From b46a62c7ed46339f5e4f1eb0488253c7e26f0f10 Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Tue, 16 Sep 2025 12:21:04 +0100 Subject: [PATCH 01/24] Dbeaver devops#2136 te version update procedure (#171) * dbeaver/dbeaver-devops#2136 Update instruction version update procedure in docker compose deployment --- compose/README.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/compose/README.md b/compose/README.md index 6bf4b60..f8b2831 100644 --- a/compose/README.md +++ b/compose/README.md @@ -187,11 +187,31 @@ For detailed instructions on how to use the script manager, refer to [manager do ## Version update procedure +### Standard update procedure (recommended) + +1. Navigate to `team-edition-deploy/compose/cbte` +2. Stop the cluster: `docker-compose down` or `docker compose down` +3. Update your deployment files: + - Fetch latest changes: `git fetch` + - Switch to new release version: `git checkout ` (e.g., `git checkout 25.2.0`) + - Change value of `CLOUDBEAVER_VERSION_TAG` in `.env` with a preferred version (skip if tag `latest` is set) +4. Pull new docker images: `docker-compose pull` or `docker compose pull` +5. Start the cluster: `docker-compose up -d` or `docker compose up -d` + +### Alternative update procedure (for simple updates) + +If you are not updating across major version boundaries and don't need configuration changes: + 1. Navigate to `team-edition-deploy/compose/cbte` 2. Change value of `CLOUDBEAVER_VERSION_TAG` in `.env` with a preferred version. Go to next step if tag `latest` is set. 3. Pull new docker images: `docker-compose pull` or `docker compose pull` 4. Restart cluster: `docker-compose up -d` or `docker compose up -d` +**Note:** The standard procedure using `docker-compose down` is recommended because it ensures clean container replacement, especially when service names or configurations change between versions. + +### Version update to 25.1.0 or later + +Starting from version 25.1.0, the proxy container name has changed from `nginx` to `web-proxy`. When updating to version 25.1.0 or later, you **must** use the [standard update procedure](#standard-update-procedure-recommended) with `docker-compose down` to ensure the old container is properly removed. ### Version update from 24.0.0 or earlier From aedee4180cdde738e03d8f8e1dd66eaa512b1b09 Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Mon, 20 Oct 2025 14:00:46 +0100 Subject: [PATCH 02/24] Dbeaver devops#2199 fix install dbeaver te script (#174) * dbeaver/dbeaver-devops#2199 Removed hardcoded paths for team edition repo location and updated install script * dbeaver/dbeaver-devops#2199 Added create .env if not exist when run command dbeaver-te --- manager/dbeaver-te | 110 ++++++++++++++++++++++--------------- manager/install-manager.sh | 16 +++++- 2 files changed, 80 insertions(+), 46 deletions(-) diff --git a/manager/dbeaver-te b/manager/dbeaver-te index d292a35..d8216dd 100755 --- a/manager/dbeaver-te +++ b/manager/dbeaver-te @@ -2,18 +2,43 @@ set -e +ARG="$1" +TEAM_EDITION_BASE_DIR="/opt/dbeaver-team-server/team-edition-deploy" +TEAM_EDITION_COMPOSE_DIR="$TEAM_EDITION_BASE_DIR/compose/cbte" +TEAM_EDITION_IMAGE="cloudbeaver-dc" +TEAM_EDITION_UPDATE_AVAILABLE=false + +if [ ! -f "$TEAM_EDITION_COMPOSE_DIR/.env" ]; then + echo "Warning: .env file not found at $TEAM_EDITION_COMPOSE_DIR/.env" + if [ -f "$TEAM_EDITION_COMPOSE_DIR/.env.example" ]; then + read -r -p "Do you want to create .env file from .env.example? [y/N] " response + case "$response" in + [yY][eE][sS]|[yY]) + cp "$TEAM_EDITION_COMPOSE_DIR/.env.example" "$TEAM_EDITION_COMPOSE_DIR/.env" + echo ".env file created successfully!" + echo "Please review and configure .env file: $TEAM_EDITION_COMPOSE_DIR/.env" + ;; + *) + echo "Cannot proceed without .env file. Exiting." + exit 1 + ;; + esac + else + echo "Error: .env.example not found at $TEAM_EDITION_COMPOSE_DIR/.env.example" + echo "Cannot create .env file. Exiting." + exit 1 + fi +fi + while read -r line do [[ $line =~ ^#.* ]] && continue [[ -z $line ]] && continue export "$line" -done < /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/.env - -ARG="$1" +done < "$TEAM_EDITION_COMPOSE_DIR/.env" -TEAM_EDITION_IMAGE="cloudbeaver-dc" TEAM_EDITION_TAG="$CLOUDBEAVER_VERSION_TAG" -TEAM_EDITION_UPDATE_AVAILABLE=false + case $(uname -m) in "x86_64") @@ -26,7 +51,6 @@ case $(uname -m) in esac - printHelp() { cat << EOF @@ -51,7 +75,7 @@ Usage: dbeaver-te [command] restor your backup in current cluster DBeaver TE server home directory: - /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/ + $TEAM_EDITION_COMPOSE_DIR/ EOF } @@ -82,7 +106,7 @@ getAvailableVersions() { configureenvfile() { - nano /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/.env + nano "$TEAM_EDITION_COMPOSE_DIR/.env" } checkCloudBeaverUpdateVersion() { @@ -197,9 +221,9 @@ startCloudbeaver() { if [ "$TEAM_EDITION_STATUS" == false ] then docker compose \ - -f /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/docker-compose.yml \ - --env-file /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/.env \ - --project-directory /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/ \ + -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + --env-file "$TEAM_EDITION_COMPOSE_DIR/.env" \ + --project-directory "$TEAM_EDITION_COMPOSE_DIR/" \ up -d \ --remove-orphans \ --pull always @@ -225,7 +249,7 @@ startCloudbeaver() { stopCloudbeaver() { checkCloudBeaverStatus - docker compose -f /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/docker-compose.yml down + docker compose -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" down echo "DBeaver Team Edition Server stopped." } @@ -234,23 +258,23 @@ rollbackCloudBeaver() { BACKUP_VERSION="$2" docker compose \ - -f /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/docker-compose.yml \ - --env-file /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/.env \ - --project-directory /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/ \ + -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + --env-file "$TEAM_EDITION_COMPOSE_DIR/.env" \ + --project-directory "$TEAM_EDITION_COMPOSE_DIR/" \ down \ --remove-orphans - rsync -av --exclude='cert' --exclude='nginx' "$BACKUP_DIR/" /opt/dbeaver-team-server/team-edition-deploy/ + rsync -av --exclude='cert' --exclude='nginx' "$BACKUP_DIR/" "$TEAM_EDITION_BASE_DIR/" sed -i \ "s/CLOUDBEAVER_VERSION_TAG=$TEAM_EDITION_NEW_TAG/CLOUDBEAVER_VERSION_TAG=$BACKUP_VERSION/g" \ - /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/.env + "$TEAM_EDITION_COMPOSE_DIR/.env" export CLOUDBEAVER_VERSION_TAG=$BACKUP_VERSION docker compose \ - -f /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/docker-compose.yml \ - --env-file /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/.env \ - --project-directory /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/ \ + -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + --env-file "$TEAM_EDITION_COMPOSE_DIR/.env" \ + --project-directory "$TEAM_EDITION_COMPOSE_DIR/" \ up -d \ --remove-orphans @@ -275,14 +299,14 @@ updateCloudbeaver() { if [ "$TEAM_EDITION_UPDATE_AVAILABLE" == true ]; then TIMESTAMP=$(date +%m-%d-%Y_%H-%M) - BACKUP_DIR="/opt/dbeaver-team-server/team-edition-deploy-${TEAM_EDITION_TAG}-${TIMESTAMP}" + BACKUP_DIR="${TEAM_EDITION_BASE_DIR}-${TEAM_EDITION_TAG}-${TIMESTAMP}" - # Check if user has write permission for /opt/dbeaver-team-server/team-edition-deploy/ - if [ ! -w "/opt/dbeaver-team-server/team-edition-deploy/" ]; then - OWNER=$(ls -ld /opt/dbeaver-team-server/team-edition-deploy/ | awk '{print $3}') - GROUP=$(ls -ld /opt/dbeaver-team-server/team-edition-deploy/ | awk '{print $4}') + # Check if user has write permission for $TEAM_EDITION_BASE_DIR/ + if [ ! -w "$TEAM_EDITION_BASE_DIR/" ]; then + OWNER=$(ls -ld "$TEAM_EDITION_BASE_DIR/" | awk '{print $3}') + GROUP=$(ls -ld "$TEAM_EDITION_BASE_DIR/" | awk '{print $4}') - echo "Error: No write permission for /opt/dbeaver-team-server/team-edition-deploy/." + echo "Error: No write permission for $TEAM_EDITION_BASE_DIR/." echo "Directory is owned by: $OWNER (group: $GROUP)." if [ "$(whoami)" != "$OWNER" ]; then @@ -294,8 +318,8 @@ updateCloudbeaver() { fi # Check .git directory and fetch latest changes - cd /opt/dbeaver-team-server/team-edition-deploy/ - if [ ! -d "/opt/dbeaver-team-server/team-edition-deploy/.git" ]; then + cd "$TEAM_EDITION_BASE_DIR/" + if [ ! -d "$TEAM_EDITION_BASE_DIR/.git" ]; then echo "===============================================================================" echo "Error: .git directory not found. The repository may be missing or corrupted." echo "Please clone the repository again." @@ -313,15 +337,15 @@ updateCloudbeaver() { # Stop team-edition-deploy docker compose \ - -f /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/docker-compose.yml \ - --env-file /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/.env \ - --project-directory /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/ \ + -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + --env-file "$TEAM_EDITION_COMPOSE_DIR/.env" \ + --project-directory "$TEAM_EDITION_COMPOSE_DIR/" \ down \ --remove-orphans # Backup current configuration - mkdir -p $BACKUP_DIR - rsync -av --exclude='cert' --exclude='nginx' /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/ "$BACKUP_DIR" + mkdir -p "$BACKUP_DIR" + rsync -av --exclude='cert' --exclude='nginx' "$TEAM_EDITION_COMPOSE_DIR/" "$BACKUP_DIR" echo "Preveous team-edition-deploy configuration copied to $BACKUP_DIR" # Checkout new version @@ -334,7 +358,7 @@ updateCloudbeaver() { } sed -i \ "s/CLOUDBEAVER_VERSION_TAG=$TEAM_EDITION_TAG/CLOUDBEAVER_VERSION_TAG=$TEAM_EDITION_NEW_TAG/g" \ - /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/.env + "$TEAM_EDITION_COMPOSE_DIR/.env" export CLOUDBEAVER_VERSION_TAG=$TEAM_EDITION_NEW_TAG @@ -342,8 +366,8 @@ updateCloudbeaver() { if [ "$DBEAVER_TEAM_EDITION_AMI" ]; then "$HOME/.local/bin/dbeaver-compose-config-editor.py" \ - -f /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/docker-compose.yml \ - -e /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/.env || { + -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + -e "$TEAM_EDITION_COMPOSE_DIR/.env" || { echo "===============================================================================" echo "Error: Failed to patch docker-compose.yml using dbeaver-compose-config-editor.py." echo "===============================================================================" @@ -355,9 +379,9 @@ updateCloudbeaver() { # Start team-edition-deploy with new version and check status docker compose \ - -f /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/docker-compose.yml \ - --env-file /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/.env \ - --project-directory /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/ \ + -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + --env-file "$TEAM_EDITION_COMPOSE_DIR/.env" \ + --project-directory "$TEAM_EDITION_COMPOSE_DIR/" \ up -d \ --remove-orphans \ --pull always @@ -475,11 +499,11 @@ restoreBackup(){ fi rm -rf $TEMP_DIR - docker compose -f /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/docker-compose.yml down + docker compose -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" down docker compose \ - -f /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/docker-compose.yml \ - --env-file /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/.env \ - --project-directory /opt/dbeaver-team-server/team-edition-deploy/compose/cbte/ \ + -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + --env-file "$TEAM_EDITION_COMPOSE_DIR/.env" \ + --project-directory "$TEAM_EDITION_COMPOSE_DIR/" \ up -d } diff --git a/manager/install-manager.sh b/manager/install-manager.sh index 11b6c27..352e895 100755 --- a/manager/install-manager.sh +++ b/manager/install-manager.sh @@ -6,13 +6,23 @@ INSTALL_DIR="$HOME/bin" CURRENT_DIR=$(pwd) mkdir -p "$INSTALL_DIR" -ln -sf "$CURRENT_DIR/dbeaver-te" "$INSTALL_DIR/" +# Determine the actual base directory and compose directory +BASE_DIR=$(realpath "$CURRENT_DIR/..") +CBTE_DIR=$(realpath "$CURRENT_DIR/../compose/cbte") + +# Copy the script to install directory +cp "$CURRENT_DIR/dbeaver-te" "$INSTALL_DIR/dbeaver-te" chmod +x "$INSTALL_DIR/dbeaver-te" +# Replace the hardcoded paths with actual paths +sed -i "s|^TEAM_EDITION_BASE_DIR=.*|TEAM_EDITION_BASE_DIR=\"$BASE_DIR\"|g" "$INSTALL_DIR/dbeaver-te" +sed -i "s|^TEAM_EDITION_COMPOSE_DIR=.*|TEAM_EDITION_COMPOSE_DIR=\"$CBTE_DIR\"|g" "$INSTALL_DIR/dbeaver-te" + if [[ ":$PATH:" != *":$INSTALL_DIR:"* ]]; then echo "export PATH=\"$INSTALL_DIR:\$PATH\"" >> ~/.bashrc source ~/.bashrc fi -CBTE_DIR=$(realpath "$CURRENT_DIR/../compose/cbte") -sed -i "s|/opt/dbeaver-team-server/team-edition-deploy/compose/cbte/|$CBTE_DIR/|g" "$INSTALL_DIR/dbeaver-te" \ No newline at end of file +echo "DBeaver Team Edition manager installed successfully!" +echo "Base directory: $BASE_DIR" +echo "Compose directory: $CBTE_DIR" \ No newline at end of file From 08fdc6625914e19dfe4e66ef960eb164a1ed6805 Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Tue, 28 Oct 2025 11:49:37 +0100 Subject: [PATCH 03/24] =?UTF-8?q?dbeaver/dbeaver-devops#2173=20Added=20a?= =?UTF-8?q?=20paragraph=20about=20the=20desktop=20appli=E2=80=A6=20(#175)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * dbeaver/dbeaver-devops#2173 Added a paragraph about the desktop application in main README * dbeaver/dbeaver-devops#2173 Changed link to desktop app * dbeaver/dbeaver-devops#2173 Changed link to desktop app in devel * dbeaver/dbeaver-devops#2173 Added warning about using early access version, updated configs to ea version * dbeaver/dbeaver-devops#2173 Removed msg about default value * dbeaver/dbeaver-devops#2173 Changed warning msg --- AWS/ecs-fargate/README.md | 2 +- AWS/ecs-fargate/variables.tf.example | 2 +- README.md | 12 ++++++++++-- compose/cbte/.env.example | 2 +- k8s/cbte/Chart.yaml | 2 +- k8s/cbte/values.yaml.example | 2 +- 6 files changed, 15 insertions(+), 7 deletions(-) diff --git a/AWS/ecs-fargate/README.md b/AWS/ecs-fargate/README.md index 3d5fdf3..20524fe 100644 --- a/AWS/ecs-fargate/README.md +++ b/AWS/ecs-fargate/README.md @@ -44,7 +44,7 @@ git clone https://github.com/dbeaver/team-edition-deploy.git ![Region](images/region.png) - Ensure that the `alb_certificate_Identifier` variable contains the ID from [AWS Certificate Manager](#importing-an-ssl-certificate-in-aws) corresponding to the domain name specified in the `CLOUDBEAVER_PUBLIC_URL` variable within `variables.tf`. The domain name in `CLOUDBEAVER_PUBLIC_URL` must match the domain for which the certificates have been issued. - - You can customize the deployment version by updating the `dbeaver_te_version` environment variable. The default version is `25.2.0`. + - You can customize the deployment version by updating the `dbeaver_te_version` environment variable. 7. Run `terraform init` and then `terraform apply` in `ecs-fargate` directory to create the ECS cluster and complete the deployment. diff --git a/AWS/ecs-fargate/variables.tf.example b/AWS/ecs-fargate/variables.tf.example index 6d8f283..a37e59d 100644 --- a/AWS/ecs-fargate/variables.tf.example +++ b/AWS/ecs-fargate/variables.tf.example @@ -13,7 +13,7 @@ variable "aws_region" { variable "dbeaver_te_version" { description = "The version of the cluster you want to deploy" type = string - default = "25.2.0" + default = "ea" } variable "alb_certificate_Identifier" { diff --git a/README.md b/README.md index d39be4d..fafa64a 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,8 @@ ## DBeaver Team Edition -#### Version 25.2 +#### Version 25.3 Early Access + +**Warning:** Please keep in mind that Early Access versions are not as stable as regular releases, and their use in a production environment is not recommended. DBeaver Team Edition is a client-server application. It requires server deployment. You can deploy it on a single host (e.g. your local computer) @@ -32,7 +34,13 @@ After you started the server: - Configure your license - That's it -Now you can use web interface or [desktop clients](https://dbeaver.com/download/team-edition/) to work with your databases +### Desktop Application + +DBeaver Team Edition works in conjunction with a desktop client application. After deploying the server, you can connect to it using: +- **Web interface** – accessible directly through your browser +- **Desktop client** – provides enhanced features and better performance + +Download the desktop client for your platform: [**DBeaver Team Edition Desktop**](https://dbeaver.com/files/ea/team/) ### Server version update Version update is handled differently for different deployment methods. To update the Team Edition version, follow these instructions: diff --git a/compose/cbte/.env.example b/compose/cbte/.env.example index 57af04a..9833717 100644 --- a/compose/cbte/.env.example +++ b/compose/cbte/.env.example @@ -1,6 +1,6 @@ # CloudBeaver TE server version. Based on DockerHub images tag # -CLOUDBEAVER_VERSION_TAG=25.2.0 +CLOUDBEAVER_VERSION_TAG=ea IMAGE_SOURCE=dbeaver PODMAN_IMAGE_SOURCE=docker.io/dbeaver # Domain name of cluster endpoint. eg. dbeaver-te.example.com diff --git a/k8s/cbte/Chart.yaml b/k8s/cbte/Chart.yaml index 7e3833d..ce930c6 100644 --- a/k8s/cbte/Chart.yaml +++ b/k8s/cbte/Chart.yaml @@ -3,4 +3,4 @@ name: cbte description: A Helm chart for CloudBeaver TE application type: application version: 0.0.1 -appVersion: 25.2.0 +appVersion: ea diff --git a/k8s/cbte/values.yaml.example b/k8s/cbte/values.yaml.example index 14c508f..d59e8e8 100644 --- a/k8s/cbte/values.yaml.example +++ b/k8s/cbte/values.yaml.example @@ -4,7 +4,7 @@ # cloudbeaver general values for all TE services cloudbeaver: - imageTag: "25.2.0" + imageTag: "ea" pullPolicy: Always # pullCredsName - name of a secret config map that contains docker repo auths # pullCredsName: regcred From 2a6f81f8a339f638555dee71c61795a12d2a212a Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Mon, 17 Nov 2025 11:06:27 +0100 Subject: [PATCH 04/24] =?UTF-8?q?dbeaver/dbeaver-devops#2258=20Moved=20kaf?= =?UTF-8?q?ka=20environment=20from=20deployments=20=E2=80=A6=20(#178)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * dbeaver/dbeaver-devops#2258 Moved kafka environment from deployments to dockerfile env * dbeaver/dbeaver-devops#2258 Changed kafka spec to run in k8s * dbeaver/dbeaver-devops#2258 Added CLOUDBEAVER_KAFKA_BROKERS env for dc --- AWS/ecs-fargate/main.tf | 1 + AWS/ecs-fargate/variables.tf.example | 29 ++++-------------------- compose/cbte/docker-compose-nethost.yml | 5 ---- compose/cbte/docker-compose.yml | 9 -------- compose/cbte/podman-compose.yml | 9 -------- k8s/cbte/templates/deployment/kafka.yaml | 22 ------------------ 6 files changed, 6 insertions(+), 69 deletions(-) diff --git a/AWS/ecs-fargate/main.tf b/AWS/ecs-fargate/main.tf index cfc1374..8d6c5ae 100644 --- a/AWS/ecs-fargate/main.tf +++ b/AWS/ecs-fargate/main.tf @@ -21,6 +21,7 @@ locals { item.name == "CLOUDBEAVER_QM_SERVER_URL" ? format("http://%s-cloudbeaver-qm:8972/qm", var.deployment_id) : item.name == "CLOUDBEAVER_RM_SERVER_URL" ? format("http://%s-cloudbeaver-rm:8971/rm", var.deployment_id) : item.name == "CLOUDBEAVER_TM_SERVER_URL" ? format("http://%s-cloudbeaver-tm:8973/tm", var.deployment_id) : + item.name == "CLOUDBEAVER_KAFKA_BROKERS" ? format("http://%s-kafka:9092", var.deployment_id) : item.value ) } diff --git a/AWS/ecs-fargate/variables.tf.example b/AWS/ecs-fargate/variables.tf.example index a37e59d..91de879 100644 --- a/AWS/ecs-fargate/variables.tf.example +++ b/AWS/ecs-fargate/variables.tf.example @@ -97,30 +97,7 @@ variable "private_subnet_cidrs" { variable "cloudbeaver-kafka-env" { # type = map(string) - default = [ - { "name" : "KAFKA_CFG_NODE_ID", - "value" : "0" }, - { "name" : "KAFKA_BROKER_ID", - "value" : "0" }, - { "name" : "KAFKA_ENABLE_KRAFT", - "value" : "yes" }, - { "name" : "ALLOW_PLAINTEXT_LISTENER", - "value" : "yes" }, - { "name" : "KAFKA_CFG_PROCESS_ROLES", - "value" : "controller,broker" }, - { "name" : "KAFKA_CFG_CONTROLLER_QUORUM_VOTERS", - "value" : "0@127.0.0.1:9093" }, - { "name" : "KAFKA_CFG_LISTENERS", - "value" : "PLAINTEXT://:9092,CONTROLLER://:9093" }, - { "name" : "KAFKA_CFG_ADVERTISED_LISTENERS", - "value" : "PLAINTEXT://:9092" }, - { "name" : "KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP", - "value" : "CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT" }, - { "name" : "KAFKA_CFG_CONTROLLER_LISTENER_NAMES", - "value" : "CONTROLLER" }, - { "name" : "KAFKA_CFG_INTER_BROKER_LISTENER_NAME", - "value" : "PLAINTEXT" } - ] + default = [] } @@ -193,6 +170,10 @@ variable "cloudbeaver-dc-env" { { "name": "CLOUDBEAVER_PUBLIC_URL", "value": "https://cloudbeaver.io" + }, + { + "name": "CLOUDBEAVER_KAFKA_BROKERS", + "value": "kafka:9092" }] } diff --git a/compose/cbte/docker-compose-nethost.yml b/compose/cbte/docker-compose-nethost.yml index ff22754..738427d 100644 --- a/compose/cbte/docker-compose-nethost.yml +++ b/compose/cbte/docker-compose-nethost.yml @@ -35,14 +35,9 @@ services: image: ${IMAGE_SOURCE:-dbeaver}/cloudbeaver-kafka:3.9 network_mode: host environment: - - KAFKA_CFG_NODE_ID=0 - - KAFKA_CFG_PROCESS_ROLES=controller,broker - KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=0@127.0.0.1:9093 - KAFKA_CFG_LISTENERS=PLAINTEXT://127.0.0.1:9092,CONTROLLER://127.0.0.1:9093 - KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://127.0.0.1:9092 - - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT - - KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER - - KAFKA_CFG_INTER_BROKER_LISTENER_NAME=PLAINTEXT postgres: restart: unless-stopped diff --git a/compose/cbte/docker-compose.yml b/compose/cbte/docker-compose.yml index fecdd49..f04a101 100644 --- a/compose/cbte/docker-compose.yml +++ b/compose/cbte/docker-compose.yml @@ -38,15 +38,6 @@ services: hostname: kafka expose: - 9092 - environment: - - KAFKA_CFG_NODE_ID=0 - - KAFKA_CFG_PROCESS_ROLES=controller,broker - - KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=0@kafka:9093 - - KAFKA_CFG_LISTENERS=PLAINTEXT://:9092,CONTROLLER://:9093 - - KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://:9092 - - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT - - KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER - - KAFKA_CFG_INTER_BROKER_LISTENER_NAME=PLAINTEXT networks: - cloudbeaver-te-private-net postgres: diff --git a/compose/cbte/podman-compose.yml b/compose/cbte/podman-compose.yml index 26b0c6c..c528dc9 100644 --- a/compose/cbte/podman-compose.yml +++ b/compose/cbte/podman-compose.yml @@ -43,15 +43,6 @@ services: hostname: kafka expose: - 9092 - environment: - - KAFKA_CFG_NODE_ID=0 - - KAFKA_CFG_PROCESS_ROLES=controller,broker - - KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=0@kafka:9093 - - KAFKA_CFG_LISTENERS=PLAINTEXT://:9092,CONTROLLER://:9093 - - KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://:9092 - - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT - - KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER - - KAFKA_CFG_INTER_BROKER_LISTENER_NAME=PLAINTEXT networks: - cloudbeaver-te-private-net postgres: diff --git a/k8s/cbte/templates/deployment/kafka.yaml b/k8s/cbte/templates/deployment/kafka.yaml index 491beb4..1641995 100644 --- a/k8s/cbte/templates/deployment/kafka.yaml +++ b/k8s/cbte/templates/deployment/kafka.yaml @@ -17,32 +17,10 @@ spec: {{ .Release.Name }}-net: "true" app: kafka spec: - securityContext: - runAsUser: 1001 - fsGroup: 1001 containers: - image: dbeaver/cloudbeaver-kafka:3.9 imagePullPolicy: "IfNotPresent" name: kafka - env: - # KRaft settings - - name: KAFKA_CFG_NODE_ID - value: "0" - - name: KAFKA_CFG_PROCESS_ROLES - value: "controller,broker" - - name: KAFKA_CFG_CONTROLLER_QUORUM_VOTERS - value: "0@kafka:9093" - # Listeners - - name: KAFKA_CFG_LISTENERS - value: "PLAINTEXT://:9092,CONTROLLER://:9093" - - name: KAFKA_CFG_ADVERTISED_LISTENERS - value: "PLAINTEXT://:9092" - - name: KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP - value: "CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT" - - name: KAFKA_CFG_CONTROLLER_LISTENER_NAMES - value: "CONTROLLER" - - name: KAFKA_CFG_INTER_BROKER_LISTENER_NAME - value: "PLAINTEXT" ports: - containerPort: 9092 resources: {} From 52addd63ee10f9ff4493a77e2377f52fe27c6f8f Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Thu, 