added infra setup with terraform

infra/main.tf

@@ -0,0 +1,253 @@
+terraform {
+  required_version = ">= 1.5"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+    tls = {
+      source  = "hashicorp/tls"
+      version = "~> 4.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = var.region
+}
+
+# --- Variables ---
+
+variable "region" {
+  default = "us-east-1"
+}
+
+variable "vpc_id" {
+  description = "VPC ID to deploy into"
+  type        = string
+}
+
+variable "subnet_ids" {
+  description = "At least 2 subnet IDs in different AZs (required for RDS subnet group)"
+  type        = list(string)
+}
+
+variable "db_password" {
+  description = "Postgres master password"
+  type        = string
+  sensitive   = true
+}
+
+variable "ssh_cidr" {
+  description = "CIDR block for SSH access (e.g., 203.0.113.50/32)"
+  type        = string
+}
+
+variable "ec2_instance_type" {
+  default = "c5.xlarge"
+}
+
+variable "scanning" {
+  description = "Set to true during scanning phase, false for serving-only (tears down EC2, RDS, icons bucket)"
+  type        = bool
+  default     = true
+}
+
+# --- Data sources ---
+
+data "aws_ami" "al2023" {
+  most_recent = true
+  owners      = ["amazon"]
+  filter {
+    name   = "name"
+    values = ["al2023-ami-2023*-x86_64"]
+  }
+  filter {
+    name   = "state"
+    values = ["available"]
+  }
+}
+
+# --- SSH Key ---
+
+resource "tls_private_key" "ec2" {
+  count     = var.scanning ? 1 : 0
+  algorithm = "ED25519"
+}
+
+resource "aws_key_pair" "ec2" {
+  count      = var.scanning ? 1 : 0
+  key_name   = "everytab-key"
+  public_key = tls_private_key.ec2[0].public_key_openssh
+}
+
+# --- Security Groups ---
+
+resource "aws_security_group" "ec2" {
+  count       = var.scanning ? 1 : 0
+  name        = "everytab-ec2"
+  description = "EveryTab EC2 instance"
+  vpc_id      = var.vpc_id
+
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = [var.ssh_cidr]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_security_group" "rds" {
+  count       = var.scanning ? 1 : 0
+  name        = "everytab-rds"
+  description = "EveryTab RDS instance"
+  vpc_id      = var.vpc_id
+
+  ingress {
+    from_port       = 5432
+    to_port         = 5432
+    protocol        = "tcp"
+    security_groups = [aws_security_group.ec2[0].id]
+  }
+}
+
+# --- IAM ---
+
+resource "aws_iam_role" "ec2" {
+  count = var.scanning ? 1 : 0
+  name  = "everytab-ec2-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "ec2.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "s3_access" {
+  count = var.scanning ? 1 : 0
+  name  = "everytab-s3-access"
+  role  = aws_iam_role.ec2[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Action = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:HeadObject"]
+      Resource = [
+        aws_s3_bucket.icons[0].arn,
+        "${aws_s3_bucket.icons[0].arn}/*",
+        aws_s3_bucket.site.arn,
+        "${aws_s3_bucket.site.arn}/*",
+      ]
+    }]
+  })
+}
+
+resource "aws_iam_instance_profile" "ec2" {
+  count = var.scanning ? 1 : 0
+  name  = "everytab-ec2-profile"
+  role  = aws_iam_role.ec2[0].name
+}
+
+# --- S3 ---
+
+resource "aws_s3_bucket" "icons" {
+  count  = var.scanning ? 1 : 0
+  bucket = "everytab-icons"
+}
+
+resource "aws_s3_bucket_public_access_block" "icons" {
+  count                   = var.scanning ? 1 : 0
+  bucket                  = aws_s3_bucket.icons[0].id
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket" "site" {
+  bucket = "everytab-site"
+}
+
+# --- RDS ---
+
+resource "aws_db_subnet_group" "main" {
+  count      = var.scanning ? 1 : 0
+  name       = "everytab"
+  subnet_ids = var.subnet_ids
+}
+
+resource "aws_db_instance" "main" {
+  count                  = var.scanning ? 1 : 0
+  identifier             = "everytab"
+  engine                 = "postgres"
+  engine_version         = "16"
+  instance_class         = "db.t3.medium"
+  allocated_storage      = 20
+  storage_type           = "gp3"
+  db_name                = "everytab"
+  username               = "everytab"
+  password               = var.db_password
+  db_subnet_group_name   = aws_db_subnet_group.main[0].name
+  vpc_security_group_ids = [aws_security_group.rds[0].id]
+  publicly_accessible    = false
+  multi_az               = false
+  backup_retention_period = 0
+  skip_final_snapshot    = true
+}
+
+# --- EC2 ---
+
+resource "aws_instance" "main" {
+  count                = var.scanning ? 1 : 0
+  ami                  = data.aws_ami.al2023.id
+  instance_type        = var.ec2_instance_type
+  key_name             = aws_key_pair.ec2[0].key_name
+  vpc_security_group_ids = [aws_security_group.ec2[0].id]
+  subnet_id            = var.subnet_ids[0]
+  iam_instance_profile = aws_iam_instance_profile.ec2[0].name
+
+  root_block_device {
+    volume_size = 50
+    volume_type = "gp3"
+  }
+
+  tags = {
+    Name = "everytab"
+  }
+}
+
+# --- Outputs ---
+
+output "ec2_public_ip" {
+  value = var.scanning ? aws_instance.main[0].public_ip : null
+}
+
+output "rds_endpoint" {
+  value = var.scanning ? aws_db_instance.main[0].endpoint : null
+}
+
+output "database_url" {
+  value     = var.scanning ? "postgres://everytab:${var.db_password}@${aws_db_instance.main[0].endpoint}/everytab" : null
+  sensitive = true
+}
+
+output "ssh_private_key" {
+  value     = var.scanning ? tls_private_key.ec2[0].private_key_openssh : null
+  sensitive = true
+}
+
+output "ssh_command" {
+  value = var.scanning ? "ssh -i everytab-key ec2-user@${aws_instance.main[0].public_ip}" : null
+}