<file_sep>.PHONY: init ansible-setup

init:
	@if [ -f terraform.tfvars ]; then mv terraform.tfvars terraform.tfvars-`date "+%Y-%m-%d-%H:%M:%S"`; fi
	@rsync -aq terraform.tfvars.template terraform.tfvars

ansible-setup:
	@mkdir -p .ansible
	@ansible-galaxy install -fr requirements.yml
<file_sep>#!/bin/bash

set -exu

#apt-cache policy | grep circle || curl https://s3.amazonaws.com/circleci-enterprise/provision-builder.sh | bash
#curl https://s3.amazonaws.com/circleci-enterprise/init-builder-0.2.sh | \
#    SERVICES_PRIVATE_IP='${services_private_ip}' \
#    CIRCLE_SECRET_PASSPHRASE='${circle_secret_passphrase}' \
#    bash

BUILDER_IMAGE="circleci/build-image:ubuntu-14.04-XXL-1167-271bbe4"

export http_proxy="${http_proxy}"
export https_proxy="${https_proxy}"
export no_proxy="${no_proxy}"

echo "-------------------------------------------"
echo "     Performing System Updates"
echo "-------------------------------------------"
apt-get update && apt-get -y upgrade

echo "--------------------------------------"
echo "        Installing Docker"
echo "--------------------------------------"
apt-get install -y linux-image-extra-$(uname -r) linux-image-extra-virtual
apt-get install -y apt-transport-https ca-certificates curl
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
apt-get update
apt-get -y install docker-ce=17.03.2~ce-0~ubuntu-trusty cgmanager

sudo echo 'export http_proxy="${http_proxy}"' >> /etc/default/docker
sudo echo 'export https_proxy="${https_proxy}"' >> /etc/default/docker
sudo echo 'export no_proxy="${no_proxy}"' >> /etc/default/docker
sudo service docker restart

echo "-------------------------------------------"
echo "      Pulling Server Builder Image"
echo "-------------------------------------------"
sudo docker pull $BUILDER_IMAGE

# Make a new docker network
docker network create -d bridge -o "com.docker.network.bridge.name"="circle0" circle-bridge

# Block traffic from build containers to the EC2 metadata API
iptables -I FORWARD -d 169.254.169.254 -p tcp -i docker0 -j DROP

# Block traffic from build containers to non-whitelisted ports on the services box
iptables -I FORWARD -d ${services_private_ip} -p tcp -i docker0 -m multiport ! --dports 80,443 -j DROP

echo "-------------------------------------------"
echo "           Starting Builder"
echo "-------------------------------------------"
sudo docker run -d -p 443:443 -v /var/run/docker.sock:/var/run/docker.sock \
      -e CIRCLE_CONTAINER_IMAGE_URI="docker://$BUILDER_IMAGE" \
      -e CIRCLE_SECRET_PASSPHRASE='${circle_secret_passphrase}' \
      -e SERVICES_PRIVATE_IP='${services_private_ip}'  \
      --net circle-bridge \
      circleci/builder-base:1.1
<file_sep># CircleCI Enterprise Setup

This package allows you to easily orchestrate your CCIE cluster in AWS using Terraform.

# Getting Started

## Pre Reqs

- Terraform

## Installation

### Basic

1. Clone or download this repository
1. Execute `make init` or save a copy of `terraform.tfvars.template` to `terraform.tfvars`
1. Fill in the configuration vars in `terraform.tfvars` for your cluster. see [Configuration](#configuration)
1. Run `terraform apply`

### Advanced: Ansible provisioning

Advanced install involves using Ansible to fully configure your services box without having to configure it via the user interface. This installation method requires having Ansible locally installed on the machine you will be running Terraform on.

To enable Ansible provisioning, set `enable_ansible_provisioning = true` in your tfvars file. Then add a dictionary to your tfvars file called `ansible_extra_vars` containing the extra variables that will be passed to the Ansible playbook in this project.