20 Nov 2025 13:51:04 +0100 Subject: [PATCH 05/24] dbeaver/dbeaver-devops#2284 Added configuration of image source for kafka and postgres in k8s deployment with default params (#179) --- k8s/cbte/templates/deployment/db.yaml | 2 +- k8s/cbte/templates/deployment/kafka.yaml | 2 +- k8s/cbte/values.yaml.example | 4 ++++ 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/k8s/cbte/templates/deployment/db.yaml b/k8s/cbte/templates/deployment/db.yaml index d2a05b1..0086dc0 100644 --- a/k8s/cbte/templates/deployment/db.yaml +++ b/k8s/cbte/templates/deployment/db.yaml @@ -19,7 +19,7 @@ spec: app: db spec: containers: - - image: dbeaver/cloudbeaver-postgres:13 + - image: "{{ .Values.postgres.image | default "dbeaver/cloudbeaver-postgres:13" }}" imagePullPolicy: "IfNotPresent" name: postgres env: diff --git a/k8s/cbte/templates/deployment/kafka.yaml b/k8s/cbte/templates/deployment/kafka.yaml index 1641995..92fcf31 100644 --- a/k8s/cbte/templates/deployment/kafka.yaml +++ b/k8s/cbte/templates/deployment/kafka.yaml @@ -18,7 +18,7 @@ spec: app: kafka spec: containers: - - image: dbeaver/cloudbeaver-kafka:3.9 + - image: "{{ .Values.kafka.image | default "dbeaver/cloudbeaver-kafka:3.9" }}" imagePullPolicy: "IfNotPresent" name: kafka ports: diff --git a/k8s/cbte/values.yaml.example b/k8s/cbte/values.yaml.example index d59e8e8..b65ea22 100644 --- a/k8s/cbte/values.yaml.example +++ b/k8s/cbte/values.yaml.example @@ -44,6 +44,10 @@ cloudbeaverQM: cloudbeaverTM: replicaCount: 1 image: dbeaver/cloudbeaver-tm +kafka: + image: "dbeaver/cloudbeaver-kafka:3.9" +postgres: + image: "dbeaver/cloudbeaver-postgres:13" # Cloud storage configuration # By default is None, it means not cloud deployment From 97093918787376e403633f9cce0a9fba3b965645 Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Mon, 8 Dec 2025 14:18:52 +0100 Subject: [PATCH 06/24] dbeaver/dbeaver-devops#2304 Update devel (#181) --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index fafa64a..a47b741 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ ## DBeaver Team Edition -#### Version 25.3 Early Access +#### Version 26.0 Early Access **Warning:** Please keep in mind that Early Access versions are not as stable as regular releases, and their use in a production environment is not recommended. @@ -62,6 +62,8 @@ To change an internal PostgreSQL password use [this instruction](CHANGEPWD.md#ho - [Early access](https://github.com/dbeaver/team-edition-deploy/tree/devel) ### Older versions: +- [25.3.0](https://github.com/dbeaver/team-edition-deploy/tree/25.3.0) +- [25.2.0](https://github.com/dbeaver/team-edition-deploy/tree/25.2.0) - [25.1.0](https://github.com/dbeaver/team-edition-deploy/tree/25.1.0) - [25.0.0](https://github.com/dbeaver/team-edition-deploy/tree/25.0.0) - [24.3.0](https://github.com/dbeaver/team-edition-deploy/tree/24.3.0) From 058c3d06e0954fce71ef0c7002ef3fc72c518150 Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Fri, 19 Dec 2025 11:42:43 +0100 Subject: [PATCH 07/24] dbeaver/tech-docs#1294 te windows deploy (#182) (#183) * dbeaver/tech-docs#1294 te windows deploy Co-authored-by: Vladimir Ivanov <38179706+daelynum@users.noreply.github.com> --- compose/Windows.md | 102 ++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 97 insertions(+), 5 deletions(-) diff --git a/compose/Windows.md b/compose/Windows.md index 632628d..95d889b 100644 --- a/compose/Windows.md +++ b/compose/Windows.md @@ -1,6 +1,98 @@ # Team Edition Server Installation on Windows -## Preparing your Windows environment +## Automatic installation using DBeaver Server Installer + +Use the **DBeaver Server Installer** to install dependencies, configure Team Edition, and run or stop the server on +Windows. + +### Prepare your Windows environment + +The installer checks your system and helps you install required components. + +1. Download the [DBeaver Server Installer](https://github.com/dbeaver/dbeaver-server-installer/releases) executable and + place it in any directory. + + If you prefer installing from source, install [Go](https://go.dev/dl/) (see the required version in the + [`go.mod` file](https://github.com/dbeaver/dbeaver-server-installer/blob/devel/go.mod)) and run: + + ``` + go install github.com/dbeaver/dbeaver-server-installer@latest + ``` + +2. Add the directory where you placed the executable to your system `PATH` environment variable. + +3. Open a new terminal so the updated `PATH` is applied. + +4. (Optional) Install shell completions. + + You can teach your shell to tab-complete the dbeaver-server-installer command and its subcommands. The exact steps + depend on your shell. + + Run: + + ``` + dbeaver-server-installer completion --help + ``` + + Follow the instructions to install the completions for your shell. + +5. Ensure WSL is installed. + + > Team Edition runs its containers under WSL, so WSL must be available before you continue. + + You can run: + + ``` + dbeaver-server-installer dependencies install + ``` + + This installs Git, Podman, and podman-compose, and also checks whether WSL is enabled. + If WSL is missing, the installer will tell you and show guidance on how to install it. + + To install WSL manually, run: + + ``` + wsl.exe --install + ``` + +6. Reboot your system after enabling WSL. The installer won’t proceed correctly until WSL is fully initialized. + +### Configure and start Team Edition + +1. Run: + + ``` + dbeaver-server-installer configure + ``` + + The tool creates the configuration directory and the `.env` file. + Edit the `.env` file to set your domain, SSL options, and other properties. [Learn more](https://dbeaver.com/docs/team-edition/Team-Edition-deployment-with-Docker-Compose/#environment-file-configuration) + + > You can start Team Edition without changing the `.env` file. The default values are enough for a basic setup. + +2. Start the server: + + ``` + dbeaver-server-installer start + ``` + + The tool deploys Team Edition, starts the containers, and opens the firewall ports needed for access. + + > **Note**: On Windows, `dbeaver-server-installer start` works only if PowerShell was launched with **Run as Administrator**. + +3. After startup, you can access Team Edition at the url configured in your `.env` file. + +### Stop Team Edition + +To stop the server, run: + +``` +dbeaver-server-installer stop +``` + +## Manual installation on Windows using WSL and podman + +### Prepare your Windows environment When running on Windows, you need to ensure that WSL is enabled. We also recommend using `podman` with `podman-compose`. @@ -45,7 +137,7 @@ New-NetFirewallRule -DisplayName "Allow Inbound TCP 443 for WSL" -Direction Inbo Change `CHANGEME` to the IP address found in the previous step. -## Configuring and starting the Team Edition cluster +### Configuring and starting the Team Edition cluster 1. Clone the Git repository to your local machine by running the following command in your terminal: ```powershell @@ -70,15 +162,15 @@ cd .\team-edition-deploy\compose\cbte\ podman compose -f .\podman-compose.yml up -d ``` -## Stopping the cluster +### Stopping the cluster ```powershell podman compose -f .\podman-compose.yml down ``` -## Misc +### Misc -### How to determine the IP address of the WSL machine +#### How to determine the IP address of the WSL machine 1. Execute `wsl.exe -d dbeaver-team-edition-machine` in PowerShell or Command Prompt: 2. Run `ip addr show eth0`. You'll see something like From 86f0bf2f09df2e651b5cfe5f8eddca80f9c9292f Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Thu, 15 Jan 2026 16:01:45 +0100 Subject: [PATCH 08/24] dbeaver/dbeaver-devops#2354 Added Configure SQL Server database (#185) * dbeaver/dbeaver-devops#2354 Added Configure SQL Server database * dbeaver/dbeaver-devops#2354 Added creating db cloudbeaver --- compose/README.md | 17 +++++++++++++++++ compose/cbte/.env.example | 1 + 2 files changed, 18 insertions(+) diff --git a/compose/README.md b/compose/README.md index f8b2831..2288f0b 100644 --- a/compose/README.md +++ b/compose/README.md @@ -157,6 +157,23 @@ You might need to add additional parameters to the `CLOUDBEAVER_DB_URL`: `CLOUDBEAVER_DB_URL=jdbc:mariadb://127.0.0.1:3306/cloudbeaver?autoReconnect=true&allowPublicKeyRetrieval=true` +#### Configure SQL Server database + +To use SQL Server as an internal database, set the driver to `microsoft` and configure the connection URL. + +Connect to your SQL Server database and run: +```sql + CREATE DATABASE cloudbeaver; + CREATE SCHEMA dc; + CREATE SCHEMA qm; + CREATE SCHEMA tm; +``` + +##### Example: + +`CLOUDBEAVER_DB_DRIVER=microsoft` +`CLOUDBEAVER_DB_URL=jdbc:sqlserver://127.0.0.1:1433;databaseName=cloudbeaver` + #### PostgreSQL update procedure If you want to update the internal PostgreSQL to version 17, follow these steps: diff --git a/compose/cbte/.env.example b/compose/cbte/.env.example index 9833717..0777ece 100644 --- a/compose/cbte/.env.example +++ b/compose/cbte/.env.example @@ -27,6 +27,7 @@ REPLICA_COUNT_RM=1 # - for postgresql use 'postgres-jdbc' driver. # - for mysql or mariadb use 'mariaDB' driver. # - for oracle use 'oracle_thin' driver. +# - for sql server use 'microsoft' driver. # USE_EXTERNAL_DB=false CLOUDBEAVER_DB_DRIVER=postgres-jdbc From eb8e8b17db136e8eda9545d196703c20bbbe1cd6 Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Tue, 20 Jan 2026 11:28:25 +0100 Subject: [PATCH 09/24] =?UTF-8?q?dbeaver/dbeaver-devops#2329=20Added=20JAV?= =?UTF-8?q?A=5FTOOL=5FOPTIONS=20in=20docker=20deploym=E2=80=A6=20(#186)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * dbeaver/dbeaver-devops#2329 Added JAVA_TOOL_OPTIONS in docker deploymnet to pass Java parameters in services * dbeaver/dbeaver-devops#2329 Added JAVA_TOOL_OPTIONS example --- compose/README.md | 9 +++++++++ compose/cbte/.env.example | 3 +++ compose/cbte/docker-compose-nethost.yml | 5 +++++ compose/cbte/docker-compose.yml | 5 +++++ compose/cbte/podman-compose.yml | 5 +++++ 5 files changed, 27 insertions(+) diff --git a/compose/README.md b/compose/README.md index 2288f0b..0c2c35e 100644 --- a/compose/README.md +++ b/compose/README.md @@ -67,6 +67,15 @@ environment: ``` This step is only required for Nginx, as HAProxy resolves service names via Docker DNS automatically. +### Java tool options + +Java does not read system environment variables. To pass Java parameters to the Java process, use the `JAVA_TOOL_OPTIONS` variable in your `.env` file. + +Example for proxy configuration: +``` +JAVA_TOOL_OPTIONS="-Dhttp.proxy.host= -Dhttps.proxy.host= -Dhttp.proxy.port= -Dhttps.proxy.port=" +``` + ## Configuring and starting Team Edition cluster 1. Clone Git repository to your local machine by running the following command in your terminal: diff --git a/compose/cbte/.env.example b/compose/cbte/.env.example index 0777ece..0ce238a 100644 --- a/compose/cbte/.env.example +++ b/compose/cbte/.env.example @@ -34,3 +34,6 @@ CLOUDBEAVER_DB_DRIVER=postgres-jdbc CLOUDBEAVER_DB_URL=jdbc:postgresql://postgres:5432/cloudbeaver CLOUDBEAVER_DB_USER=postgres CLOUDBEAVER_DB_PASSWORD=StR0NgP2sSw0rD + +# Java tool options for JVM configuration +JAVA_TOOL_OPTIONS= diff --git a/compose/cbte/docker-compose-nethost.yml b/compose/cbte/docker-compose-nethost.yml index 738427d..10145a2 100644 --- a/compose/cbte/docker-compose-nethost.yml +++ b/compose/cbte/docker-compose-nethost.yml @@ -72,6 +72,7 @@ services: - CLOUDBEAVER_QM_BACKEND_DB_DRIVER=${CLOUDBEAVER_DB_DRIVER} - CLOUDBEAVER_DC_BACKEND_DB_DRIVER=${CLOUDBEAVER_DB_DRIVER} - CLOUDBEAVER_TM_BACKEND_DB_DRIVER=${CLOUDBEAVER_DB_DRIVER} + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} volumes: - dc_data:/opt/domain-controller/workspace - ./cert/private/:/opt/domain-controller/conf/certificates/ @@ -90,6 +91,7 @@ services: - trusted_cacerts:/opt/cloudbeaver/conf/certificates/custom/ environment: - CLOUDBEAVER_DC_SERVER_URL=http://127.0.0.1:8970/dc + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} expose: - ${CLOUDBEAVER_WEB_SERVER_PORT:-8978} depends_on: @@ -105,6 +107,7 @@ services: replicas: ${REPLICA_COUNT_RM:-1} environment: - CLOUDBEAVER_DC_SERVER_URL=http://127.0.0.1:8970/dc + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} volumes: - rm_data:/opt/resource-manager/workspace - ./cert/public/:/opt/resource-manager/conf/certificates/ @@ -120,6 +123,7 @@ services: replicas: ${REPLICA_COUNT_QM:-1} environment: - CLOUDBEAVER_DC_SERVER_URL=http://127.0.0.1:8970/dc + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} volumes: - ./cert/public/:/opt/query-manager/conf/certificates/ - trusted_cacerts:/opt/query-manager/conf/certificates/custom/ @@ -134,6 +138,7 @@ services: replicas: ${REPLICA_COUNT_TM:-1} environment: - CLOUDBEAVER_DC_SERVER_URL=http://127.0.0.1:8970/dc + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} volumes: - tm_data:/opt/task-manager/workspace - ./cert/public/:/opt/task-manager/conf/certificates/ diff --git a/compose/cbte/docker-compose.yml b/compose/cbte/docker-compose.yml index f04a101..1dc844e 100644 --- a/compose/cbte/docker-compose.yml +++ b/compose/cbte/docker-compose.yml @@ -76,6 +76,7 @@ services: - CLOUDBEAVER_QM_BACKEND_DB_DRIVER=${CLOUDBEAVER_DB_DRIVER} - CLOUDBEAVER_DC_BACKEND_DB_DRIVER=${CLOUDBEAVER_DB_DRIVER} - CLOUDBEAVER_TM_BACKEND_DB_DRIVER=${CLOUDBEAVER_DB_DRIVER} + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} volumes: - dc_data:/opt/domain-controller/workspace - ./cert/private/:/opt/domain-controller/conf/certificates/ @@ -97,6 +98,7 @@ services: - trusted_cacerts:/opt/cloudbeaver/conf/certificates/custom/ environment: - CLOUDBEAVER_DC_SERVER_URL=http://cloudbeaver-dc:8970/dc + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} expose: - ${CLOUDBEAVER_WEB_SERVER_PORT:-8978} depends_on: @@ -113,6 +115,7 @@ services: replicas: ${REPLICA_COUNT_RM:-1} environment: - CLOUDBEAVER_DC_SERVER_URL=http://cloudbeaver-dc:8970/dc + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} volumes: - rm_data:/opt/resource-manager/workspace - ./cert/public/:/opt/resource-manager/conf/certificates/ @@ -131,6 +134,7 @@ services: replicas: ${REPLICA_COUNT_QM:-1} environment: - CLOUDBEAVER_DC_SERVER_URL=http://cloudbeaver-dc:8970/dc + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} volumes: - ./cert/public/:/opt/query-manager/conf/certificates/ - trusted_cacerts:/opt/query-manager/conf/certificates/custom/ @@ -148,6 +152,7 @@ services: replicas: ${REPLICA_COUNT_TM:-1} environment: - CLOUDBEAVER_DC_SERVER_URL=http://cloudbeaver-dc:8970/dc + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} volumes: - tm_data:/opt/task-manager/workspace - ./cert/public/:/opt/task-manager/conf/certificates/ diff --git a/compose/cbte/podman-compose.yml b/compose/cbte/podman-compose.yml index c528dc9..0112142 100644 --- a/compose/cbte/podman-compose.yml +++ b/compose/cbte/podman-compose.yml @@ -81,6 +81,7 @@ services: - CLOUDBEAVER_QM_BACKEND_DB_DRIVER=${CLOUDBEAVER_DB_DRIVER} - CLOUDBEAVER_DC_BACKEND_DB_DRIVER=${CLOUDBEAVER_DB_DRIVER} - CLOUDBEAVER_TM_BACKEND_DB_DRIVER=${CLOUDBEAVER_DB_DRIVER} + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} volumes: - dc_data:/opt/domain-controller/workspace:z - ./cert/private/:/opt/domain-controller/conf/certificates/:z @@ -102,6 +103,7 @@ services: - trusted_cacerts:/opt/cloudbeaver/conf/certificates/custom/:z environment: - CLOUDBEAVER_DC_SERVER_URL=http://cloudbeaver-dc:8970/dc + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} expose: - ${CLOUDBEAVER_WEB_SERVER_PORT:-8978} depends_on: @@ -118,6 +120,7 @@ services: replicas: ${REPLICA_COUNT_RM:-1} environment: - CLOUDBEAVER_DC_SERVER_URL=http://cloudbeaver-dc:8970/dc + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} volumes: - rm_data:/opt/resource-manager/workspace:z - ./cert/public/:/opt/resource-manager/conf/certificates/:z @@ -136,6 +139,7 @@ services: replicas: ${REPLICA_COUNT_QM:-1} environment: - CLOUDBEAVER_DC_SERVER_URL=http://cloudbeaver-dc:8970/dc + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} volumes: - ./cert/public/:/opt/query-manager/conf/certificates/:z - trusted_cacerts:/opt/query-manager/conf/certificates/custom/:z @@ -153,6 +157,7 @@ services: replicas: ${REPLICA_COUNT_TM:-1} environment: - CLOUDBEAVER_DC_SERVER_URL=http://cloudbeaver-dc:8970/dc + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} volumes: - tm_data:/opt/task-manager/workspace:z - ./cert/public/:/opt/task-manager/conf/certificates/:z From 73cc8fc07043aa7c609c89b0d60ea866259a78b3 Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Thu, 12 Feb 2026 15:33:59 +0100 Subject: [PATCH 10/24] dbeaver/dbeaver-devops#1669 Avoid keeping password in example (#189) * dbeaver/dbeaver-devops#1669 Avoid keeping password in example * dbeaver/dbeaver-devops#1669 Update README * dbeaver/dbeaver-devops#1669 Removed k8s secret check for old password --- AWS/ecs-fargate/README.md | 2 +- AWS/ecs-fargate/variables.tf.example | 8 ++++---- compose/README.md | 1 + compose/cbte/.env.example | 2 +- k8s/README.md | 1 + k8s/cbte/templates/secrets/db-passwords.yaml | 4 ---- k8s/cbte/values.yaml.example | 2 +- 7 files changed, 9 insertions(+), 11 deletions(-) diff --git a/AWS/ecs-fargate/README.md b/AWS/ecs-fargate/README.md index 20524fe..9e66bcf 100644 --- a/AWS/ecs-fargate/README.md +++ b/AWS/ecs-fargate/README.md @@ -24,7 +24,7 @@ git clone https://github.com/dbeaver/team-edition-deploy.git - Navigate to `team-edition-deploy/AWS/ecs-fargate` - Copy `variables.tf.example` to `variables.tf` - Open `variables.tf`. - - Update `variables.tf` file. Modify `POSTGRES_PASSWORD` field in `cloudbeaver-db-env` vatiables. + - Update `variables.tf` file. You must set `POSTGRES_PASSWORD` field in `cloudbeaver-db-env` variables. The password are empty by default and the service will not start without them. - If you plan to use an RDS-based database: **Note:** only [Amazon RDS for PostgreSQL](https://aws.amazon.com/rds/postgresql/) is supported. diff --git a/AWS/ecs-fargate/variables.tf.example b/AWS/ecs-fargate/variables.tf.example index 91de879..6e5d157 100644 --- a/AWS/ecs-fargate/variables.tf.example +++ b/AWS/ecs-fargate/variables.tf.example @@ -64,7 +64,7 @@ variable "cloudbeaver-db-env" { # type = map(string) default = [ { "name": "POSTGRES_PASSWORD", - "value": "postgres"}, + "value": ""}, { "name": "POSTGRES_USER", "value": "postgres"}, { "name": "POSTGRES_DB", @@ -157,15 +157,15 @@ variable "cloudbeaver-dc-env" { }, { "name": "CLOUDBEAVER_DC_BACKEND_DB_PASSWORD", - "value": "DCpassword" + "value": "" }, { "name": "CLOUDBEAVER_TM_BACKEND_DB_PASSWORD", - "value": "TMpassword" + "value": "" }, { "name": "CLOUDBEAVER_QM_BACKEND_DB_PASSWORD", - "value": "QMpassword" + "value": "" }, { "name": "CLOUDBEAVER_PUBLIC_URL", diff --git a/compose/README.md b/compose/README.md index 0c2c35e..a94c33e 100644 --- a/compose/README.md +++ b/compose/README.md @@ -86,6 +86,7 @@ JAVA_TOOL_OPTIONS="-Dhttp.proxy.host= -Dhttps.proxy.host= - Navigate to `team-edition-deploy/compose/cbte` - Copy `.env.example` to `.env` - Edit `.env` file to set configuration properties + - You must set the `CLOUDBEAVER_DB_PASSWORD` variable before starting the cluster. The database password is empty by default and the service will not start without it. 3. [Configure SSL and domain](../SSL/README.md#ssl-certificate-configuration) 4. Start the cluster: - `docker-compose up -d` or `docker compose up -d` diff --git a/compose/cbte/.env.example b/compose/cbte/.env.example index 0ce238a..5097ce7 100644 --- a/compose/cbte/.env.example +++ b/compose/cbte/.env.example @@ -33,7 +33,7 @@ USE_EXTERNAL_DB=false CLOUDBEAVER_DB_DRIVER=postgres-jdbc CLOUDBEAVER_DB_URL=jdbc:postgresql://postgres:5432/cloudbeaver CLOUDBEAVER_DB_USER=postgres -CLOUDBEAVER_DB_PASSWORD=StR0NgP2sSw0rD +CLOUDBEAVER_DB_PASSWORD= # Java tool options for JVM configuration JAVA_TOOL_OPTIONS= diff --git a/k8s/README.md b/k8s/README.md index c0a48ab..4b4f28f 100644 --- a/k8s/README.md +++ b/k8s/README.md @@ -41,6 +41,7 @@ Previously, the volumes were owned by the ‘root’ user, but now they are owne 2. `cd team-edition-deploy/k8s/cbte` 3. `cp ./values.yaml.example ./values.yaml` 4. Edit chart values in `values.yaml` (use any text editor). + - You must set the `cloudbeaver_db_password` variable before deploying the cluster. The database password is empty by default and the deployment will fail without it. 5. Configure domain and SSL certificate: - Add an A record in your DNS hosting for a value of `cloudbeaverBaseDomain` variable with load balancer IP address. - Generate internal services certificates: diff --git a/k8s/cbte/templates/secrets/db-passwords.yaml b/k8s/cbte/templates/secrets/db-passwords.yaml index 3408e47..f02f0b3 100644 --- a/k8s/cbte/templates/secrets/db-passwords.yaml +++ b/k8s/cbte/templates/secrets/db-passwords.yaml @@ -2,10 +2,6 @@ {{- fail "Error: backend.cloudbeaver_db_password is missing or empty" }} {{- end }} -{{- if eq .Values.backend.cloudbeaver_db_password "StR0NgP2sSw0rD" }} - {{- fail "Error: Default password 'StR0NgP2sSw0rD' is insecure! Please change it before deployment." }} -{{- end }} - apiVersion: v1 kind: Secret metadata: diff --git a/k8s/cbte/values.yaml.example b/k8s/cbte/values.yaml.example index b65ea22..eb7de83 100644 --- a/k8s/cbte/values.yaml.example +++ b/k8s/cbte/values.yaml.example @@ -66,4 +66,4 @@ backend: cloudbeaver_db_driver: postgres-jdbc cloudbeaver_db_url: jdbc:postgresql://postgres:5432/cloudbeaver cloudbeaver_db_user: postgres - cloudbeaver_db_password: StR0NgP2sSw0rD + cloudbeaver_db_password: "" From 8b21cd229faddfced02fd07abe446383ebfa6d25 Mon Sep 17 00:00:00 2001 From: mayer <57711367+mayerro@users.noreply.github.com> Date: Thu, 12 Feb 2026 18:29:13 +0100 Subject: [PATCH 11/24] dbeaver/dbeaver-devops#2461 db isolated in compose projects (#191) --- compose/cbte/docker-compose.yml | 12 ++++++++---- compose/cbte/podman-compose.yml | 10 +++++++--- 2 files changed, 15 insertions(+), 7 deletions(-) diff --git a/compose/cbte/docker-compose.yml b/compose/cbte/docker-compose.yml index 1dc844e..77b5d4b 100644 --- a/compose/cbte/docker-compose.yml +++ b/compose/cbte/docker-compose.yml @@ -10,6 +10,7 @@ volumes: api_tokens: {} networks: cloudbeaver-te-private-net: null + cloudbeaver-te-common-net: null services: web-proxy: restart: unless-stopped @@ -22,7 +23,7 @@ services: - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-dbeaver} - CLOUDBEAVER_WEB_SERVER_PORT=${CLOUDBEAVER_WEB_SERVER_PORT:-8978} networks: - - cloudbeaver-te-private-net + - cloudbeaver-te-common-net volumes: - nginx_conf_data:/etc/${PROXY_TYPE:-nginx}/product-conf/ - nginx_ssl_data:/etc/${PROXY_TYPE:-nginx}/ssl/ @@ -39,7 +40,7 @@ services: expose: - 9092 networks: - - cloudbeaver-te-private-net + - cloudbeaver-te-common-net postgres: restart: unless-stopped hostname: postgres @@ -87,6 +88,7 @@ services: - 8970 networks: - cloudbeaver-te-private-net + - cloudbeaver-te-common-net cloudbeaver-te: restart: unless-stopped hostname: cloudbeaver-te @@ -106,7 +108,7 @@ services: - cloudbeaver-rm - cloudbeaver-qm networks: - - cloudbeaver-te-private-net + - cloudbeaver-te-common-net cloudbeaver-rm: restart: unless-stopped image: ${IMAGE_SOURCE:-dbeaver}/cloudbeaver-rm:${CLOUDBEAVER_VERSION_TAG} @@ -125,7 +127,7 @@ services: expose: - 8971 networks: - - cloudbeaver-te-private-net + - cloudbeaver-te-common-net cloudbeaver-qm: restart: unless-stopped image: ${IMAGE_SOURCE:-dbeaver}/cloudbeaver-qm:${CLOUDBEAVER_VERSION_TAG} @@ -144,6 +146,7 @@ services: - 8972 networks: - cloudbeaver-te-private-net + - cloudbeaver-te-common-net cloudbeaver-tm: restart: unless-stopped image: ${IMAGE_SOURCE:-dbeaver}/cloudbeaver-tm:${CLOUDBEAVER_VERSION_TAG} @@ -163,3 +166,4 @@ services: - 8973 networks: - cloudbeaver-te-private-net + - cloudbeaver-te-common-net diff --git a/compose/cbte/podman-compose.yml b/compose/cbte/podman-compose.yml index 0112142..f520947 100644 --- a/compose/cbte/podman-compose.yml +++ b/compose/cbte/podman-compose.yml @@ -15,6 +15,7 @@ volumes: api_tokens: {} networks: cloudbeaver-te-private-net: null + cloudbeaver-te-common-net: null services: web-proxy: restart: unless-stopped @@ -44,7 +45,7 @@ services: expose: - 9092 networks: - - cloudbeaver-te-private-net + - cloudbeaver-te-common-net postgres: restart: unless-stopped hostname: postgres @@ -92,6 +93,7 @@ services: - 8970 networks: - cloudbeaver-te-private-net + - cloudbeaver-te-common-net cloudbeaver-te: restart: unless-stopped hostname: cloudbeaver-te @@ -111,7 +113,7 @@ services: - cloudbeaver-rm - cloudbeaver-qm networks: - - cloudbeaver-te-private-net + - cloudbeaver-te-common-net cloudbeaver-rm: restart: unless-stopped image: ${PODMAN_IMAGE_SOURCE:-docker.io/dbeaver}/cloudbeaver-rm:${CLOUDBEAVER_VERSION_TAG} @@ -130,7 +132,7 @@ services: expose: - 8971 networks: - - cloudbeaver-te-private-net + - cloudbeaver-te-common-net cloudbeaver-qm: restart: unless-stopped image: ${PODMAN_IMAGE_SOURCE:-docker.io/dbeaver}/cloudbeaver-qm:${CLOUDBEAVER_VERSION_TAG} @@ -149,6 +151,7 @@ services: - 8972 networks: - cloudbeaver-te-private-net + - cloudbeaver-te-common-net cloudbeaver-tm: restart: unless-stopped image: ${PODMAN_IMAGE_SOURCE:-docker.io/dbeaver}/cloudbeaver-tm:${CLOUDBEAVER_VERSION_TAG} @@ -168,3 +171,4 @@ services: - 8973 networks: - cloudbeaver-te-private-net + - cloudbeaver-te-common-net From 9c6d05cea0bea47c0077b22ba3fc00153c60427b Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Fri, 13 Feb 2026 11:27:42 +0100 Subject: [PATCH 12/24] dbeaver/dbeaver-devops#2459 Remove CLOUDBEAVER_PUBLIC_URL (#190) * dbeaver/dbeaver-devops#2459 Remove CLOUDBEAVER_PUBLIC_URL * dbeaver/dbeaver-devops#2459 Remove CLOUDBEAVER_PUBLIC_URL from .env --- AWS/ecs-fargate/README.md | 2 +- AWS/ecs-fargate/variables.tf.example | 4 ---- compose/cbte/.env.example | 3 --- compose/cbte/docker-compose.yml | 1 - compose/cbte/podman-compose.yml | 1 - k8s/cbte/templates/deployment/cloudbeaver-dc.yaml | 2 -- 6 files changed, 1 insertion(+), 12 deletions(-) diff --git a/AWS/ecs-fargate/README.md b/AWS/ecs-fargate/README.md index 9e66bcf..7c371df 100644 --- a/AWS/ecs-fargate/README.md +++ b/AWS/ecs-fargate/README.md @@ -43,7 +43,7 @@ git clone https://github.com/dbeaver/team-edition-deploy.git ![Region](images/region.png) - - Ensure that the `alb_certificate_Identifier` variable contains the ID from [AWS Certificate Manager](#importing-an-ssl-certificate-in-aws) corresponding to the domain name specified in the `CLOUDBEAVER_PUBLIC_URL` variable within `variables.tf`. The domain name in `CLOUDBEAVER_PUBLIC_URL` must match the domain for which the certificates have been issued. + - Ensure that the `alb_certificate_Identifier` variable contains the ID from [AWS Certificate Manager](#importing-an-ssl-certificate-in-aws) corresponding to your domain name. The domain name must match the domain for which the certificates have been issued. - You can customize the deployment version by updating the `dbeaver_te_version` environment variable. 