Merge pull request 'Add Terraform Provisioning.' (#1) from feat/terraform into main

Reviewed-on: https://code.maximhutz.com/Web/Portfolio/pulls/1

.gitea/workflows/prepare.yml

@@ -1,39 +0,0 @@
-name: Prepare changes for deployment.
-
-on:
-  push:
-    branches:
-      - 'main'
-
-jobs:
-  prepare:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          token: ${{ secrets.SECRET }}
-  
-      - uses: actions/setup-node@v3
-        with:
-          node-version: '16'
-
-      - name: Install dependencies.
-        run: npm i -g terser csso-cli
-
-      - name: "Copying changes over to build."
-        run: git checkout -b build
-
-      - name: Minify files.
-        run: |
-          find . -name "*.js" -type f -exec terser {} -c -o {} \;
-          find . -name "*.css" -type f -exec csso {} -o {} \;
-      
-      - name: "Commiting changes."
-        run: |
-          git config user.name github-actions
-          git config user.email noreply@github.com
-          git commit -am "Preparing changes for deployment."
-  
-      - name: "Pushing changes."
-        run: git push -uf origin build

.gitignore

@@ -3,4 +3,49 @@ _site
 .jekyll-cache
 vendor
 .vscode
-.DS_Store
+.DS_Store
+secrets
+secret.tfvars
+
+# ---> Terraform
+# Local .terraform directories
+.terraform
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version 
+# control as they are data points which are potentially sensitive and subject 
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+*.terraformrc
+terraform.rc
+
+# ---------------------------------------------------------------------------- #
+
+# Custom ignores.
+
+*.tfvars
+*.tfbackend

Taskfile.yml

@@ -1,5 +1,16 @@
 version: 3
+
+env: { TF: terraform -chdir=terraform }
 silent: true
 
 tasks:
-  action: act -W .gitea/workflows --container-architecture linux/amd64
+  tf/init: $TF init -backend-config=s3.tfbackend
+  tf/plan: $TF plan
+  tf/destroy: $TF destroy
+  tf/format: $TF fmt -recursive
+  tf/apply: 
+    - $TF apply
+    - $TF output -json > terraform.secrets
+
+  action: act -W .gitea/workflows --container-architecture linux/amd64
+  dev: bundle exec jekyll serve

_config.yml

@@ -0,0 +1,5 @@
+exclude:
+  - "*.yml"
+  - "*.md"
+  - "LICENSE"
+  - "terraform/*"

terraform/main.tf

@@ -0,0 +1,59 @@
+# Create the S3 bucket.
+
+resource "aws_s3_bucket" "portfolio_bucket" {
+  bucket = var.bucket_name
+
+  tags = {
+    Name        = "Portfolio Bucket"
+    Environment = "Production"
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "portfolio_bucket_access" {
+  bucket = aws_s3_bucket.portfolio_bucket.id
+
+  block_public_acls   = false
+  block_public_policy = false
+}
+
+resource "aws_s3_bucket_versioning" "portfolio_bucket_access_versioning" {
+  bucket = aws_s3_bucket.portfolio_bucket.id
+
+  versioning_configuration {
+    status = "Disabled"
+  }
+}
+
+#------------------------------------------------------------------------------#
+
+# Give a user access.
+
+data "aws_iam_policy_document" "portfolio_bucket_policy_doc" {
+  statement {
+    effect  = "Allow"
+    actions = ["s3:*", "s3-object-lambda:*"]
+    resources = [
+      "${aws_s3_bucket.portfolio_bucket.arn}/*",
+      "${aws_s3_bucket.portfolio_bucket.arn}"
+    ]
+  }
+}
+
+resource "aws_iam_policy" "portfolio_bucket_policy" {
+  name        = "${var.role_name}Policy"
+  description = "The policy that manages the Portfolio Bucket."
+  policy      = data.aws_iam_policy_document.portfolio_bucket_policy_doc.json
+}
+
+resource "aws_iam_user" "portfolio_bucket_user" {
+  name = "${var.role_name}User"
+}
+
+resource "aws_iam_user_policy_attachment" "portfolio_bucket_attachment" {
+  user       = aws_iam_user.portfolio_bucket_user.name
+  policy_arn = aws_iam_policy.portfolio_bucket_policy.arn
+}
+
+resource "aws_iam_access_key" "portfolio_bucket_key" {
+  user = aws_iam_user.portfolio_bucket_user.name
+}

terraform/outputs.tf

@@ -0,0 +1,16 @@
+output "access_region" {
+  value = aws_s3_bucket.portfolio_bucket.region
+  description = "This is the region of the bucket."
+}
+
+output "access_id" {
+  value = aws_iam_access_key.portfolio_bucket_key.id
+  description = "This is the access ID to modify the bucket."
+  sensitive = true
+}
+
+output "access_secret" {
+  value = aws_iam_access_key.portfolio_bucket_key.secret
+  description = "This is the access secret to modify the bucket."
+  sensitive = true
+}

terraform/variables.tf

@@ -0,0 +1,9 @@
+variable "bucket_name" {
+  type = string
+  description = "The name of the bucket to create."
+}
+
+variable "role_name" {
+  type = string
+  description = "The base name for the role to modify the bucket."
+}