diff --git a/.gitignore b/.gitignore index 2063ae9647..93b98c4ec7 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,5 @@ *.swp *~ default.etcd +*.tfstate +*.tfstate.backup diff --git a/README.md b/README.md index c6f1786980..8a6974b6d7 100644 --- a/README.md +++ b/README.md @@ -95,8 +95,10 @@ You can then set up the [expected tables](storage/mysql/storage.sql) in a ```bash ./scripts/resetdb.sh -Completely wipe and reset database 'test'. +Warning: about to destroy and reset database 'test' Are you sure? y +> Resetting DB... +> Reset Complete ``` ### Integration Tests diff --git a/examples/deployment/README.md b/examples/deployment/README.md new file mode 100644 index 0000000000..b04415a7be --- /dev/null +++ b/examples/deployment/README.md @@ -0,0 +1,65 @@ +Deploying Trillian +================== + +Want to deploy/use the Trillian General Transparency project in the cloud? Here are some common ways of getting off the ground with Docker. + +## Setup + +**Clone Source** + +Both build and example deployment files are stored within this repo. For any of the below deployment methods, start here: + +```shell +git clone https://github.com/google/trillian.git/ +cd trillian +``` + +## Local Deployments + +**Run With Docker Compose** + +For simple deployments, running in a container is an easy way to get up and running with a local database. To use Docker to run and interact with Trillian, start here: + +Set a random password and bring up the services defined in the provided compose file. This includes a local MySQL database, a one-shot container to create the schema and the trillian server: + +```shell +# Set a random password +export DB_PASSWORD="$(openssl rand -hex 16)" + +# Bring up services defined in this compose file. This includes: +# - local MySQL database +# - container to initialize the database +# - the trillian server +docker-compose -f examples/deployment/docker-compose.yml up +``` + +Verify that your local installation is working by checking the metrics endpoint: + +```shell +curl localhost:8091/metrics +``` + +## Cloud Deployments + +For better persistence and performance you may want to run in your datacenter or a cloud. Here are some simple cloud deployment templates: + +### Run in GCP + +TODO + +### Run in AWS + +With a pair of AWS keys [accessible to Terraform](https://www.terraform.io/docs/providers/aws/), this template deploys a simple Trillian setup in AWS using EC2 and RDS MySQL. + +```shell +cd examples/deployment/aws/ + +# Set a random password +export TF_VAR_DB_PASSWORD="$(openssl rand -hex 16)" +# Substitute this variable with a block you'll be accessing from +export TF_VAR_WHITELIST_CIDR="0.0.0.0/0" + +# Review and Create Resources +terraform plan +terraform apply +``` diff --git a/examples/deployment/aws/terraform.tf b/examples/deployment/aws/terraform.tf new file mode 100644 index 0000000000..db8f380156 --- /dev/null +++ b/examples/deployment/aws/terraform.tf @@ -0,0 +1,155 @@ +variable "WHITELIST_CIDR" { + description="Your IP block to whitelist access from" +} +variable "DB_PASSWORD" { } + +provider "aws" { + region = "us-west-2" +} + +/* The Database */ + +resource "aws_rds_cluster" "trillian" { + cluster_identifier = "trillian" + database_name = "test" + master_username = "root" + master_password = "${var.DB_PASSWORD}" + skip_final_snapshot = true + port = 3306 + vpc_security_group_ids = ["${aws_security_group.trillian_db.id}"] + availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] + storage_encrypted = true + apply_immediately = true + +} + +resource "aws_rds_cluster_instance" "cluster_instances" { + count = 2 + identifier = "trillian-${count.index}" + cluster_identifier = "${aws_rds_cluster.trillian.id}" + instance_class = "db.r3.large" + publicly_accessible = true + apply_immediately = true +} + +resource "aws_security_group" "trillian_db" { + name = "trillian-db" + description = "Allow MySQL from Trillian and Development CIDR" + + ingress { + from_port = 3306 + to_port = 3306 + protocol = "tcp" + cidr_blocks = ["${var.WHITELIST_CIDR}"] + } + + ingress { + from_port = 3306 + to_port = 3306 + protocol = "tcp" + security_groups = ["${aws_security_group.trillian.id}"] + } + + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } +} + +resource "aws_rds_cluster_parameter_group" "trillian" { + name = "trillian-pg" + family = "aurora5.6" + + # Whether InnoDB returns errors rather than warnings for exceptional conditions. + # replaces: `sql_mode = STRICT_ALL_TABLES` + parameter { + name = "innodb_strict_mode" + value = "1" + } +} + +/* The Instance */ + +/* select the latest official hvm amazon linux release */ +data "aws_ami" "trillian" { + most_recent = true + executable_users = ["all"] + + name_regex = "^amzn-ami-hvm" + owners = ["amazon"] +} + +resource "aws_security_group" "trillian" { + name = "trillian" + description = "Expose Rest, TPC and SSH endpoint to local cidr" + + ingress { + from_port = 8090 + to_port = 8091 + protocol = "tcp" + cidr_blocks = ["${var.WHITELIST_CIDR}"] + } + ingress { + from_port = 22 + to_port = 22 + protocol = "tcp" + cidr_blocks = ["${var.WHITELIST_CIDR}"] + } + + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } +} + +resource "aws_instance" "trillian" { + ami = "${data.aws_ami.trillian.id}" + instance_type = "t2.medium" + vpc_security_group_ids = ["${aws_security_group.trillian.id}"] + associate_public_ip_address = true + + tags { + Name = "trillian" + } + + user_data = <