terraform plan / apply #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: terraform plan / apply | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| CLOUD_PROVIDER: | |
| description: 'Choose the cloud provider (aws, azure, gcp)' | |
| required: true | |
| type: choice | |
| options: | |
| - aws | |
| - azure | |
| - gcp | |
| TERRAFORM_COMPONENT: | |
| description: 'Choose component to deploy (base-infra is one-time, infra/observ-infra can be destroyed/recreated multiple times)' | |
| required: true | |
| type: choice | |
| options: | |
| - base-infra | |
| - infra | |
| - observ-infra | |
| default: infra | |
| BACKEND_TYPE: | |
| description: 'Choose Terraform backend type' | |
| required: true | |
| type: choice | |
| options: | |
| - local | |
| - remote | |
| default: local | |
| REMOTE_BACKEND_CONFIG: | |
| description: 'Remote backend config (format: aws:bucket_base_name:region OR azure:rg_name:storage_account:container OR gcp:bucket_name). SECURITY: Use separate buckets per component for production (e.g., mybucket-base-infra, mybucket-infra, mybucket-observ)' | |
| required: false | |
| type: string | |
| ENABLE_STATE_LOCKING: | |
| description: 'Enable Terraform state locking with DynamoDB (recommended for production)' | |
| required: false | |
| type: boolean | |
| default: true | |
| SSH_PRIVATE_KEY: | |
| description: 'The GitHub secret containing the private key of the SSH key named in the preceding input variable `SSH_PRIVATE_KEY` is used for SSH login purposes on nginx node.' | |
| required: true | |
| TERRAFORM_APPLY: | |
| description: 'Terraform apply' | |
| required: false | |
| type: boolean | |
| default: false | |
| env: | |
| # TF_LOG_PATH: ./temp/terraform.log | |
| ## TRACE, DEBUG, INFO, WARN or ERROR | |
| # TF_LOG: TRACE | |
| # Repository-level secrets for cloud credentials | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| # Fix: Use lowercase variable name to match Terraform variable | |
| TF_VAR_ssh_private_key: ${{ secrets[inputs.SSH_PRIVATE_KEY] }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| jobs: | |
| terraform: | |
| runs-on: ubuntu-latest | |
| # Use dynamic environment based on current branch name | |
| environment: ${{ github.ref_name }} | |
| defaults: | |
| run: | |
| shell: bash | |
| # We work in the cloud-specific implementation directory | |
| working-directory: 'terraform/implementations/${{ inputs.CLOUD_PROVIDER }}/${{ inputs.TERRAFORM_COMPONENT }}' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Check for required implementation directory | |
| run: | | |
| if [ ! -d "." ]; then | |
| echo "Directory 'terraform/implementations/${{ inputs.CLOUD_PROVIDER }}/${{ inputs.TERRAFORM_COMPONENT }}' does not exist." | |
| echo "Available providers: aws, azure, gcp" | |
| echo "Available components: base-infra, infra" | |
| exit 1 | |
| fi | |
| # Check if tfvars file exists | |
| if [ ! -f "${{ inputs.CLOUD_PROVIDER }}.tfvars" ]; then | |
| echo "Configuration file '${{ inputs.CLOUD_PROVIDER }}.tfvars' not found in current directory." | |
| exit 1 | |
| fi | |
| - name: Setup Cloud Storage for Remote State (All Providers) | |
| run: | | |
| if [ "${{ inputs.BACKEND_TYPE }}" = "remote" ]; then | |
| echo "Setting up cloud storage for remote Terraform state..." | |
| # Use the cloud-agnostic storage setup script | |
| ../../../../.github/scripts/setup-cloud-storage.sh \ | |
| --provider "${{ inputs.CLOUD_PROVIDER }}" \ | |
| --config "${{ inputs.REMOTE_BACKEND_CONFIG }}" \ | |
| --branch "${{ github.ref_name }}" \ | |
| --component "${{ inputs.TERRAFORM_COMPONENT }}" \ | |