7. Run `terraform init` and then `terraform apply` in `ecs-fargate` directory to create the ECS cluster and complete the deployment. diff --git a/AWS/ecs-fargate/variables.tf.example b/AWS/ecs-fargate/variables.tf.example index 6e5d157..720ef47 100644 --- a/AWS/ecs-fargate/variables.tf.example +++ b/AWS/ecs-fargate/variables.tf.example @@ -167,10 +167,6 @@ variable "cloudbeaver-dc-env" { "name": "CLOUDBEAVER_QM_BACKEND_DB_PASSWORD", "value": "" }, - { - "name": "CLOUDBEAVER_PUBLIC_URL", - "value": "https://cloudbeaver.io" - }, { "name": "CLOUDBEAVER_KAFKA_BROKERS", "value": "kafka:9092" diff --git a/compose/cbte/.env.example b/compose/cbte/.env.example index 5097ce7..c51b3b9 100644 --- a/compose/cbte/.env.example +++ b/compose/cbte/.env.example @@ -7,9 +7,6 @@ PODMAN_IMAGE_SOURCE=docker.io/dbeaver # COMPOSE_PROJECT_NAME=dbeaver -CLOUDBEAVER_PUBLIC_URL=http://localhost - - # Type of web server. Supported values: nginx, haproxy PROXY_TYPE=nginx diff --git a/compose/cbte/docker-compose.yml b/compose/cbte/docker-compose.yml index 77b5d4b..3d9bf87 100644 --- a/compose/cbte/docker-compose.yml +++ b/compose/cbte/docker-compose.yml @@ -60,7 +60,6 @@ services: image: ${IMAGE_SOURCE:-dbeaver}/cloudbeaver-dc:${CLOUDBEAVER_VERSION_TAG} hostname: cloudbeaver-dc environment: - - CLOUDBEAVER_PUBLIC_URL=${CLOUDBEAVER_PUBLIC_URL} - CLOUDBEAVER_DC_SERVER_URL=http://cloudbeaver-dc:8970/dc - CLOUDBEAVER_RM_SERVER_URL=http://cloudbeaver-rm:8971/rm - CLOUDBEAVER_QM_SERVER_URL=http://cloudbeaver-qm:8972/qm diff --git a/compose/cbte/podman-compose.yml b/compose/cbte/podman-compose.yml index f520947..a94d5b9 100644 --- a/compose/cbte/podman-compose.yml +++ b/compose/cbte/podman-compose.yml @@ -65,7 +65,6 @@ services: image: ${PODMAN_IMAGE_SOURCE:-docker.io/dbeaver}/cloudbeaver-dc:${CLOUDBEAVER_VERSION_TAG} hostname: cloudbeaver-dc environment: - - CLOUDBEAVER_PUBLIC_URL=${CLOUDBEAVER_PUBLIC_URL} - CLOUDBEAVER_DC_SERVER_URL=http://cloudbeaver-dc:8970/dc - CLOUDBEAVER_RM_SERVER_URL=http://cloudbeaver-rm:8971/rm - CLOUDBEAVER_QM_SERVER_URL=http://cloudbeaver-qm:8972/qm diff --git a/k8s/cbte/templates/deployment/cloudbeaver-dc.yaml b/k8s/cbte/templates/deployment/cloudbeaver-dc.yaml index bb6283d..a74cb67 100644 --- a/k8s/cbte/templates/deployment/cloudbeaver-dc.yaml +++ b/k8s/cbte/templates/deployment/cloudbeaver-dc.yaml @@ -62,8 +62,6 @@ spec: value: "http://cloudbeaver-rm:8971/rm" - name: CLOUDBEAVER_QM_SERVER_URL value: "http://cloudbeaver-qm:8972/qm" - - name: CLOUDBEAVER_PUBLIC_URL - value: "{{ .Values.httpScheme }}://{{ .Values.cloudbeaverBaseDomain }}" ports: - containerPort: 8970 resources: {} From bef924229ca25f5417e91691c5bc72071f686165 Mon Sep 17 00:00:00 2001 From: Dmitrii Barnukov <29237913+Nexus6v2@users.noreply.github.com> Date: Fri, 13 Feb 2026 12:46:09 +0100 Subject: [PATCH 13/24] dbeaver/pro#6761 added host mode envs (#184) * dbeaver/pro#6761 added host mode envs * dbeaver/pro#6761 enforce 127.0.0.1 for nodes --------- Co-authored-by: Aleksandr Skoblikov --- compose/cbte/docker-compose-nethost.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/compose/cbte/docker-compose-nethost.yml b/compose/cbte/docker-compose-nethost.yml index 10145a2..b96f7eb 100644 --- a/compose/cbte/docker-compose-nethost.yml +++ b/compose/cbte/docker-compose-nethost.yml @@ -72,7 +72,8 @@ services: - CLOUDBEAVER_QM_BACKEND_DB_DRIVER=${CLOUDBEAVER_DB_DRIVER} - CLOUDBEAVER_DC_BACKEND_DB_DRIVER=${CLOUDBEAVER_DB_DRIVER} - CLOUDBEAVER_TM_BACKEND_DB_DRIVER=${CLOUDBEAVER_DB_DRIVER} - - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} + - NETWORK_MODE=host + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} -Dserver.address=127.0.0.1 volumes: - dc_data:/opt/domain-controller/workspace - ./cert/private/:/opt/domain-controller/conf/certificates/ @@ -91,6 +92,7 @@ services: - trusted_cacerts:/opt/cloudbeaver/conf/certificates/custom/ environment: - CLOUDBEAVER_DC_SERVER_URL=http://127.0.0.1:8970/dc + - NETWORK_MODE=host - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} expose: - ${CLOUDBEAVER_WEB_SERVER_PORT:-8978} @@ -107,7 +109,8 @@ services: replicas: ${REPLICA_COUNT_RM:-1} environment: - CLOUDBEAVER_DC_SERVER_URL=http://127.0.0.1:8970/dc - - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} + - NETWORK_MODE=host + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} -Dserver.address=127.0.0.1 volumes: - rm_data:/opt/resource-manager/workspace - ./cert/public/:/opt/resource-manager/conf/certificates/ @@ -123,7 +126,8 @@ services: replicas: ${REPLICA_COUNT_QM:-1} environment: - CLOUDBEAVER_DC_SERVER_URL=http://127.0.0.1:8970/dc - - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} + - NETWORK_MODE=host + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} -Dserver.address=127.0.0.1 volumes: - ./cert/public/:/opt/query-manager/conf/certificates/ - trusted_cacerts:/opt/query-manager/conf/certificates/custom/ @@ -138,7 +142,8 @@ services: replicas: ${REPLICA_COUNT_TM:-1} environment: - CLOUDBEAVER_DC_SERVER_URL=http://127.0.0.1:8970/dc - - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} + - NETWORK_MODE=host + - JAVA_TOOL_OPTIONS=${JAVA_TOOL_OPTIONS:-} -Dserver.address=127.0.0.1 volumes: - tm_data:/opt/task-manager/workspace - ./cert/public/:/opt/task-manager/conf/certificates/ From 2a1053876e75e3e05b7c34c8885e26a4f1fa141c Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Thu, 26 Feb 2026 16:22:42 +0100 Subject: [PATCH 14/24] dbeaver/dbeaver-devops#2465 Added listen_addresses=localhost in postgres iamage for NETWORK_MODE=host (#193) --- compose/cbte/docker-compose-nethost.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/compose/cbte/docker-compose-nethost.yml b/compose/cbte/docker-compose-nethost.yml index b96f7eb..dba1786 100644 --- a/compose/cbte/docker-compose-nethost.yml +++ b/compose/cbte/docker-compose-nethost.yml @@ -48,6 +48,7 @@ services: - POSTGRES_DB=cloudbeaver - POSTGRES_USER=${CLOUDBEAVER_DB_USER} - POSTGRES_PASSWORD=${CLOUDBEAVER_DB_PASSWORD} + - NETWORK_MODE=host network_mode: host cloudbeaver-dc: From 7fa0f3083bb334a674c67f26d997398357b84551 Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Tue, 3 Mar 2026 16:57:37 +0100 Subject: [PATCH 15/24] dbeaver/dbeaver-devops#2467 Fixed update with dbeaver-te (#192) * dbeaver/dbeaver-devops#2467 Fixed update with dbeaver-te --- manager/dbeaver-te | 60 +++++++++++++++++++++++++++----------- manager/install-manager.sh | 15 ++++------ 2 files changed, 49 insertions(+), 26 deletions(-) diff --git a/manager/dbeaver-te b/manager/dbeaver-te index d8216dd..7c6c5ca 100755 --- a/manager/dbeaver-te +++ b/manager/dbeaver-te @@ -39,6 +39,8 @@ done < "$TEAM_EDITION_COMPOSE_DIR/.env" TEAM_EDITION_TAG="$CLOUDBEAVER_VERSION_TAG" +COMPOSE_FILE="${COMPOSE_FILE:-docker-compose.yml}" + case $(uname -m) in "x86_64") @@ -221,7 +223,7 @@ startCloudbeaver() { if [ "$TEAM_EDITION_STATUS" == false ] then docker compose \ - -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + -f "$TEAM_EDITION_COMPOSE_DIR/$COMPOSE_FILE" \ --env-file "$TEAM_EDITION_COMPOSE_DIR/.env" \ --project-directory "$TEAM_EDITION_COMPOSE_DIR/" \ up -d \ @@ -249,7 +251,7 @@ startCloudbeaver() { stopCloudbeaver() { checkCloudBeaverStatus - docker compose -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" down + docker compose -f "$TEAM_EDITION_COMPOSE_DIR/$COMPOSE_FILE" down echo "DBeaver Team Edition Server stopped." } @@ -258,13 +260,22 @@ rollbackCloudBeaver() { BACKUP_VERSION="$2" docker compose \ - -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + -f "$TEAM_EDITION_COMPOSE_DIR/$COMPOSE_FILE" \ --env-file "$TEAM_EDITION_COMPOSE_DIR/.env" \ --project-directory "$TEAM_EDITION_COMPOSE_DIR/" \ down \ --remove-orphans - rsync -av --exclude='cert' --exclude='nginx' "$BACKUP_DIR/" "$TEAM_EDITION_BASE_DIR/" + cd "$TEAM_EDITION_BASE_DIR/" + git checkout --force "$BACKUP_VERSION" || { + echo "===============================================================================" + echo "Error: Failed to checkout version $BACKUP_VERSION." + echo "===============================================================================" + printSupportMessage + exit 1 + } + + rsync -av --exclude='cert' --exclude='nginx' "$BACKUP_DIR/" "$TEAM_EDITION_COMPOSE_DIR/" sed -i \ "s/CLOUDBEAVER_VERSION_TAG=$TEAM_EDITION_NEW_TAG/CLOUDBEAVER_VERSION_TAG=$BACKUP_VERSION/g" \ @@ -272,7 +283,7 @@ rollbackCloudBeaver() { export CLOUDBEAVER_VERSION_TAG=$BACKUP_VERSION docker compose \ - -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + -f "$TEAM_EDITION_COMPOSE_DIR/$COMPOSE_FILE" \ --env-file "$TEAM_EDITION_COMPOSE_DIR/.env" \ --project-directory "$TEAM_EDITION_COMPOSE_DIR/" \ up -d \ @@ -290,6 +301,9 @@ rollbackCloudBeaver() { sleep 1 done + echo -e "ERROR: Failed to start after rollback." + printSupportMessage + exit 1 } updateCloudbeaver() { @@ -337,7 +351,7 @@ updateCloudbeaver() { # Stop team-edition-deploy docker compose \ - -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + -f "$TEAM_EDITION_COMPOSE_DIR/$COMPOSE_FILE" \ --env-file "$TEAM_EDITION_COMPOSE_DIR/.env" \ --project-directory "$TEAM_EDITION_COMPOSE_DIR/" \ down \ @@ -345,9 +359,20 @@ updateCloudbeaver() { # Backup current configuration mkdir -p "$BACKUP_DIR" - rsync -av --exclude='cert' --exclude='nginx' "$TEAM_EDITION_COMPOSE_DIR/" "$BACKUP_DIR" - echo "Preveous team-edition-deploy configuration copied to $BACKUP_DIR" + rsync -av --exclude='cert' --exclude='nginx' "$TEAM_EDITION_COMPOSE_DIR/" "$BACKUP_DIR/" + echo "Previous team-edition-deploy configuration copied to $BACKUP_DIR" + git config user.name "DBeaver Support" + git config user.email "support@dbeaver.com" + + USER_BACKUP_BRANCH="user-backup/${TEAM_EDITION_TAG}_${TIMESTAMP}" + if [ -n "$(git status --porcelain)" ]; then + git checkout -b "$USER_BACKUP_BRANCH" + git add -A + git commit -m "Auto-backup before update from $TEAM_EDITION_TAG to $TEAM_EDITION_NEW_TAG" + echo "Your local changes have been saved in branch: $USER_BACKUP_BRANCH" + fi + # Checkout new version git checkout --force $TEAM_EDITION_NEW_TAG || { echo "===============================================================================" @@ -355,18 +380,18 @@ updateCloudbeaver() { echo "===============================================================================" rollbackCloudBeaver "$BACKUP_DIR" "$TEAM_EDITION_TAG" printSupportMessage + exit 1 } sed -i \ "s/CLOUDBEAVER_VERSION_TAG=$TEAM_EDITION_TAG/CLOUDBEAVER_VERSION_TAG=$TEAM_EDITION_NEW_TAG/g" \ "$TEAM_EDITION_COMPOSE_DIR/.env" export CLOUDBEAVER_VERSION_TAG=$TEAM_EDITION_NEW_TAG - - # Update docker-compose volumes - if [ "$DBEAVER_TEAM_EDITION_AMI" ]; then + # Update docker-compose volumes for AMI + if [ "$DBEAVER_TEAM_EDITION_AMI" ]; then "$HOME/.local/bin/dbeaver-compose-config-editor.py" \ - -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + -f "$TEAM_EDITION_COMPOSE_DIR/$COMPOSE_FILE" \ -e "$TEAM_EDITION_COMPOSE_DIR/.env" || { echo "===============================================================================" echo "Error: Failed to patch docker-compose.yml using dbeaver-compose-config-editor.py." @@ -379,7 +404,7 @@ updateCloudbeaver() { # Start team-edition-deploy with new version and check status docker compose \ - -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + -f "$TEAM_EDITION_COMPOSE_DIR/$COMPOSE_FILE" \ --env-file "$TEAM_EDITION_COMPOSE_DIR/.env" \ --project-directory "$TEAM_EDITION_COMPOSE_DIR/" \ up -d \ @@ -402,6 +427,7 @@ updateCloudbeaver() { echo -e "\nERROR: CloudBeaver failed to start. Rolling back to previous version..." rollbackCloudBeaver "$BACKUP_DIR" "$TEAM_EDITION_TAG" printSupportMessage + exit 1 fi } @@ -423,7 +449,7 @@ createBackup(){ if [ "$USE_EXTERNAL_DB" = false ]; then PG_SERVICE="postgres" DB_NAME="cloudbeaver" - docker exec $PROJECT_NAME-"$PG_SERVICE"-1 pg_dump $DB_NAME --username $CLOUDBEAVER_DB_USER --format c > $BACKUP_PATH/"$PG_SERVICE".backup + docker exec -e PGPASSWORD="$CLOUDBEAVER_DB_PASSWORD" $PROJECT_NAME-"$PG_SERVICE"-1 pg_dump -h localhost $DB_NAME --username $CLOUDBEAVER_DB_USER --format c > $BACKUP_PATH/"$PG_SERVICE".backup fi CERT_VOLUME_PATH="/opt/domain-controller/conf/certificates" @@ -471,7 +497,7 @@ restoreBackup(){ DB_BACKUP="$BACKUP_DIR/postgres.backup" if [ -f "$DB_BACKUP" ]; then echo "Restoring PostgreSQL database..." - docker exec -i $PROJECT_NAME-"postgres"-1 pg_restore --dbname cloudbeaver --username $CLOUDBEAVER_DB_USER --clean --if-exists < "$DB_BACKUP" + docker exec -i -e PGPASSWORD="$CLOUDBEAVER_DB_PASSWORD" $PROJECT_NAME-"postgres"-1 pg_restore -h localhost --dbname cloudbeaver --username $CLOUDBEAVER_DB_USER --clean --if-exists < "$DB_BACKUP" else echo "PostgreSQL backup file not found." printSupportMessage @@ -499,9 +525,9 @@ restoreBackup(){ fi rm -rf $TEMP_DIR - docker compose -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" down + docker compose -f "$TEAM_EDITION_COMPOSE_DIR/$COMPOSE_FILE" down docker compose \ - -f "$TEAM_EDITION_COMPOSE_DIR/docker-compose.yml" \ + -f "$TEAM_EDITION_COMPOSE_DIR/$COMPOSE_FILE" \ --env-file "$TEAM_EDITION_COMPOSE_DIR/.env" \ --project-directory "$TEAM_EDITION_COMPOSE_DIR/" \ up -d diff --git a/manager/install-manager.sh b/manager/install-manager.sh index 352e895..d24476e 100755 --- a/manager/install-manager.sh +++ b/manager/install-manager.sh @@ -2,25 +2,22 @@ set -e +SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd) INSTALL_DIR="$HOME/bin" -CURRENT_DIR=$(pwd) -mkdir -p "$INSTALL_DIR" -# Determine the actual base directory and compose directory -BASE_DIR=$(realpath "$CURRENT_DIR/..") -CBTE_DIR=$(realpath "$CURRENT_DIR/../compose/cbte") +BASE_DIR=$(realpath "$SCRIPT_DIR/..") +CBTE_DIR=$(realpath "$SCRIPT_DIR/../compose/cbte") + +mkdir -p "$INSTALL_DIR" -# Copy the script to install directory -cp "$CURRENT_DIR/dbeaver-te" "$INSTALL_DIR/dbeaver-te" +cp "$SCRIPT_DIR/dbeaver-te" "$INSTALL_DIR/dbeaver-te" chmod +x "$INSTALL_DIR/dbeaver-te" -# Replace the hardcoded paths with actual paths sed -i "s|^TEAM_EDITION_BASE_DIR=.*|TEAM_EDITION_BASE_DIR=\"$BASE_DIR\"|g" "$INSTALL_DIR/dbeaver-te" sed -i "s|^TEAM_EDITION_COMPOSE_DIR=.*|TEAM_EDITION_COMPOSE_DIR=\"$CBTE_DIR\"|g" "$INSTALL_DIR/dbeaver-te" if [[ ":$PATH:" != *":$INSTALL_DIR:"* ]]; then echo "export PATH=\"$INSTALL_DIR:\$PATH\"" >> ~/.bashrc - source ~/.bashrc fi echo "DBeaver Team Edition manager installed successfully!" From 088b538b204313a139ccb6d0513497971d59a9f2 Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Wed, 4 Mar 2026 17:07:23 +0100 Subject: [PATCH 16/24] dbeaver/dbeaver-devops#2480 Fixed environment KAFKA_CFG_CONTROLLER_QUORUM_VOTERS KAFKA_CFG_ADVERTISED_LISTENERS vars for kafka (#194) --- AWS/ecs-fargate/main.tf | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/AWS/ecs-fargate/main.tf b/AWS/ecs-fargate/main.tf index 8d6c5ae..576893c 100644 --- a/AWS/ecs-fargate/main.tf +++ b/AWS/ecs-fargate/main.tf @@ -308,7 +308,16 @@ resource "aws_ecs_task_definition" "kafka" { name = "${var.deployment_id}-kafka" image = "dbeaver/cloudbeaver-kafka:3.9" essential = true - environment = var.cloudbeaver-kafka-env + environment = concat(var.cloudbeaver-kafka-env, [ + { + name = "KAFKA_CFG_CONTROLLER_QUORUM_VOTERS" + value = "0@localhost:9093" + }, + { + name = "KAFKA_CFG_ADVERTISED_LISTENERS" + value = "PLAINTEXT://${var.deployment_id}-kafka:9092" + } + ]) logConfiguration = { logDriver = "awslogs" options = { From 26b3be9d9ff13590c6a6a140fa55714cefa77df9 Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Thu, 5 Mar 2026 15:16:15 +0100 Subject: [PATCH 17/24] dbeaver/dbeaver-devops#2499 Added image_source in AWS ECS deployment for services (#195) --- AWS/ecs-fargate/main.tf | 14 +++++++------- AWS/ecs-fargate/variables.tf.example | 6 ++++++ 2 files changed, 13 insertions(+), 7 deletions(-) diff --git a/AWS/ecs-fargate/main.tf b/AWS/ecs-fargate/main.tf index 576893c..a2971ee 100644 --- a/AWS/ecs-fargate/main.tf +++ b/AWS/ecs-fargate/main.tf @@ -225,7 +225,7 @@ resource "aws_ecs_task_definition" "dbeaver_db" { } container_definitions = jsonencode([{ name = "${var.deployment_id}-postgres" - image = "dbeaver/cloudbeaver-postgres:16" + image = "${var.image_source}/cloudbeaver-postgres:16" essential = true environment = var.cloudbeaver-db-env mountPoints = [{ @@ -306,7 +306,7 @@ resource "aws_ecs_task_definition" "kafka" { container_definitions = jsonencode([{ name = "${var.deployment_id}-kafka" - image = "dbeaver/cloudbeaver-kafka:3.9" + image = "${var.image_source}/cloudbeaver-kafka:3.9" essential = true environment = concat(var.cloudbeaver-kafka-env, [ { @@ -418,7 +418,7 @@ resource "aws_ecs_task_definition" "dbeaver_dc" { } container_definitions = jsonencode([{ name = "${var.deployment_id}-cloudbeaver-dc" - image = "dbeaver/cloudbeaver-dc:${var.dbeaver_te_version}" + image = "${var.image_source}/cloudbeaver-dc:${var.dbeaver_te_version}" essential = true environment = local.updated_cloudbeaver_dc_env mountPoints = [{ @@ -535,7 +535,7 @@ resource "aws_ecs_task_definition" "dbeaver_rm" { container_definitions = jsonencode([{ name = "${var.deployment_id}-cloudbeaver-rm" - image = "dbeaver/cloudbeaver-rm:${var.dbeaver_te_version}" + image = "${var.image_source}/cloudbeaver-rm:${var.dbeaver_te_version}" essential = true environment = local.cloudbeaver_shared_env_modified mountPoints = [{ @@ -638,7 +638,7 @@ resource "aws_ecs_task_definition" "dbeaver_qm" { } container_definitions = jsonencode([{ name = "${var.deployment_id}-cloudbeaver-qm" - image = "dbeaver/cloudbeaver-qm:${var.dbeaver_te_version}" + image = "${var.image_source}/cloudbeaver-qm:${var.dbeaver_te_version}" essential = true environment = local.cloudbeaver_shared_env_modified mountPoints = [ @@ -748,7 +748,7 @@ resource "aws_ecs_task_definition" "dbeaver_tm" { } container_definitions = jsonencode([{ name = "${var.deployment_id}-cloudbeaver-tm" - image = "dbeaver/cloudbeaver-tm:${var.dbeaver_te_version}" + image = "${var.image_source}/cloudbeaver-tm:${var.dbeaver_te_version}" essential = true environment = local.cloudbeaver_shared_env_modified mountPoints = [{ @@ -854,7 +854,7 @@ resource "aws_ecs_task_definition" "dbeaver_te" { } container_definitions = jsonencode([{ name = "${var.deployment_id}-cloudbeaver-te" - image = "dbeaver/cloudbeaver-te:${var.dbeaver_te_version}" + image = "${var.image_source}/cloudbeaver-te:${var.dbeaver_te_version}" essential = true environment = local.cloudbeaver_shared_env_modified mountPoints = [{ diff --git a/AWS/ecs-fargate/variables.tf.example b/AWS/ecs-fargate/variables.tf.example index 720ef47..d747959 100644 --- a/AWS/ecs-fargate/variables.tf.example +++ b/AWS/ecs-fargate/variables.tf.example @@ -16,6 +16,12 @@ variable "dbeaver_te_version" { default = "ea" } +variable "image_source" { + description = "Docker image source" + type = string + default = "dbeaver" +} + variable "alb_certificate_Identifier" { description = "Your certificate ID from AWS Certificate Manager" type = string From 2355db7416b03637cea60d5c381a184880eaac4b Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Fri, 6 Mar 2026 13:13:43 +0100 Subject: [PATCH 18/24] dbeaver/dbeaver-devops#2467 Added check for COMPOSE_FILE in env for ami (#196) --- manager/dbeaver-te | 5 +++++ manager/install-manager.sh | 1 + 2 files changed, 6 insertions(+) diff --git a/manager/dbeaver-te b/manager/dbeaver-te index 7c6c5ca..13887e8 100755 --- a/manager/dbeaver-te +++ b/manager/dbeaver-te @@ -39,6 +39,11 @@ done < "$TEAM_EDITION_COMPOSE_DIR/.env" TEAM_EDITION_TAG="$CLOUDBEAVER_VERSION_TAG" +if [ "$DBEAVER_TEAM_EDITION_AMI" ] && [ -z "$COMPOSE_FILE" ] && grep -q '127\.0\.0\.1' "$TEAM_EDITION_COMPOSE_DIR/.env"; then + echo "COMPOSE_FILE=docker-compose-nethost.yml" >> "$TEAM_EDITION_COMPOSE_DIR/.env" + export COMPOSE_FILE="docker-compose-nethost.yml" +fi + COMPOSE_FILE="${COMPOSE_FILE:-docker-compose.yml}" case $(uname -m) in diff --git a/manager/install-manager.sh b/manager/install-manager.sh index d24476e..00be84a 100755 --- a/manager/install-manager.sh +++ b/manager/install-manager.sh @@ -18,6 +18,7 @@ sed -i "s|^TEAM_EDITION_COMPOSE_DIR=.*|TEAM_EDITION_COMPOSE_DIR=\"$CBTE_DIR\"|g" if [[ ":$PATH:" != *":$INSTALL_DIR:"* ]]; then echo "export PATH=\"$INSTALL_DIR:\$PATH\"" >> ~/.bashrc + source ~/.bashrc fi echo "DBeaver Team Edition manager installed successfully!" From f789f766c8717baa7b334adaed55b4a458392d1c Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Tue, 10 Mar 2026 11:12:07 +0100 Subject: [PATCH 19/24] dbeaver/dbeaver-devops#2512 Updated devel to 26.1.0 (#198) --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index a47b741..7e7c50f 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ ## DBeaver Team Edition -#### Version 26.0 Early Access +#### Version 26.1 Early Access **Warning:** Please keep in mind that Early Access versions are not as stable as regular releases, and their use in a production environment is not recommended. @@ -62,6 +62,7 @@ To change an internal PostgreSQL password use [this instruction](CHANGEPWD.md#ho - [Early access](https://github.com/dbeaver/team-edition-deploy/tree/devel) ### Older versions: +- [26.0.0](https://github.com/dbeaver/team-edition-deploy/tree/26.0.0) - [25.3.0](https://github.com/dbeaver/team-edition-deploy/tree/25.3.0) - [25.2.0](https://github.com/dbeaver/team-edition-deploy/tree/25.2.0) - [25.1.0](https://github.com/dbeaver/team-edition-deploy/tree/25.1.0) From 2dac6f997a6331cc0d11c737916002f26b36685f Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Wed, 11 Mar 2026 09:46:27 +0100 Subject: [PATCH 20/24] dbeaver/dbeaver-devops#2518 Fixed networks in podman-compose.yml for web-proxy (#199) --- compose/cbte/podman-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose/cbte/podman-compose.yml b/compose/cbte/podman-compose.yml index a94d5b9..ec9025d 100644 --- a/compose/cbte/podman-compose.yml +++ b/compose/cbte/podman-compose.yml @@ -28,7 +28,7 @@ services: - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-dbeaver} - CLOUDBEAVER_WEB_SERVER_PORT=${CLOUDBEAVER_WEB_SERVER_PORT:-8978} networks: - - cloudbeaver-te-private-net + - cloudbeaver-te-common-net volumes: - nginx_conf_data:/etc/${PROXY_TYPE:-nginx}/product-conf/:z - nginx_ssl_data:/etc/${PROXY_TYPE:-nginx}/ssl/:z From 0bd5fa3518e42375e6898e51141b2e91cfa6c448 Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Mon, 27 Apr 2026 14:45:35 +0200 Subject: [PATCH 21/24] dbeaver/dbeaver-devops#2605 Added header description for proxy configuration (#201) --- compose/README.