Merge branch 'ansible-tarraform-provisioning' into 'development'

Added IaC and ConfigManagement See merge request fiat-tux/hat-softwares/lutim!85
2026-08-07 17:33:03 +02:00 · 2022-03-29 10:08:59 +00:00
parent d10ecc41fb f610608aa1
commit a46aab6ffa
23 changed files with 822 additions and 0 deletions
@@ -0,0 +1,7 @@
+## ansible-role-lutim
+
+An ansible role deploy the application on host machine(Ubuntu 20.04)
+
+## terraform-aws-lutim
+
+A terraform plan creates necessary AWS infrastructure and deploy the lutim. This terraform plan uses the above ansible roles `ansible-role-lutim` to configure the application on AWS.
@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/
@@ -0,0 +1,50 @@
+Ansible-Role-lutim
+=========
+This role installs the and configures lutim on Debian/Ubuntu servers with nginx web server configuration.
+
+Role Variables
+-------------- 
+| Variable name | Value | Description |
+| ------------- | ----- | ----------- |
+| `app_dir` | /var/www/lutim | Set the application directory for the best practice |
+| `lutim_owner` | www-data | Set the application user for the best practice |
+| `lutim_group` | www-data | Set the application group for the best practice |
+| `contact` | contact.example.com | Contact option (mandatory), where you have to put some way for the users to contact you. |
+| `secrets` | ffyg7kbkjba | Secrets option (mandotory), which is array of random string. Used by Mojolicious for encrypting session cookies |
+| `project_version` | master | We can chose the project version either Master branch, Dev branch or tag based |
+| `servername` | IP address (or) CNAME/FQDN | Mention the Server Name for the Nginx configurations |
+
+Sample example of use in a playbook
+--------------
+
+The following code has been tested with Ubuntu 20.04
+
+```yaml
+ 
+- name: "install lutim"
+  hosts: enter your hosts file
+  become: yes
+  role:
+    - ansible-role-lutim
+  vars:
+    lutim_owner: "www-data"
+    lutim_group: "www-data"
+    contact: "contact.example.com"
+    secrets: "yigavlvlivwe"
+    app_dir: "/var/www/lutim"
+    project_version: "master"
+    servername: "IP address (or) CNAME/FQDN"
+```   
+
+Contributing
+------------
+Don’t hesitate to create a pull request
+
+
+
+
+
+
+
+
+
@@ -0,0 +1,2 @@
+---
+# defaults file for ansible-role-lutim
@@ -0,0 +1,6 @@
+#Path of the script
+PATH=/var/www/lutim
+
+carton exec script/lutim cron cleanbdd --mode production
+carton exec script/lutim cron cleanfiles --mode production
+carton exec script/lutim cron watch --mode production
@@ -0,0 +1,5 @@
+---
+# handlers file for ansible-role-lutim
+
+- name: restart nginx
+  service: name=nginx state=restarted
@@ -0,0 +1,52 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.1
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.