| ${{ inputs.ENABLE_STATE_LOCKING == true && '--enable-locking' || '' }} | |
| else | |
| echo "Skipping cloud storage setup (using local backend)" | |
| fi | |
| - name: Configure Terraform Backend for State Management | |
| run: | | |
| # Use backend configuration script for cleaner code | |
| ../../../../.github/scripts/configure-backend.sh \ | |
| --type "${{ inputs.BACKEND_TYPE }}" \ | |
| --provider "${{ inputs.CLOUD_PROVIDER }}" \ | |
| --component "${{ inputs.TERRAFORM_COMPONENT }}" \ | |
| --branch "${{ github.ref_name }}" \ | |
| --remote-config "${{ inputs.REMOTE_BACKEND_CONFIG }}" \ | |
| ${{ inputs.ENABLE_STATE_LOCKING == true && '--enable-locking' || '' }} | |
| - name: Skip SSH Host key verification | |
| run: | | |
| mkdir -p ~/.ssh | |
| echo -e "Host *\n StrictHostKeyChecking no" > ~/.ssh/config | |
| - name: Setup ufw firewall | |
| run: | | |
| sudo ufw enable | |
| sudo ufw allow ssh | |
| sudo ufw allow 443/tcp | |
| sudo ufw allow 51820/udp | |
| sudo ufw status | |
| if: "${{ inputs.TERRAFORM_COMPONENT != 'base-infra' }}" | |
| - name: Install WireGuard | |
| run: sudo apt-get install -y wireguard | |
| if: "${{ inputs.TERRAFORM_COMPONENT != 'base-infra' }}" | |
| - name: Configure WireGuard | |
| run: | | |
| # WG_CONFIG comes from environment-level secrets (dynamic based on branch name) | |
| if [ -z "${{ secrets.TF_WG_CONFIG }}" ]; then | |
| echo "❌ ERROR: TF_WG_CONFIG secret is not configured for environment '${{ github.ref_name }}'" | |
| echo "Please configure the WireGuard configuration secret for this branch/environment" | |
| exit 1 | |
| fi | |
| # Debug: Check if secret is available (without exposing content) | |
| echo "🔍 Checking TF_WG_CONFIG secret..." | |
| if [ ${#TF_WG_CONFIG} -eq 0 ]; then | |
| echo "❌ ERROR: TF_WG_CONFIG environment variable is empty" | |
| echo "Secret may contain only whitespace or special characters" | |
| exit 1 | |
| fi | |
| echo "✅ Secret length: ${#TF_WG_CONFIG} characters" | |
| # Create config file with proper handling of multiline content | |
| sudo mkdir -p /etc/wireguard | |
| echo "$TF_WG_CONFIG" | sudo tee /etc/wireguard/wg0.conf > /dev/null | |
| # Verify config file is not empty and has expected content | |
| if [ ! -s /etc/wireguard/wg0.conf ]; then | |
| echo "❌ ERROR: WireGuard config file is empty after writing!" | |
| echo "This usually means the secret contains only whitespace or invalid characters" | |
| exit 1 | |
| fi | |
| # Basic validation that it looks like a WireGuard config | |
| if ! grep -q "\[Interface\]" /etc/wireguard/wg0.conf; then | |
| echo "❌ ERROR: WireGuard config doesn't contain [Interface] section" | |
| echo "Please check that TF_WG_CONFIG contains a valid WireGuard configuration" | |
| echo "Config file size: $(wc -c < /etc/wireguard/wg0.conf) bytes" | |
| exit 1 | |
| fi | |
| echo "✅ WireGuard configuration applied successfully" | |
| echo "Config file size: $(wc -c < /etc/wireguard/wg0.conf) bytes" | |
| env: | |
| TF_WG_CONFIG: ${{ secrets.TF_WG_CONFIG }} | |
| if: "${{ inputs.TERRAFORM_COMPONENT != 'base-infra' }}" | |
| - name: Start WireGuard | |
| run: | | |
| sudo chmod 600 /etc/wireguard/wg0.conf | |
| sudo chmod 700 /etc/wireguard/ | |
| sudo chmod 644 /lib/systemd/system/wg-quick@.service | |
| sudo systemctl daemon-reload | |
| echo "Starting WireGuard..." | |
| if ! sudo wg-quick up wg0; then | |
| echo "❌ ERROR: Failed to start WireGuard VPN" | |
| echo "Config file contents (first 5 lines):" | |
| head -5 /etc/wireguard/wg0.conf | |
| exit 1 | |
| fi | |
| echo "✅ WireGuard started successfully" | |
| sudo wg show wg0 | |
