streamline nginx-tls cos module

modules/cloud-config-container/nginx-tls/README.md

@@ -1,60 +1,46 @@
 # Containerized Nginx with self-signed TLS on Container Optimized OS
 
-This module manages a `cloud-config` configuration that starts a containerized Nginx with a self-signed TLS cert on Container Optimized OS.
-This can be useful if you need quickly a VM or instance group answering HTTPS for prototyping.
+This module manages a `cloud-config` configuration that starts a containerized Nginx with a self-signed TLS cert on Container Optimized OS. This can be useful if you need quickly a VM or instance group answering HTTPS for prototyping.
 
 The generated cloud config is rendered in the `cloud_config` output, and is meant to be used in instances or instance templates via the `user-data` metadata.
 
-This module depends on the [`cos-generic-metadata` module](../cos-generic-metadata) being in the parent folder. If you change its location be sure to adjust the `source` attribute in `main.tf`.
-
-## Examples
-
-### Default configuration
+## Example
 
 ```hcl
-# Nginx with self-signed TLS config
 module "cos-nginx-tls" {
   source = "./fabric/modules/cloud-config-container/nginx-tls"
 }
 
-# COS VM
 module "vm-nginx-tls" {
   source     = "./fabric/modules/compute-vm"
-  project_id = local.project_id
-  zone       = local.zone
+  project_id = "my-project"
+  zone       = "europe-west8-b"
   name       = "cos-nginx-tls"
   network_interfaces = [{
-    network    = local.vpc.self_link,
-    subnetwork = local.vpc.subnet_self_link,
-    nat        = false,
-    addresses  = null
+    network    = "default"
+    subnetwork = "gce"
   }]
-
   metadata = {
     user-data              = module.cos-nginx-tls.cloud_config
     google-logging-enabled = true
   }
-
   boot_disk = {
     image = "projects/cos-cloud/global/images/family/cos-stable"
     type  = "pd-ssd"
     size  = 10
   }
-
-  service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
 }
+# tftest modules=1 resources=1
 ```
 <!-- BEGIN TFDOC -->
 
 ## Variables
 
 | name | description | type | required | default |
 |---|---|:---:|:---:|:---:|
-| [files](variables.tf#L17) | Map of extra files to create on the instance, path as key. Owner and permissions will use defaults if null. | <code title="map&#40;object&#40;&#123;&#10;  content     &#61; string&#10;  owner       &#61; string&#10;  permissions &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>null</code> |
-| [nginx_image](variables.tf#L27) | Nginx container image to use. | <code>string</code> |  | <code>&#34;nginx:1.23.1&#34;</code> |
-| [runcmd_post](variables.tf#L33) | Extra commands to run after starting nginx. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
-| [runcmd_pre](variables.tf#L39) | Extra commands to run before starting nginx. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
-| [users](variables.tf#L45) | Additional list of usernames to be created. | <code title="list&#40;object&#40;&#123;&#10;  username &#61; string,&#10;  uid      &#61; number,&#10;&#125;&#41;&#41;">list&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code title="&#91;&#10;&#93;">&#91;&#8230;&#93;</code> |
+| [files](variables.tf#L17) | Map of extra files to create on the instance, path as key. Owner and permissions will use defaults if null. | <code title="map&#40;object&#40;&#123;&#10;  content     &#61; string&#10;  owner       &#61; optional&#40;string, &#34;root&#34;&#41;&#10;  permissions &#61; optional&#40;string, &#34;0644&#34;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [hello](variables.tf#L28) | Behave like the nginx hello image by returning plain text informative responses. | <code>bool</code> |  | <code>true</code> |
+| [image](variables.tf#L35) | Nginx container image to use. | <code>string</code> |  | <code>&#34;nginx:1.23.1&#34;</code> |
 
 ## Outputs
 

modules/cloud-config-container/nginx-tls/assets/cloud-config.yaml

@@ -0,0 +1,63 @@
+#cloud-config
+
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+users:
+  - name: nginx
+    uid: 2000
+
+write_files:
+  - path: /var/lib/docker/daemon.json
+    permissions: "0644"
+    owner: root
+    content: |
+      {
+        "live-restore": true,
+        "storage-driver": "overlay2",
+        "log-opts": {
+          "max-size": "1024m"
+        }
+      }
+  # nginx container service
+  - path: /etc/systemd/system/nginx.service
+    permissions: "0644"
+    owner: root
+    content: |
+      [Unit]
+      Description=Start nginx container
+      After=gcr-online.target docker.socket
+      Wants=gcr-online.target docker.socket docker-events-collector.service
+      [Service]
+      Environment="HOME=/home/nginx"
+      ExecStart=/usr/bin/docker run --rm --name=nginx \
+        --network host --pid host \
+        -v /etc/nginx/conf.d:/etc/nginx/conf.d \
+        -v /etc/ssl:/etc/ssl \
+        ${image}
+      ExecStop=/usr/bin/docker stop nginx
+%{ for k, v in files ~}
+  - path: ${k}
+    owner: ${v.owner}
+    permissions: "${v.permissions}"
+    content: |
+      ${indent(6, v.content)}
+%{ endfor ~}
+
+runcmd:
+  - iptables -I INPUT 1 -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+  - iptables -I INPUT 1 -p tcp -m tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+  - /var/run/nginx/customize.sh
+  - systemctl daemon-reload
+  - systemctl start nginx