@@ -0,0 +1,23 @@
+#apprun.yml
+---
+    - name: This command will install the postgress module
+      ansible.builtin.shell:
+        cmd: carton install --deployment --without=test --without=sqlite
+        chdir: "{{ app_dir }}"          
+
+    - name: Upload application config file
+      template:
+        src: ../templates/lutim.conf.j2
+        dest: "{{ app_dir }}/lutim.conf"
+
+    - name: App executes
+      ansible.builtin.shell:
+        cmd: carton exec hypnotoad script/lutim
+        chdir: "{{ app_dir }}" 
+
+    - name: Nginx configuration file add
+      template:
+        src: ../templates/app.conf
+        dest: /etc/nginx/conf.d/
+        mode: '0644'
+      notify: restart nginx
@@ -0,0 +1,21 @@
+---
+  - name: Copy the cronjob file
+    ansible.builtin.copy:
+      src: ../files/cronjob
+      dest: /etc/cron.d/lutim
+      owner: www-data
+      group: www-data
+
+  - name: "example cronjob"
+    ansible.builtin.cron:
+      name: "cronjob"
+      state: present
+      user: www-data
+      minute: "0"
+      hour: "0"
+      day: "*"
+      month: "*"
+      weekday: "*"
+      job: |
+        carton exec script/lutim cron cleanbdd --mode production; carton exec script/lutim cron cleanfiles --mode production; carton exec script/lutim cron watch --mode production        
+        
@@ -0,0 +1,23 @@
+# dependencies.yaml
+--- 
+ - name: Lutim | Update apt cache
+   apt: update_cache=yes 
+   changed_when: no
+ - name: Install Dependencies
+   apt:
+     name:
+       - nginx
+       - carton
+       - build-essential
+       - libssl-dev 
+       - libpq-dev
+       - libio-socket-ssl-perl 
+       - zlib1g-dev
+       - libmojo-sqlite-perl
+       - shared-mime-info
+       - perlmagick
+     state: present
+
+
+    
+    
@@ -0,0 +1,18 @@
+#gitclone
+---
+
+- name: clone the repository
+  ansible.builtin.git:
+    repo: 'https://framagit.org/fiat-tux/hat-softwares/lutim.git'
+    dest: "{{ app_dir }}"
+    clone: yes
+    update: yes 
+    version: "{{ project_version }}"
+
+- name: Change the owner 
+  ansible.builtin.file:
+    path: "{{ app_dir }}"
+    owner: "{{ lutim_owner }}"
+    group: "{{ lutim_group }}"
+    state: directory
+    recurse: yes
@@ -0,0 +1,7 @@
+---
+# tasks file for ansible-role-lutim
+
+- include: dependencies.yaml
+- include: gitclone.yaml
+- include: apprun.yaml
+- include: cronjob.yaml
@@ -0,0 +1,43 @@
+server {
+    listen 80;
+    # No need to have a `root` parameter.
+    server_name {{ servername }};
+    # This is important for user's privacy !
+    access_log off;
+    error_log /var/log/nginx/lutim.error.log;
+    # This is important ! Make it OK with your Lutim configuration
+    client_max_body_size 40M;
+
+    location ~* ^/(img|css|font|js)/ {
+        try_files $uri @lutim;
+        add_header Expires "Thu, 31 Dec 2037 23:55:55 GMT";
+        add_header Cache-Control "public, max-age=315360000";
+
+        # HTTPS only header, improves security
+        #add_header Strict-Transport-Security "max-age=15768000";
+    }
+
+    location / {
+        try_files $uri @lutim;
+
+        # HTTPS only header, improves security
+        #add_header Strict-Transport-Security "max-age=15768000";
+    }
+
+    location @lutim {
+        # Adapt this to your configuration
+        proxy_pass http://127.0.0.1:8080;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+        # If you want to log the remote port of the image senders, you'll need that
+        proxy_set_header X-Remote-Port $remote_port;
+
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # We expect the downsteam servers to redirect to the right hostname, so don't do any rewrites here.
+        proxy_redirect off;
+    }
+}
@@ -0,0 +1,317 @@
+# vim:set sw=4 ts=4 sts=4 ft=perl expandtab:
+{
+    ####################
+    # Hypnotoad settings
+    ####################
+    # see http://mojolicio.us/perldoc/Mojo/Server/Hypnotoad for a full list of settings
+    hypnotoad => {
+        # array of IP addresses and ports you want to listen to
+        listen => ['http://127.0.0.1:8080'],
+        # if you use Lutim behind a reverse proxy like Nginx, you want to set proxy to 1
+        # if you use Lutim directly, let it commented
+        #proxy  => 1,
+    },
+
+    ################
+    # Lutim settings
+    ################
+
+    # put a way to contact you here and uncomment it
+    # mandatory
+    contact           => '{{ contact }}',
+
+    # random string used to encrypt cookies
+    # mandatory
+    secrets           => ['{{ secrets }}'],
+
+    # choose a theme. See the available themes in `themes` directory
+    # optional, default is 'default'
+    #theme         => 'default',
+
+    # length of the images random URL
+    # optional, default is 8
+    #length            => 8,
+
+    # length of the encryption key
+    # optional, default is 8
+    #crypto_key_length => 8,
+
+    # how many URLs will be provisioned in a batch ?
