oss-nginx

solution/tech-solution/oss-nginx/README.md

@@ -0,0 +1,62 @@
+## Introduction
+
+<!-- DOCS_DESCRIPTION_CN -->
+本示例用于实现解决方案[应用日志数据归档](https://www.aliyun.com/solution/tech-solution/oss-nginx),  涉及到专有网络（VPC）、交换机（VSwitch）、云服务器（ECS）、RAM 用户等资源的创建。
+<!-- DOCS_DESCRIPTION_CN -->
+
+<!-- DOCS_DESCRIPTION_EN -->
+This example is used to implement solution [Archive App Logs](https://www.aliyun.com/solution/tech-solution/oss-nginx). It involves the creation, and deployment of resources such as Virtual Private Cloud (VPC), VSwitch, Elastic Compute Service (ECS), and RAM users.
+<!-- DOCS_DESCRIPTION_EN -->
+
+<!-- BEGIN_TF_DOCS -->
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_alicloud"></a> [alicloud](#provider\_alicloud) | n/a |
+| <a name="provider_random"></a> [random](#provider\_random) | n/a |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [alicloud_ecs_command.run_command_nginx_loongcollector](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/ecs_command) | resource |
+| [alicloud_ecs_invocation.invoke_script_nginx_loongcollector](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/ecs_invocation) | resource |
+| [alicloud_instance.ecs_instance](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/instance) | resource |
+| [alicloud_log_machine_group.this](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/log_machine_group) | resource |
+| [alicloud_log_project.sls_project](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/log_project) | resource |
+| [alicloud_log_store.sls_log_store](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/log_store) | resource |
+| [alicloud_log_store_index.sls_index](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/log_store_index) | resource |
+| [alicloud_logtail_attachment.this](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/logtail_attachment) | resource |
+| [alicloud_logtail_config.this](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/logtail_config) | resource |
+| [alicloud_oss_bucket.oss_bucket](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/oss_bucket) | resource |
+| [alicloud_ram_access_key.ramak](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/ram_access_key) | resource |
+| [alicloud_ram_role.log_default_role](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/ram_role) | resource |
+| [alicloud_ram_role_policy_attachment.attach_policy_to_role](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/ram_role_policy_attachment) | resource |
+| [alicloud_ram_user.ram_user](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/ram_user) | resource |
+| [alicloud_ram_user_policy_attachment.attach_policy_to_user](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/ram_user_policy_attachment) | resource |
+| [alicloud_security_group.security_group](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/security_group) | resource |
+| [alicloud_security_group_rule.allow_db](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/security_group_rule) | resource |
+| [alicloud_security_group_rule.allow_http](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/security_group_rule) | resource |
+| [alicloud_security_group_rule.allow_ssh](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/security_group_rule) | resource |
+| [alicloud_sls_oss_export_sink.default](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/sls_oss_export_sink) | resource |
+| [alicloud_vpc.vpc](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/vpc) | resource |
+| [alicloud_vswitch.vswitch](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/resources/vswitch) | resource |
+| [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
+| [alicloud_images.default](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/data-sources/images) | data source |
+| [alicloud_log_service.open](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/data-sources/log_service) | data source |
+| [alicloud_oss_service.open](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/data-sources/oss_service) | data source |
+| [alicloud_zones.default](https://registry.terraform.io/providers/hashicorp/alicloud/latest/docs/data-sources/zones) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_ecs_instance_password"></a> [ecs\_instance\_password](#input\_ecs\_instance\_password) | 服务器登录密码,长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）` | `string` | n/a | yes |
+| <a name="input_ecs_instance_type"></a> [ecs\_instance\_type](#input\_ecs\_instance\_type) | 实例类型 | `string` | `"ecs.t6-c1m2.large"` | no |
+| <a name="input_region"></a> [region](#input\_region) | n/a | `string` | `"cn-hangzhou"` | no |
+<!-- END_TF_DOCS -->

