Skip to content

README.md

Latest commit

 

History

History
242 lines (179 loc) · 7.48 KB

README.md

File metadata and controls

242 lines (179 loc) · 7.48 KB

Groundwork - Ameciclo Infrastructure

Modern cloud infrastructure for Ameciclo using Pulumi + Azure + Kubernetes.

🚀 Quick Start

# 1. Deploy infrastructure
cd infrastructure/pulumi
npm install           # Install dependencies
pulumi stack init ameciclo/prod  # Initialize stack
pulumi up             # Deploy to Azure

# 2. Access your cluster
ssh azureuser@$(pulumi stack output k3sPublicIp)

# 3. Check applications
kubectl get applications -n argocd

🏗️ What Gets Deployed

Infrastructure (Pulumi)

  • 🌐 Azure Virtual Network - Secure networking with K3s and database subnets
  • 🗄️ PostgreSQL Flexible Server - Private database (Standard_B2s) with 3 databases: strapi, atlas, zitadel
  • ☸️ K3s Kubernetes Cluster - Lightweight Kubernetes on Ubuntu 22.04 LTS (Standard_B2as_v2)
  • 💾 Blob Storage - Media, backups, and logs containers
  • 🔒 Network Security - Firewall rules, private DNS, and SSH-only access

Bootstrap (Ansible)

  • K3s - Kubernetes installation and configuration
  • Tailscale Operator - VPN operator (bootstrap only)
  • ArgoCD - GitOps deployment platform

GitOps (ArgoCD)

  • Tailscale - Ingress and subnet router configuration
  • Traefik - Ingress controller v37.2.0 with Let's Encrypt
  • Monitoring - Prometheus + Grafana for metrics and dashboards
  • Applications - Strapi CMS, Atlas APIs, Zitadel Auth
  • Infrastructure - Infisical secrets management

💰 Cost: ~$70-80/month for complete infrastructure

📁 Repository Structure

groundwork/
├── 🏗️  infrastructure/           # Infrastructure as Code
│   └── pulumi/                  # Pulumi (Azure infrastructure)
│       ├── index.ts             # Main infrastructure definition
│       ├── vm.ts                # K3s VM configuration
│       ├── scripts/             # Database setup scripts
│       └── esc/                 # Pulumi ESC environments
├── ☸️  kubernetes/               # Kubernetes manifests
│   ├── applications/            # Custom applications (Strapi, Atlas, Zitadel)
│   ├── infrastructure/          # Platform components (Traefik, ArgoCD)
│   └── argocd/                  # ArgoCD application definitions
└── 📚 docs/                     # Documentation & guides

📋 Prerequisites

  • Node.js 18+
  • Pulumi CLI v3.139.0+
  • Azure CLI
  • Azure account + Service Principal
  • SSH key pair
  • Pulumi Cloud account (for ESC environments)

🔧 Detailed Setup

Click to expand detailed setup instructions

1. Install Dependencies

cd infrastructure/pulumi
npm install

2. Configure Pulumi ESC Environment

# Create ESC environment
pulumi env init ameciclo/infrastructure-prod

# Edit environment (copy from infrastructure/pulumi/esc/prod.yaml)
pulumi env edit ameciclo/infrastructure-prod

# Update SSH public key in the environment
cat ~/.ssh/id_rsa.pub  # Copy this value

3. Configure Azure Authentication

# Login to Azure
az login

# Pulumi will auto-detect Azure credentials from Azure CLI

4. Set Stack Configuration

# Set SSH key (if not using ESC)
pulumi config set --secret adminSshPublicKey "$(cat ~/.ssh/id_rsa.pub)"

5. Deploy

pulumi preview  # Review what will be created
pulumi up      # Deploy infrastructure

6. Create Database Users

# SSH into the K3s VM
ssh azureuser@$(pulumi stack output k3sPublicIp)

# Copy and run the database setup script
# (Script is automatically copied during deployment)
POSTGRES_ADMIN_PASSWORD='<from-pulumi-output>' ./create-database-users.sh

🏗️ Infrastructure Details

Azure Resources (click to expand)

🌐 Virtual Network

  • Address Space: 10.10.0.0/16
  • K3s Subnet: 10.10.1.0/24
  • Database Subnet: 10.10.2.0/24

🗄️ PostgreSQL Flexible Server

  • Tier: Standard_B2s (2 vCores, 4GB RAM)
  • Storage: 32GB, 7-day backups
  • Networking: Private only (VNet access)
  • Databases: strapi, atlas, zitadel
  • Users: Auto-generated with secure passwords

☸️ K3s Cluster

  • VM Size: Standard_B2as_v2 (2 vCPUs, 8GB RAM)
  • OS: Ubuntu 22.04 LTS
  • Storage: 30GB Premium SSD
  • IP: Static private + public IP
  • K3s Version: Latest stable

💾 Blob Storage

  • Type: Standard LRS (Locally Redundant Storage)
  • Containers: media, backups, logs
  • Access: Private with VNet integration
  • TLS: Minimum version 1.2

📱 Applications

Application Purpose URL Pattern
Strapi Headless CMS strapi.az.ameciclo.org
Atlas Traffic Data APIs atlas.az.ameciclo.org
Zitadel Identity & Auth auth.az.ameciclo.org
Traefik Ingress Controller Auto HTTPS
ArgoCD GitOps Deployment Internal
Infisical Secrets Management Internal

🔄 GitOps Workflow

  1. Push code changes to this repository
  2. ArgoCD detects changes automatically
  3. Deploys applications to Kubernetes cluster
  4. Notifies via Telegram on success/failure

💰 Cost Breakdown

Service Tier Monthly Cost
PostgreSQL Standard_B2s ~$24
VM (K3s) Standard_B2as_v2 ~$38
Storage Standard LRS ~$2
Networking Standard ~$8
Total ~$72

Costs are estimates for West US 3 region. Actual costs may vary.

🛠️ Management Commands

# Infrastructure
cd infrastructure/pulumi
pulumi stack output                              # View outputs
pulumi stack output postgresqlAdminPassword --show-secrets  # Get DB password
pulumi up                                        # Update infrastructure
pulumi destroy                                   # ⚠️ Destroy everything

# Access K3s VM
ssh azureuser@$(pulumi stack output k3sPublicIp)

# Kubernetes (from VM)
kubectl get applications -n argocd               # View ArgoCD apps
kubectl get pods -A                              # Check all pods
kubectl logs -n <namespace> <pod-name>           # View logs
btop                                             # System monitor

🔒 Security Features

  • ✅ Private Database - PostgreSQL only accessible from VNet
  • ✅ SSH Key Auth - No password authentication
  • ✅ Network Security Groups - Restricted port access (SSH, HTTP, HTTPS only)
  • ✅ Secret Management - Pulumi ESC + Infisical
  • ✅ Auto HTTPS - Traefik + Let's Encrypt
  • ✅ Encrypted Secrets - All passwords encrypted in Pulumi state
  • ✅ Private DNS - Internal DNS resolution for database

📚 Documentation

🤝 Contributing

  1. Fork this repository
  2. Create a feature branch
  3. Test in a separate Pulumi stack
  4. Submit a pull request

Built with ❤️ by Ameciclo | Website | GitHub