d api.ranky.top --non-interactive --agree-tos -m mikel.garin@ranky.top + # Certbot (HTTPS) + certbot --nginx -d api.ranky.top --non-interactive --agree-tos -m mikel.garin@ranky.top EOF iam_instance_profile = aws_iam_instance_profile.ranky-ec2-profile.name From 2d7f4938d3e2268ea3dad4bf48de7604fe5e1fbc Mon Sep 17 00:00:00 2001 From: JoseNav <87873877+LiReXz@users.noreply.github.com> Date: Mon, 22 Jun 2026 19:16:33 +0200 Subject: [PATCH 3/4] skip s3 bucket creation if exists --- .github/workflows/aws-create.yml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/aws-create.yml b/.github/workflows/aws-create.yml index 373d7d1..50981d2 100644 --- a/.github/workflows/aws-create.yml +++ b/.github/workflows/aws-create.yml @@ -62,11 +62,19 @@ jobs: run: | aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com - - name: Create S3 bucket for terraform.tfstate + - name: Create S3 bucket for terraform.tfstate (if not exists) run: | BUCKET_NAME=ranky-bot-s3 - FILE_PATH=terraform/terraform.tfstate - aws s3api create-bucket --bucket $BUCKET_NAME --region eu-west-2 --create-bucket-configuration LocationConstraint=eu-west-2 + + if aws s3api head-bucket --bucket "$BUCKET_NAME" 2>/dev/null; then + echo "El bucket $BUCKET_NAME ya existe y eres el propietario. Skipeando creación..." + else + echo "El bucket no existe o no tienes acceso. Intentando crearlo..." + aws s3api create-bucket \ + --bucket "$BUCKET_NAME" \ + --region eu-west-2 \ + --create-bucket-configuration LocationConstraint=eu-west-2 + fi - name: Terraform Init run: terraform init From 7f28a89ba72153e363fe6edcfaf959fd4c6ee5ec Mon Sep 17 00:00:00 2001 From: JoseNav <87873877+LiReXz@users.noreply.github.com> Date: Mon, 22 Jun 2026 19:20:43 +0200 Subject: [PATCH 4/4] add var prefix to AWS_ACCOUNT_ID in terraform --- terraform/ec2.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/terraform/ec2.tf b/terraform/ec2.tf index 8bb6715..5818f27 100644 --- a/terraform/ec2.tf +++ b/terraform/ec2.tf @@ -32,17 +32,17 @@ resource "aws_instance" "ranky-ec2" { # ECR login aws ecr get-login-password --region eu-west-2 \ - | docker login --username AWS --password-stdin ${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo + | docker login --username AWS --password-stdin ${var.AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo # Pull image - docker pull ${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest + docker pull ${var.AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest # Run container SOLO LOCAL docker run -d \ --name ranky-app \ -p 127.0.0.1:8080:8080 \ --restart always \ - ${AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest + ${var.AWS_ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/ranky-repo:latest # NGINX reverse proxy (Cambiado a EON para evitar conflictos) cat > /etc/nginx/conf.d/ranky.conf <<'EON'