Aws enhancements - #230
Open
doanac wants to merge 2 commits into
Open
Conversation
Until now fioserver's logs only ever landed in the local systemd journal, reachable only by opening an SSM session and running journalctl. That is fine for interactive debugging but gives no retention, search, or alerting once the operator disconnects. Add an enable_cloudwatch_logs variable (default false) to the server module. When set, Terraform creates a CloudWatch Logs group named after the existing secret_prefix convention, grants the instance role a scoped PutLogEvents/CreateLogStream/DescribeLogStreams policy on just that group, and has user_data configure and start the CloudWatch agent's native journald log collection for the fioserver unit. The agent itself is always installed by packer but disabled at boot, the same bake-always/enable-conditionally pattern already used for Caddy, so a single AMI still serves every topology. Both examples thread the new variable through and gain a cloudwatch_log_group_name output for `aws logs tail`. Signed-off-by: Andy Doan <doanac@qti.qualcomm.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
The VPC, subnets, security groups, load balancers, and DNS records were all IPv4-only, so devices or browsers without IPv4 connectivity could not reach the update server. Add an enable_ipv6 variable (default true) threaded through every module. The VPC gets an Amazon-provided IPv6 CIDR, each public subnet a /64, and a ::/0 route through the existing internet gateway. Every security-group rule that allowed 0.0.0.0/0 gets an ::/0 sibling (SSH is left IPv4-only since its CIDR is user-supplied). The ALB and NLB run dualstack while their targets stay IPv4 -- AWS translates IPv6 client traffic to the IPv4 target natively, so no target-group changes are needed. The DNS module writes an AAAA record next to every A record it already manages. In the load-balancer topology the instance itself is kept IPv6-off deliberately: the dualstack load balancers already terminate IPv6 client connections and forward to the instance's private IPv4 address, so giving the instance its own public IPv6 would let the device gateway be reached directly, bypassing the NLB. In the Caddy topology the instance is the only public endpoint, so it gets a public IPv6 address of its own (Elastic IPs are IPv4-only, so this is a separate address, not an EIP). Signed-off-by: Andy Doan <doanac@qti.qualcomm.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+139
to
+145
| resource "aws_cloudwatch_log_group" "fioserver" { | ||
| count = var.enable_cloudwatch_logs ? 1 : 0 | ||
|
|
||
| name = local.log_group_name | ||
| retention_in_days = var.cloudwatch_log_retention_days | ||
| tags = local.tags | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds logic to enable IPV6; fixes issue #226
Adds logic to allow streaming of fioserver logs to cloudwatch