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/compose/README.md b/compose/README.md index a94c33e..ec43eb4 100644 --- a/compose/README.md +++ b/compose/README.md @@ -76,6 +76,20 @@ Example for proxy configuration: JAVA_TOOL_OPTIONS="-Dhttp.proxy.host= -Dhttps.proxy.host= -Dhttp.proxy.port= -Dhttps.proxy.port=" ``` +### Proxy configuration in front of Team Edition + +If you place your own reverse proxy in front of Team Edition instead of the bundled `web-proxy`, it must forward the following headers so the backend can resolve the correct public origin. + +The backend looks for the public origin in this order (first non-empty wins): + +- `Origin` — public URL the client used (`scheme://host[:port]`). +- `X-Origin` — fallback when `Origin` is absent. +- `Referer` — last-resort fallback. +- `X-Forwarded-Scheme` — original scheme (`http` / `https`). +- `X-Forwarded-Proto` — fallback for `X-Forwarded-Scheme` (`http` / `https`). +- `X-Forwarded-Host` — original host. If both the scheme and host above are set, they override `Origin` / `X-Origin` / `Referer`. +- `X-Forwarded-Port` — original port (only needed if it differs from 80/443). + ## Configuring and starting Team Edition cluster 1. Clone Git repository to your local machine by running the following command in your terminal: From 7f7f76508d1c1b4a162a56efc2d60134f014c67c Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Wed, 29 Apr 2026 11:34:52 +0200 Subject: [PATCH 22/24] Dbeaver devops#2197 aws ecs deployment improvements (#200) * dbeaver/dbeaver-devops#2197 Global refactoring AWS ECS deployment * dbeaver/dbeaver-devops#2197 Added optional creating ECS cluster in existing VPC * dbeaver/dbeaver-devops#2197 Fixed migration of old resources to new modules * dbeaver/dbeaver-devops#2197 Added removed old aws_route_table during mugration * dbeaver/dbeaver-devops#2197 Reverter remove * dbeaver/dbeaver-devops#2197 Fixed long destroying vpc * dbeaver/dbeaver-devops#2197 Removed rds vars * dbeaver/dbeaver-devops#2197 Created modules in AWS ECS deployment, added migration from flat deployment to modules * dbeaver/dbeaver-devops#2197 Added variable efs_encrypted and added warning about enabling encryption on existet EFS volumes * dbeaver/dbeaver-devops#2197 Added modules description --- AWS/ecs-fargate/README.md | 16 + AWS/ecs-fargate/alb.tf | 199 +--- AWS/ecs-fargate/aws-iam.tf | 118 --- AWS/ecs-fargate/ecs-cloudbeaver-dc.tf | 73 ++ AWS/ecs-fargate/ecs-cloudbeaver-qm.tf | 60 ++ AWS/ecs-fargate/ecs-cloudbeaver-rm.tf | 66 ++ AWS/ecs-fargate/ecs-cloudbeaver-te.tf | 62 ++ AWS/ecs-fargate/ecs-cloudbeaver-tm.tf | 66 ++ AWS/ecs-fargate/ecs-kafka.tf | 41 + AWS/ecs-fargate/ecs-postgres.tf | 45 + AWS/ecs-fargate/ecs.tf | 24 + AWS/ecs-fargate/efs.tf | 21 + AWS/ecs-fargate/iam.tf | 17 + AWS/ecs-fargate/locals.tf | 72 ++ AWS/ecs-fargate/main.tf | 923 ------------------ AWS/ecs-fargate/migration.tf | 363 +++++++ AWS/ecs-fargate/modules/alb-route/main.tf | 43 + AWS/ecs-fargate/modules/alb-route/outputs.tf | 4 + .../modules/alb-route/variables.tf | 61 ++ AWS/ecs-fargate/modules/alb/main.tf | 49 + AWS/ecs-fargate/modules/alb/outputs.tf | 24 + AWS/ecs-fargate/modules/alb/variables.tf | 47 + AWS/ecs-fargate/modules/ecs-cluster/main.tf | 24 + .../modules/ecs-cluster/outputs.tf | 14 + .../modules/ecs-cluster/variables.tf | 40 + AWS/ecs-fargate/modules/ecs-service/main.tf | 109 +++ .../modules/ecs-service/outputs.tf | 19 + .../modules/ecs-service/variables.tf | 150 +++ AWS/ecs-fargate/modules/efs-volume/main.tf | 41 + AWS/ecs-fargate/modules/efs-volume/outputs.tf | 28 + .../modules/efs-volume/variables.tf | 59 ++ AWS/ecs-fargate/modules/iam/main.tf | 126 +++ AWS/ecs-fargate/modules/iam/outputs.tf | 28 + AWS/ecs-fargate/modules/iam/variables.tf | 32 + AWS/ecs-fargate/modules/rds/main.tf | 28 + AWS/ecs-fargate/modules/rds/outputs.tf | 14 + AWS/ecs-fargate/modules/rds/variables.tf | 76 ++ AWS/ecs-fargate/modules/vpc/main.tf | 132 +++ AWS/ecs-fargate/modules/vpc/outputs.tf | 24 + AWS/ecs-fargate/modules/vpc/variables.tf | 24 + AWS/ecs-fargate/network.tf | 111 --- AWS/ecs-fargate/outputs.tf | 4 + AWS/ecs-fargate/providers.tf | 11 + AWS/ecs-fargate/rds.tf | 61 +- AWS/ecs-fargate/security-groups.tf | 132 ++- AWS/ecs-fargate/variables.tf.example | 46 +- AWS/ecs-fargate/versions.tf | 4 +- AWS/ecs-fargate/vpc.tf | 18 + 48 files changed, 2312 insertions(+), 1437 deletions(-) delete mode 100644 AWS/ecs-fargate/aws-iam.tf create mode 100644 AWS/ecs-fargate/ecs-cloudbeaver-dc.tf create mode 100644 AWS/ecs-fargate/ecs-cloudbeaver-qm.tf create mode 100644 AWS/ecs-fargate/ecs-cloudbeaver-rm.tf create mode 100644 AWS/ecs-fargate/ecs-cloudbeaver-te.tf create mode 100644 AWS/ecs-fargate/ecs-cloudbeaver-tm.tf create mode 100644 AWS/ecs-fargate/ecs-kafka.tf create mode 100644 AWS/ecs-fargate/ecs-postgres.tf create mode 100644 AWS/ecs-fargate/ecs.tf create mode 100644 AWS/ecs-fargate/efs.tf create mode 100644 AWS/ecs-fargate/iam.tf create mode 100644 AWS/ecs-fargate/locals.tf delete mode 100644 AWS/ecs-fargate/main.tf create mode 100644 AWS/ecs-fargate/migration.tf create mode 100644 AWS/ecs-fargate/modules/alb-route/main.tf create mode 100644 AWS/ecs-fargate/modules/alb-route/outputs.tf create mode 100644 AWS/ecs-fargate/modules/alb-route/variables.tf create mode 100644 AWS/ecs-fargate/modules/alb/main.tf create mode 100644 AWS/ecs-fargate/modules/alb/outputs.tf create mode 100644 AWS/ecs-fargate/modules/alb/variables.tf create mode 100644 AWS/ecs-fargate/modules/ecs-cluster/main.tf create mode 100644 AWS/ecs-fargate/modules/ecs-cluster/outputs.tf create mode 100644 AWS/ecs-fargate/modules/ecs-cluster/variables.tf create mode 100644 AWS/ecs-fargate/modules/ecs-service/main.tf create mode 100644 AWS/ecs-fargate/modules/ecs-service/outputs.tf create mode 100644 AWS/ecs-fargate/modules/ecs-service/variables.tf create mode 100644 AWS/ecs-fargate/modules/efs-volume/main.tf create mode 100644 AWS/ecs-fargate/modules/efs-volume/outputs.tf create mode 100644 AWS/ecs-fargate/modules/efs-volume/variables.tf create mode 100644 AWS/ecs-fargate/modules/iam/main.tf create mode 100644 AWS/ecs-fargate/modules/iam/outputs.tf create mode 100644 AWS/ecs-fargate/modules/iam/variables.tf create mode 100644 AWS/ecs-fargate/modules/rds/main.tf create mode 100644 AWS/ecs-fargate/modules/rds/outputs.tf create mode 100644 AWS/ecs-fargate/modules/rds/variables.tf create mode 100644 AWS/ecs-fargate/modules/vpc/main.tf create mode 100644 AWS/ecs-fargate/modules/vpc/outputs.tf create mode 100644 AWS/ecs-fargate/modules/vpc/variables.tf delete mode 100644 AWS/ecs-fargate/network.tf create mode 100644 AWS/ecs-fargate/outputs.tf create mode 100644 AWS/ecs-fargate/providers.tf create mode 100644 AWS/ecs-fargate/vpc.tf diff --git a/AWS/ecs-fargate/README.md b/AWS/ecs-fargate/README.md index 7c371df..a8691ab 100644 --- a/AWS/ecs-fargate/README.md +++ b/AWS/ecs-fargate/README.md @@ -75,3 +75,19 @@ git clone https://github.com/dbeaver/team-edition-deploy.git 2. Specify the desired version in `variables.tf` in the `dbeaver_te_version` variable. 3. Run `terraform apply` to upgrade the ECS cluster and complete the deployment. + + +## Modules description + +This deployment is built on self-contained parameterized Terraform modules. All modules are located in the local [`./modules/`](./modules/) folder, so every piece of infrastructure can be reviewed, customized and maintained. Root `*.tf` files only wire modules together and pass variables, resource definitions are kept inside the modules. + +- **alb** — Application Load Balancer with HTTP to HTTPS redirect and HTTPS listener. +- **alb-route** — Target group and listener rule for a single backend service. +- **ecs-cluster** — ECS cluster with Fargate capacity providers. +- **ecs-service** — Fargate task definition and ECS service, with optional EFS volumes and ALB target group. +- **efs-volume** — EFS file system, mount targets and optional access point. +- **iam** — ECS task and execution IAM roles with CloudWatch Logs and EFS access policies. +- **rds** — RDS instance and DB subnet group. +- **vpc** — VPC with public/private subnets, Internet Gateway, NAT Gateway and route tables. + +For customers who used the previous flat Terraform deployment, the [`migration.tf`](./migration.tf) file remaps the existing Terraform state to the new module layout, so `terraform apply` preserves the environment without losing data. \ No newline at end of file diff --git a/AWS/ecs-fargate/alb.tf b/AWS/ecs-fargate/alb.tf index e6e0de0..c6ecfbf 100644 --- a/AWS/ecs-fargate/alb.tf +++ b/AWS/ecs-fargate/alb.tf @@ -1,194 +1,19 @@ ################################################################################ -# ALB +# AWS ALB ################################################################################ -resource "aws_lb" "dbeaver_te_lb" { - name = "DBeaverTE-${var.deployment_id}-ALB" - internal = false - load_balancer_type = "application" - security_groups = [aws_security_group.dbeaver_alb.id] - subnets = aws_subnet.public_subnets[*].id - tags = { - env = var.deployment_id - } -} - - -# This resources must be edited if HTTPS not used -resource "aws_lb_listener" "dbeaver-te-listener" { - - load_balancer_arn = aws_lb.dbeaver_te_lb.arn - port = "80" - protocol = "HTTP" - - default_action { - type = "redirect" - - redirect { - port = "443" - protocol = "HTTPS" - status_code = "HTTP_301" - } - } -} - -# This resources must be edited if HTTPS not used -resource "aws_lb_listener" "dbeaver-te-listener-https" { - - load_balancer_arn = aws_lb.dbeaver_te_lb.arn - port = "443" - protocol = "HTTPS" - ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01" - certificate_arn = "arn:aws:acm:${var.aws_region}:${var.aws_account_id}:certificate/${var.alb_certificate_Identifier}" - - default_action { - type = "forward" - target_group_arn = aws_lb_target_group.dbeaver_te.arn - } -} +module "alb" { + source = "./modules/alb" -resource "aws_lb_listener_rule" "forward_to_service_uri_dc" { - listener_arn = aws_lb_listener.dbeaver-te-listener-https.arn - priority = 99 + name = "${local.name_prefix}-${var.deployment_id}-ALB" + deployment_id = var.deployment_id + vpc_id = local.vpc_id + public_subnets = local.public_subnets + security_group_ids = [aws_security_group.dbeaver_alb.id] + certificate_arn = "arn:aws:acm:${var.aws_region}:${var.aws_account_id}:certificate/${var.alb_certificate_Identifier}" + ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06" - condition { - path_pattern { - values = ["/dc*"] - } - } - - action { - type = "forward" - target_group_arn = aws_lb_target_group.dbeaver_dc.arn - } -} - -resource "aws_lb_listener_rule" "forward_to_service_uri_qm" { - listener_arn = aws_lb_listener.dbeaver-te-listener-https.arn - priority = 98 - - condition { - path_pattern { - values = ["/qm*"] - } - } - - action { - type = "forward" - target_group_arn = aws_lb_target_group.dbeaver_qm.arn - } -} - -resource "aws_lb_listener_rule" "forward_to_service_uri_rm" { - listener_arn = aws_lb_listener.dbeaver-te-listener-https.arn - priority = 97 - - condition { - path_pattern { - values = ["/rm*"] - } - } - - action { - type = "forward" - target_group_arn = aws_lb_target_group.dbeaver_rm.arn - } -} - - -resource "aws_lb_listener_rule" "forward_to_service_uri_tm" { - listener_arn = aws_lb_listener.dbeaver-te-listener-https.arn - priority = 94 - - condition { - path_pattern { - values = ["/tm*"] - } - } - - action { - type = "forward" - target_group_arn = aws_lb_target_group.dbeaver_tm.arn - } -} - - -resource "aws_lb_target_group" "dbeaver_dc" { - name = "DBeaverTE-${var.deployment_id}-dc" - port = 80 - protocol = "HTTP" - target_type = "ip" - vpc_id = aws_vpc.dbeaver_net.id - - health_check { - matcher = "200,302" - unhealthy_threshold = 7 - enabled = true - path = "/dc/health" - } -} - -resource "aws_lb_target_group" "dbeaver_te" { - name = "DBeaverTE-${var.deployment_id}" - port = 80 - protocol = "HTTP" - target_type = "ip" - vpc_id = aws_vpc.dbeaver_net.id - - health_check { - matcher = "200,302" - unhealthy_threshold = 10 - enabled = true - path = "/" - } - stickiness { - enabled = true - type = "lb_cookie" - cookie_duration = 86400 - } -} - -resource "aws_lb_target_group" "dbeaver_qm" { - name = "DBeaverTE-${var.deployment_id}-qm" - port = 80 - protocol = "HTTP" - target_type = "ip" - vpc_id = aws_vpc.dbeaver_net.id - - health_check { - matcher = "200,302" - unhealthy_threshold = 7 - enabled = true - path = "/qm/health" - } -} - -resource "aws_lb_target_group" "dbeaver_rm" { - name = "DBeaverTE-${var.deployment_id}-rm" - port = 80 - protocol = "HTTP" - target_type = "ip" - vpc_id = aws_vpc.dbeaver_net.id - - health_check { - matcher = "200,302" - unhealthy_threshold = 7 - enabled = true - path = "/rm/health" - } -} - -resource "aws_lb_target_group" "dbeaver_tm" { - name = "DBeaverTE-${var.deployment_id}-tm" - port = 80 - protocol = "HTTP" - target_type = "ip" - vpc_id = aws_vpc.dbeaver_net.id - - health_check { - matcher = "200,302" - unhealthy_threshold = 7 - enabled = true - path = "/tm/health" + tags = { + Env = var.deployment_id } } diff --git a/AWS/ecs-fargate/aws-iam.tf b/AWS/ecs-fargate/aws-iam.tf deleted file mode 100644 index 6d321ad..0000000 --- a/AWS/ecs-fargate/aws-iam.tf +++ /dev/null @@ -1,118 +0,0 @@ -data "aws_iam_policy_document" "assume_role_policy" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - - principals { - type = "Service" - identifiers = ["ecs-tasks.amazonaws.com"] - } - } -} - -resource "aws_iam_policy" "CloudbeaverTeamEditionEFSAccessPolicy" { - name = "DBeaverTE-${var.deployment_id}-CloudbeaverTeamEditionEFSAccessPolicy" - description = "Policy to allow access only to specific EFS resources for ${var.deployment_id} environment" - policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Effect = "Allow" - Action = [ - "elasticfilesystem:DescribeFileSystems", - "elasticfilesystem:DescribeMountTargets", - "elasticfilesystem:DescribeMountTargetSecurityGroups", - "elasticfilesystem:DescribeTags", - "elasticfilesystem:CreateMountTarget", - "elasticfilesystem:DeleteMountTarget", - "elasticfilesystem:ModifyMountTargetSecurityGroups", - "elasticfilesystem:ListTagsForResource", - "elasticfilesystem:TagResource", - "elasticfilesystem:UntagResource" - ] - Resource = [ - aws_efs_file_system.cloudbeaver_db_data.arn, - aws_efs_file_system.cloudbeaver_rm_data.arn, - aws_efs_file_system.cloudbeaver_tm_data.arn, - aws_efs_file_system.cloudbeaver_dc_data.arn - ] - }, - { - Effect = "Allow" - Action = [ - "elasticfilesystem:CreateTags", - "elasticfilesystem:DeleteTags", - "elasticfilesystem:DescribeFileSystemPolicy", - "elasticfilesystem:PutFileSystemPolicy" - ] - Resource = [ - aws_efs_file_system.cloudbeaver_db_data.arn, - aws_efs_file_system.cloudbeaver_rm_data.arn, - aws_efs_file_system.cloudbeaver_tm_data.arn, - aws_efs_file_system.cloudbeaver_dc_data.arn, - aws_efs_file_system.cloudbeaver_certificates.arn - ] - }, - { - "Effect": "Allow", - "Action": [ - "elasticfilesystem:ClientMount", - "elasticfilesystem:ClientWrite", - "elasticfilesystem:ClientRootAccess" - ], - "Resource": [ - "${aws_efs_file_system.cloudbeaver_certificates.arn}", - "${aws_efs_access_point.certs_public.arn}" - ] - }, - { - "Effect": "Allow", - "Action": "elasticfilesystem:DescribeAccessPoints", - "Resource": "*" - } - ] - }) - - depends_on = [ - aws_efs_file_system.cloudbeaver_db_data, - aws_efs_file_system.cloudbeaver_rm_data, - aws_efs_file_system.cloudbeaver_tm_data, - aws_efs_file_system.cloudbeaver_dc_data - ] -} - -resource "aws_iam_role" "ecsTaskExecutionRole" { - name = "DBeaverTE-${var.deployment_id}-ecsTaskExecutionRole" - assume_role_policy = "${data.aws_iam_policy_document.assume_role_policy.json}" -} - - - -resource "aws_iam_role_policy_attachment" "ecsTaskExecutionRole_policy" { - role = "${aws_iam_role.ecsTaskExecutionRole.name}" - policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy" -} - -resource "aws_iam_role_policy_attachment" "TeamEditionEFSAccessPolicy_attachment" { - role = "${aws_iam_role.ecsTaskExecutionRole.name}" - policy_arn = "${aws_iam_policy.CloudbeaverTeamEditionEFSAccessPolicy.arn}" -} -resource "aws_iam_role_policy_attachment" "logs_policy_attachment" { - role = "${aws_iam_role.ecsTaskExecutionRole.name}" - policy_arn = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess" -} - -resource "aws_iam_role" "ecs_task_role_exec" { - name = "DBeaverTE-${var.deployment_id}-ecsTaskRoleExec" - assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json -} - -resource "aws_iam_role_policy_attachment" "ecs_task_role_exec_ssm" { - role = aws_iam_role.ecs_task_role_exec.name - policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" -} - -resource "aws_iam_role_policy_attachment" "ecs_task_role_exec_logs" { - role = aws_iam_role.ecs_task_role_exec.name - policy_arn = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess" -} \ No newline at end of file diff --git a/AWS/ecs-fargate/ecs-cloudbeaver-dc.tf b/AWS/ecs-fargate/ecs-cloudbeaver-dc.tf new file mode 100644 index 0000000..cd62357 --- /dev/null +++ b/AWS/ecs-fargate/ecs-cloudbeaver-dc.tf @@ -0,0 +1,73 @@ +################################################################################ +# DBeaver TE DC +################################################################################ + +module "cloudbeaver_dc_route" { + source = "./modules/alb-route" + + name = "${local.name_prefix}-${var.deployment_id}-dc" + vpc_id = local.vpc_id + listener_arn = module.alb.https_listener_arn + path_pattern = "/dc*" + priority = 99 + health_check_path = "/dc/health" + + tags = { Env = var.deployment_id } +} + +module "cloudbeaver_dc" { + source = "./modules/ecs-service" + + name = "cloudbeaver-dc" + name_prefix = local.name_prefix + name_prefix_full = local.name_prefix_full + family_suffix = "dc" + deployment_id = var.deployment_id + image = "${var.image_source}/cloudbeaver-dc:${var.dbeaver_te_version}" + cpu = 1024 + memory = 2048 + container_port = 8970 + + execution_role_arn = module.iam.execution_role_arn + task_role_arn = module.iam.task_role_arn + environment = local.updated_cloudbeaver_dc_env + + efs_volumes = [ + { + name = "cloudbeaver_dc_data" + file_system_id = module.efs["dc_data"].file_system_id + root_directory = "/" + mount_path = "/opt/domain-controller/workspace" + }, + { + name = "cloudbeaver_certificates" + file_system_id = module.efs["certificates"].file_system_id + root_directory = "/" + transit_encryption = true + mount_path = "/opt/domain-controller/conf/certificates" + }, + { + name = "api_tokens" + file_system_id = module.efs["api_tokens"].file_system_id + root_directory = "/" + transit_encryption = true + mount_path = "/opt/domain-controller/conf/keys" + } + ] + + cluster_id = module.ecs_cluster.id + security_group_ids = [aws_security_group.dbeaver_te.id] + subnet_ids = local.private_subnets + service_connect_namespace_arn = aws_service_discovery_private_dns_namespace.dbeaver.arn + desired_count = var.desired_count["dc"] + enable_execute_command = true + + target_group_arn = module.cloudbeaver_dc_route.target_group_arn + + aws_region = var.aws_region + log_group_name = local.log_group_name + + tags = { Env = var.deployment_id } + + depends_on = [module.kafka, module.rds, module.postgres] +} diff --git a/AWS/ecs-fargate/ecs-cloudbeaver-qm.tf b/AWS/ecs-fargate/ecs-cloudbeaver-qm.tf new file mode 100644 index 0000000..c1a567a --- /dev/null +++ b/AWS/ecs-fargate/ecs-cloudbeaver-qm.tf @@ -0,0 +1,60 @@ +################################################################################ +# DBeaver TE QM +################################################################################ + +module "cloudbeaver_qm_route" { + source = "./modules/alb-route" + + name = "${local.name_prefix}-${var.deployment_id}-qm" + vpc_id = local.vpc_id + listener_arn = module.alb.https_listener_arn + path_pattern = "/qm*" + priority = 98 + health_check_path = "/qm/health" + + tags = { Env = var.deployment_id } +} + +module "cloudbeaver_qm" { + source = "./modules/ecs-service" + + name = "cloudbeaver-qm" + name_prefix = local.name_prefix + name_prefix_full = local.name_prefix_full + family_suffix = "qm" + deployment_id = var.deployment_id + image = "${var.image_source}/cloudbeaver-qm:${var.dbeaver_te_version}" + cpu = 1024 + memory = 2048 + container_port = 8972 + + execution_role_arn = module.iam.execution_role_arn + task_role_arn = module.iam.task_role_arn + environment = local.cloudbeaver_shared_env_modified + + efs_volumes = [ + { + name = "cloudbeaver_certificates_public" + file_system_id = module.efs["certificates"].file_system_id + access_point_id = module.efs["certificates"].access_point_id + mount_path = "/opt/query-manager/conf/certificates" + transit_encryption = true + } + ] + + cluster_id = module.ecs_cluster.id + security_group_ids = [aws_security_group.dbeaver_te.id] + subnet_ids = local.private_subnets + service_connect_namespace_arn = aws_service_discovery_private_dns_namespace.dbeaver.arn + desired_count = var.desired_count["qm"] + enable_execute_command = true + + target_group_arn = module.cloudbeaver_qm_route.target_group_arn + + aws_region = var.aws_region + log_group_name = local.log_group_name + + tags = { Env = var.deployment_id } + + depends_on = [module.cloudbeaver_dc] +} diff --git a/AWS/ecs-fargate/ecs-cloudbeaver-rm.tf b/AWS/ecs-fargate/ecs-cloudbeaver-rm.tf new file mode 100644 index 0000000..b743af0 --- /dev/null +++ b/AWS/ecs-fargate/ecs-cloudbeaver-rm.tf @@ -0,0 +1,66 @@ +################################################################################ +# DBeaver TE RM +################################################################################ + +module "cloudbeaver_rm_route" { + source = "./modules/alb-route" + + name = "${local.name_prefix}-${var.deployment_id}-rm" + vpc_id = local.vpc_id + listener_arn = module.alb.https_listener_arn + path_pattern = "/rm*" + priority = 97 + health_check_path = "/rm/health" + + tags = { Env = var.deployment_id } +} + +module "cloudbeaver_rm" { + source = "./modules/ecs-service" + + name = "cloudbeaver-rm" + name_prefix = local.name_prefix + name_prefix_full = local.name_prefix_full + family_suffix = "rm" + deployment_id = var.deployment_id + image = "${var.image_source}/cloudbeaver-rm:${var.dbeaver_te_version}" + cpu = 1024 + memory = 2048 + container_port = 8971 + + execution_role_arn = module.iam.execution_role_arn + task_role_arn = module.iam.task_role_arn + environment = local.cloudbeaver_shared_env_modified + + efs_volumes = [ + { + name = "cloudbeaver_rm_data" + file_system_id = module.efs["rm_data"].file_system_id + root_directory = "/" + mount_path = "/opt/resource-manager/workspace" + }, + { + name = "cloudbeaver_certificates_public" + file_system_id = module.efs["certificates"].file_system_id + access_point_id = module.efs["certificates"].access_point_id + mount_path = "/opt/resource-manager/conf/certificates" + transit_encryption = true + } + ] + + cluster_id = module.ecs_cluster.id + security_group_ids = [aws_security_group.dbeaver_te.id] + subnet_ids = local.private_subnets + service_connect_namespace_arn = aws_service_discovery_private_dns_namespace.dbeaver.arn + desired_count = var.desired_count["rm"] + enable_execute_command = true + + target_group_arn = module.cloudbeaver_rm_route.target_group_arn + + aws_region = var.aws_region + log_group_name = local.log_group_name + + tags = { Env = var.deployment_id } + + depends_on = [module.cloudbeaver_dc] +} diff --git a/AWS/ecs-fargate/ecs-cloudbeaver-te.tf b/AWS/ecs-fargate/ecs-cloudbeaver-te.tf new file mode 100644 index 0000000..a102208 --- /dev/null +++ b/AWS/ecs-fargate/ecs-cloudbeaver-te.tf @@ -0,0 +1,62 @@ +################################################################################ +# DBeaver TE