+    # optional, default is 5
+    #provis_step       => 5,
+
+    # max number of URLs to be provisioned
+    # optional, default is 100
+    #provisioning      => 100,
+
+    # anti-flood protection delay, in seconds
+    # users won't be able to ask Lutim to download images more than one per anti_flood_delay seconds
+    # optional, default is 5
+    #anti_flood_delay  => 5,
+
+    # twitter account which will appear on twitter cards
+    # see https://dev.twitter.com/docs/cards/validation/validator to register your Lutim instance on twitter
+    # optional, no default
+    #tweet_card_via    => '@foo',
+
+    # max image size, in octets
+    # you can write it 10*1024*1024
+    # optional, default is 10485760
+    #max_file_size     => 10485760,
+
+    # if you want to have piwik statistics, provide a piwik image tracker
+    # only the image tracker is allowed, no javascript
+    # optional, no default
+    #piwik_img         => 'https://piwik.example.org/piwik.php?idsite=1&amp;rec=1',
+
+    # if you want to include something in the right of the screen, put it here
+    # here's an example to put the logo of your hoster
+    # optional, no default
+    #hosted_by         => 'My super hoster <img src="http://hoster.example.com" alt="Hoster logo">',
+
+    # DEPRECATED DEPRECATED DEPRECATED DEPRECATED DEPRECATED DEPRECATED DEPRECATED DEPRECATED DEPRECATED DEPRECATED
+    # Lutim now checks if the X-Forwarded-Proto header is present and equal to https.
+    # set to 1 if you use Lutim behind a secure web server
+    # optional, default is 0
+    #https             => 0,
+
+    # broadcast_message which will displayed on all pages of Lutim (but no in json response)
+    # optional, no default
+    #broadcast_message => 'Maintenance',
+
+    # array of authorized domains for API calls.
+    # if you want to authorize everyone to use the API: ['*']
+    # optional, no domains allowed by default
+    #allowed_domains   => ['http://1.example.com', 'http://2.example.com'],
+
+    # default time limit for files
+    # valid values are 0, 1, 7, 30 and 365
+    # optional, default is 0 (no limit)
+    #default_delay     => 0,
+
+    # comma-separated values proposed for delays
+    # optional, default is '0,1,7,30,365'
+    #proposed_delays         => '0,1,7,30,365',
+
+    # number of days after which the images will be deleted, even if they were uploaded with "no delay" (or value superior to max_delay)
+    # a warning message will be displayed on homepage
+    # optional, default is 0 (no limit)
+    #max_delay         => 0,
+
+    # if set to 1, all the images will be encrypted and the encryption option will no be displayed
+    # optional, default is 0
+    #always_encrypt    => 0,
+
+    # you can allow to use a watermark on the uploaded images (or enforce its use)
+    # define a path to the watermark image (provide an image with alpha channel)
+    # you can define the path relative to lutim directory or set an absolute path
+    # to disable the usage of a watermark, leave it blank or commented
+    # optional, no default
+    #watermark_path              => '',
+
+    # the watermark can be a tiling one or a single one
+    # when using a small one, you can choose where to place it
+    # valid values are 'Center', 'North', 'NorthEast', 'East', 'SouthEast', 'South', 'SouthWest', 'West' and 'NorthWest' (case insensitive)
+    # optional, default is 'SouthEast'
+    #watermark_placement => 'SouthEast',
+
+    # choose which watermark (tiling, single or none) should be used by default
+    # valid values are 'tiling', 'single' or 'none' (case insensitive)
+    # optional, default is 'none'
+    #watermark_default => 'none',
+
+    # choose which watermark (tiling, single or none) should be enforced (users will always have a watermark and won’t be able to disable it)
+    # valid values are 'tiling', 'single' or 'none' (case insensitive)
+    # optional, default is 'none'
+    #watermark_enforce => 'none',
+
+    # length of the image's delete token
+    # optional, default is 24
+    #token_length      => 24,
+
+    # URL sub-directory in which you want Lutim to be accessible
+    # example: you want to have Lutim under https://example.org/lutim/