| if: "${{ inputs.TERRAFORM_COMPONENT != 'base-infra' }}" | |
| - name: Setup Terraform with specified version on the runner | |
| uses: hashicorp/setup-terraform@v3 | |
| with: | |
| terraform_version: v1.8.5 | |
| - name: Display Component Information | |
| run: | | |
| echo "Deploying to: ${{ inputs.CLOUD_PROVIDER }} (${{ inputs.TERRAFORM_COMPONENT }})" | |
| echo "Working directory: $(pwd)" | |
| echo "Available files:" | |
| ls -la | |
| if [ "${{ inputs.TERRAFORM_COMPONENT }}" = "base-infra" ]; then | |
| echo "WARNING: base-infra should only be deployed once per cloud provider" | |
| echo " This creates foundational resources like VPCs, subnets, etc." | |
| else | |
| echo "INFO: infra deployment - can be destroyed and recreated multiple times" | |
| echo " This creates MOSIP application infrastructure" | |
| fi | |
| - name: Terraform fmt | |
| run: terraform fmt -recursive | |
| - name: Terraform Init | |
| run: | | |
| # First try normal init | |
| if ! terraform init; then | |
| echo "Normal init failed, trying with -reconfigure to handle backend configuration changes..." | |
| terraform init -reconfigure | |
| fi | |
| - name: Terraform Validate | |
| run: terraform validate -no-color | |
| - name: Terraform Plan | |
| id: plan | |
| run: | | |
| terraform plan -input=false -var-file="${{ inputs.CLOUD_PROVIDER }}.tfvars" -out ./tf-plan -no-color | |
| continue-on-error: true | |
| - name: Terraform Apply | |
| id: apply | |
| run: terraform apply -input=false -var-file="${{ inputs.CLOUD_PROVIDER }}.tfvars" -no-color -auto-approve | |
| if: "${{ inputs.TERRAFORM_APPLY == true }}" | |
| continue-on-error: true | |
| - name: Add the Terraform plan file / *.tfstate files / terraform format changes | |
| run: | | |
| echo "Current working directory: $(pwd)" | |
| echo "Files in current directory:" | |
| ls -la | |
| echo "Checking for Terraform files to commit..." | |
| # Force add Terraform files even if they're in .gitignore | |
| git add -f *.tfstate* 2>/dev/null || echo "No .tfstate files found" | |
| git add -f tf-plan 2>/dev/null || echo "No tf-plan file found" | |
| git add -f backend.tf 2>/dev/null || echo "No backend.tf file found" | |
| git add -f *.tf 2>/dev/null || echo "No .tf file found" | |
| # Also add any other Terraform-related files that might have been created | |
| git add -A | |
| echo "Git status after adding files:" | |
| git status | |
| # Check if there are any changes to commit | |
| if git diff --cached --quiet; then | |
| echo "No changes to commit - this is normal for remote backends or when state is managed remotely" | |
| echo "Terraform execution completed successfully" | |
| else | |
| echo "Committing Terraform changes..." | |
| git config --global user.email ${{ github.actor }}@users.noreply.github.com | |
| git config --global user.name ${{ github.actor }} | |
| git commit -s -am "Terraform files GitHub Actions - ${{ inputs.CLOUD_PROVIDER }}-${{ inputs.TERRAFORM_COMPONENT }}" | |
| git push | |
| echo "Changes committed and pushed successfully" | |
| fi | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| if: always() | |
| - name: Terraform plan / apply status | |
| if: ${{ steps.plan.outcome == 'failure' || steps.apply.outcome == 'failure' }} | |
| run: exit 1 | |
| - uses: 8398a7/action-slack@v3 | |
| with: | |
| status: ${{ job.status }} | |
| fields: repo,message,author,commit,workflow,job # selectable (default: repo,message) | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} # required | |
| if: "${{ github.event_name != 'pull_request' && failure() }}" # Pick up events even if the job fails or is canceled. |