第08章 配置管理¶

# provider.tf — 定义云服务提供商及认证方式
provider "aws" {
  region = var.aws_region
  # 推荐使用环境变量 AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY
  # 或 AWS CLI 配置文件（~/.aws/credentials），避免在代码中硬编码凭证
}

# vpc.tf — 创建VPC虚拟私有网络（所有资源的网络基础）
resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr       # VPC的IP地址范围
  enable_dns_support   = true               # 启用DNS解析
  enable_dns_hostnames = true               # 启用DNS主机名

  tags = {
    Name        = "${var.project_name}-vpc"  # 使用字符串插值生成资源名称
    Environment = var.environment
  }
}

# subnet.tf — 创建公有/私有子网（按可用区分布，实现高可用）
# 注意：下方示例使用 count 仅为简化演示。
# 生产环境推荐使用 for_each + 命名映射，避免删除/插入元素时索引偏移导致资源不必要的重建。
resource "aws_subnet" "public" {
  count                   = length(var.availability_zones)  # 每个可用区创建一个子网
  vpc_id                  = aws_vpc.main.id                 # 引用上面创建的VPC
  cidr_block              = cidrsubnet(var.vpc_cidr, 8, count.index)  # 自动计算子网CIDR
  availability_zone       = var.availability_zones[count.index]
  map_public_ip_on_launch = true   # 公有子网：自动分配公网IP

  tags = {
    Name        = "${var.project_name}-public-subnet-${count.index}"
    Environment = var.environment
  }
}

# 私有子网：不分配公网IP，通过NAT网关访问外网
resource "aws_subnet" "private" {
  count             = length(var.availability_zones)
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, count.index + 3)  # CIDR偏移3，避免与公有子网冲突
  availability_zone = var.availability_zones[count.index]

  tags = {
    Name        = "${var.project_name}-private-subnet-${count.index}"
    Environment = var.environment
  }
}

# ec2.tf — 创建EC2 Web服务器实例
resource "aws_instance" "web" {
  count         = var.instance_count           # 创建的实例数量
  ami           = var.ami_id                   # Amazon Machine Image（操作系统镜像）
  instance_type = var.instance_type            # 实例规格（CPU/内存）
  subnet_id     = aws_subnet.public[count.index % length(var.availability_zones)].id  # 轮询分配到不同可用区

  vpc_security_group_ids = [aws_security_group.web.id]  # 关联安全组

  # user_data：实例首次启动时执行的初始化脚本
  user_data = <<-EOF
              #!/bin/bash
              yum update -y
              yum install -y docker
              service docker start
              usermod -aG docker ec2-user
              EOF

  tags = {
    Name        = "${var.project_name}-web-${count.index}"
    Environment = var.environment
  }
}

# security_group.tf — 定义安全组规则（相当于云上防火墙）
resource "aws_security_group" "web" {
  name        = "${var.project_name}-web-sg"
  description = "Security group for web servers"
  vpc_id      = aws_vpc.main.id

  # 入站规则：允许HTTP（80端口）访问
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]    # 对所有IP开放
  }

  # 入站规则：允许HTTPS（443端口）访问
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # 入站规则：限制SSH（22端口）访问来源
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = var.ssh_allowed_cidr  # 仅允许指定CIDR范围访问
  }

  # 出站规则：允许所有出站流量（protocol="-1" 表示全协议）
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name        = "${var.project_name}-web-sg"
    Environment = var.environment
  }
}

# variables.tf — 定义所有可配置变量（支持多环境复用）
variable "aws_region" {
  description = "AWS region"              # AWS部署区域
  type        = string
  default     = "us-east-1"
}

variable "project_name" {
  description = "Project name"            # 项目名称，用于资源命名前缀
  type        = string
  default     = "myapp"
}

variable "environment" {
  description = "Environment name"        # 环境标识（production/staging/dev）
  type        = string
  default     = "production"
}

variable "vpc_cidr" {
  description = "VPC CIDR block"          # VPC网段，/16提供65536个IP
  type        = string
  default     = "10.0.0.0/16"
}

variable "availability_zones" {
  description = "Availability zones"      # 可用区列表，跨AZ部署实现高可用
  type        = list(string)
  default     = ["us-east-1a", "us-east-1b", "us-east-1c"]
}

variable "ami_id" {
  description = "AMI ID"                  # 操作系统镜像ID
  type        = string
  default     = "ami-0c55b159cbfafe1f0"
}

variable "instance_type" {
  description = "Instance type"           # 实例规格（t3.micro适合测试）
  type        = string
  default     = "t3.micro"
}

variable "instance_count" {
  description = "Number of instances"     # Web服务器实例数量
  type        = number
  default     = 3
}

variable "ssh_allowed_cidr" {
  description = "CIDR blocks allowed for SSH"  # SSH访问白名单（生产环境应限制具体IP）
  type        = list(string)
  default     = ["0.0.0.0/0"]
}

# outputs.tf — 定义输出值（用于跨模块引用或部署后查看关键信息）
output "vpc_id" {
  description = "VPC ID"
  value       = aws_vpc.main.id
}

output "public_subnet_ids" {
  description = "Public subnet IDs"
  value       = aws_subnet.public[*].id    # [*] 展开列表获取所有子网ID
}

output "private_subnet_ids" {
  description = "Private subnet IDs"
  value       = aws_subnet.private[*].id
}

output "instance_ids" {
  description = "Instance IDs"
  value       = aws_instance.web[*].id
}

output "instance_public_ips" {
  description = "Instance public IPs"     # 输出所有实例的公网IP，便于访问
  value       = aws_instance.web[*].public_ip
}