+    # => set prefix to '/lutim' or to '/lutim/', it doesn't matter
+    # optional, defaut is /
+    #prefix            => '/',
+
+    # choose what database you want to use
+    # valid choices are sqlite and postgresql (all lowercase)
+    # optional, default is sqlite
+    #dbtype => 'sqlite',
+
+    # SQLite ONLY - only used if dbtype is set to sqlite
+    # define a path to the SQLite database
+    # you can define it relative to lutim directory or set an absolute path
+    # remember that it has to be in a directory writable by Lutim user
+    # optional, default is lutim.db
+    #db_path           => 'lutim.db',
+
+    # PostgreSQL ONLY - only used if dbtype is set to postgresql
+    # these are the credentials to access the PostgreSQL database
+    # mandatory if you choosed postgresql as dbtype
+    pgdb => {
+        database => 'lutim',
+        host     => 'localhost',
+        user     => 'DBUSER',
+        pwd      => 'DBPASSWORD'
+    },
+
+    # use Minion instead of directly increase counters
+    # need to launch a minion worker service if enabled
+    # optional, Minion is disabled by default
+    minion => {
+        enabled => 0,
+    #    # Which Minion backend to use?
+    #    # valid values are sqlite and postgresql (all lowercase)
+    #    # mandatory if Minion is enabled, default is sqlite
+    #    dbtype  => 'sqlite',
+    #    # SQLite ONLY - only used if if you choose sqlite as Minion backend, define the path to the minion database
+    #    # you can define it relative to lutim directory or set an absolute path
+    #    # remember that it has to be in a directory writable by Lutim user
+    #    # optional, default is minion.db
+        db_path => 'minion.db',
+    #    # PostgreSQL ONLY - only used if you choose postgresql as Minion backend
+    #    # these are the credentials to access the Minion's PostgreSQL database
+    #    # mandatory if you choosed postgresql as Minion backend, no default
+        pgdb => {
+            database => 'lutim_minion',
+            host     => 'localhost',
+            user     => 'DBUSER',
+            pwd      => 'DBPASSWORD'
+        }
+    },
+
+    # set `ldap` if you want that only authenticated users can shorten URLs
+    # please note that everybody can still use shortend URLs
+    # optional, no default
+    #ldap => {
+    #    uri         => 'ldaps://ldap.example.org',                 # server URI
+    #    user_tree   => 'ou=users,dc=example,dc=org',               # search base DN
+    #    bind_dn     => 'uid=ldap_user,ou=users,dc=example,dc=org', # search bind DN
+    #    bind_pwd    => 'secr3t',                                   # search bind password
+    #    user_attr   => 'uid',                                      # user attribute (uid, mail, sAMAccountName, etc.)
+    #    user_filter => '(!(uid=ldap_user))',                       # user filter (to exclude some users, etc.)
+    #},
+
+    # set `htpasswd` if you want to use an htpasswd file instead of ldap
+    # create the file with `htpasswd -c lutim.passwd user`, update it with `htpasswd lutim.passwd user2`
+    # make sure that lutim can read the file!
+    # optional, no default
+    #htpasswd => 'lutim.passwd',
+
+    # if you've set ldap or htpasswd above, the session will last `session_duration` seconds before
+    # the user needs to reauthenticate
+    # optional, default is 3600
+    #session_duration => 3600,
+
+    # disable counters of images
+    # set to 1 to disable counters
+    # optional, counters are enabled by default
+    #disable_img_stats => 0,
+
+    # define the height of the thumbnails generated at users' will
+    # this is not the height of the thumbnails send after upload,
+    # we're talking about thumbnails generated when someone asked for
+    # https://example.org/lutim/tesrinp?thumb
+    # this works only if you have ImageMagick
+    # optional, default is 100 (pixels)
+    #thumbnail_size => 100,
+
+    # maximum number of files that can be downloaded as a single zip archive
+    # if too many files are asked, it results a timeout, so Lutim split the zip URL
+    # in multiple URLs, each with max_file_size images.