Example:

```
enable_ansible_provisioning = true
ansible_extra_vars = {
  license_file_path = "/path/to/my/CircleCILicense.rli"
  ghe_type = "github_type_enterprise"
  ghe_domain = "ghe.example.com"
  github_client_id = "insertclientidfromghe"
  github_client_secret = "insertclientsecretfromghe"
  aws_access_key_id = "insertawskey"
  aws_access_secret_key = "insertawssecretkey"
}
```

## Configuration

To configure the cluster that terraform will create, simply fill out the terraform.tfvars file. The following are all required vars:

  | Var      | Description |
  | -------- | ----------- |
  | aws_access_key | Access key used to create instances |
  | aws_secret_key | Secret key used to create instances |
  | aws_region | Region where instances get created |
  | aws_vpc_id | The VPC ID where the instances should reside |
  | aws_subnet_id | The subnet-id to be used for the instance |
  | aws_ssh_key_name |  The SSH key to be used for the instances|
  | circle_secret_passphrase | <PASSWORD> key for secrets used by CircleCI machines |

Optional vars:

  | Var      | Description | Default |
  | -------- | ----------- | ------- |
  | services_instance_type | instance type for the centralized services box.  We recommend a c4 instance | c4.2xlarge |
  | builder_instance_type | instance type for the builder machines.  We recommend a r3 instance | r3.2xlarge |
  | max_builders_count | max number of builders | 2 |
  | nomad_client_instance_type | instance type for the nomad clients. We recommend a XYZ instance | m4.xlarge |
  | max_clients_count | max number of nomad clients | 2 |
  | prefix   | prefix for resource names | circleci |
  | enable_nomad | provisions a nomad cluster for CCIE v2 | 0 |
  | enable_ansible_provisioner | enable provisioning of Services box via Ansible | 0 |
  | enable_route | enable creating a Route53 route for the Services box | 0 |
  | route_name | Route name to configure for Services box | "" |
  | route_zone_id | Zone to configure route in | "" |
<file_sep>#! /usr/bin/env bash

set -e
set -o pipefail


brew_install_terraform() {
    brew -v &> /dev/null || return 1
    echo "It looks like you have homebrew installed. Would you like to use it to install Terraform?" >&2
    echo "1: Yes, install Terraform on the system using homebrew." >&2
    echo "2: No, use local Terraform without installing it on the system." >&2
    echo "3: Exit. I'll install it on my own." >&2
    read selection
    case "$selection" in
        1) brew install terraform;;
        2) return 1;;
        3) exit 1;;
        *) echo "Please enter \"1\", \"2\", or \"3\" then hit ENTER" >&2; brew_install_terraform "$@";;
    esac
}

install_local_terraform() {
    platform="$1"
    tempfile=$(mktemp)
    curl -o $tempfile "https://releases.hashicorp.com/terraform/0.6.14/terraform_0.6.14_${platform}_amd64.zip"
    mkdir -p .dependencies
    unzip $tempfile -d .dependencies
}

install_terraform() {
    if [[ $OSTYPE =~ darwin.* ]]; then
        # Special-case terraform uninstalled but homebrew installed, because that's most customers
        [[ -z $local ]] && brew_install_terraform || install_local_terraform darwin
    elif [[ $OSTYPE = linux-gnu ]]; then
        install_local_terraform linux
    else
        echo "Unsupported OSTYPE: $OSTYPE" >&2
        exit 1
    fi
}

terraform_wrapper() {
    version=$(terraform -v 2>/dev/null | awk '{print $2}') || true
    if [[ -x .dependencies/terraform ]]; then
        echo "Using local Terraform" >&2
        .dependencies/terraform "$@"
    elif [[ -z $version ]]; then
        install_terraform
        terraform_wrapper "$@"
    else
        echo "Using system Terraform" >&2
        terraform "$@"
    fi
}

terraform_wrapper "$@"