solution/tech-solution/oss-nginx/main.tf

@@ -0,0 +1,267 @@
+provider "alicloud" {
+  region = var.region
+}
+
+data "alicloud_zones" "default" {
+  available_disk_category     = "cloud_essd"
+  available_resource_creation = "VSwitch"
+  available_instance_type     = var.ecs_instance_type
+}
+
+resource "random_string" "suffix" {
+  length  = 8
+  lower   = true
+  upper   = false
+  numeric = false
+  special = false
+}
+
+locals {
+  common_name = random_string.suffix.id
+}
+
+resource "alicloud_vpc" "vpc" {
+  cidr_block = "192.168.0.0/16"
+  vpc_name   = "vpc-${local.common_name}"
+}
+
+resource "alicloud_vswitch" "vswitch" {
+  vpc_id       = alicloud_vpc.vpc.id
+  cidr_block   = "192.168.0.0/24"
+  zone_id      = data.alicloud_zones.default.zones.0.id
+  vswitch_name = "vswitch-${local.common_name}"
+}
+
+resource "alicloud_security_group" "security_group" {
+  vpc_id              = alicloud_vpc.vpc.id
+  security_group_name = "sg-${local.common_name}"
+}
+
+resource "alicloud_security_group_rule" "allow_ssh" {
+  type              = "ingress"
+  ip_protocol       = "tcp"
+  nic_type          = "intranet"
+  policy            = "accept"
+  port_range        = "22/22"
+  priority          = 1
+  security_group_id = alicloud_security_group.security_group.id
+  cidr_ip           = "0.0.0.0/0"
+}
+
+resource "alicloud_security_group_rule" "allow_http" {
+  type              = "ingress"
+  ip_protocol       = "tcp"
+  nic_type          = "intranet"
+  policy            = "accept"
+  port_range        = "80/80"
+  priority          = 1
+  security_group_id = alicloud_security_group.security_group.id
+  cidr_ip           = "0.0.0.0/0"
+}
+
+resource "alicloud_security_group_rule" "allow_db" {
+  type              = "ingress"
+  ip_protocol       = "tcp"
+  nic_type          = "intranet"
+  policy            = "accept"
+  port_range        = "3306/3306"
+  priority          = 1
+  security_group_id = alicloud_security_group.security_group.id
+  cidr_ip           = "0.0.0.0/0"
+}
+
+data "alicloud_images" "default" {
+  name_regex  = "^aliyun_3_x64_20G_alibase_.*"
+  most_recent = true
+  owners      = "system"
+}
+
+resource "alicloud_ram_user" "ram_user" {
+  name = "ram-user-${local.common_name}"
+}
+
+resource "alicloud_ram_access_key" "ramak" {
+  user_name = alicloud_ram_user.ram_user.name
+}
+
+resource "alicloud_ram_user_policy_attachment" "attach_policy_to_user" {
+  user_name   = alicloud_ram_user.ram_user.name
+  policy_type = "System"
+  policy_name = "AliyunLogFullAccess"
+  depends_on = [
+    alicloud_ram_access_key.ramak
+  ]
+}
+
+resource "alicloud_instance" "ecs_instance" {
+  instance_name              = "ecs-${local.common_name}"
+  image_id                   = data.alicloud_images.default.images[0].id
+  instance_type              = var.ecs_instance_type
+  system_disk_category       = "cloud_essd"
+  security_groups            = [alicloud_security_group.security_group.id]
+  vswitch_id                 = alicloud_vswitch.vswitch.id
+  password                   = var.ecs_instance_password
+  internet_max_bandwidth_out = 5
+}
+
+resource "alicloud_ecs_command" "run_command_nginx_loongcollector" {
+  name = "command-run-nginx-loongcollector-${local.common_name}"
+  command_content = base64encode(<<EOF
+#!/bin/bash
+yum update -y
+yum install -y nginx
+systemctl start nginx
+systemctl enable nginx
+
+wget http://aliyun-observability-release-${var.region}.oss-${var.region}.aliyuncs.com/loongcollector/linux64/latest/loongcollector.sh -O loongcollector.sh
+chmod +x loongcollector.sh
+./loongcollector.sh install ${var.region}-internet
+
+cat << EOJ >> genlog.sh
+echo "127.0.0.1 - - [\$(date +'%d/%b/%Y:%H:%M:%S %z')] \"GET /HTTP/1.1\" 200 4897 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\"" >> /var/log/nginx/access.log
+EOJ
+chmod +x genlog.sh
+
+cat << EOT >> crontest.cron
+* * * * * ./genlog.sh
+EOT
+
+crontab crontest.cron
+EOF
+  )
+  working_dir = "/root"
+  type        = "RunShellScript"
+  timeout     = 3600
+}
+
+resource "alicloud_ecs_invocation" "invoke_script_nginx_loongcollector" {
+  instance_id = [alicloud_instance.ecs_instance.id]
+  command_id  = alicloud_ecs_command.run_command_nginx_loongcollector.id
+  timeouts {
+    create = "15m"
+  }
+  depends_on = [alicloud_instance.ecs_instance]