CloudBeaver +################################################################################ + +module "cloudbeaver_te_route" { + source = "./modules/alb-route" + + name = "${local.name_prefix}-${var.deployment_id}" + vpc_id = local.vpc_id + listener_arn = module.alb.https_listener_arn + path_pattern = "/*" + priority = 200 + health_check_path = "/" + health_check_unhealthy_threshold = 10 + stickiness_enabled = true + + tags = { Env = var.deployment_id } +} + +module "cloudbeaver_te" { + source = "./modules/ecs-service" + + name = "cloudbeaver-te" + name_prefix = local.name_prefix + name_prefix_full = local.name_prefix_full + family_suffix = "te" + deployment_id = var.deployment_id + image = "${var.image_source}/cloudbeaver-te:${var.dbeaver_te_version}" + cpu = 4096 + memory = 8192 + container_port = 8978 + + execution_role_arn = module.iam.execution_role_arn + task_role_arn = module.iam.task_role_arn + environment = local.cloudbeaver_shared_env_modified + + efs_volumes = [ + { + name = "cloudbeaver_certificates_public" + file_system_id = module.efs["certificates"].file_system_id + access_point_id = module.efs["certificates"].access_point_id + mount_path = "/opt/cloudbeaver/conf/certificates" + transit_encryption = true + } + ] + + cluster_id = module.ecs_cluster.id + security_group_ids = [aws_security_group.dbeaver_te.id] + subnet_ids = local.private_subnets + service_connect_namespace_arn = aws_service_discovery_private_dns_namespace.dbeaver.arn + desired_count = var.desired_count["te"] + enable_execute_command = true + + target_group_arn = module.cloudbeaver_te_route.target_group_arn + + aws_region = var.aws_region + log_group_name = local.log_group_name + + tags = { Env = var.deployment_id } + + depends_on = [module.cloudbeaver_dc, module.cloudbeaver_qm, module.cloudbeaver_rm] +} diff --git a/AWS/ecs-fargate/ecs-cloudbeaver-tm.tf b/AWS/ecs-fargate/ecs-cloudbeaver-tm.tf new file mode 100644 index 0000000..d6b9728 --- /dev/null +++ b/AWS/ecs-fargate/ecs-cloudbeaver-tm.tf @@ -0,0 +1,66 @@ +################################################################################ +# DBeaver TE TM +################################################################################ + +module "cloudbeaver_tm_route" { + source = "./modules/alb-route" + + name = "${local.name_prefix}-${var.deployment_id}-tm" + vpc_id = local.vpc_id + listener_arn = module.alb.https_listener_arn + path_pattern = "/tm*" + priority = 94 + health_check_path = "/tm/health" + + tags = { Env = var.deployment_id } +} + +module "cloudbeaver_tm" { + source = "./modules/ecs-service" + + name = "cloudbeaver-tm" + name_prefix = local.name_prefix + name_prefix_full = local.name_prefix_full + family_suffix = "tm" + deployment_id = var.deployment_id + image = "${var.image_source}/cloudbeaver-tm:${var.dbeaver_te_version}" + cpu = 2048 + memory = 4096 + container_port = 8973 + + execution_role_arn = module.iam.execution_role_arn + task_role_arn = module.iam.task_role_arn + environment = local.cloudbeaver_shared_env_modified + + efs_volumes = [ + { + name = "cloudbeaver_tm_data" + file_system_id = module.efs["tm_data"].file_system_id + root_directory = "/" + mount_path = "/opt/task-manager/workspace" + }, + { + name = "cloudbeaver_certificates_public" + file_system_id = module.efs["certificates"].file_system_id + access_point_id = module.efs["certificates"].access_point_id + mount_path = "/opt/task-manager/conf/certificates" + transit_encryption = true + } + ] + + cluster_id = module.ecs_cluster.id + security_group_ids = [aws_security_group.dbeaver_te.id] + subnet_ids = local.private_subnets + service_connect_namespace_arn = aws_service_discovery_private_dns_namespace.dbeaver.arn + desired_count = var.desired_count["tm"] + enable_execute_command = true + + target_group_arn = module.cloudbeaver_tm_route.target_group_arn + + aws_region = var.aws_region + log_group_name = local.log_group_name + + tags = { Env = var.deployment_id } + + depends_on = [module.cloudbeaver_dc] +} diff --git a/AWS/ecs-fargate/ecs-kafka.tf b/AWS/ecs-fargate/ecs-kafka.tf new file mode 100644 index 0000000..8f8a421 --- /dev/null +++ b/AWS/ecs-fargate/ecs-kafka.tf @@ -0,0 +1,41 @@ +################################################################################ +# Kafka +################################################################################ + +module "kafka" { + source = "./modules/ecs-service" + + name = "kafka" + name_prefix = local.name_prefix + name_prefix_full = local.name_prefix_full + deployment_id = var.deployment_id + image = "${var.image_source}/cloudbeaver-kafka:3.9" + cpu = 2048 + memory = 4096 + container_port = 9092 + + execution_role_arn = module.iam.execution_role_arn + + environment = concat(var.cloudbeaver-kafka-env, [ + { + name = "KAFKA_CFG_CONTROLLER_QUORUM_VOTERS" + value = "0@localhost:9093" + }, + { + name = "KAFKA_CFG_ADVERTISED_LISTENERS" + value = "PLAINTEXT://${var.deployment_id}-kafka:9092" + } + ]) + + cluster_id = module.ecs_cluster.id + security_group_ids = [aws_security_group.dbeaver_te_private.id] + subnet_ids = local.private_subnets + service_connect_namespace_arn = aws_service_discovery_private_dns_namespace.dbeaver.arn + desired_count = 1 + enable_execute_command = false + + aws_region = var.aws_region + log_group_name = local.log_group_name + + tags = { Env = var.deployment_id } +} diff --git a/AWS/ecs-fargate/ecs-postgres.tf b/AWS/ecs-fargate/ecs-postgres.tf new file mode 100644 index 0000000..ea0fc55 --- /dev/null +++ b/AWS/ecs-fargate/ecs-postgres.tf @@ -0,0 +1,45 @@ +################################################################################ +# Postgres (container-based, disabled when var.rds_db = true) +################################################################################ + +module "postgres" { + source = "./modules/ecs-service" + count = var.rds_db ? 0 : 1 + + name = "postgres" + name_prefix = local.name_prefix + name_prefix_full = local.name_prefix_full + family_suffix = "db" + log_prefix = "db" + deployment_id = var.deployment_id + container_name_override = "${var.deployment_id}-postgres" + image = "${var.image_source}/cloudbeaver-postgres:16" + cpu = 256 + memory = 512 + container_port = 5432 + + execution_role_arn = module.iam.execution_role_arn + + environment = var.cloudbeaver-db-env + + efs_volumes = [ + { + name = "cloudbeaver_db_data" + file_system_id = module.efs["db_data"].file_system_id + root_directory = "/" + mount_path = "/var/lib/postgresql/data" + } + ] + + cluster_id = module.ecs_cluster.id + security_group_ids = [aws_security_group.dbeaver_te_private.id] + subnet_ids = local.private_subnets + service_connect_namespace_arn = aws_service_discovery_private_dns_namespace.dbeaver.arn + desired_count = 1 + enable_execute_command = false + + aws_region = var.aws_region + log_group_name = local.log_group_name + + tags = { Env = var.deployment_id } +} diff --git a/AWS/ecs-fargate/ecs.tf b/AWS/ecs-fargate/ecs.tf new file mode 100644 index 0000000..43ed915 --- /dev/null +++ b/AWS/ecs-fargate/ecs.tf @@ -0,0 +1,24 @@ +################################################################################ +# ECS Cluster +################################################################################ + +module "ecs_cluster" { + source = "./modules/ecs-cluster" + + name = "${local.name_prefix_full}-${var.deployment_id}" + + capacity_providers = ["FARGATE"] + default_capacity_provider = "FARGATE" + default_capacity_provider_base = 1 + default_capacity_provider_weight = 1 + + tags = { + Env = var.deployment_id + } +} + +resource "aws_service_discovery_private_dns_namespace" "dbeaver" { + name = "${var.deployment_id}-${var.dbeaver_te_default_ns}" + description = "DBeaver SD Namespace" + vpc = local.vpc_id +} diff --git a/AWS/ecs-fargate/efs.tf b/AWS/ecs-fargate/efs.tf new file mode 100644 index 0000000..c75f2b3 --- /dev/null +++ b/AWS/ecs-fargate/efs.tf @@ -0,0 +1,21 @@ +################################################################################ +# EFS Volumes +################################################################################ + +module "efs" { + source = "./modules/efs-volume" + for_each = local.efs_volumes + + name = each.value.name + deployment_id = var.deployment_id + name_prefix = local.name_prefix + subnet_ids = local.private_subnets + security_group_ids = [aws_security_group.dbeaver_efs.id] + encrypted = var.efs_encrypted + + access_point = lookup(each.value, "access_point", null) + + tags = { + Env = var.deployment_id + } +} diff --git a/AWS/ecs-fargate/iam.tf b/AWS/ecs-fargate/iam.tf new file mode 100644 index 0000000..7223d57 --- /dev/null +++ b/AWS/ecs-fargate/iam.tf @@ -0,0 +1,17 @@ +################################################################################ +# IAM Roles +################################################################################ + +module "iam" { + source = "./modules/iam" + + deployment_id = var.deployment_id + name_prefix = local.name_prefix + name_prefix_full = local.name_prefix_full + efs_arns = [for k, v in module.efs : v.file_system_arn] + efs_ap_arns = compact([for k, v in module.efs : v.access_point_arn != null ? v.access_point_arn : ""]) + + tags = { + Env = var.deployment_id + } +} diff --git a/AWS/ecs-fargate/locals.tf b/AWS/ecs-fargate/locals.tf new file mode 100644 index 0000000..8d65b69 --- /dev/null +++ b/AWS/ecs-fargate/locals.tf @@ -0,0 +1,72 @@ +locals { + name_prefix = "DBeaverTE" + name_prefix_full = "DBeaverTeamEdition" + + vpc_id = var.create_vpc ? module.vpc[0].vpc_id : var.vpc_id + public_subnets = var.create_vpc ? module.vpc[0].public_subnets : var.public_subnet_ids + private_subnets = var.create_vpc ? module.vpc[0].private_subnets : var.private_subnet_ids + + log_group_name = "${local.name_prefix_full}-${var.deployment_id}" + + rds_db_url = var.rds_db ? "jdbc:postgresql://${module.rds[0].db_instance_address}:5432/cloudbeaver" : "" + + efs_volumes = { + db_data = { name = "cloudbeaver_db_data" } + rm_data = { name = "cloudbeaver_rm_data" } + tm_data = { name = "cloudbeaver_tm_data" } + dc_data = { name = "cloudbeaver_dc_data" } + certificates = { + name = "cloudbeaver_certificates" + access_point = { + path = "/public" + owner_uid = 8978 + owner_gid = 8978 + permissions = "0755" + } + } + api_tokens = { name = "api_tokens" } + } + + cloudbeaver_dc_env_modified = [ + for item in var.cloudbeaver-dc-env : { + name = item.name + value = ( + item.name == "CLOUDBEAVER_DC_BACKEND_DB_URL" ? (var.rds_db ? local.rds_db_url : format("jdbc:postgresql://%s-postgres:5432/cloudbeaver", var.deployment_id)) : + item.name == "CLOUDBEAVER_QM_BACKEND_DB_URL" ? (var.rds_db ? local.rds_db_url : format("jdbc:postgresql://%s-postgres:5432/cloudbeaver", var.deployment_id)) : + item.name == "CLOUDBEAVER_TM_BACKEND_DB_URL" ? (var.rds_db ? local.rds_db_url : format("jdbc:postgresql://%s-postgres:5432/cloudbeaver", var.deployment_id)) : + item.name == "CLOUDBEAVER_DC_SERVER_URL" ? format("http://%s-cloudbeaver-dc:8970/dc", var.deployment_id) : + item.name == "CLOUDBEAVER_QM_SERVER_URL" ? format("http://%s-cloudbeaver-qm:8972/qm", var.deployment_id) : + item.name == "CLOUDBEAVER_RM_SERVER_URL" ? format("http://%s-cloudbeaver-rm:8971/rm", var.deployment_id) : + item.name == "CLOUDBEAVER_TM_SERVER_URL" ? format("http://%s-cloudbeaver-tm:8973/tm", var.deployment_id) : + item.name == "CLOUDBEAVER_KAFKA_BROKERS" ? format("%s-kafka:9092", var.deployment_id) : + item.value + ) + } + ] + + cloudbeaver_shared_env_modified = [ + for item in var.cloudbeaver-shared-env : { + name = item.name + value = ( + item.name == "CLOUDBEAVER_DC_SERVER_URL" ? format("http://%s-cloudbeaver-dc:8970/dc", var.deployment_id) : + item.value + ) + } + ] + + postgres_password = { for item in var.cloudbeaver-db-env : item.name => item.value }["POSTGRES_PASSWORD"] + postgres_user = { for item in var.cloudbeaver-db-env : item.name => item.value }["POSTGRES_USER"] + + updated_cloudbeaver_dc_env = [for item in local.cloudbeaver_dc_env_modified : { + name = item.name + value = ( + item.name == "CLOUDBEAVER_DC_BACKEND_DB_PASSWORD" ? local.postgres_password : + item.name == "CLOUDBEAVER_QM_BACKEND_DB_PASSWORD" ? local.postgres_password : + item.name == "CLOUDBEAVER_TM_BACKEND_DB_PASSWORD" ? local.postgres_password : + item.name == "CLOUDBEAVER_DC_BACKEND_DB_USER" ? local.postgres_user : + item.name == "CLOUDBEAVER_QM_BACKEND_DB_USER" ? local.postgres_user : + item.name == "CLOUDBEAVER_TM_BACKEND_DB_USER" ? local.postgres_user : + item.value + ) + }] +} diff --git a/AWS/ecs-fargate/main.tf b/AWS/ecs-fargate/main.tf deleted file mode 100644 index a2971ee..0000000 --- a/AWS/ecs-fargate/main.tf +++ /dev/null @@ -1,923 +0,0 @@ -provider "aws" { - region = var.aws_region -} - -resource "aws_ecs_cluster" "dbeaver_te" { - name = "DBeaverTeamEdition-${var.deployment_id}" -} - -locals { - - rds_db_url = length(aws_db_instance.rds_dbeaver_db) > 0 ? "jdbc:postgresql://${try(aws_db_instance.rds_dbeaver_db[0].address, "")}:5432/cloudbeaver" : "" - - cloudbeaver_dc_env_modified = [ - for item in var.cloudbeaver-dc-env : { - name = item.name - value = ( - item.name == "CLOUDBEAVER_DC_BACKEND_DB_URL" ? (var.rds_db ? local.rds_db_url : format("jdbc:postgresql://%s-postgres:5432/cloudbeaver", var.deployment_id)) : - item.name == "CLOUDBEAVER_QM_BACKEND_DB_URL" ? (var.rds_db ? local.rds_db_url : format("jdbc:postgresql://%s-postgres:5432/cloudbeaver", var.deployment_id)) : - item.name == "CLOUDBEAVER_TM_BACKEND_DB_URL" ? (var.rds_db ? local.rds_db_url : format("jdbc:postgresql://%s-postgres:5432/cloudbeaver", var.deployment_id)) : - item.name == "CLOUDBEAVER_DC_SERVER_URL" ? format("http://%s-cloudbeaver-dc:8970/dc", var.deployment_id) : - item.name == "CLOUDBEAVER_QM_SERVER_URL" ? format("http://%s-cloudbeaver-qm:8972/qm", var.deployment_id) : - item.name == "CLOUDBEAVER_RM_SERVER_URL" ? format("http://%s-cloudbeaver-rm:8971/rm", var.deployment_id) : - item.name == "CLOUDBEAVER_TM_SERVER_URL" ? format("http://%s-cloudbeaver-tm:8973/tm", var.deployment_id) : - item.name == "CLOUDBEAVER_KAFKA_BROKERS" ? format("http://%s-kafka:9092", var.deployment_id) : - item.value - ) - } - ] - - cloudbeaver_shared_env_modified = [ - for item in var.cloudbeaver-shared-env : { - name = item.name - value = ( - item.name == "CLOUDBEAVER_DC_SERVER_URL" ? format("http://%s-cloudbeaver-dc:8970/dc", var.deployment_id) : - item.value - ) - } - ] - - postgres_password = { for item in var.cloudbeaver-db-env : item.name => item.value }["POSTGRES_PASSWORD"] - postgres_user = { for item in var.cloudbeaver-db-env : item.name => item.value }["POSTGRES_USER"] - - updated_cloudbeaver_dc_env = [for item in local.cloudbeaver_dc_env_modified : { - name = item.name - value = ( - item.name == "CLOUDBEAVER_DC_BACKEND_DB_PASSWORD" ? local.postgres_password : - item.name == "CLOUDBEAVER_QM_BACKEND_DB_PASSWORD" ? local.postgres_password : - item.name == "CLOUDBEAVER_TM_BACKEND_DB_PASSWORD" ? local.postgres_password : - item.name == "CLOUDBEAVER_DC_BACKEND_DB_USER" ? local.postgres_user : - item.name == "CLOUDBEAVER_QM_BACKEND_DB_USER" ? local.postgres_user : - item.name == "CLOUDBEAVER_TM_BACKEND_DB_USER" ? local.postgres_user : - item.value - ) - }] -} - - -################################################################################ -# Namespace -################################################################################ - -resource "aws_service_discovery_private_dns_namespace" "dbeaver" { - name = "${var.deployment_id}-${var.dbeaver_te_default_ns}" - description = "DBeaver SD Namespace" - vpc = aws_vpc.dbeaver_net.id -} - - -################################################################################ -# EFS -################################################################################ - -resource "aws_efs_file_system" "cloudbeaver_db_data" { - creation_token = "${var.deployment_id}-cloudbeaver_db_data" - performance_mode = "generalPurpose" - throughput_mode = "bursting" - encrypted = "false" - tags = { - Env = var.deployment_id - Name = "DBeaver TE DATA EFS" - } -} - -resource "aws_efs_mount_target" "cloudbeaver_db_data_mt" { - count = length(aws_subnet.private_subnets) - file_system_id = aws_efs_file_system.cloudbeaver_db_data.id - subnet_id = aws_subnet.private_subnets[count.index].id - security_groups = [aws_security_group.dbeaver_efs.id] -} - -resource "aws_efs_file_system" "cloudbeaver_rm_data" { - creation_token = "${var.deployment_id}-cloudbeaver_rm_data" - performance_mode = "generalPurpose" - throughput_mode = "bursting" - encrypted = "false" - tags = { - Env = var.deployment_id - Name = "DBeaver TE RM DATA EFS" - } -} - -resource "aws_efs_mount_target" "cloudbeaver_rm_data_mt" { - count = length(aws_subnet.private_subnets) - file_system_id = aws_efs_file_system.cloudbeaver_rm_data.id - subnet_id = aws_subnet.private_subnets[count.index].id - security_groups = [aws_security_group.dbeaver_efs.id] -} - -resource "aws_efs_file_system" "cloudbeaver_tm_data" { - creation_token = "${var.deployment_id}-cloudbeaver_tm_data" - performance_mode = "generalPurpose" - throughput_mode = "bursting" - encrypted = "false" - tags = { - Env = var.deployment_id - Name = "DBeaver TE TM DATA EFS" - } -} - -resource "aws_efs_mount_target" "cloudbeaver_tm_data_mt" { - count = length(aws_subnet.private_subnets) - file_system_id = aws_efs_file_system.cloudbeaver_tm_data.id - subnet_id = aws_subnet.private_subnets[count.index].id - security_groups = [aws_security_group.dbeaver_efs.id] -} - -resource "aws_efs_file_system" "cloudbeaver_dc_data" { - creation_token = "${var.deployment_id}-cloudbeaver_dc_data" - performance_mode = "generalPurpose" - throughput_mode = "bursting" - encrypted = "false" - tags = { - Env = var.deployment_id - Name = "DBeaver TE DC DATA EFS" - } -} - -resource "aws_efs_mount_target" "cloudbeaver_dc_data_mt" { - count = length(aws_subnet.private_subnets) - file_system_id = aws_efs_file_system.cloudbeaver_dc_data.id - subnet_id = aws_subnet.private_subnets[count.index].id - security_groups = [aws_security_group.dbeaver_efs.id] -} - -resource "aws_efs_file_system" "cloudbeaver_certificates" { - creation_token = "${var.deployment_id}-cloudbeaver_certificates" - performance_mode = "generalPurpose" - throughput_mode = "bursting" - encrypted = "false" - tags = { - Env = var.deployment_id - Name = "DBeaver TE CERTIFICATES EFS" - } -} - -resource "aws_efs_access_point" "certs_public" { - file_system_id = aws_efs_file_system.cloudbeaver_certificates.id - root_directory { - path = "/public" - - creation_info { - owner_uid = 8978 - owner_gid = 8978 - permissions = "0755" - } - } - - posix_user { - uid = 8978 - gid = 8978 - } - - tags = { - Env = var.deployment_id - Name = "DBeaver TE PUBLIC CERTIFICATES MOUNTPOINT EFS" - } -} - -resource "aws_efs_file_system" "api_tokens" { - creation_token = "${var.deployment_id}-api_tokens" - performance_mode = "generalPurpose" - throughput_mode = "bursting" - encrypted = "false" - tags = { - Env = var.deployment_id - Name = "DBeaver TE API TOKENS EFS" - } -} -resource "aws_efs_mount_target" "cloudbeaver_certificates_mt" { - count = length(aws_subnet.private_subnets) - file_system_id = aws_efs_file_system.cloudbeaver_certificates.id - subnet_id = aws_subnet.private_subnets[count.index].id - security_groups = [aws_security_group.dbeaver_efs.id] -} - -resource "aws_efs_mount_target" "api_tokens_mt" { - count = length(aws_subnet.private_subnets) - file_system_id = aws_efs_file_system.api_tokens.id - subnet_id = aws_subnet.private_subnets[count.index].id - security_groups = [aws_security_group.dbeaver_efs.id] -} - -################################################################################ -# Postgres -################################################################################ - -resource "aws_ecs_task_definition" "dbeaver_db" { - - depends_on = [ - aws_ecs_cluster.dbeaver_te - ] - count = var.rds_db ? 0 : 1 - family = "DBeaverTeamEdition-${var.deployment_id}-db" - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - cpu = 256 - memory = 512 - execution_role_arn = aws_iam_role.ecsTaskExecutionRole.arn - volume { - name = "${var.deployment_id}-cloudbeaver_db_data" - efs_volume_configuration { - file_system_id = aws_efs_file_system.cloudbeaver_db_data.id - root_directory = "/" - } - } - container_definitions = jsonencode([{ - name = "${var.deployment_id}-postgres" - image = "${var.image_source}/cloudbeaver-postgres:16" - essential = true - environment = var.cloudbeaver-db-env - mountPoints = [{ - "containerPath": "/var/lib/postgresql/data", - "sourceVolume": "${var.deployment_id}-cloudbeaver_db_data" - }] - logConfiguration = { - "logDriver": "awslogs" - "options": { - "awslogs-group": "DBeaverTeamEdition-${var.deployment_id}", - "awslogs-region": "${var.aws_region}", - "awslogs-create-group": "true", - "awslogs-stream-prefix": "db" - } - } - portMappings = [{ - name = "${var.deployment_id}-postgres" - protocol = "tcp" - containerPort = 5432 - hostPort = 5432 - }] - }]) -} - -resource "aws_ecs_service" "postgres" { - - depends_on = [ - aws_ecs_task_definition.dbeaver_db[0], - aws_security_group.dbeaver_te_private - ] - count = var.rds_db ? 