+    # timeout behavior depends heavily on your server ressources (CPU) and if images
+    # are encrypted
+    # optional, default is 15
+    #max_files_in_zip => 15,
+
+    # maximum size (in MB) of memory allowed for the image cache
+    # Lutim has a built-in memory-based image cache to accelerate responses to often-viewed images.
+    # This setting makes the cache remove oldest viewed image if the cache size is over it.
+    # WARNING: a cache is created for each hypnotoad worker, which by default is twice the number of
+    # CPUs you have. See http://mojolicious.org/perldoc/Mojo/Server/Hypnotoad#workers for details
+    # So, if you have 4 workers and set cache_max_size to 100, the real maximum size of RAM used for
+    # cache is 400MB.
+    # If set to 0, the cache is disabled
+    # optional, default is 0
+    #cache_max_size => 0,
+
+    # array of memcached servers to cache URL in order to accelerate responses to often-viewed URL.
+    # If set to [], the use of memcached is disabled.
+    # If you use memcached, the internal cache (see cache_max_size option above) will not be used.
+    # Please see https://framagit.org/luc/lutim/wikis/memcached to know how to configure your memcached
+    # servers.
+    # exemple of valid value: ['127.0.0.1:11211']
+    # optional, default is []
+    #memcached_servers => [],
+
+    # enable or disable Lutim built-in logs
+    # set to 1 to disable logs
+    # optional, default is 0
+    #quiet_logs => 0,
+
+    # Content-Security-Policy header that will be sent by Lstu
+    # Set to '' to disable CSP header
+    # https://content-security-policy.com/ provides a good documentation about CSP.
+    # https://report-uri.com/home/generate provides a tool to generate a CSP header.
+    # optional, default is "base-uri 'self'; connect-src 'self'; default-src 'none'; font-src 'self'; form-action 'self'; img-src 'self' data:; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
+    # NB: unsafe-inline for script-src and style-src are here only because morris,
+    # the graph library used in the stats page requires it
+    # the default value is good for `default` theme
+    #csp => "base-uri 'self'; connect-src 'self'; default-src 'none'; font-src 'self'; form-action 'self'; img-src 'self' data:; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'",
+
+    # X-Frame-Options header that will be sent by Lstu
+    # Valid values are: 'DENY', 'SAMEORIGIN', 'ALLOW-FROM https://example.com/'
+    # Set to '' to disable X-Frame-Options header
+    # See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+    # Please note that this will add a "frame-ancestors" directive to the CSP header (see above) accordingly
+    # to the chosen setting (See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors)
+    # optional, default is 'DENY'
+    #x_frame_options => 'DENY',
+
+    # X-Content-Type-Options that will be sent by Lstu
+    # See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
+    # Set to '' to disable X-Content-Type-Options header
+    # optional, default is 'nosniff'
+    #x_content_type_options => 'nosniff',
+
+    # X-XSS-Protection that will be sent by Lstu
+    # See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
+    # Set to '' to disable X-XSS-Protection header
+    # optional, default is '1; mode=block'
+    #x_xss_protection => '1; mode=block',
+
+    # if set, the uploaded images will use this domain
+    # optional
+    #fixed_domain => 'example.org',
+
+    ##########################
+    # Lutim cron jobs settings
+    ##########################
+
+    # number of days shown in /stats page (used with script/lutim cron stats)
