Add a Terraform configuration to deploy lnt.llvm.org #128

ldionne · 2025-10-31T16:18:57Z

This patch adds a Terraform configuration file that should allow deploying to an EC2 instance. It requires a few secrets to be made available to Github Actions.

docker/lnt.llvm.org/main.tf

.github/workflows/deploy-lnt.llvm.org.yaml

ldionne · 2025-10-31T16:24:15Z

CC @lukel97 I went ahead and gave this a shot, I was curious to understand the whole pipeline

ldionne · 2025-10-31T16:26:44Z

@boomanaiden154 I also created the appropriately-named secrets in the Github Actions of this repository, however they all have fake values at the moment.

lukel97

Thanks for fleshing this out, I'm not sure if you've tried deploying this to a test AWS account yet but it looks like it's missing a security group/ingress rules etc., so the web server won't be reachable by any public traffic IIUC.

I've also got some terraform files written here, it would be good to collaborate on this. I don't want us to step on each others toes so I'll just leave review comments for now but let me know if you'd rather have me just commit directly to the branch.

.github/workflows/deploy-lnt.llvm.org.yaml

docker/lnt.llvm.org/ec2-startup.sh.tpl

ldionne · 2025-10-31T16:42:36Z

I've also got some terraform files written here, it would be good to collaborate on this. I don't want us to step on each others toes so I'll just leave review comments for now but let me know if you'd rather have me just commit directly to the branch.

Please feel free to commit directly to the branch. Sorry, I didn't know you had started on this already.

I did try to deploy an EC2 instance in my personal account, however that account is blocked right now (IDK why) so I haven't gotten very far. This was intended to be a starting point.

Feel free to push whatever changes you have to the branch.

docker/lnt.llvm.org/main.tf

docker/lnt.llvm.org/ec2-startup.sh.tpl

lukel97 · 2025-10-31T16:42:40Z

docker/lnt.llvm.org/ec2-startup.sh.tpl

+
+LNT_DB_PASSWORD=${__db_password__}
+LNT_AUTH_TOKEN=${__auth_token__}
+docker compose --file compose.yaml up


IIUC these user data scripts are only called when the instance is first initialized, but not e.g. rebooted. So we probably want to change the docker-compose restart policy to be unless-stopped so the containers get relaunched on a reboot

This depends upon how we set it up. I was thinking it might be better to setup the machine to be a clean slate on every boot, and mount a persistent volume that actually contains the DB. That makes it super easy to change system software inside TF.

lukel97 · 2025-10-31T16:45:14Z

I did try to deploy an EC2 instance in my personal account, however that account is blocked right now (IDK why) so I haven't gotten very far. This was intended to be a starting point.

Hah, my AWS account was also blocked, I'm currently waiting for AWS support to verify my identity. I feel your pain :)

.github/workflows/deploy-lnt.llvm.org.yaml

docker/lnt.llvm.org/ec2-startup.sh.tpl

boomanaiden154 · 2025-10-31T20:18:14Z

docker/lnt.llvm.org/ec2-startup.sh.tpl

+
+LNT_DB_PASSWORD=${__db_password__}
+LNT_AUTH_TOKEN=${__auth_token__}
+docker compose --file compose.yaml up


This depends upon how we set it up. I was thinking it might be better to setup the machine to be a clean slate on every boot, and mount a persistent volume that actually contains the DB. That makes it super easy to change system software inside TF.

docker/lnt.llvm.org/main.tf

boomanaiden154 · 2025-10-31T20:20:06Z

docker/lnt.llvm.org/main.tf

+  region = "us-west-2"
+}
+
+variable "lnt_db_password" {


These should probably be data resources that reference secrets stored inside AWS's secret manager.

https://github.com/llvm/llvm-zorg/blob/87d07e600970abf419046d2ab6083b2d64240bce/premerge/main.tf#L113 is how we set this up for premerge. Not sure exactly how to do this for AWS.

My preference would actually be to leave it as-is and to store these secrets in the Github Actions secrets, unless you see a problem with that. That makes it easier to reuse this Terraform configuration by using their own AWS keys -- that's almost the only thing required.

docker/lnt.llvm.org/main.tf

ldionne · 2025-11-10T22:46:05Z

Just to avoid duplicate work, @lukel97 my AWS account is functional now and I am working on addressing the PR comments. LMK if you had also made progress on your end before I invest too much time into it.

This patch adds a Terraform configuration file that should allow deploying to an EC2 instance. It requires a few secrets to be made available to Github Actions.

ldionne · 2025-11-13T21:15:57Z

@lukel97 @boomanaiden154 This should be ready for review now. With this Terraform configuration, I'm able to deploy a server in my personal AWS account.

The only remaining steps would be:

Creating the S3 bucket in the LLVM Foundation's account to store the Terraform state
Adjusting the AWS credentials to use the ones from the LLVM Foundation's AWS account (in the Github secrets)
Adjusting the instance size and the EBS storage size, which we can arguably do later

Also CC @petrhosek as member of the infrastructure group.

deployment/main.tf

boomanaiden154

Looking pretty good at this point. Another round of comments.

