Fix configuring certs directly via terraform

ooni · Oct 1, 2024 · 461d1a1 · 461d1a1
1 parent 63968c0
commit 461d1a1
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 41 deletions.
diff --git a/tf/environments/dev/main.tf b/tf/environments/dev/main.tf
@@ -584,6 +584,9 @@ module "ooniapi_frontend" {
 
 locals {
  ooniapi_frontend_alternative_domains = {
+ "ooniauth.${local.environment}.ooni.io" : local.dns_zone_ooni_io,
+ "ooniprobe.${local.environment}.ooni.io" : local.dns_zone_ooni_io,
+ "oonirun.${local.environment}.ooni.io" : local.dns_zone_ooni_io,
  "8.th.dev.ooni.io" : local.dns_zone_ooni_io,
  }
  ooniapi_frontend_main_domain_name = "api.${local.environment}.ooni.io"
@@ -625,10 +628,6 @@ resource "aws_acm_certificate" "ooniapi_frontend" {
  tags = local.tags
 
  subject_alternative_names = keys(local.ooniapi_frontend_alternative_domains)
-
- lifecycle {
- create_before_destroy = true
- }
 }
 
 resource "aws_route53_record" "ooniapi_frontend_cert_validation" {
@@ -646,7 +645,7 @@ resource "aws_route53_record" "ooniapi_frontend_cert_validation" {
  records = [each.value.record]
  ttl = 60
  type = each.value.type
- zone_id = lookup(local.ooniapi_frontend_alternative_domains, each.value.domain_name, module.ooniapi_frontend.ooniapi_dns_zone_id)
+ zone_id = lookup(local.ooniapi_frontend_alternative_domains, each.value.domain_name, local.dns_zone_ooni_io)
 }
 
 resource "aws_acm_certificate_validation" "ooniapi_frontend" {

diff --git a/tf/environments/prod/main.tf b/tf/environments/prod/main.tf
@@ -567,7 +567,7 @@ module "ooniapi_frontend" {
  module.ooniapi_cluster.web_security_group_id
  ]
 
- ooniapi_acm_certificate_arn = "arn:aws:acm:eu-central-1:471112720364:certificate/d0a13d97-677e-4713-84fa-b7f3f992af87"
+ ooniapi_acm_certificate_arn = aws_acm_certificate.ooniapi_frontend.arn
 
  oonith_domains = [
  "*.th.ooni.org",
@@ -595,6 +595,10 @@ locals {
  "4.th.ooni.org" : local.dns_root_zone_ooni_org,
  "5.th.ooni.org" : local.dns_root_zone_ooni_org,
  "6.th.ooni.org" : local.dns_root_zone_ooni_org,
+ # TODO: add these once we unlock the quota for maximum certificates
+ #"ooniauth.${local.environment}.ooni.io" : local.dns_zone_ooni_io,
+ #"ooniprobe.${local.environment}.ooni.io" : local.dns_zone_ooni_io,
+ #"oonirun.${local.environment}.ooni.io" : local.dns_zone_ooni_io,
  }
  ooniapi_frontend_main_domain_name = "api.${local.environment}.ooni.io"
  ooniapi_frontend_main_domain_name_zone_id = local.dns_zone_ooni_io
@@ -629,41 +633,37 @@ resource "aws_route53_record" "ooniapi_frontend_alt" {
 }
 
 # TODO: currently the certificate is hardcoded
-#resource "aws_acm_certificate" "ooniapi_frontend" {
-# domain_name = local.ooniapi_frontend_main_domain_name
-# validation_method = "DNS"
-#
-# tags = local.tags
-#
-# subject_alternative_names = keys(local.ooniapi_frontend_alternative_domains)
-#
-# lifecycle {
-# create_before_destroy = true
-# }
-#}
-#
-#resource "aws_route53_record" "ooniapi_frontend_cert_validation" {
-# for_each = {
-# for dvo in aws_acm_certificate.ooniapi_frontend.domain_validation_options : dvo.domain_name => {
-# name = dvo.resource_record_name
-# record = dvo.resource_record_value
-# type = dvo.resource_record_type
-# domain_name = dvo.domain_name
-# }
-# }
-#
-# allow_overwrite = true
-# name = each.value.name
-# records = [each.value.record]
-# ttl = 60
-# type = each.value.type
-# zone_id = lookup(local.ooniapi_frontend_alternative_domains, each.value.domain_name, module.ooniapi_frontend.ooniapi_dns_zone_id)
-#}
-#
-#resource "aws_acm_certificate_validation" "ooniapi_frontend" {
-# certificate_arn = aws_acm_certificate.ooniapi_frontend.arn
-# validation_record_fqdns = [for record in aws_route53_record.ooniapi_frontend_cert_validation : record.fqdn]
-#}
+resource "aws_acm_certificate" "ooniapi_frontend" {
+ domain_name = local.ooniapi_frontend_main_domain_name
+ validation_method = "DNS"
+
+ tags = local.tags
+
+ subject_alternative_names = keys(local.ooniapi_frontend_alternative_domains)
+}
+
+resource "aws_route53_record" "ooniapi_frontend_cert_validation" {
+ for_each = {
+ for dvo in aws_acm_certificate.ooniapi_frontend.domain_validation_options : dvo.domain_name => {
+ name = dvo.resource_record_name
+ record = dvo.resource_record_value
+ type = dvo.resource_record_type
+ domain_name = dvo.domain_name
+ }
+ }
+
+ allow_overwrite = true
+ name = each.value.name
+ records = [each.value.record]
+ ttl = 60
+ type = each.value.type
+ zone_id = lookup(local.ooniapi_frontend_alternative_domains, each.value.domain_name, local.dns_zone_ooni_io)
+}
+
+resource "aws_acm_certificate_validation" "ooniapi_frontend" {
+ certificate_arn = aws_acm_certificate.ooniapi_frontend.arn
+ validation_record_fqdns = [for record in aws_route53_record.ooniapi_frontend_cert_validation : record.fqdn]
+}
 
 
 ## Code signing setup