0 : 1 - name = "${var.deployment_id}-postgres" - cluster = aws_ecs_cluster.dbeaver_te.id - task_definition = aws_ecs_task_definition.dbeaver_db[0].arn - launch_type = "FARGATE" - desired_count = 1 - - network_configuration { - security_groups = [aws_security_group.dbeaver_te_private.id] - subnets = aws_subnet.private_subnets[*].id - assign_public_ip = false - } - service_connect_configuration { - enabled = true - namespace = aws_service_discovery_private_dns_namespace.dbeaver.arn - service { - port_name = "${var.deployment_id}-postgres" - client_alias { - dns_name = "${var.deployment_id}-postgres" - port = 5432 - } - - } - } - - tags = { - Env = var.deployment_id - Name = "DBeaver TE DC DATA EFS" - } -} - -################################################################################ -# Kafka -################################################################################ - -resource "aws_ecs_task_definition" "kafka" { - - depends_on = [ - aws_ecs_cluster.dbeaver_te - ] - - family = "DBeaverTeamEdition-${var.deployment_id}-kafka" - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - cpu = 2048 - memory = 4096 - execution_role_arn = aws_iam_role.ecsTaskExecutionRole.arn - - container_definitions = jsonencode([{ - name = "${var.deployment_id}-kafka" - image = "${var.image_source}/cloudbeaver-kafka:3.9" - essential = true - environment = concat(var.cloudbeaver-kafka-env, [ - { - name = "KAFKA_CFG_CONTROLLER_QUORUM_VOTERS" - value = "0@localhost:9093" - }, - { - name = "KAFKA_CFG_ADVERTISED_LISTENERS" - value = "PLAINTEXT://${var.deployment_id}-kafka:9092" - } - ]) - logConfiguration = { - logDriver = "awslogs" - options = { - awslogs-group = "DBeaverTeamEdition-${var.deployment_id}" - awslogs-region = "${var.aws_region}" - awslogs-create-group = "true" - awslogs-stream-prefix = "kafka" - } - } - portMappings = [{ - name = "${var.deployment_id}-kafka" - protocol = "tcp" - containerPort = 9092 - hostPort = 9092 - }] - }]) -} - -resource "aws_ecs_service" "kafka" { - - depends_on = [ - aws_ecs_task_definition.kafka, - aws_security_group.dbeaver_te_private - ] - - name = "${var.deployment_id}-kafka" - cluster = aws_ecs_cluster.dbeaver_te.id - task_definition = aws_ecs_task_definition.kafka.arn - launch_type = "FARGATE" - desired_count = 1 - - network_configuration { - security_groups = [aws_security_group.dbeaver_te_private.id] - subnets = aws_subnet.private_subnets[*].id - assign_public_ip = false - } - service_connect_configuration { - enabled = true - namespace = aws_service_discovery_private_dns_namespace.dbeaver.arn - service { - port_name = "${var.deployment_id}-kafka" - client_alias { - dns_name = "${var.deployment_id}-kafka" - port = 9092 - } - - } - } - tags = { - Env = var.deployment_id - Name = "DBeaverTeamEdition-kafka" - } -} - - - -################################################################################ -# DBeaver TE DC -################################################################################ - - -resource "aws_ecs_task_definition" "dbeaver_dc" { - - depends_on = [ - aws_ecs_cluster.dbeaver_te - ] - - family = "DBeaverTeamEdition-${var.deployment_id}-dc" - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - cpu = 1024 - memory = 2048 - execution_role_arn = aws_iam_role.ecsTaskExecutionRole.arn - task_role_arn = aws_iam_role.ecs_task_role_exec.arn - - volume { - name = "${var.deployment_id}-cloudbeaver_dc_data" - efs_volume_configuration { - file_system_id = aws_efs_file_system.cloudbeaver_dc_data.id - root_directory = "/" - } - } - volume { - name = "${var.deployment_id}-cloudbeaver_certificates" - efs_volume_configuration { - file_system_id = aws_efs_file_system.cloudbeaver_certificates.id - root_directory = "/" - transit_encryption = "ENABLED" - } - } - volume { - name = "${var.deployment_id}-api_tokens" - efs_volume_configuration { - file_system_id = aws_efs_file_system.api_tokens.id - root_directory = "/" - transit_encryption = "ENABLED" - } - } - container_definitions = jsonencode([{ - name = "${var.deployment_id}-cloudbeaver-dc" - image = "${var.image_source}/cloudbeaver-dc:${var.dbeaver_te_version}" - essential = true - environment = local.updated_cloudbeaver_dc_env - mountPoints = [{ - containerPath = "/opt/domain-controller/workspace" - sourceVolume = "${var.deployment_id}-cloudbeaver_dc_data" - }, - { - containerPath = "/opt/domain-controller/conf/certificates" - sourceVolume = "${var.deployment_id}-cloudbeaver_certificates" - }, - { - containerPath = "/opt/domain-controller/conf/keys" - sourceVolume = "${var.deployment_id}-api_tokens" - } - ] - logConfiguration = { - logDriver = "awslogs" - options = { - awslogs-group = "DBeaverTeamEdition-${var.deployment_id}" - awslogs-region = "${var.aws_region}" - awslogs-create-group = "true" - awslogs-stream-prefix = "dc" - } - } - portMappings = [{ - name = "${var.deployment_id}-cloudbeaver-dc" - protocol = "tcp" - containerPort = 8970 - hostPort = 8970 - }] - }]) -} - -resource "aws_ecs_service" "dc" { - - depends_on = [ - aws_ecs_task_definition.dbeaver_dc, - aws_security_group.dbeaver_te - ] - - name = "${var.deployment_id}-cloudbeaver-dc" - cluster = aws_ecs_cluster.dbeaver_te.id - task_definition = aws_ecs_task_definition.dbeaver_dc.arn - launch_type = "FARGATE" - desired_count = var.desired_count["dc"] - enable_execute_command = true - - network_configuration { - security_groups = [aws_security_group.dbeaver_te.id] - subnets = aws_subnet.private_subnets[*].id - assign_public_ip = false - } - service_connect_configuration { - enabled = true - namespace = aws_service_discovery_private_dns_namespace.dbeaver.arn - service { - port_name = "${var.deployment_id}-cloudbeaver-dc" - client_alias { - dns_name = "${var.deployment_id}-cloudbeaver-dc" - port = 8970 - } - } - } - load_balancer { - target_group_arn = aws_lb_target_group.dbeaver_dc.arn - container_name = "${var.deployment_id}-cloudbeaver-dc" - container_port = 8970 - } - - tags = { - Env = var.deployment_id - Name = "DBeaverTeamEdition-dc" - } -} - -################################################################################ -# DBeaver TE RM -################################################################################ - -resource "aws_ecs_task_definition" "dbeaver_rm" { - - depends_on = [ - aws_ecs_cluster.dbeaver_te, - aws_ecs_task_definition.dbeaver_dc - ] - - family = "DBeaverTeamEdition-${var.deployment_id}-rm" - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - cpu = 1024 - memory = 2048 - execution_role_arn = aws_iam_role.ecsTaskExecutionRole.arn - task_role_arn = aws_iam_role.ecs_task_role_exec.arn - - volume { - name = "${var.deployment_id}-cloudbeaver_rm_data" - efs_volume_configuration { - file_system_id = aws_efs_file_system.cloudbeaver_rm_data.id - root_directory = "/" - } - } - volume { - name = "${var.deployment_id}-cloudbeaver_certificates_public" - efs_volume_configuration { - file_system_id = aws_efs_file_system.cloudbeaver_certificates.id - transit_encryption = "ENABLED" - - authorization_config { - access_point_id = aws_efs_access_point.certs_public.id - iam = "DISABLED" - } - } - } - - container_definitions = jsonencode([{ - name = "${var.deployment_id}-cloudbeaver-rm" - image = "${var.image_source}/cloudbeaver-rm:${var.dbeaver_te_version}" - essential = true - environment = local.cloudbeaver_shared_env_modified - mountPoints = [{ - containerPath = "/opt/resource-manager/workspace" - sourceVolume = "${var.deployment_id}-cloudbeaver_rm_data" - }, - { - containerPath = "/opt/resource-manager/conf/certificates" - sourceVolume = "${var.deployment_id}-cloudbeaver_certificates_public" - }] - logConfiguration = { - logDriver = "awslogs" - options = { - awslogs-group = "DBeaverTeamEdition-${var.deployment_id}" - awslogs-region = "${var.aws_region}" - awslogs-create-group = "true" - awslogs-stream-prefix = "rm" - } - } - portMappings = [{ - name = "${var.deployment_id}-cloudbeaver-rm" - protocol = "tcp" - containerPort = 8971 - hostPort = 8971 - }] - }]) -} - -resource "aws_ecs_service" "rm" { - - depends_on = [ - aws_ecs_task_definition.dbeaver_rm, - aws_security_group.dbeaver_te - ] - - name = "${var.deployment_id}-cloudbeaver-rm" - cluster = aws_ecs_cluster.dbeaver_te.id - task_definition = aws_ecs_task_definition.dbeaver_rm.arn - launch_type = "FARGATE" - desired_count = var.desired_count["rm"] - enable_execute_command = true - - network_configuration { - security_groups = [aws_security_group.dbeaver_te.id] - subnets = aws_subnet.private_subnets[*].id - assign_public_ip = false - } - service_connect_configuration { - enabled = true - namespace = aws_service_discovery_private_dns_namespace.dbeaver.arn - service { - port_name = "${var.deployment_id}-cloudbeaver-rm" - client_alias { - dns_name = "${var.deployment_id}-cloudbeaver-rm" - port = 8971 - } - } - } - load_balancer { - target_group_arn = aws_lb_target_group.dbeaver_rm.arn - container_name = "${var.deployment_id}-cloudbeaver-rm" - container_port = 8971 - } - - tags = { - Env = var.deployment_id - Name = "DBeaverTeamEdition-rm" - } -} - -################################################################################ -# DBeaver TE QM -################################################################################ - -resource "aws_ecs_task_definition" "dbeaver_qm" { - - depends_on = [ - aws_ecs_cluster.dbeaver_te, - aws_ecs_task_definition.dbeaver_dc - ] - - family = "DBeaverTeamEdition-${var.deployment_id}-qm" - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - cpu = 1024 - memory = 2048 - execution_role_arn = aws_iam_role.ecsTaskExecutionRole.arn - task_role_arn = aws_iam_role.ecs_task_role_exec.arn - volume { - name = "${var.deployment_id}-cloudbeaver_certificates_public" - efs_volume_configuration { - file_system_id = aws_efs_file_system.cloudbeaver_certificates.id - transit_encryption = "ENABLED" - - authorization_config { - access_point_id = aws_efs_access_point.certs_public.id - iam = "DISABLED" - } - } - } - container_definitions = jsonencode([{ - name = "${var.deployment_id}-cloudbeaver-qm" - image = "${var.image_source}/cloudbeaver-qm:${var.dbeaver_te_version}" - essential = true - environment = local.cloudbeaver_shared_env_modified - mountPoints = [ - { - containerPath = "/opt/query-manager/conf/certificates" - sourceVolume = "${var.deployment_id}-cloudbeaver_certificates_public" - }] - logConfiguration = { - logDriver = "awslogs" - options = { - awslogs-group = "DBeaverTeamEdition-${var.deployment_id}" - awslogs-region = "${var.aws_region}" - awslogs-create-group = "true" - awslogs-stream-prefix = "qm" - } - } - portMappings = [{ - name = "${var.deployment_id}-cloudbeaver-qm" - protocol = "tcp" - containerPort = 8972 - hostPort = 8972 - }] - }]) -} - -resource "aws_ecs_service" "qm" { - - depends_on = [ - aws_ecs_task_definition.dbeaver_qm, - aws_security_group.dbeaver_te - ] - - name = "${var.deployment_id}-cloudbeaver-qm" - cluster = aws_ecs_cluster.dbeaver_te.id - task_definition = aws_ecs_task_definition.dbeaver_qm.arn - launch_type = "FARGATE" - desired_count = var.desired_count["qm"] - enable_execute_command = true - - network_configuration { - security_groups = [aws_security_group.dbeaver_te.id] - subnets = aws_subnet.private_subnets[*].id - assign_public_ip = false - } - service_connect_configuration { - enabled = true - namespace = aws_service_discovery_private_dns_namespace.dbeaver.arn - service { - port_name = "${var.deployment_id}-cloudbeaver-qm" - client_alias { - dns_name = "${var.deployment_id}-cloudbeaver-qm" - port = 8972 - } - } - } - load_balancer { - target_group_arn = aws_lb_target_group.dbeaver_qm.arn - container_name = "${var.deployment_id}-cloudbeaver-qm" - container_port = 8972 - } - - tags = { - Env = var.deployment_id - Name = "DBeaverTeamEdition-qm" - } -} - - -################################################################################ -# DBeaver TE TM -################################################################################ - -resource "aws_ecs_task_definition" "dbeaver_tm" { - - depends_on = [ - aws_ecs_cluster.dbeaver_te, - aws_ecs_task_definition.dbeaver_rm, - aws_ecs_task_definition.dbeaver_dc - ] - - family = "DBeaverTeamEdition-${var.deployment_id}-tm" - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - cpu = 2048 - memory = 4096 - execution_role_arn = aws_iam_role.ecsTaskExecutionRole.arn - task_role_arn = aws_iam_role.ecs_task_role_exec.arn - - volume { - name = "${var.deployment_id}-cloudbeaver_tm_data" - efs_volume_configuration { - file_system_id = aws_efs_file_system.cloudbeaver_tm_data.id - root_directory = "/" - } - } - volume { - name = "${var.deployment_id}-cloudbeaver_certificates_public" - efs_volume_configuration { - file_system_id = aws_efs_file_system.cloudbeaver_certificates.id - transit_encryption = "ENABLED" - - authorization_config { - access_point_id = aws_efs_access_point.certs_public.id - iam = "DISABLED" - } - } - } - container_definitions = jsonencode([{ - name = "${var.deployment_id}-cloudbeaver-tm" - image = "${var.image_source}/cloudbeaver-tm:${var.dbeaver_te_version}" - essential = true - environment = local.cloudbeaver_shared_env_modified - mountPoints = [{ - containerPath = "/opt/task-manager/workspace" - sourceVolume = "${var.deployment_id}-cloudbeaver_tm_data" - }, - { - containerPath = "/opt/task-manager/conf/certificates" - sourceVolume = "${var.deployment_id}-cloudbeaver_certificates_public" - }] - logConfiguration = { - logDriver = "awslogs" - options = { - awslogs-group = "DBeaverTeamEdition-${var.deployment_id}" - awslogs-region = "${var.aws_region}" - awslogs-create-group = "true" - awslogs-stream-prefix = "tm" - } - } - portMappings = [{ - name = "${var.deployment_id}-cloudbeaver-tm" - protocol = "tcp" - containerPort = 8973 - hostPort = 8973 - }] - }]) -} - -resource "aws_ecs_service" "tm" { - - depends_on = [ - aws_ecs_task_definition.dbeaver_tm, - aws_security_group.dbeaver_te - ] - - name = "${var.deployment_id}-cloudbeaver-tm" - cluster = aws_ecs_cluster.dbeaver_te.id - task_definition = aws_ecs_task_definition.dbeaver_tm.arn - launch_type = "FARGATE" - desired_count = var.desired_count["tm"] - enable_execute_command = true - - network_configuration { - security_groups = [aws_security_group.dbeaver_te.id] - subnets = aws_subnet.private_subnets[*].id - assign_public_ip = false - } - service_connect_configuration { - enabled = true - namespace = aws_service_discovery_private_dns_namespace.dbeaver.arn - service { - port_name = "${var.deployment_id}-cloudbeaver-tm" - client_alias { - dns_name = "${var.deployment_id}-cloudbeaver-tm" - port = 8973 - } - } - } - load_balancer { - target_group_arn = aws_lb_target_group.dbeaver_tm.arn - container_name = "${var.deployment_id}-cloudbeaver-tm" - container_port = 8973 - } - - tags = { - Env = var.deployment_id - Name = "DBeaverTeamEdition-tm" - } -} - -################################################################################ -# DBeaver TE CloudBeaver -################################################################################ - -resource "aws_ecs_task_definition" "dbeaver_te" { - - depends_on = [ - aws_ecs_cluster.dbeaver_te, - aws_ecs_task_definition.dbeaver_dc, - aws_ecs_task_definition.dbeaver_rm - ] - - family = "DBeaverTeamEdition-${var.deployment_id}-te" - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - cpu = 4096 - memory = 8192 - execution_role_arn = aws_iam_role.ecsTaskExecutionRole.arn - task_role_arn = aws_iam_role.ecs_task_role_exec.arn - - - volume { - name = "${var.deployment_id}-cloudbeaver_certificates_public" - efs_volume_configuration { - file_system_id = aws_efs_file_system.cloudbeaver_certificates.id - transit_encryption = "ENABLED" - - authorization_config { - access_point_id = aws_efs_access_point.certs_public.id - iam = "DISABLED" - } - } - } - container_definitions = jsonencode([{ - name = "${var.deployment_id}-cloudbeaver-te" - image = "${var.image_source}/cloudbeaver-te:${var.dbeaver_te_version}" - essential = true - environment = local.cloudbeaver_shared_env_modified - mountPoints = [{ - containerPath = "/opt/cloudbeaver/conf/certificates" - sourceVolume = "${var.deployment_id}-cloudbeaver_certificates_public" - }] - logConfiguration = { - logDriver = "awslogs" - options = { - awslogs-group = "DBeaverTeamEdition-${var.deployment_id}" - awslogs-region = "${var.aws_region}" - awslogs-create-group = "true" - awslogs-stream-prefix = "te" - } - } - portMappings = [{ - name = "${var.deployment_id}-cloudbeaver-te" - protocol = "tcp" - containerPort = 8978 - hostPort = 8978 - }] - }]) -} - -resource "aws_ecs_service" "te" { - - depends_on = [ - aws_ecs_task_definition.dbeaver_te, - aws_security_group.dbeaver_te, - aws_lb_target_group.dbeaver_te - ] - - name = "${var.deployment_id}-cloudbeaver-te" - cluster = aws_ecs_cluster.dbeaver_te.id - task_definition = aws_ecs_task_definition.dbeaver_te.arn - launch_type = "FARGATE" - desired_count = var.desired_count["te"] - enable_execute_command = true - - network_configuration { - security_groups = [aws_security_group.dbeaver_te.id] - subnets = aws_subnet.private_subnets[*].id - assign_public_ip = false - } - service_connect_configuration { - enabled = true - namespace = aws_service_discovery_private_dns_namespace.dbeaver.arn - service { - port_name = "${var.deployment_id}-cloudbeaver-te" - client_alias { - dns_name = "${var.deployment_id}-cloudbeaver-te" - port = 8978 - } - } - } - load_balancer { - target_group_arn = aws_lb_target_group.dbeaver_te.arn - container_name = "${var.deployment_id}-cloudbeaver-te" - container_port = 8978 - } - - tags = { - Env = var.deployment_id - Name = "DBeaverTeamEdition-${var.deployment_id}-te" - } -} diff --git a/AWS/ecs-fargate/migration.tf b/AWS/ecs-fargate/migration.tf new file mode 100644 index 0000000..be634f9 --- /dev/null +++ b/AWS/ecs-fargate/migration.tf @@ -0,0 +1,363 @@ +################################################################################ +# VPC +################################################################################ + +moved { + from = aws_vpc.dbeaver_net + to = module.vpc[0].aws_vpc.this +} + +moved { + from = aws_subnet.public_subnets[0] + to = module.vpc[0].aws_subnet.public[0] +} + +moved { + from = aws_subnet.public_subnets[1] + to = module.vpc[0].aws_subnet.public[1] +} + +moved { + from = aws_subnet.private_subnets[0] + to = module.vpc[0].aws_subnet.private[0] +} + +moved { + from = aws_subnet.private_subnets[1] + to = module.vpc[0].aws_subnet.private[1] +} + +moved { + from = aws_internet_gateway.dbeaver_gw + to = module.vpc[0].aws_internet_gateway.this +} + +moved { + from = aws_eip.dbeaver_nat_gateway + to = module.vpc[0].aws_eip.nat +} + +moved { + from = aws_nat_gateway.nat_gateway + to = module.vpc[0].aws_nat_gateway.this +} + +removed { + from = aws_route.dbeaver_vpc_main_gw + lifecycle { destroy = true } +} + +removed { + from = aws_route_table.dbeaver_private_rt_nat + lifecycle { destroy = true } +} + +removed { + from = aws_route_table_association.private_subnets_rt + lifecycle { destroy = true } +} + + +################################################################################ +# IAM +################################################################################ + +moved { + from = aws_iam_role.ecsTaskExecutionRole + to = module.iam.aws_iam_role.execution +} + +moved { + from = aws_iam_role.ecs_task_role_exec + to = module.iam.aws_iam_role.task +} + +moved { + from = aws_iam_policy.CloudbeaverTeamEditionEFSAccessPolicy + to = module.iam.aws_iam_policy.efs_access +} + +moved { + from = aws_iam_role_policy_attachment.ecsTaskExecutionRole_policy + to = module.iam.aws_iam_role_policy_attachment.execution_ecs +} + +moved { + from = aws_iam_role_policy_attachment.TeamEditionEFSAccessPolicy_attachment + to = module.iam.aws_iam_role_policy_attachment.execution_efs +} + +moved { + from = aws_iam_role_policy_attachment.ecs_task_role_exec_ssm + to = module.iam.aws_iam_role_policy_attachment.task_ssm +} + +removed { + from = aws_iam_role_policy_attachment.logs_policy_attachment + lifecycle { destroy = true } +} + +removed { + from = aws_iam_role_policy_attachment.ecs_task_role_exec_logs + lifecycle { destroy = true } +} + + +################################################################################ +# RDS +################################################################################ + +moved { + from = aws_db_subnet_group.rds_dbeaver_db_subnet[0] + to = module.rds[0].aws_db_subnet_group.this +} + +moved { + from = aws_db_instance.rds_dbeaver_db[0] + to = module.rds[0].aws_db_instance.this +} + + +################################################################################ +# EFS +################################################################################ + +moved { + from = aws_efs_file_system.cloudbeaver_db_data + to = module.efs["db_data"].aws_efs_file_system.this +} + +moved { + from = aws_efs_mount_target.cloudbeaver_db_data_mt[0] + to = module.efs["db_data"].aws_efs_mount_target.this[0] +} + +moved { + from = aws_efs_mount_target.cloudbeaver_db_data_mt[1] + to = module.efs["db_data"].aws_efs_mount_target.this[1] +} + +moved { + from = aws_efs_file_system.cloudbeaver_dc_data + to = module.efs["dc_data"].aws_efs_file_system.this +} + +moved { + from = aws_efs_mount_target.cloudbeaver_dc_data_mt[0] + to = module.efs["dc_data"].aws_efs_mount_target.this[0] +} + +moved { + from = aws_efs_mount_target.cloudbeaver_dc_data_mt[1] + to = module.efs["dc_data"].aws_efs_mount_target.this[1] +} + +moved { + from = aws_efs_file_system.cloudbeaver_rm_data + to = module.efs["rm_data"].aws_efs_file_system.this +} + +moved { + from = aws_efs_mount_target.cloudbeaver_rm_data_mt[0] + to = module.efs["rm_data"].aws_efs_mount_target.this[0] +} + +moved { + from = aws_efs_mount_target.cloudbeaver_rm_data_mt[1] + to = module.efs["rm_data"].aws_efs_mount_target.this[1] +} + +moved { + from = aws_efs_file_system.cloudbeaver_tm_data + to = module.efs["tm_data"].aws_efs_file_system.this +} + +moved { + from = aws_efs_mount_target.cloudbeaver_tm_data_mt[0] + to = module.efs["tm_data"].aws_efs_mount_target.this[0] +} + +moved { + from = aws_efs_mount_target.cloudbeaver_tm_data_mt[1] + to = module.efs["tm_data"].aws_efs_mount_target.this[1] +} + +moved { + from = aws_efs_file_system.cloudbeaver_certificates + to = module.efs["certificates"].aws_efs_file_system.this +} + +moved { + from = aws_efs_access_point.certs_public + to = module.efs["certificates"].aws_efs_access_point.this[0] +} + +moved { + from = aws_efs_mount_target.cloudbeaver_certificates_mt[0] + to = module.efs["certificates"].aws_efs_mount_target.this[0] +} + +moved { + from = aws_efs_mount_target.cloudbeaver_certificates_mt[1] + to = module.efs["certificates"].aws_efs_mount_target.this[1] +} + +moved { + from = aws_efs_file_system.api_tokens + to = module.efs["api_tokens"].aws_efs_file_system.this +} + +moved { + from = aws_efs_mount_target.api_tokens_mt[0] + to = module.efs["api_tokens"].aws_efs_mount_target.this[0] +} + +moved { + from = aws_efs_mount_target.api_tokens_mt[1] + to = module.efs["api_tokens"].aws_efs_mount_target.this[1] +} + + +################################################################################ +# ECS +################################################################################ + +moved { + from = aws_ecs_cluster.dbeaver_te + to = module.ecs_cluster.aws_ecs_cluster.this +} + +moved { + from = aws_ecs_task_definition.dbeaver_te + to = module.cloudbeaver_te.aws_ecs_task_definition.this +} + +moved { + from = aws_ecs_task_definition.dbeaver_dc + to = module.cloudbeaver_dc.aws_ecs_task_definition.this +} + +moved { + from = aws_ecs_task_definition.dbeaver_qm + to = module.cloudbeaver_qm.aws_ecs_task_definition.this +} + +moved { + from = aws_ecs_task_definition.dbeaver_rm + to = module.cloudbeaver_rm.aws_ecs_task_definition.this +} + +moved { + from = aws_ecs_task_definition.dbeaver_tm + to = module.cloudbeaver_tm.aws_ecs_task_definition.this +} + +moved { + from = aws_ecs_task_definition.kafka + to = module.kafka.aws_ecs_task_definition.this +} + +moved { + from = aws_ecs_task_definition.dbeaver_db[0] + to = module.postgres[0].aws_ecs_task_definition.this +} + +moved { + from = aws_ecs_service.te + to = module.cloudbeaver_te.aws_ecs_service.this +} + +moved { + from = aws_ecs_service.dc + to = module.cloudbeaver_dc.aws_ecs_service.this +} + +moved { + from = aws_ecs_service.qm + to = module.cloudbeaver_qm.aws_ecs_service.this +} + +moved { + from = aws_ecs_service.rm + to = module.cloudbeaver_rm.aws_ecs_service.this +} + +moved { + from = aws_ecs_service.tm + to = module.cloudbeaver_tm.aws_ecs_service.this +} + +moved { + from = aws_ecs_service.kafka + to = module.kafka.aws_ecs_service.this +} + +moved { + from = aws_ecs_service.postgres[0] + to = module.postgres[0].aws_ecs_service.this +} + + +################################################################################ +# ALB +################################################################################ + +moved { + from = aws_lb.dbeaver_te_lb + to = module.alb.aws_lb.this +} + +moved { + from = aws_lb_listener.dbeaver-te-listener + to = module.alb.aws_lb_listener.http +} + +moved { + from = aws_lb_listener.dbeaver-te-listener-https + to = module.alb.aws_lb_listener.https +} + +moved { + from = aws_lb_target_group.dbeaver_te + to = module.cloudbeaver_te_route.aws_lb_target_group.this +} + +moved { + from = aws_lb_target_group.dbeaver_dc + to = module.cloudbeaver_dc_route.aws_lb_target_group.this +} + +moved { + from = aws_lb_target_group.dbeaver_qm + to = module.cloudbeaver_qm_route.aws_lb_target_group.this +} + +moved { + from = aws_lb_target_group.dbeaver_rm + to = module.cloudbeaver_rm_route.aws_lb_target_group.this +} + +moved { + from = aws_lb_target_group.dbeaver_tm + to = module.cloudbeaver_tm_route.aws_lb_target_group.this +} + +moved { + from = aws_lb_listener_rule.forward_to_service_uri_dc + to = module.cloudbeaver_dc_route.aws_lb_listener_rule.this +} + +moved { + from = aws_lb_listener_rule.forward_to_service_uri_qm + to = module.cloudbeaver_qm_route.aws_lb_listener_rule.this +} + +moved { + from = aws_lb_listener_rule.forward_to_service_uri_rm + to = module.cloudbeaver_rm_route.aws_lb_listener_rule.this +} + +moved { + from = aws_lb_listener_rule.forward_to_service_uri_tm + to = module.cloudbeaver_tm_route.aws_lb_listener_rule.this +} diff --git a/AWS/ecs-fargate/modules/alb-route/main.tf b/AWS/ecs-fargate/modules/alb-route/main.tf new file mode 100644 index 0000000..1c37873 --- /dev/null +++ b/AWS/ecs-fargate/modules/alb-route/main.tf @@ -0,0 +1,43 @@ +resource "aws_lb_target_group" "this" { + name = var.name + port = 80 + protocol = "HTTP" + target_type = "ip" + vpc_id = var.vpc_id + + health_check { + matcher = var.health_check_matcher + unhealthy_threshold = var.health_check_unhealthy_threshold + enabled = true + path = var.health_check_path + } + + dynamic "stickiness" { + for_each = var.stickiness_enabled ? [1] : [] + content { + enabled = true + type = "lb_cookie" + cookie_duration = var.stickiness_duration + } + } + + tags = var.tags +} + +resource "aws_lb_listener_rule" "this" { + listener_arn = var.listener_arn + priority = var.priority + + condition { + path_pattern { + values = [var.path_pattern] + } + } + + action { + type = "forward" + target_group_arn = aws_lb_target_group.this.arn + } + + tags = var.tags +} diff --git a/AWS/ecs-fargate/modules/alb-route/outputs.tf b/AWS/ecs-fargate/modules/alb-route/outputs.tf new file mode 100644 index 0000000..4198db6 --- /dev/null +++ b/AWS/ecs-fargate/modules/alb-route/outputs.tf @@ -0,0 +1,4 @@ +output "target_group_arn" { + description = "ARN of the ALB target group" + value = aws_lb_target_group.this.arn +} diff --git a/AWS/ecs-fargate/modules/alb-route/variables.tf b/AWS/ecs-fargate/modules/alb-route/variables.tf new file mode 100644 index 0000000..445581f --- /dev/null +++ b/AWS/ecs-fargate/modules/alb-route/variables.tf @@ -0,0 +1,61 @@ +variable "name" { + description = "Name for the target group" + type = string +} + +variable "vpc_id" { + description = "VPC ID for the target group" + type = string +} + +variable "listener_arn" { + description = "ARN of the ALB HTTPS listener" + type = string +} + +variable "path_pattern" { + description = "ALB path pattern for the listener rule" + type = string +} + +variable "priority" { + description = "Priority for the ALB listener rule" + type = number + default = 100 +} + +variable "health_check_path" { + description = "Health check path for the target group" + type = string + default = "/" +} + +variable "health_check_matcher" { + description = "HTTP status codes for health check success" + type = string + default = "200,302" +} + +variable "health_check_unhealthy_threshold" { + description = "Number of consecutive failures before marking unhealthy" + type = number + default = 7 +} + +variable "stickiness_enabled" { + description = "Whether to enable session stickiness on the target group" + type = bool + default = false +} + +variable "stickiness_duration" { + description = "Cookie duration in seconds for session stickiness" + type = number + default = 86400 +} + +variable "tags" { + description = "Tags to apply to all resources" + type = map(string) + default = {} +} diff --git a/AWS/ecs-fargate/modules/alb/main.tf b/AWS/ecs-fargate/modules/alb/main.tf new file mode 100644 index 0000000..c9753aa --- /dev/null +++ b/AWS/ecs-fargate/modules/alb/main.tf @@ -0,0 +1,49 @@ +resource "aws_lb" "this" { + name = var.name + internal = var.internal + load_balancer_type = "application" + security_groups = var.security_group_ids + subnets = var.public_subnets + + tags = merge(var.tags, { + Name = var.name + }) +} + +resource "aws_lb_listener" "http" { + load_balancer_arn = aws_lb.this.arn + port = 80 + protocol = "HTTP" + + default_action { + type = "redirect" + + redirect { + port = "443" + protocol = "HTTPS" + status_code = "HTTP_301" + } + } + + tags = var.tags +} + +resource "aws_lb_listener" "https" { + load_balancer_arn = aws_lb.this.arn + port = 443 + protocol = "HTTPS" + ssl_policy = var.ssl_policy + certificate_arn = var.certificate_arn + + default_action { + type = "fixed-response" + + fixed_response { + content_type = "text/plain" + message_body = "Not Found" + status_code = "404" + } + } + + tags = var.tags +} diff --git a/AWS/ecs-fargate/modules/alb/outputs.tf b/AWS/ecs-fargate/modules/alb/outputs.tf new file mode 100644 index 0000000..3d98b51 --- /dev/null +++ b/AWS/ecs-fargate/modules/alb/outputs.tf @@ -0,0 +1,24 @@ +output "alb_arn" { + description = "ARN of the Application Load Balancer" + value = aws_lb.this.arn +} + +output "alb_dns_name" { + description = "DNS name of the Application Load Balancer" + value = aws_lb.this.dns_name +} + +output "alb_zone_id" { + description = "Hosted zone ID of the ALB" + value = aws_lb.this.zone_id +} + +output "https_listener_arn" { + description = "ARN of the HTTPS listener" + value = aws_lb_listener.https.arn +} + +output "http_listener_arn" { + description = "ARN of the HTTP listener" + value = aws_lb_listener.http.arn +} diff --git a/AWS/ecs-fargate/modules/alb/variables.tf b/AWS/ecs-fargate/modules/alb/variables.tf new file mode 100644 index 0000000..7ed3251 --- /dev/null +++ b/AWS/ecs-fargate/modules/alb/variables.tf @@ -0,0 +1,47 @@ +variable "name" { + description = "Name for the ALB" + type = string +} + +variable "deployment_id" { + description = "Deployment identifier" + type = string +} + +variable "vpc_id" { + description = "VPC ID for the ALB" + type = string +} + +variable "public_subnets" { + description = "List of public subnet IDs for ALB placement" + type = list(string) +} + +variable "security_group_ids" { + description = "Security group IDs to attach to the ALB" + type = list(string) +} + +variable "certificate_arn" { + description = "ACM certificate ARN for HTTPS listener" + type = string +} + +variable "ssl_policy" { + description = "SSL policy for the HTTPS listener" + type = string + default = "ELBSecurityPolicy-TLS13-1-2-2021-06" +} + +variable "internal" { + description = "Whether the ALB is internal" + type = bool + default = false +} + +variable "tags" { + description = "Tags to apply to all resources" + type = map(string) + default = {} +} diff --git a/AWS/ecs-fargate/modules/ecs-cluster/main.tf b/AWS/ecs-fargate/modules/ecs-cluster/main.tf new file mode 100644 index 0000000..b1ea3cb --- /dev/null +++ b/AWS/ecs-fargate/modules/ecs-cluster/main.tf @@ -0,0 +1,24 @@ +resource "aws_ecs_cluster" "this" { + name = var.name + + dynamic "setting" { + for_each = var.container_insights_enabled ? [1] : [] + content { + name = "containerInsights" + value = "enabled" + } + } + + tags = var.tags +} + +resource "aws_ecs_cluster_capacity_providers" "this" { + cluster_name = aws_ecs_cluster.this.name + capacity_providers = var.capacity_providers + + default_capacity_provider_strategy { + base = var.default_capacity_provider_base + weight = var.default_capacity_provider_weight + capacity_provider = var.default_capacity_provider + } +} diff --git a/AWS/ecs-fargate/modules/ecs-cluster/outputs.tf b/AWS/ecs-fargate/modules/ecs-cluster/outputs.tf new file mode 100644 index 0000000..b974cb5 --- /dev/null +++ b/AWS/ecs-fargate/modules/ecs-cluster/outputs.tf @@ -0,0 +1,14 @@ +output "id" { + description = "ID of the ECS cluster" + value = aws_ecs_cluster.this.id +} + +output "arn" { + description = "ARN of the ECS cluster" + value = aws_ecs_cluster.this.arn +} + +output "name" { + description = "Name of the ECS cluster" + value = aws_ecs_cluster.this.name +} diff --git a/AWS/ecs-fargate/modules/ecs-cluster/variables.tf b/AWS/ecs-fargate/modules/ecs-cluster/variables.tf new file mode 100644 index 0000000..2944804 --- /dev/null +++ b/AWS/ecs-fargate/modules/ecs-cluster/variables.tf @@ -0,0 +1,40 @@ +variable "name" { + description = "Name of the ECS cluster" + type = string +} + +variable "capacity_providers" { + description = "List of capacity providers associated with the cluster" + type = list(string) + default = ["FARGATE", "FARGATE_SPOT"] +} + +variable "default_capacity_provider" { + description = "Name of the default capacity provider" + type = string + default = "FARGATE" +} + +variable "default_capacity_provider_base" { + description = "Minimum number of tasks to run with the default provider" + type = number + default = 1 +} + +variable "default_capacity_provider_weight" { + description = "Relative percentage of tasks to run with the default provider" + type = number + default = 1 +} + +variable "container_insights_enabled" { + description = "Whether to enable CloudWatch Container Insights" + type = bool + default = false +} + +variable "tags" { + description = "Tags to apply to all resources" + type = map(string) + default = {} +} diff --git a/AWS/ecs-fargate/modules/ecs-service/main.tf b/AWS/ecs-fargate/modules/ecs-service/main.tf new file mode 100644 index 0000000..29d18b4 --- /dev/null +++ b/AWS/ecs-fargate/modules/ecs-service/main.tf @@ -0,0 +1,109 @@ +locals { + family_suffix = coalesce(var.family_suffix, var.name) + log_prefix = coalesce(var.log_prefix, local.family_suffix) + container_name = coalesce(var.container_name_override, "${var.deployment_id}-${var.name}") + service_name = "${var.deployment_id}-${var.name}" + family_name = "${var.name_prefix_full}-${var.deployment_id}-${local.family_suffix}" +} + +resource "aws_ecs_task_definition" "this" { + family = local.family_name + network_mode = "awsvpc" + requires_compatibilities = ["FARGATE"] + cpu = var.cpu + memory = var.memory + execution_role_arn = var.execution_role_arn + task_role_arn = var.task_role_arn + + dynamic "volume" { + for_each = var.efs_volumes + content { + name = "${var.deployment_id}-${volume.value.name}" + efs_volume_configuration { + file_system_id = volume.value.file_system_id + root_directory = volume.value.access_point_id != null ? null : coalesce(volume.value.root_directory, "/") + transit_encryption = volume.value.transit_encryption || volume.value.access_point_id != null ? "ENABLED" : null + + dynamic "authorization_config" { + for_each = volume.value.access_point_id != null ? [1] : [] + content { + access_point_id = volume.value.access_point_id + iam = "DISABLED" + } + } + } + } + } + + container_definitions = jsonencode([{ + name = local.container_name + image = var.image + essential = true + + environment = var.environment + + mountPoints = [ + for vol in var.efs_volumes : { + containerPath = vol.mount_path + sourceVolume = "${var.deployment_id}-${vol.name}" + } + ] + + logConfiguration = { + logDriver = "awslogs" + options = { + awslogs-group = var.log_group_name + awslogs-region = var.aws_region + awslogs-create-group = "true" + awslogs-stream-prefix = local.log_prefix + } + } + + portMappings = [{ + name = local.service_name + protocol = "tcp" + containerPort = var.container_port + hostPort = var.container_port + }] + }]) + + tags = var.tags +} + +resource "aws_ecs_service" "this" { + name = local.service_name + cluster = var.cluster_id + task_definition = aws_ecs_task_definition.this.arn + launch_type = "FARGATE" + desired_count = var.desired_count + enable_execute_command = var.enable_execute_command + + network_configuration { + security_groups = var.security_group_ids + subnets = var.subnet_ids + assign_public_ip = var.assign_public_ip + } + + service_connect_configuration { + enabled = true + namespace = var.service_connect_namespace_arn + service { + port_name = local.service_name + client_alias { + dns_name = local.service_name + port = var.container_port + } + } + } + + dynamic "load_balancer" { + for_each = var.target_group_arn != null ? [1] : [] + content { + target_group_arn = var.target_group_arn + container_name = local.container_name + container_port = var.container_port + } + } + + tags = var.tags +} diff --git a/AWS/ecs-fargate/modules/ecs-service/outputs.tf b/AWS/ecs-fargate/modules/ecs-service/outputs.tf new file mode 100644 index 0000000..3a044ce --- /dev/null +++ b/AWS/ecs-fargate/modules/ecs-service/outputs.tf @@ -0,0 +1,19 @@ +output "service_arn" { + description = "ARN of the ECS service" + value = aws_ecs_service.this.id +} + +output "service_name" { + description = "Name of the ECS service" + value = aws_ecs_service.this.name +} + +output "task_definition_arn" { + description = "ARN of the task definition" + value = aws_ecs_task_definition.this.arn +} + +output "container_name" { + description = "Name of the container in the task definition" + value = local.container_name +} diff --git a/AWS/ecs-fargate/modules/ecs-service/variables.tf b/AWS/ecs-fargate/modules/ecs-service/variables.tf new file mode 100644 index 0000000..3c0331b --- /dev/null +++ b/AWS/ecs-fargate/modules/ecs-service/variables.tf @@ -0,0 +1,150 @@ +variable "name" { + description = "Service name" + type = string +} + +variable "deployment_id" { + description = "Deployment identifier" + type = string +} + +variable "name_prefix" { + description = "Short prefix for resource names" + type = string +} + +variable "name_prefix_full" { + description = "Full prefix for resource names" + type = string +} + +variable "family_suffix" { + description = "Task definition family suffix" + type = string + default = null +} + +variable "log_prefix" { + description = "CloudWatch Logs stream prefix" + type = string + default = null +} + +variable "image" { + description = "Container image URI" + type = string +} + +variable "cpu" { + description = "CPU units for the task" + type = number +} + +variable "memory" { + description = "Memory in MiB for the task" + type = number +} + +variable "container_port" { + description = "Port the container listens on" + type = number +} + +variable "container_name_override" { + description = "Override container name" + type = string + default = null +} + +variable "execution_role_arn" { + description = "ARN of the ECS task execution role" + type = string +} + +variable "task_role_arn" { + description = "ARN of the ECS task role" + type = string + default = null +} + +variable "environment" { + description = "Environment variables for the container" + type = list(object({ + name = string + value = string + })) + default = [] +} + +variable "efs_volumes" { + description = "EFS volumes to attach to the task" + type = list(object({ + name = string + file_system_id = string + root_directory = optional(string, null) + transit_encryption = optional(bool, false) + access_point_id = optional(string, null) + mount_path = string + })) + default = [] +} + +variable "cluster_id" { + description = "ECS cluster ID" + type = string +} + +variable "security_group_ids" { + description = "Security group IDs for the ECS service" + type = list(string) +} + +variable "subnet_ids" { + description = "Subnet IDs for the ECS service" + type = list(string) +} + +variable "service_connect_namespace_arn" { + description = "ARN of the Service Connect namespace" + type = string +} + +variable "desired_count" { + description = "Number of task instances" + type = number + default = 1 +} + +variable "enable_execute_command" { + description = "Enable ECS Exec" + type = bool + default = true +} + +variable "assign_public_ip" { + description = "Assign a public IP to the task ENI" + type = bool + default = false +} + +variable "target_group_arn" { + description = "ARN of the ALB target group" + type = string + default = null +} + +variable "aws_region" { + description = "AWS region" + type = string +} + +variable "log_group_name" { + description = "CloudWatch log group name" + type = string +} + +variable "tags" { + description = "Tags to apply to all resources" + type = map(string) + default = {} +} diff --git a/AWS/ecs-fargate/modules/efs-volume/main.tf b/AWS/ecs-fargate/modules/efs-volume/main.tf new file mode 100644 index 0000000..04b0851 --- /dev/null +++ b/AWS/ecs-fargate/modules/efs-volume/main.tf @@ -0,0 +1,41 @@ +resource "aws_efs_file_system" "this" { + creation_token = "${var.deployment_id}-${var.name}" + performance_mode = var.performance_mode + throughput_mode = var.throughput_mode + encrypted = var.encrypted + + tags = merge(var.tags, { + Name = "${var.name_prefix}-${var.deployment_id}-${var.name}" + }) +} + +resource "aws_efs_mount_target" "this" { + count = length(var.subnet_ids) + file_system_id = aws_efs_file_system.this.id + subnet_id = var.subnet_ids[count.index] + security_groups = var.security_group_ids +} + +resource "aws_efs_access_point" "this" { + count = var.access_point != null ? 1 : 0 + file_system_id = aws_efs_file_system.this.id + + root_directory { + path = var.access_point.path + + creation_info { + owner_uid = var.access_point.owner_uid + owner_gid = var.access_point.owner_gid + permissions = var.access_point.permissions + } + } + + posix_user { + uid = var.access_point.owner_uid + gid = var.access_point.owner_gid + } + + tags = merge(var.tags, { + Name = "${var.name_prefix}-${var.deployment_id}-${var.name}" + }) +} diff --git a/AWS/ecs-fargate/modules/efs-volume/outputs.tf b/AWS/ecs-fargate/modules/efs-volume/outputs.tf new file mode 100644 index 0000000..1bf5ccd --- /dev/null +++ b/AWS/ecs-fargate/modules/efs-volume/outputs.tf @@ -0,0 +1,28 @@ +output "file_system_id" { + description = "The ID of the EFS file system" + value = aws_efs_file_system.this.id + depends_on = [aws_efs_mount_target.this] +} + +output "file_system_arn" { + description = "The ARN of the EFS file system" + value = aws_efs_file_system.this.arn + depends_on = [aws_efs_mount_target.this] +} + +output "access_point_id" { + description = "The ID of the EFS access point" + value = try(aws_efs_access_point.this[0].id, null) + depends_on = [aws_efs_mount_target.this] +} + +output "access_point_arn" { + description = "The ARN of the EFS access point" + value = try(aws_efs_access_point.this[0].arn, null) + depends_on = [aws_efs_mount_target.this] +} + +output "mount_target_ids" { + description = "List of mount target IDs" + value = aws_efs_mount_target.this[*].id +} diff --git a/AWS/ecs-fargate/modules/efs-volume/variables.tf b/AWS/ecs-fargate/modules/efs-volume/variables.tf new file mode 100644 index 0000000..e0f0ce5 --- /dev/null +++ b/AWS/ecs-fargate/modules/efs-volume/variables.tf @@ -0,0 +1,59 @@ +variable "name" { + description = "Name suffix for the EFS file system" + type = string +} + +variable "deployment_id" { + description = "Deployment identifier used for naming and tagging" + type = string +} + +variable "name_prefix" { + description = "Prefix for resource names and tags" + type = string +} + +variable "subnet_ids" { + description = "List of subnet IDs for EFS mount targets" + type = list(string) +} + +variable "security_group_ids" { + description = "Security group IDs to attach to mount targets" + type = list(string) +} + +variable "encrypted" { + description = "Whether to enable encryption at rest" + type = bool + default = false +} + +variable "performance_mode" { + description = "EFS performance mode" + type = string + default = "generalPurpose" +} + +variable "throughput_mode" { + description = "EFS throughput mode" + type = string + default = "bursting" +} + +variable "access_point" { + description = "Optional access point configuration" + type = object({ + path = string + owner_uid = number + owner_gid = number + permissions = string + }) + default = null +} + +variable "tags" { + description = "Tags to apply to all resources" + type = map(string) + default = {} +} diff --git a/AWS/ecs-fargate/modules/iam/main.tf b/AWS/ecs-fargate/modules/iam/main.tf new file mode 100644 index 0000000..8cb4a8a --- /dev/null +++ b/AWS/ecs-fargate/modules/iam/main.tf @@ -0,0 +1,126 @@ +data "aws_iam_policy_document" "assume_role_policy" { + statement { + effect = "Allow" + actions = ["sts:AssumeRole"] + + principals { + type = "Service" + identifiers = ["ecs-tasks.amazonaws.com"] + } + } +} + +resource "aws_iam_role" "execution" { + name = "${var.name_prefix}-${var.deployment_id}-ecsTaskExecutionRole" + assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json + tags = var.tags +} + +resource "aws_iam_role_policy_attachment" "execution_ecs" { + role = aws_iam_role.execution.name + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy" +} + +resource "aws_iam_policy" "efs_access" { + name = "${var.name_prefix}-${var.deployment_id}-EFSAccessPolicy" + description = "EFS access policy scoped to ${var.deployment_id} file systems" + + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Effect = "Allow" + Action = [ + "elasticfilesystem:DescribeFileSystems", + "elasticfilesystem:DescribeMountTargets", + "elasticfilesystem:DescribeMountTargetSecurityGroups", + "elasticfilesystem:DescribeTags", + "elasticfilesystem:CreateMountTarget", + "elasticfilesystem:DeleteMountTarget", + "elasticfilesystem:ModifyMountTargetSecurityGroups", + "elasticfilesystem:ListTagsForResource", + "elasticfilesystem:TagResource", + "elasticfilesystem:UntagResource" + ] + Resource = var.efs_arns + }, + { + Effect = "Allow" + Action = [ + "elasticfilesystem:CreateTags", + "elasticfilesystem:DeleteTags", + "elasticfilesystem:DescribeFileSystemPolicy", + "elasticfilesystem:PutFileSystemPolicy" + ] + Resource = var.efs_arns + }, + { + Effect = "Allow" + Action = [ + "elasticfilesystem:ClientMount", + "elasticfilesystem:ClientWrite", + "elasticfilesystem:ClientRootAccess" + ] + Resource = concat(var.efs_arns, var.efs_ap_arns) + }, + { + Effect = "Allow" + Action = "elasticfilesystem:DescribeAccessPoints" + Resource = "*" + } + ] + }) + + tags = var.tags +} + +resource "aws_iam_role_policy_attachment" "execution_efs" { + role = aws_iam_role.execution.name + policy_arn = aws_iam_policy.efs_access.arn +} + +resource "aws_iam_policy" "cloudwatch_logs" { + name = "${var.name_prefix}-${var.deployment_id}-CloudWatchLogsPolicy" + description = "Scoped CloudWatch Logs policy for ${var.deployment_id}" + + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Effect = "Allow" + Action = [ + "logs:CreateLogGroup", + "logs:CreateLogStream", + "logs:PutLogEvents", + "logs:DescribeLogStreams", + "logs:DescribeLogGroups" + ] + Resource = "arn:aws:logs:*:*:log-group:${var.name_prefix_full}-${var.deployment_id}*" + } + ] + }) + + tags = var.tags +} + +resource "aws_iam_role_policy_attachment" "execution_logs" { + role = aws_iam_role.execution.name + policy_arn = aws_iam_policy.cloudwatch_logs.arn +} + + +resource "aws_iam_role" "task" { + name = "${var.name_prefix}-${var.deployment_id}-ecsTaskRoleExec" + assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json + tags = var.tags +} + +resource "aws_iam_role_policy_attachment" "task_ssm" { + role = aws_iam_role.task.name + policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" +} + +resource "aws_iam_role_policy_attachment" "task_logs" { + role = aws_iam_role.task.name + policy_arn = aws_iam_policy.cloudwatch_logs.arn +} diff --git a/AWS/ecs-fargate/modules/iam/outputs.tf b/AWS/ecs-fargate/modules/iam/outputs.tf new file mode 100644 index 0000000..25abee4 --- /dev/null +++ b/AWS/ecs-fargate/modules/iam/outputs.tf @@ -0,0 +1,28 @@ +output "execution_role_arn" { + description = "ARN of the ECS task execution role" + value = aws_iam_role.execution.arn + depends_on = [ + aws_iam_role_policy_attachment.execution_ecs, + aws_iam_role_policy_attachment.execution_efs, + aws_iam_role_policy_attachment.execution_logs, + ] +} + +output "execution_role_name" { + description = "Name of the ECS task execution role" + value = aws_iam_role.execution.name +} + +output "task_role_arn" { + description = "ARN of the ECS task role" + value = aws_iam_role.task.arn + depends_on = [ + aws_iam_role_policy_attachment.task_ssm, + aws_iam_role_policy_attachment.task_logs, + ] +} + +output "task_role_name" { + description = "Name of the ECS task role" + value = aws_iam_role.task.name +} diff --git a/AWS/ecs-fargate/modules/iam/variables.tf b/AWS/ecs-fargate/modules/iam/variables.tf new file mode 100644 index 0000000..2cc05e5 --- /dev/null +++ b/AWS/ecs-fargate/modules/iam/variables.tf @@ -0,0 +1,32 @@ +variable "deployment_id" { + description = "Deployment identifier used for naming" + type = string +} + +variable "name_prefix" { + description = "Short prefix for resource names" + type = string +} + +variable "name_prefix_full" { + description = "Full prefix for log group ARN pattern" + type = string +} + +variable "efs_arns" { + description = "List of EFS file system ARNs for the access policy" + type = list(string) + default = [] +} + +variable "efs_ap_arns" { + description = "List of EFS access point ARNs for the mount policy" + type = list(string) + default = [] +} + +variable "tags" { + description = "Tags to apply to all resources" + type = map(string) + default = {} +} diff --git a/AWS/ecs-fargate/modules/rds/main.tf b/AWS/ecs-fargate/modules/rds/main.tf new file mode 100644 index 0000000..800b521 --- /dev/null +++ b/AWS/ecs-fargate/modules/rds/main.tf @@ -0,0 +1,28 @@ +resource "aws_db_subnet_group" "this" { + name = var.subnet_group_name + subnet_ids = var.subnet_ids + + tags = var.tags +} + +resource "aws_db_instance" "this" { + identifier = var.identifier + + engine = var.engine + engine_version = var.engine_version + instance_class = var.instance_class + + allocated_storage = var.allocated_storage + storage_type = var.storage_type + + db_name = var.db_name + username = var.username + password = var.password + + db_subnet_group_name = aws_db_subnet_group.this.name + vpc_security_group_ids = var.vpc_security_group_ids + + skip_final_snapshot = var.skip_final_snapshot + + tags = var.tags +} \ No newline at end of file diff --git a/AWS/ecs-fargate/modules/rds/outputs.tf b/AWS/ecs-fargate/modules/rds/outputs.tf new file mode 100644 index 0000000..ea2ab02 --- /dev/null +++ b/AWS/ecs-fargate/modules/rds/outputs.tf @@ -0,0 +1,14 @@ +output "db_instance_address" { + description = "Hostname of the RDS instance" + value = aws_db_instance.this.address +} + +output "db_instance_endpoint" { + description = "Connection endpoint" + value = aws_db_instance.this.endpoint +} + +output "db_instance_port" { + description = "Port of the RDS instance" + value = aws_db_instance.this.port +} diff --git a/AWS/ecs-fargate/modules/rds/variables.tf b/AWS/ecs-fargate/modules/rds/variables.tf new file mode 100644 index 0000000..50f19b9 --- /dev/null +++ b/AWS/ecs-fargate/modules/rds/variables.tf @@ -0,0 +1,76 @@ +variable "identifier" { + description = "RDS instance identifier (lowercase, hyphens)" + type = string +} + +variable "subnet_group_name" { + description = "Name for the DB subnet group" + type = string +} + +variable "subnet_ids" { + description = "List of subnet IDs for the DB subnet group" + type = list(string) +} + +variable "engine" { + description = "Database engine" + type = string + default = "postgres" +} + +variable "engine_version" { + description = "Database engine version" + type = string +} + +variable "instance_class" { + description = "RDS instance class" + type = string + default = "db.t3.micro" +} + +variable "allocated_storage" { + description = "Allocated storage in GB" + type = number + default = 20 +} + +variable "storage_type" { + description = "Storage type (gp2, gp3)" + type = string + default = "gp2" +} + +variable "db_name" { + description = "Initial database name" + type = string +} + +variable "username" { + description = "Master username" + type = string +} + +variable "password" { + description = "Master password" + type = string + sensitive = true +} + +variable "vpc_security_group_ids" { + description = "List of security group IDs attached to the RDS instance" + type = list(string) +} + +variable "skip_final_snapshot" { + description = "Whether to skip the final snapshot on deletion" + type = bool + default = true +} + +variable "tags" { + description = "Tags to apply to all resources" + type = map(string) + default = {} +} diff --git a/AWS/ecs-fargate/modules/vpc/main.tf b/AWS/ecs-fargate/modules/vpc/main.tf new file mode 100644 index 0000000..dc28ce6 --- /dev/null +++ b/AWS/ecs-fargate/modules/vpc/main.tf @@ -0,0 +1,132 @@ +################################################################################ +# Availability Zones +################################################################################ + +data "aws_availability_zones" "available" { + state = "available" +} + +locals { + azs = slice(data.aws_availability_zones.available.names, 0, length(var.public_subnet_cidrs)) +} + +################################################################################ +# VPC +################################################################################ + +resource "aws_vpc" "this" { + cidr_block = var.cidr + instance_tenancy = "default" + enable_dns_hostnames = true + enable_dns_support = true + + tags = merge(var.tags, { + Name = var.name + }) +} + +################################################################################ +# Subnets +################################################################################ + +resource "aws_subnet" "public" { + count = length(var.public_subnet_cidrs) + + vpc_id = aws_vpc.this.id + cidr_block = var.public_subnet_cidrs[count.index] + availability_zone = local.azs[count.index] + map_public_ip_on_launch = true + + tags = merge(var.tags, { + Name = "${var.name}-public-${count.index + 1}" + }) +} + +resource "aws_subnet" "private" { + count = length(var.private_subnet_cidrs) + + vpc_id = aws_vpc.this.id + cidr_block = var.private_subnet_cidrs[count.index] + availability_zone = local.azs[count.index] + + tags = merge(var.tags, { + Name = "${var.name}-private-${count.index + 1}" + }) +} + +################################################################################ +# Internet Gateway +################################################################################ + +resource "aws_internet_gateway" "this" { + vpc_id = aws_vpc.this.id + + tags = merge(var.tags, { + Name = "${var.name}-igw" + }) +} + +resource "aws_route_table" "public" { + vpc_id = aws_vpc.this.id + + tags = merge(var.tags, { + Name = "${var.name}-public-rt" + }) +} + +resource "aws_route" "public_internet_gateway" { + route_table_id = aws_route_table.public.id + destination_cidr_block = "0.0.0.0/0" + gateway_id = aws_internet_gateway.this.id +} + +resource "aws_route_table_association" "public" { + count = length(aws_subnet.public) + + subnet_id = aws_subnet.public[count.index].id + route_table_id = aws_route_table.public.id +} + +################################################################################ +# NAT Gateway +################################################################################ + +resource "aws_eip" "nat" { + domain = "vpc" + + tags = merge(var.tags, { + Name = "${var.name}-nat-eip" + }) +} + +resource "aws_nat_gateway" "this" { + allocation_id = aws_eip.nat.id + subnet_id = aws_subnet.public[0].id + + tags = merge(var.tags, { + Name = "${var.name}-nat" + }) + + depends_on = [aws_internet_gateway.this] +} + +resource "aws_route_table" "private" { + vpc_id = aws_vpc.this.id + + tags = merge(var.tags, { + Name = "${var.name}-private-rt" + }) +} + +resource "aws_route" "private_nat_gateway" { + route_table_id = aws_route_table.private.id + destination_cidr_block = "0.0.0.0/0" + nat_gateway_id = aws_nat_gateway.this.id +} + +resource "aws_route_table_association" "private" { + count = length(aws_subnet.private) + + subnet_id = aws_subnet.private[count.index].id + route_table_id = aws_route_table.private.id +} diff --git a/AWS/ecs-fargate/modules/vpc/outputs.tf b/AWS/ecs-fargate/modules/vpc/outputs.tf new file mode 100644 index 0000000..bc37cbd --- /dev/null +++ b/AWS/ecs-fargate/modules/vpc/outputs.tf @@ -0,0 +1,24 @@ +output "vpc_id" { + description = "ID of the VPC" + value = aws_vpc.this.id +} + +output "vpc_cidr_block" { + description = "CIDR block of the VPC" + value = aws_vpc.this.cidr_block +} + +output "public_subnets" { + description = "List of public subnet IDs" + value = aws_subnet.public[*].id +} + +output "private_subnets" { + description = "List of private subnet IDs" + value = aws_subnet.private[*].id +} + +output "nat_gateway_id" { + description = "ID of the NAT gateway" + value = aws_nat_gateway.this.id +} diff --git a/AWS/ecs-fargate/modules/vpc/variables.tf b/AWS/ecs-fargate/modules/vpc/variables.tf new file mode 100644 index 0000000..6424ff9 --- /dev/null +++ b/AWS/ecs-fargate/modules/vpc/variables.tf @@ -0,0 +1,24 @@ +variable "name" { + description = "Name prefix for VPC and related resources" + type = string +} + +variable "cidr" { + description = "CIDR block for the VPC" + type = string + default = "10.0.0.0/16" +} + +variable "public_subnet_cidrs" { + type = list(string) +} + +variable "private_subnet_cidrs" { + type = list(string) +} + +variable "tags" { + description = "Tags to apply to all resources" + type = map(string) + default = {} +} diff --git a/AWS/ecs-fargate/network.tf b/AWS/ecs-fargate/network.tf deleted file mode 100644 index 0b0bfac..0000000 --- a/AWS/ecs-fargate/network.tf +++ /dev/null @@ -1,111 +0,0 @@ -resource "aws_vpc" "dbeaver_net" { - cidr_block = var.vpc_cidr - instance_tenancy = "default" - enable_dns_hostnames = true - - tags = { - Env = var.deployment_id - Name = "DBeaverTeamEdition" - } -} - -data "aws_availability_zones" "available" { - state = "available" -} - -resource "aws_subnet" "public_subnets" { - count = length(var.public_subnet_cidrs) - vpc_id = aws_vpc.dbeaver_net.id - cidr_block = element(var.public_subnet_cidrs, count.index) - availability_zone = data.aws_availability_zones.available.names[count.index] - map_public_ip_on_launch = true - - tags = { - Env = var.deployment_id - Name = "DBeaverTE Public Subnet ${count.index + 1}" - } - - depends_on = [aws_vpc.dbeaver_net] -} - -resource "aws_subnet" "private_subnets" { - count = length(var.private_subnet_cidrs) - vpc_id = aws_vpc.dbeaver_net.id - cidr_block = element(var.private_subnet_cidrs, count.index) - availability_zone = data.aws_availability_zones.available.names[count.index] - - tags = { - Env = var.deployment_id - Name = "DBeaverTE Private Subnet ${count.index + 1}" - } - - depends_on = [aws_vpc.dbeaver_net] -} - -resource "aws_internet_gateway" "dbeaver_gw" { - vpc_id = aws_vpc.dbeaver_net.id - - tags = { - Env = var.deployment_id - Name = "DBeaverTE VPC IG" - } - depends_on = [aws_vpc.dbeaver_net] -} - -resource "aws_route" "dbeaver_vpc_main_gw" { - route_table_id = aws_vpc.dbeaver_net.main_route_table_id - - destination_cidr_block = "0.0.0.0/0" - gateway_id = aws_internet_gateway.dbeaver_gw.id - depends_on = [ - aws_vpc.dbeaver_net, - aws_internet_gateway.dbeaver_gw - ] -} - - -resource "aws_eip" "dbeaver_nat_gateway" { - domain = "vpc" - tags = { - Env = var.deployment_id - Name = "DBeaverTE EIP for Private VPC " - } -} - -resource "aws_nat_gateway" "nat_gateway" { - allocation_id = aws_eip.dbeaver_nat_gateway.id - subnet_id = aws_subnet.public_subnets[0].id - tags = { - Env = var.deployment_id - Name = "DBeaverTE Private Subnets Nat Gateway" - } - - depends_on = [ - aws_vpc.dbeaver_net, - aws_subnet.public_subnets - ] -} - -resource "aws_route_table" "dbeaver_private_rt_nat" { - vpc_id = aws_vpc.dbeaver_net.id - - route { - cidr_block = "0.0.0.0/0" - gateway_id = aws_nat_gateway.nat_gateway.id - } - - tags = { - Env = var.deployment_id - Name = "DBeaver TE Private Route Table" - } - depends_on = [ - aws_vpc.dbeaver_net, - aws_eip.dbeaver_nat_gateway - ] -} - -resource "aws_route_table_association" "private_subnets_rt" { - count = length(var.private_subnet_cidrs) - subnet_id = aws_subnet.private_subnets[count.index].id - route_table_id = aws_route_table.dbeaver_private_rt_nat.id -} \ No newline at end of file diff --git a/AWS/ecs-fargate/outputs.tf b/AWS/ecs-fargate/outputs.tf new file mode 100644 index 0000000..88f05ab --- /dev/null +++ b/AWS/ecs-fargate/outputs.tf @@ -0,0 +1,4 @@ +output "alb_dns_name" { + description = "The DNS name of the load balancer" + value = module.alb.alb_dns_name +} diff --git a/AWS/ecs-fargate/providers.tf b/AWS/ecs-fargate/providers.tf new file mode 100644 index 0000000..0a87691 --- /dev/null +++ b/AWS/ecs-fargate/providers.tf @@ -0,0 +1,11 @@ +provider "aws" { + region = var.aws_region + + default_tags { + tags = { + Project = local.name_prefix_full + Deployment = var.deployment_id + ManagedBy = "terraform" + } + } +} diff --git a/AWS/ecs-fargate/rds.tf b/AWS/ecs-fargate/rds.tf index 4fbab4c..4b4184c 100644 --- a/AWS/ecs-fargate/rds.tf +++ b/AWS/ecs-fargate/rds.tf @@ -1,49 +1,30 @@ -variable "db_instance_class" { - description = "The instance type of the RDS instance" - default = "db.t3.micro" -} +################################################################################ +# RDS PostgreSQL (optional, enabled via var.rds_db) +################################################################################ -variable "db_allocated_storage" { - description = "The allocated storage in gigabytes" - default = 20 -} +module "rds" { + source = "./modules/rds" -resource "aws_db_subnet_group" "rds_dbeaver_db_subnet" { + count = var.rds_db ? 1 : 0 - depends_on = [ - aws_vpc.dbeaver_net, - aws_subnet.private_subnets - ] - count = var.rds_db ? 1 : 0 - name = "dbeaverte-${var.deployment_id}-rds_db_subnet" - subnet_ids = [aws_subnet.private_subnets[0].id, aws_subnet.private_subnets[1].id] + identifier = lower("${local.name_prefix}-${var.deployment_id}") + subnet_group_name = lower("${local.name_prefix}-${var.deployment_id}-rds_db_subnet") + subnet_ids = local.private_subnets - tags = { - Env = var.deployment_id - Name = "DBeaver Team Edition Database subnet" - } -} + engine = var.rds_db_type + engine_version = var.rds_db_version + instance_class = var.db_instance_class + + allocated_storage = var.db_allocated_storage + storage_type = "gp2" + + db_name = var.cloudbeaver-db-env[2].value + username = var.cloudbeaver-db-env[1].value + password = var.cloudbeaver-db-env[0].value -# For oracle db class db.m5.large && POSTGRES_DB < 8 charters -resource "aws_db_instance" "rds_dbeaver_db" { - - depends_on = [ - aws_vpc.dbeaver_net, - aws_subnet.private_subnets - ] - - count = var.rds_db ? 1 : 0 - allocated_storage = var.db_allocated_storage - storage_type = "gp2" - engine = var.rds_db_type - engine_version = var.rds_db_version - instance_class = var.db_instance_class - db_name = var.cloudbeaver-db-env[2].value - username = var.cloudbeaver-db-env[1].value - password = var.cloudbeaver-db-env[0].value - db_subnet_group_name = aws_db_subnet_group.rds_dbeaver_db_subnet[0].name vpc_security_group_ids = [aws_security_group.dbeaver_te_private.id] - skip_final_snapshot = true + + skip_final_snapshot = true tags = { Env = var.deployment_id diff --git a/AWS/ecs-fargate/security-groups.tf b/AWS/ecs-fargate/security-groups.tf index 3984a93..ccc952b 100644 --- a/AWS/ecs-fargate/security-groups.tf +++ b/AWS/ecs-fargate/security-groups.tf @@ -1,99 +1,123 @@ +################################################################################ +# Security Groups +################################################################################ + resource "aws_security_group" "dbeaver_alb" { - name = "DBeaverTE-${var.deployment_id}-sg-alb" - vpc_id = aws_vpc.dbeaver_net.id + name = "${local.name_prefix}-${var.deployment_id}-sg-alb" + vpc_id = local.vpc_id description = "DBeaverTE ${var.deployment_id} EKS Default SG" ingress { - protocol = "tcp" - from_port = 80 - to_port = 80 - cidr_blocks = ["0.0.0.0/0"] - ipv6_cidr_blocks = ["::/0"] + protocol = "tcp" + from_port = 80 + to_port = 80 + cidr_blocks = ["0.0.0.0/0"] + ipv6_cidr_blocks = ["::/0"] + description = "HTTP" } ingress { - protocol = "tcp" - from_port = 443 - to_port = 443 - cidr_blocks = ["0.0.0.0/0"] - ipv6_cidr_blocks = ["::/0"] + protocol = "tcp" + from_port = 443 + to_port = 443 + cidr_blocks = ["0.0.0.0/0"] + ipv6_cidr_blocks = ["::/0"] + description = "HTTPS" } egress { - protocol = "-1" - from_port = 0 - to_port = 0 - cidr_blocks = ["0.0.0.0/0"] - ipv6_cidr_blocks = ["::/0"] + protocol = "-1" + from_port = 0 + to_port = 0 + cidr_blocks = ["0.0.0.0/0"] + ipv6_cidr_blocks = ["::/0"] + } + + tags = { + Env = var.deployment_id } } resource "aws_security_group" "dbeaver_efs" { - name = "DBeaverTE-${var.deployment_id}-ecs-efs-sg" - vpc_id = aws_vpc.dbeaver_net.id + name = "${local.name_prefix}-${var.deployment_id}-ecs-efs-sg" + vpc_id = local.vpc_id description = "DBeaverTE ${var.deployment_id} efs SG" ingress { - protocol = "tcp" - from_port = 2049 - to_port = 2049 - cidr_blocks = var.private_subnet_cidrs - description = "Allow NFS traffic - TCP 2049" + protocol = "tcp" + from_port = 2049 + to_port = 2049 + cidr_blocks = var.private_subnet_cidrs + description = "Allow NFS traffic - TCP 2049" } egress { - protocol = "-1" - from_port = 0 - to_port = 0 - cidr_blocks = ["0.0.0.0/0"] + protocol = "-1" + from_port = 0 + to_port = 0 + cidr_blocks = ["0.0.0.0/0"] + } + + tags = { + Env = var.deployment_id } } resource "aws_security_group" "dbeaver_te_private" { - name = "DBeaverTE-${var.deployment_id}-ecs-service-postgres" - vpc_id = aws_vpc.dbeaver_net.id + name = "${local.name_prefix}-${var.deployment_id}-ecs-service-postgres" + vpc_id = local.vpc_id description = "DBeaverTE ${var.deployment_id} ECS Postgres SG" ingress { - protocol = "tcp" - from_port = 5432 - to_port = 5432 + protocol = "tcp" + from_port = 5432 + to_port = 5432 cidr_blocks = var.private_subnet_cidrs + description = "PostgreSQL" } - ingress { - protocol = "tcp" - from_port = 9092 - to_port = 9093 + ingress { + protocol = "tcp" + from_port = 9092 + to_port = 9093 cidr_blocks = var.private_subnet_cidrs + description = "Kafka" } egress { - protocol = "-1" - from_port = 0 - to_port = 0 - cidr_blocks = ["0.0.0.0/0"] - ipv6_cidr_blocks = ["::/0"] + protocol = "-1" + from_port = 0 + to_port = 0 + cidr_blocks = ["0.0.0.0/0"] + ipv6_cidr_blocks = ["::/0"] + } + + tags = { + Env = var.deployment_id } } resource "aws_security_group" "dbeaver_te" { - name = "DBeaverTE-${var.deployment_id}-ecs-service-dbeaver-te" - vpc_id = aws_vpc.dbeaver_net.id + name = "${local.name_prefix}-${var.deployment_id}-ecs-service-dbeaver-te" + vpc_id = local.vpc_id description = "DBeaverTE ${var.deployment_id} ECS DBeaverTE SG" ingress { - protocol = "tcp" - from_port = 8970 - to_port = 8980 - cidr_blocks = concat(var.private_subnet_cidrs, var.public_subnet_cidrs) + protocol = "tcp" + from_port = 8970 + to_port = 8980 + cidr_blocks = concat(var.private_subnet_cidrs, var.public_subnet_cidrs) } egress { - protocol = "-1" - from_port = 0 - to_port = 0 - cidr_blocks = ["0.0.0.0/0"] - ipv6_cidr_blocks = ["::/0"] + protocol = "-1" + from_port = 0 + to_port = 0 + cidr_blocks = ["0.0.0.0/0"] + ipv6_cidr_blocks = ["::/0"] + } + + tags = { + Env = var.deployment_id } -} \ No newline at end of file +} diff --git a/AWS/ecs-fargate/variables.tf.example b/AWS/ecs-fargate/variables.tf.example index d747959..0d7140b 100644 --- a/AWS/ecs-fargate/variables.tf.example +++ b/AWS/ecs-fargate/variables.tf.example @@ -61,10 +61,9 @@ variable "rds_db_type" { variable "rds_db_version" { description = "Version of type RDS DB instance" type = string - default = "16.1" + default = "16.6" } - variable "cloudbeaver-db-env" { description = "Parameters for your internal database" # type = map(string) @@ -79,11 +78,54 @@ variable "cloudbeaver-db-env" { } +variable "db_instance_class" { + description = "The instance type of the RDS instance" + type = string + default = "db.t3.micro" +} + +variable "db_allocated_storage" { + description = "The allocated storage in gigabytes" + type = number + default = 20 +} + +# WARNING: changing this on an existing deployment forces recreation and destroys all EFS data +variable "efs_encrypted" { + description = "Enable encryption for EFS file systems" + type = bool + default = true +} + variable "dbeaver_te_default_ns" { type = string default = "dbeaver-te.local" } +variable "create_vpc" { + description = "Whether to create a new VPC or use an existing one" + type = bool + default = true +} + +variable "vpc_id" { + description = "Existing VPC ID (used when create_vpc = false)" + type = string + default = "" +} + +variable "public_subnet_ids" { + description = "Existing public subnet IDs (used when create_vpc = false)" + type = list(string) + default = [] +} + +variable "private_subnet_ids" { + description = "Existing private subnet IDs (used when create_vpc = false)" + type = list(string) + default = [] +} + variable "vpc_cidr" { type = string default = "10.0.0.0/16" diff --git a/AWS/ecs-fargate/versions.tf b/AWS/ecs-fargate/versions.tf index 2fac521..498fb88 100644 --- a/AWS/ecs-fargate/versions.tf +++ b/AWS/ecs-fargate/versions.tf @@ -1,10 +1,10 @@ terraform { - required_version = ">= 1.0" + required_version = ">= 1.7" required_providers { aws = { source = "hashicorp/aws" - version = ">= 4.6" + version = ">= 5.0" } } } \ No newline at end of file diff --git a/AWS/ecs-fargate/vpc.tf b/AWS/ecs-fargate/vpc.tf new file mode 100644 index 0000000..132e00a --- /dev/null +++ b/AWS/ecs-fargate/vpc.tf @@ -0,0 +1,18 @@ +################################################################################ +# VPC (optional, created when var.create_vpc = true) +################################################################################ + +module "vpc" { + source = "./modules/vpc" + + count = var.create_vpc ? 1 : 0 + + name = local.name_prefix_full + cidr = var.vpc_cidr + public_subnet_cidrs = var.public_subnet_cidrs + private_subnet_cidrs = var.private_subnet_cidrs + + tags = { + Env = var.deployment_id + } +} From 3a73231eac8ea06cb77349e9a1165d4ecef3831c Mon Sep 17 00:00:00 2001 From: Mikhailov Grigorii <49814763+ggxed@users.noreply.github.com> Date: Mon, 1 Jun 2026 12:51:37 +0200 Subject: [PATCH 23/24] =?UTF-8?q?dbeaver/dbeaver-devops#2197=20The=20postg?= =?UTF-8?q?res=5Fimage=20variable=20has=20been=20adde=E2=80=A6=20(#202)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * dbeaver/dbeaver-devops#2197 The postgres_image variable has been added to make it easier to change the internal database images * dbeaver/dbeaver-devops#2197 Changed db_image varible name --- AWS/ecs-fargate/ecs-postgres.tf | 2 +- AWS/ecs-fargate/variables.tf.example | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/AWS/ecs-fargate/ecs-postgres.tf b/AWS/ecs-fargate/ecs-postgres.tf index ea0fc55..eb2e0c7 100644 --- a/AWS/ecs-fargate/ecs-postgres.tf +++ b/AWS/ecs-fargate/ecs-postgres.tf @@ -13,7 +13,7 @@ module "postgres" { log_prefix = "db" deployment_id = var.deployment_id container_name_override = "${var.deployment_id}-postgres" - image = "${var.image_source}/cloudbeaver-postgres:16" + image = var.db_image cpu = 256 memory = 512 container_port = 5432 diff --git a/AWS/ecs-fargate/variables.tf.example b/AWS/ecs-fargate/variables.tf.example index 0d7140b..a93de49 100644 --- a/AWS/ecs-fargate/variables.tf.example +++ b/AWS/ecs-fargate/variables.tf.example @@ -64,6 +64,12 @@ variable "rds_db_version" { default = "16.6" } +variable "db_image" { + description = "Image for the internal database container" + type = string + default = "dbeaver/cloudbeaver-postgres:16" +} + variable "cloudbeaver-db-env" { description = "Parameters for your internal database" # type = map(string) From 5442e139010182f5578d2f2c60dac59a744276d5 Mon Sep 17 00:00:00 2001 From: Greg Miller Date: Thu, 4 Jun 2026 19:53:31 +0200 Subject: [PATCH 24/24] dbeaver/dbeaver-devops#2678 Release 26.1.0 --- AWS/ecs-fargate/variables.tf.example | 2 +- README.md | 6 ++---- compose/cbte/.env.example | 2 +- k8s/cbte/Chart.yaml | 2 +- k8s/cbte/values.yaml.example | 2 +- 5 files changed, 6 insertions(+), 8 deletions(-) diff --git a/AWS/ecs-fargate/variables.tf.example b/AWS/ecs-fargate/variables.tf.example index a93de49..51070a5 100644 --- a/AWS/ecs-fargate/variables.tf.example +++ b/AWS/ecs-fargate/variables.tf.example @@ -13,7 +13,7 @@ variable "aws_region" { variable "dbeaver_te_version" { description = "The version of the cluster you want to deploy" type = string - default = "ea" + default = "26.1.0" } variable "image_source" { diff --git a/README.md b/README.md index 7e7c50f..b79f035 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,6 @@ ## DBeaver Team Edition -#### Version 26.1 Early Access - -**Warning:** Please keep in mind that Early Access versions are not as stable as regular releases, and their use in a production environment is not recommended. +#### Version 26.1 DBeaver Team Edition is a client-server application. It requires server deployment. You can deploy it on a single host (e.g. your local computer) @@ -40,7 +38,7 @@ DBeaver Team Edition works in conjunction with a desktop client application. Aft - **Web interface** – accessible directly through your browser - **Desktop client** – provides enhanced features and better performance -Download the desktop client for your platform: [**DBeaver Team Edition Desktop**](https://dbeaver.com/files/ea/team/) +Download the desktop client for your platform: [**DBeaver Team Edition Desktop**](https://dbeaver.com/downloads-team/26.1.0/) ### Server version update Version update is handled differently for different deployment methods. To update the Team Edition version, follow these instructions: diff --git a/compose/cbte/.env.example b/compose/cbte/.env.example index c51b3b9..ce36bcb 100644 --- a/compose/cbte/.env.example +++ b/compose/cbte/.env.example @@ -1,6 +1,6 @@ # CloudBeaver TE server version. Based on DockerHub images tag # -CLOUDBEAVER_VERSION_TAG=ea +CLOUDBEAVER_VERSION_TAG=26.1.0 IMAGE_SOURCE=dbeaver PODMAN_IMAGE_SOURCE=docker.io/dbeaver # Domain name of cluster endpoint. eg. dbeaver-te.example.com diff --git a/k8s/cbte/Chart.yaml b/k8s/cbte/Chart.yaml index ce930c6..7b2e39d 100644 --- a/k8s/cbte/Chart.yaml +++ b/k8s/cbte/Chart.yaml @@ -3,4 +3,4 @@ name: cbte description: A Helm chart for CloudBeaver TE application type: application version: 0.0.1 -appVersion: ea +appVersion: 26.1.0 diff --git a/k8s/cbte/values.yaml.example b/k8s/cbte/values.yaml.example index eb7de83..11f7a48 100644 --- a/k8s/cbte/values.yaml.example +++ b/k8s/cbte/values.yaml.example @@ -4,7 +4,7 @@ # cloudbeaver general values for all TE services cloudbeaver: - imageTag: "ea" + imageTag: "26.1.0" pullPolicy: Always # pullCredsName - name of a secret config map that contains docker repo auths # pullCredsName: regcred