+}
+
+data "alicloud_log_service" "open" {
+  enable = "On"
+}
+
+resource "alicloud_log_project" "sls_project" {
+  project_name = "sls-project-${local.common_name}"
+}
+
+resource "alicloud_log_store" "sls_log_store" {
+  logstore_name = "sls-logstore-${local.common_name}"
+  project_name  = alicloud_log_project.sls_project.project_name
+  depends_on    = [alicloud_log_project.sls_project]
+}
+
+resource "alicloud_log_machine_group" "this" {
+  identify_list = alicloud_instance.ecs_instance[*].primary_ip_address
+  name          = "lmg-${local.common_name}"
+  project       = alicloud_log_project.sls_project.project_name
+  identify_type = "ip"
+}
+
+resource "alicloud_logtail_config" "this" {
+  project      = alicloud_log_project.sls_project.project_name
+  input_detail = <<EOF
+{
+  "discardUnmatch": false,
+  "enableRawLog": true,
+  "fileEncoding": "utf8",
+  "filePattern": "access.log",
+  "logPath": "/var/log/nginx/",
+  "logType": "common_reg_log",
+  "maxDepth": 10,
+  "topicFormat": "none"
+}
+EOF
+  input_type   = "file"
+  logstore     = alicloud_log_store.sls_log_store.logstore_name
+  name         = "lc-${local.common_name}"
+  output_type  = "LogService"
+}
+
+resource "alicloud_logtail_attachment" "this" {
+  project             = alicloud_log_project.sls_project.project_name
+  logtail_config_name = alicloud_logtail_config.this.name
+  machine_group_name  = alicloud_log_machine_group.this.name
+}
+
+resource "alicloud_log_store_index" "sls_index" {
+  project  = alicloud_log_project.sls_project.project_name
+  logstore = alicloud_log_store.sls_log_store.logstore_name
+  full_text {
+    token = " :#$^*\r\n\t"
+  }
+  field_search {
+    name  = "content"
+    type  = "text"
+    token = " :#$^*\r\n\t"
+  }
+  depends_on = [alicloud_log_store.sls_log_store]
+}
+
+data "alicloud_oss_service" "open" {
+  enable = "On"
+}
+
+resource "alicloud_ram_role" "log_default_role" {
+  role_name                   = "log-default-role-${local.common_name}"
+  assume_role_policy_document = <<EOF
+  {
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": [
+          "log.aliyuncs.com"
+        ]
+      }
+    }
+  ],
+  "Version": "1"
+  }
+  EOF
+}
+
+resource "alicloud_ram_role_policy_attachment" "attach_policy_to_role" {
+  role_name   = alicloud_ram_role.log_default_role.role_name
+  policy_type = "System"
+  policy_name = "AliyunLogRolePolicy"
+}
+
+resource "alicloud_oss_bucket" "oss_bucket" {
+  bucket        = "bucket-${local.common_name}"
+  storage_class = "IA"
+  force_destroy = true
+}
+
+resource "alicloud_sls_oss_export_sink" "default" {
+  project      = alicloud_log_project.sls_project.project_name
+  display_name = "display-${local.common_name}"
+  job_name     = "export-${local.common_name}"
+  configuration {
+    logstore  = alicloud_log_store.sls_log_store.logstore_name
+    role_arn  = alicloud_ram_role.log_default_role.arn
+    from_time = 1
+    to_time   = 0
+    sink {
+      bucket           = alicloud_oss_bucket.oss_bucket.bucket
+      buffer_interval  = "300"
+      buffer_size      = "250"
+      compression_type = "gzip"
+      content_type     = "json"
+      content_detail   = jsonencode({ "enableTag" : true })
+      endpoint         = "https://oss-${var.region}-internal.aliyuncs.com"
+      time_zone        = "+0800"
+      role_arn         = alicloud_ram_role.log_default_role.arn
+      prefix           = "app01"
+      suffix           = ""
+      path_format      = "%Y/%m/%d/%H/%M"
+    }
+  }
+}

solution/tech-solution/oss-nginx/outputs.tf

@@ -0,0 +1,4 @@
+output "ecs_login_address" {
+  description = "生成日志的ECS实例的登录地址。通过此地址登录ECS后，在本地查看生成日志文件的命令为：tail -f /var/log/nginx/access.log"
+  value       = format("https://ecs-workbench.aliyun.com/?from=ecs&instanceType=ecs&regionId=%s&instanceId=%s&resourceGroupId=", var.region, alicloud_instance.ecs_instance.id)
+}

solution/tech-solution/oss-nginx/variables.tf

@@ -0,0 +1,16 @@
+variable "region" {
+  type    = string
+  default = "cn-hangzhou"
+}
+
+variable "ecs_instance_type" {
+  type        = string
+  default     = "ecs.t6-c1m2.large"
+  description = "实例类型"
+}
+
+variable "ecs_instance_password" {
+  type        = string
+  sensitive   = true
+  description = "服务器登录密码,长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）"
+}