modules/cloud-config-container/nginx-tls/files/customize.sh → modules/cloud-config-container/nginx-tls/assets/customize.sh

@@ -13,8 +13,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FQDN=$(curl -s -H "Metadata-Flavor: Google" http://metadata/computeMetadata/v1/instance/hostname)
+FQDN=$(\
+  curl -s -H "Metadata-Flavor: Google" \
+  http://metadata/computeMetadata/v1/instance/hostname)
 HOSTNAME=$(echo $FQDN | cut -d"." -f1)
-openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 -subj /CN=$HOSTNAME/ -addext "subjectAltName = DNS:$FQDN" -keyout /etc/ssl/self-signed.key -out /etc/ssl/self-signed.crt
+openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 \
+  -subj /CN=$HOSTNAME/ -addext "subjectAltName = DNS:$FQDN" \
+  -keyout /etc/ssl/self-signed.key -out /etc/ssl/self-signed.crt
 chgrp nginx /etc/ssl/self-signed.key -out /etc/ssl/self-signed.crt
 sed -i "s/HOSTNAME/${HOSTNAME}/" /etc/nginx/conf.d/default.conf

modules/cloud-config-container/nginx-tls/assets/default.conf

@@ -0,0 +1,24 @@
+server {
+  listen              80;
+  listen              443 ssl;
+  server_name         HOSTNAME;
+  ssl_certificate     /etc/ssl/self-signed.crt;
+  ssl_certificate_key /etc/ssl/self-signed.key;
+
+  location / {
+    {% if hello %}
+    default_type text/plain;
+    expires -1;
+    return 200 'Server address: $server_addr:$server_port\nServer name: $hostname\nDate: $time_local\nURI: $request_uri\nRequest ID: $request_id\n';
+    {% else %}
+    root   /usr/share/nginx/html;
+    index  index.html index.htm;
+    {% endif %}
+  }
+
+  error_page   500 502 503 504  /50x.html;
+
+  location = /50x.html {
+    root   /usr/share/nginx/html;
+  }
+}

modules/cloud-config-container/nginx-tls/outputs.tf

@@ -16,5 +16,23 @@
 
 output "cloud_config" {
   description = "Rendered cloud-config file to be passed as user-data instance metadata."
-  value       = module.cos-envoy-td.cloud_config
+  value = templatefile("${path.module}/assets/cloud-config.yaml", {
+    files = merge(
+      {
+        "/var/run/nginx/customize.sh" = {
+          content     = file("${path.module}/assets/customize.sh")
+          owner       = "root"
+          permissions = "0744"
+        }
+        "/etc/nginx/conf.d/default.conf" = {
+          content = templatefile(
+            "${path.module}/assets/default.conf", { hello = var.hello }
+          )
+          owner       = "root"
+          permissions = "0644"
+        }
+      }, var.files
+    )
+    image = var.image
+  })
 }

modules/cloud-config-container/nginx-tls/variables.tf

@@ -18,38 +18,22 @@ variable "files" {
   description = "Map of extra files to create on the instance, path as key. Owner and permissions will use defaults if null."
   type = map(object({
     content     = string
-    owner       = string
-    permissions = string
+    owner       = optional(string, "root")
+    permissions = optional(string, "0644")
   }))
-  default = null
+  default  = {}
+  nullable = false
 }
 
-variable "nginx_image" {
+variable "hello" {
+  description = "Behave like the nginx hello image by returning plain text informative responses."
+  type        = bool
+  default     = true
+  nullable    = false
+}
+
+variable "image" {
   description = "Nginx container image to use."
   type        = string
   default     = "nginx:1.23.1"
 }
-
-variable "runcmd_post" {
-  description = "Extra commands to run after starting nginx."
-  type        = list(string)
-  default     = []
-}
-
-variable "runcmd_pre" {
-  description = "Extra commands to run before starting nginx."
-  type        = list(string)
-  default     = []
-}
-
-variable "users" {
-  description = "Additional list of usernames to be created."
-  type = list(object({
-    username = string,
-    uid      = number,
-  }))
-  default = [
-  ]
-}
-
-