+    # optional, default is 365
+    stats_day_num     => 365,
+
+    # number of days senders' IP addresses are kept in database
+    # after that delay, they will be deleted from database (used with script/lutim cron cleanbdd)
+    # optional, default is 365
+    keep_ip_during    => 365,
+
+    # max size of the files directory, in octets
+    # used by script/lutim cron watch to trigger an action
+    # optional, no default
+    max_total_size    => 10*1024*1024*1024,
+
+    # default action when files directory is over max_total_size (used with script/lutim cron watch)
+    # valid values are 'warn', 'stop-upload' and 'delete'
+    # please, see readme
+    # optional, default is 'warn'
+    #policy_when_full  => 'warn',
+
+    # images which are not viewed since delete_no_longer_viewed_files days will be deleted by the cron cleanfiles task
+    # if delete_no_longer_viewed_files is not set, the no longer viewed files will NOT be deleted
+    # optional, no default
+    delete_no_longer_viewed_files => 90
+};
@@ -0,0 +1,2 @@
+localhost
+
@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - ansible-role-lutim
@@ -0,0 +1,16 @@
+---
+# vars file for ansible-role-lutim
+
+lutim_owner: "www-data"
+
+lutim_group: "www-data"
+
+contact: "contact.example.com"
+
+app_dir: "/var/www/lutim"
+
+secrets: "yyiqwhuqwg"
+
+project_version: "master"
+
+servername: "192.168.56.18"
@@ -0,0 +1,18 @@
+# Terraform-AWS-Deploy
+
+ This terraform plan create the resourcess of EC2 instance
+
+## Terraform Variables
+ Edit the `vars.tf` file to add the variables as per your need.
+
+| Variable name | Value | Description |
+| ------------- | ----- | ----------- |
+| `aws_region` | us-east-1 | Set the region  |
+| `vpc_cidr` | 10.0.0.0/16 | Set the cidr value for the vpc |
+| `public_subnet_cidr` | 10.0.2.0/24 | Set the cidr value for the public subnet |
+| `user` | ubuntu | Set the EC2 instance user name |
+| `public_key` | /home/user_name/.ssh/id_rsa_pub | Set the publickey value for the ec2 instance from the host machine |
+| `private_key` | /home/user_name/.ssh/id_rsa | Set the private key value for the ec2 instance from the hostmachine |
+| `aws_access_key` | AWSACCESSKEY | Enter your aws access key |
+| `aws_secrete_key` | AWSSECRETEKEY | Enter your aws secrete key |
+| `instance_name` | lutim_app_instance | Set the name for instance |
@@ -0,0 +1,126 @@
+#Create the VPC 
+resource "aws_vpc" "MAIN" {
+  cidr_block           = "${var.vpc_cidr}"
+  enable_dns_hostnames = true 
+  enable_dns_support   = true
+  instance_tenancy     = "default"
+  tags                 = {
+      Name             = "lutim-master-vpc"
+  }
+}
+
+# Create InternetGateWay and attach to VPC
+
+resource "aws_internet_gateway" "IGW" {
+  vpc_id           = "${aws_vpc.MAIN.id}"
+  tags = {
+    "Name"         = "lutim-master-igw"
+  } 
+}
+
+# Create a public subnet
+
+resource "aws_subnet" "publicsubnet" {
+  vpc_id                  = "${aws_vpc.MAIN.id}" 
+  cidr_block              = "${var.public_subnet_cidr}"
+  map_public_ip_on_launch = true
+  tags                    = {
+      Name                = "lutim-master-us-east-1-public"
+  }  
+}
+
+# Create routeTable
+resource "aws_route_table" "publicroute" {
+    vpc_id         = "${aws_vpc.MAIN.id}"
+    route {
+        cidr_block = "0.0.0.0/0"
+        gateway_id = "${aws_internet_gateway.IGW.id}"
+    }
+             
+    tags           = {
+      Name         = "lutim-master-us-east-1-public-rt"
+ }
+}
+
+resource "aws_main_route_table_association" "mainRTB" {
+  vpc_id         = "${aws_vpc.MAIN.id}"
+  route_table_id = "${aws_route_table.publicroute.id}"
+}
+## Create security group
