TF Infrastructure is a basic Terraform repo which sets up most of the infrastructure involved in this website, as well as a few other services.

If it were a more collaborative project I would probably split it up into multiple repositories. But it’s just me making very occasional changes, so monorepo it is!

It’s fairly specific to the services I use, it probably won’t be directly useful to anyone else. You may not use mailbox.org for email, but the DNS entries required to set up email is fairly consistent across providers. Hopefully it can provide some ideas for a problem you’re trying to solve.

Services

This repo lets you manage the following:

  • A Cloudflare zone
  • DNS for mailbox.org configured on Cloudflare
  • AWS billing alerts
  • AWS S3 bucket for a static site (undoes this)
  • AWS S3 bucket for a static site with redirections

Set Up

At the moment the Terraform state, workspaces, variables, and execution are managed by Terraform Cloud. My over all experience with Terraform Cloud is good, my only gripe is with importing resources. TF Cloud doesn’t support it, instead it has to be done locally. It’s fine occasionally but gets tedious quickly.

Workspaces, Variables, and Projects

While this is a monorepo I don’t want to redeploy all of my infrastructure at once. That’s where workspaces come in handy. Set up a new workspace using version control, and specify the Terraform working directory. On top of that you can create multiple workspaces pointing to the same working directory but with different variables specified to deploy very similar but distinct applications.

It gets a bit messy though, so it helps to split these workspaces into different projects.

Credentials

To apply Terraform code we need to grant access to wherever we’re deploying to.

AWS

I followed this blog post on AWS about setting up OIDC for Terraform Cloud.

Cloudflare

Unfortunately Cloudflare doesn’t have such an elegant way of providing access. Creating an API with the appropriate access, and assigning it to the CLOUDFLARE_API_TOKEN environment variable within a variable set or individual workspace works well enough.

Folder Overview

aws

alerts

Creates:

  • A Cloudwatch metric alarm for when AWS/Billing meets a certain threshold.
  • An SNS topic and subscription for that metric.

S3

Creates a static site on S3 with corresponding DNS on Cloudflare.

S3-redirect

Creates a static site for redirection on S3 with corresponding DNS on Cloudflare.

Cloudflare

Email

Sets up the DNS required for mailbox.org.

Zone

Creates a zone in Cloudflare.

Modules

S3-policy

Creates the policies required for publicly accessible S3 static sites.

Originally I wanted to create some sort of S3 site module and use null and count to switch between resource creation and attributes.

It ended up messy and I didn’t want to think about making modifications to it in the future. So instead we have both s3 and s3-redirect as separate folders with shared definitions for their policies.