.github/workflows/deploy-lnt.llvm.org.yaml

boomanaiden154 · 2025-11-19T19:43:30Z

deployment/main.tf

+
+terraform {
+  backend "s3" {
+    bucket  = "lnt.llvm.org-test-bucket" # TODO: Adjust this for the real LLVM Foundation account


Is the plan to also control this bucket within terraform?

So far, I've been managing this bucket manually in AWS. But TBH, nothing is really required beyond the initial creation of the bucket (which you want to make versioned). After that, Terraform automatically updates its state in the bucket without you having to do anything.

What kind of "management in Terraform" did you have in mind?

I was mainly thinking of what we do in premerge where we also create the bucket in terraform.

https://github.com/llvm/llvm-zorg/blob/a811e7962f335663ccc123026839bdc35409d395/premerge/main.tf#L18

If it's easier to create manually, we can probably just do that.

How does that work though? It looks like you are using a new (randomly-generated) bucket name every time. Is that really the case, or what am I missing?

It randomly generates the name once and then that name gets stored in the terraform state inside the bucket.

The name doesn't need to be random though.

It randomly generates the name once and then that name gets stored in the terraform state inside the bucket.

But how does it know where to get the state from when it starts again without having that state available already, then?

deployment/main.tf

boomanaiden154

One more nit, otherwise LGTM.

I guess the next step is getting permissions to actually deploy this to the foundation's AWS account.

.github/workflows/deploy-lnt.llvm.org.yaml

boomanaiden154 · 2025-11-19T21:58:44Z

deployment/main.tf

+
+terraform {
+  backend "s3" {
+    bucket  = "lnt.llvm.org-test-bucket" # TODO: Adjust this for the real LLVM Foundation account


I was mainly thinking of what we do in premerge where we also create the bucket in terraform.

https://github.com/llvm/llvm-zorg/blob/a811e7962f335663ccc123026839bdc35409d395/premerge/main.tf#L18

If it's easier to create manually, we can probably just do that.

deployment/main.tf

.github/workflows/deploy-lnt.llvm.org.yaml

ldionne · 2025-11-21T13:46:44Z

Thanks for the review and the iteration! @boomanaiden154 If you have any other requests for improvements or changes to the Terraform setup, let me know. The best would be to file an issue that describes them so I can have a look when I get back in two weeks.

ldionne requested a review from boomanaiden154 October 31, 2025 16:18

ldionne commented Oct 31, 2025

View reviewed changes

docker/lnt.llvm.org/main.tf Outdated Show resolved Hide resolved

docker/lnt.llvm.org/main.tf Outdated Show resolved Hide resolved

.github/workflows/deploy-lnt.llvm.org.yaml Outdated Show resolved Hide resolved

.github/workflows/deploy-lnt.llvm.org.yaml Show resolved Hide resolved

lukel97 reviewed Oct 31, 2025

View reviewed changes

.github/workflows/deploy-lnt.llvm.org.yaml Show resolved Hide resolved

docker/lnt.llvm.org/ec2-startup.sh.tpl Outdated Show resolved Hide resolved

lukel97 reviewed Oct 31, 2025

View reviewed changes

boomanaiden154 reviewed Oct 31, 2025

View reviewed changes

ldionne force-pushed the review/terraform branch 3 times, most recently from f01d36e to c591f0b Compare November 13, 2025 21:07

Add a Terraform configuration to deploy lnt.llvm.org

469b91d

This patch adds a Terraform configuration file that should allow deploying to an EC2 instance. It requires a few secrets to be made available to Github Actions.

ldionne force-pushed the review/terraform branch from c591f0b to 469b91d Compare November 13, 2025 21:14

lukel97 reviewed Nov 17, 2025

View reviewed changes

deployment/main.tf Show resolved Hide resolved

deployment/main.tf Outdated Show resolved Hide resolved

deployment/main.tf Outdated Show resolved Hide resolved

Bump size of EBS storage

9654661

boomanaiden154 reviewed Nov 19, 2025

View reviewed changes

ldionne added 2 commits November 19, 2025 15:45

Hash pin actions

c978235

Use AWS Secrets Manager instead of passing form Github secrets

d89843a

boomanaiden154 approved these changes Nov 19, 2025

View reviewed changes

ldionne added 4 commits November 19, 2025 17:03

Also run Terraform plan on PRs

89191d8

Version comment

c1e9c70

Add AWS region

d87720e

Run deploy action on pull-request target only

f8bb46d

ldionne commented Nov 19, 2025

View reviewed changes

.github/workflows/deploy-lnt.llvm.org.yaml Outdated Show resolved Hide resolved

On workflow dispatch'

c12f11a

ldionne merged commit 98a5160 into llvm:main Nov 21, 2025
15 checks passed

ldionne deleted the review/terraform branch November 21, 2025 13:45

Add a Terraform configuration to deploy lnt.llvm.org #128

Add a Terraform configuration to deploy lnt.llvm.org #128

Uh oh!

Conversation

ldionne commented Oct 31, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ldionne commented Oct 31, 2025

Uh oh!

ldionne commented Oct 31, 2025

Uh oh!

lukel97 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ldionne commented Oct 31, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lukel97 commented Oct 31, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ldionne commented Nov 10, 2025

Uh oh!

ldionne commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

boomanaiden154 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

boomanaiden154 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ldionne commented Nov 13, 2025 •

edited

Loading