-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: move out private site content leaving only template for aws-site
- Loading branch information
Showing
12 changed files
with
248 additions
and
61 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| # Ghost Blog Deployment | ||
|
|
||
| Ghost blog deployment using Cloud Run, Cloud DB and GLB. | ||
|
|
||
| ## Repository Structure | ||
|
|
||
| This Git repository is structured as follows: | ||
|
|
||
| * [module](module) - contains Terraform modules for Ghost deployment and Cloud Function for posts management. | ||
| * [stage](stage) - contains Terragrunt deployment configurations per environment (dev, prod) | ||
| * [docs](docs) - contains documentation including architecture, user guide, sre guide, etc. For PDF/HTML version of the documentation - see artifacts in Releases. | ||
| * [Makefile](Makefile) - entrypoint for SRE engineer to perform deployment | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| * Free Tier GCP Project | ||
| * [Compute Engine API enabled](https://console.cloud.google.com/apis/library/compute.googleapis.com) - needed to configure gcloud command fully, deployment does not use VM at all | ||
| * terragrunt, terraform, make, zip, gcloud - present on your machine, tested on Ubuntu 22.10 | ||
| * (Optionally, but recommended) Enable remaining required GCP APIs. Deployments ensure that particular API is enabled first, but Google often claims that API is enabled, but later on deployment claims it is not yet, and several minutes waiting is really required that API is truly enabled on GCP side. | ||
| The list of required APIs: [Cloud Run](https://console.cloud.google.com/apis/library/run.googleapis.com), [SQL Component](https://console.cloud.google.com/apis/library/sql-component.googleapis.com), [SQL Admin](https://console.cloud.google.com/apis/library/sqladmin.googleapis.com), [Binary Authz](https://console.cloud.google.com/apis/library/binaryauthorization.googleapis.com), [CloudFunctions](https://console.cloud.google.com/apis/library/cloudfunctions.googleapis.com), [ArtifactRegistry](https://console.cloud.google.com/apis/library/artifactregistry.googleapis.com), [CloudBuild](https://console.cloud.google.com/apis/library/cloudbuild.googleapis.com) | ||
| * Ensure you have DNS domain for [stage/dev/ghost/terragrunt.hcl#input.url](stage/dev/ghost/terragrunt.hcl). Change input.url parameter to meet DNS domain you wish site will be accessible from internet. I use free DNS subdomains from [https://freedns.afraid.org/](https://freedns.afraid.org/) | ||
|
|
||
| * Authenticate to GCP: | ||
|
|
||
| ```bash | ||
| # create separate gcloud config configuration to not mess with your current config | ||
| gcloud config configuration create dev-ghost | ||
| # init your gcloud command, select us-central1-a as zone for example | ||
| make google-authentication | ||
| ``` | ||
|
|
||
| ## Usage | ||
|
|
||
| * Deploy Ghost | ||
|
|
||
| ```bash | ||
| # show Ghost Terraform deployment plan (development option) | ||
| # agree on bucket creation for Terraform state | ||
| make run-ghost ENV=dev MODE=plan | ||
|
|
||
| # when plan looks good, perform deployment | ||
| make run-ghost ENV=dev MODE=apply | ||
|
|
||
| # configure A record | ||
| # for stage/dev/ghost/terragrunt.hcl#input.url DNS domain | ||
| # with IP returned from the deployment output of: ghost_glb_public_ip | ||
| # in your DNS domain provider | ||
| ``` | ||
|
|
||
| * Deploy Post Management | ||
|
|
||
| * Go to your site configured here: [stage/dev/ghost/terragrunt.hcl#input.url](stage/dev/ghost/terragrunt.hcl) | ||
|
|
||
| * Follow [Ghost Authentication](https://ghost.org/docs/admin-api/javascript/#authentication) procedure to retrieve Admin API key and Content API key | ||
|
|
||
| ```bash | ||
| # store your ADMIN_KEY and CONTENT_KEY as environment variables | ||
| # (add space so that this command will be not stored in your .bash_history) | ||
| export ADMIN_KEY='...' | ||
| export CONTENT_KEY='...' | ||