+resource "aws_security_group" "security" {
+  name             = "lutim-master-sg"  
+  description      = "allow all traffic"
+  vpc_id           = "${aws_vpc.MAIN.id}"
+
+  ingress  {
+    description    =  "allow all traffic"
+    from_port      = "0"
+    to_port        = "65535"  
+    protocol       = "tcp"
+    cidr_blocks    = ["0.0.0.0/0"]
+  }
+  ingress  {
+    description    = "allow port SSH"
+    from_port      = "22"
+    to_port        = "22"
+    protocol       = "tcp"
+    cidr_blocks    = ["0.0.0.0/0"]
+  }
+  egress  {
+    from_port      = 0
+    to_port        = 0
+    protocol       = "-1"
+    cidr_blocks    = ["0.0.0.0/0"]
+  }
+  
+}
+
+#Create key_pair for the instance
+
+resource "aws_key_pair" "genkey" {
+  key_name           = "lutim.webapp"
+  public_key         = "${file(var.public_key)}"
+}
+
+# Craete ec2 instance
+resource "aws_instance" "ec2_instance" {
+  ami                = "ami-04505e74c0741db8d"
+  instance_type      = "t2.medium"
+  associate_public_ip_address = "true"
+  subnet_id          = "${aws_subnet.publicsubnet.id}"
+  vpc_security_group_ids = ["${aws_security_group.security.id}"]
+  key_name           = "lutim.webapp"
+
+  connection          {
+    agent            = false
+    type             = "ssh"
+    host             = aws_instance.ec2_instance.public_dns 
+    private_key      = "${file(var.private_key)}"
+    user             = "${var.user}"
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "sudo apt update -y",
+      "sudo apt install python3.9 -y",
+      ]
+  }
+
+  provisioner "local-exec" {
+    command = <<EOT
+      sleep 120 && \
+      > hosts && \
+      echo "[lutim]" | tee -a hosts && \
+      echo "${aws_instance.ec2_instance.public_ip} ansible_user=${var.user} ansible_ssh_private_key_file=${var.private_key}" | tee -a hosts && \
+      export ANSIBLE_HOST_KEY_CHECKING=False && \
+      ansible-playbook -u ${var.user} --private-key ${var.private_key} -i hosts site.yml
+    EOT
+  }
+  
+  tags               = {
+    Name             = "${var.instance_name}"
+  }
+}
+
+
+
@@ -0,0 +1,7 @@
+output "public_ip" {
+  value = "${aws_instance.ec2_instance.public_ip}"
+}
+
+output "App_running_at" {
+  value = "http://${aws_instance.ec2_instance.public_ip}:8081"
+}
@@ -0,0 +1,5 @@
+provider "aws" {
+access_key = "${var.aws_access_key}"
+secret_key = "${var.aws_secret_key}"
+region     = "${var.aws_region}"
+}
@@ -0,0 +1,36 @@
+variable "aws_region" {
+    default = "aws_region"
+}
+variable "vpc_cidr" {
+    default = "cidr_value"
+}
+variable "public_subnet_cidr" {
+    default = "cidr_value"
+}
+variable "public_subnet1_cidr" {
+    default = "cidr_value"
+}
+
+variable "user" {
+    default = "user_of_instance" 
+}
+
+variable "public_key" {
+    default = "$PWD_publickey"
+}
+variable "private_key" {
+    default = "$PWD_privatekey"
+}
+variable "aws_access_key" {
+    default = "aws_access_key"
+}
+
+variable "aws_secret_key" {
+    default = "aws_secrete_key"
+}
+
+variable "instance_name" {
+    default = "instance_name"  
+}
+
+
@@ -68,3 +68,7 @@ It uses:
 * [JSZip](https://stuk.github.io/jszip/) for generating a zip containing all the images in the gallery
 * [FileSaver.js](https://github.com/eligrey/FileSaver.js/) for saving the zip
 * [Toastify JS](https://apvarun.github.io/toastify-js/) for notifications
+
+## Deploy lutim
+
+An ansible role and a terraform plan reside under the `.provision` directory. An user could utilize the terraform plan if they chose to deploy lutim on AWS, if that's not the goal, they could simply execute the ansible role in part. Usage docs for both are present in their respective directories.