| # show Ghost Terraform deployment plan (development option) | ||
| # agree on bucket creation for Terraform state | ||
| make run-posts-management ENV=dev MODE=plan | ||
| # when plan looks good, perform deployment | ||
| make run-posts-management ENV=dev MODE=apply | ||
| # when you wish to remove all posts invoke: | ||
| make remove-all-posts ENV=dev | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| clean: ## clean build data | ||
| rm -rf target | ||
|
|
||
| docs: ## generate html/pdf from *.ad in target directory | ||
| @mkdir -p target | ||
| asciidoctor -r asciidoctor-diagram -b html -D target *.ad | ||
| asciidoctor -r asciidoctor-pdf,asciidoctor-diagram -b pdf -D target *.ad | ||
|
|
||
| help: ## show usage and tasks (default) | ||
| @eval $$(sed -E -n 's/^([\*\.a-zA-Z0-9_-]+):.*?## (.*)$$/printf "\\033[36m%-30s\\033[0m %s\\n" "\1" "\2" ;/; ta; b; :a p' $(MAKEFILE_LIST)) | ||
| .DEFAULT_GOAL := help | ||
| .PHONY: help clean docs |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| = Ghost GCP Deployment : Architecture | ||
| Matihost | ||
| :doctype: book | ||
| :reproducible: | ||
| :source-highlighter: rouge | ||
| :listing-caption: Listing | ||
| :math: | ||
| :data-uri: | ||
| :imagesoutdir: ../target/generated-images | ||
| :stem: latexmath | ||
| :toc: left | ||
|
|
||
|
|
||
| == Architecture Proposal | ||
|
|
||
| The proposed application architecture is mainly based on SAAS GCP services: CloudRun, Global Load Balancer, CloudArmor/WAF and CloudSQL. | ||
| The architecture is a highly scalable and available architecture that can handle a large number of users and requests while protecting against malicious traffic and attacks. | ||
|
|
||
|
|
||
| The following diagram shows main components and how they interact with each other: | ||
| [plantuml, target=minecraft-infra, format=png] | ||
| .... | ||
| include::diagrams/architecture.puml[] | ||
| .... | ||
|
|
||
| Here is how the architecture works: | ||
|
|
||
| The Ghost blogging application is packaged into a container image and mirrored from DockeHub registry to GCP artifact registry. | ||
|
|
||
| A CloudSQL instance is used for Ghost blog backend. CloudSQL in HA mode (3 zones) scales automatically based on the workload, ensuring that there is enough database capacity to handle the data storage and retrieval requirements. | ||
|
|
||
| A CloudRun service is created to run Ghost application in at least two distinct regions. That helps with DR and HA in case region or geographical outages. CloudRun also automatically scales the application based on the incoming traffic, ensuring that there is always enough capacity to handle the traffic. | ||
|
|
||
| A DNS record is created to direct traffic to the Global Load Balancer (or to WAF in front of GLB). | ||
|
|
||
| The Global Load Balancer is set up to distribute traffic to the CloudRun services deployed in different regions. It is configured to monitor the health of the instances and direct traffic to the instances that are closest geographically to the client and are healthy. CloudArmor is configured to protect the application from DDoS attacks. Optionally client may add other SAAS WAF solution in front of GCP (Imperva?). | ||
| Cloud CDN is enabled for faster images and static content retrieval as well. | ||
|
|
||
| Users can access the application by navigating to the DNS record. The Global Load Balancer will distribute the traffic to the appropriate CloudRun instance based on the user's location and the health of the instances. The CloudRun instances will connect to the CloudSQL database to retrieve and store data. | ||
|
|
||
| Per client request - CloudFunction is created to clean all posts on demand. | ||
|
|
||
|
|
||
| Overall, this architecture provides a highly scalable and highly available solution for running containerized applications with a managed database service in the cloud. It offers automatic scaling, redundancy, and reliability, ensuring that the application is always available and responsive to user requests. |
Oops, something went wrong.