terraform.yml

name: 'Terraform'

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      # Working directory input from user.
      terraform_operation:
        description: "Terraform operation: plan, apply, destroy"
        required: true
        default: "plan"
        type: choice
        options:
          - plan
          - apply
          - destroy

jobs:
  Terraform:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Terraform Init
        run: |
          export TF_VAR_USERNAME=$DB_USERNAME
          export TF_VAR_PASSWORD=$DB_PASSWORD
          export TF_VAR_S3_BUCKET_NAME=$S3_BUCKET_NAME
          export TF_VAR_S3_BUCKET_POLICY_ACTIONS=$S3_BUCKET_POLICY_ACTIONS
          export TF_VAR_DB_IDENTIFIER=$DB_IDENTIFIER
          export TF_VAR_PUBLIC_KEY=$PUBLIC_KEY
          export TF_VAR_CERTIFICATE_DOMAIN=$CERTIFICATE_DOMAIN
          export TF_VAR_DNS=$DNS
          export TF_VAR_GATEWAY_DNS=$GATEWAY_DNS
          
          terraform init
        env:
          DB_USERNAME: ${{secrets.DB_USERNAME}}
          DB_PASSWORD: ${{secrets.DB_PASSWORD}}
          S3_BUCKET_NAME: ${{secrets.S3_BUCKET_NAME}}
          DB_IDENTIFIER: ${{secrets.DB_IDENTIFIER}}
          PUBLIC_KEY: ${{secrets.PUBLIC_KEY}}
          CERTIFICATE_DOMAIN: ${{secrets.CERTIFICATE_DOMAIN}}
          DNS: ${{secrets.DNS}}
          GATEWAY_DNS: ${{secrets.GATEWAY_DNS}}

      - name: Terraform Plan
        run: |
          export TF_VAR_DB_USERNAME=$DB_USERNAME
          export TF_VAR_DB_PASSWORD=$DB_PASSWORD
          export TF_VAR_S3_BUCKET_NAME=$S3_BUCKET_NAME
          export TF_VAR_S3_BUCKET_POLICY_ACTIONS=$S3_BUCKET_POLICY_ACTIONS
          export TF_VAR_DB_IDENTIFIER=$DB_IDENTIFIER
          export TF_VAR_PUBLIC_KEY=$PUBLIC_KEY
          export TF_VAR_CERTIFICATE_DOMAIN=$CERTIFICATE_DOMAIN
          export TF_VAR_DNS=$DNS
          export TF_VAR_GATEWAY_DNS=$GATEWAY_DNS
          
          terraform plan -input=false
        env:
          DB_USERNAME: ${{secrets.DB_USERNAME}}
          DB_PASSWORD: ${{secrets.DB_PASSWORD}}
          S3_BUCKET_NAME: ${{secrets.S3_BUCKET_NAME}}
          DB_IDENTIFIER: ${{secrets.DB_IDENTIFIER}}
          PUBLIC_KEY: ${{secrets.PUBLIC_KEY}}
          CERTIFICATE_DOMAIN: ${{secrets.CERTIFICATE_DOMAIN}}
          DNS: ${{secrets.DNS}}
          GATEWAY_DNS: ${{secrets.GATEWAY_DNS}}
        if: ${{ github.event.inputs.terraform_operation == 'plan' }}

      - name: Terraform Validate
        id: validate
        run: terraform validate -no-color

      - name: Terraform Apply
        run: |
          export TF_VAR_DB_USERNAME=$DB_USERNAME
          export TF_VAR_DB_PASSWORD=$DB_PASSWORD
          export TF_VAR_S3_BUCKET_NAME=$S3_BUCKET_NAME
          export TF_VAR_S3_BUCKET_POLICY_ACTIONS=$S3_BUCKET_POLICY_ACTIONS
          export TF_VAR_DB_IDENTIFIER=$DB_IDENTIFIER
          export TF_VAR_PUBLIC_KEY=$PUBLIC_KEY
          export TF_VAR_CERTIFICATE_DOMAIN=$CERTIFICATE_DOMAIN
          export TF_VAR_DNS=$DNS
          export TF_VAR_GATEWAY_DNS=$GATEWAY_DNS

          terraform apply -auto-approve
        env:
          DB_USERNAME: ${{secrets.DB_USERNAME}}
          DB_PASSWORD: ${{secrets.DB_PASSWORD}}
          S3_BUCKET_NAME: ${{secrets.S3_BUCKET_NAME}}
          DB_IDENTIFIER: ${{secrets.DB_IDENTIFIER}}
          PUBLIC_KEY: ${{secrets.PUBLIC_KEY}}
          CERTIFICATE_DOMAIN: ${{secrets.CERTIFICATE_DOMAIN}}
          DNS: ${{secrets.DNS}}
          GATEWAY_DNS: ${{secrets.GATEWAY_DNS}}
        if: ${{ github.event.inputs.terraform_operation == 'apply' }}

      - name: AWS Plan Copy to S3
        run: aws s3 cp terraform.tfstate s3://terraform-state-saving/terraform.tfstate
        id: copy
        if: ${{ github.event.inputs.terraform_operation == 'apply' }}

      - name: Get outputs
        uses: dflook/terraform-output@v1
        id: tf-outputs
        if: ${{ github.event.inputs.terraform_operation == 'apply' }}

      - name: basic Install on EC2
        uses: appleboy/ssh-action@master
        with:
          host: ${{ steps.tf-outputs.outputs.elastic-ip-auth }}
          username: ubuntu
          key: ${{ secrets.KEY }}
          script: |
            sudo apt update -y
            sudo apt install -y build-essential
            sudo apt-get install -y apt-transport-https ca-certificates curl gnupg-agent software-properties-common
            curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
            sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
            sudo apt-get install -y docker-ce docker-ce-cli containerd.io
            sudo chmod 666 /var/run/docker.sock
            docker run -p 8080:80 nginx
        if: ${{ github.event.inputs.terraform_operation == 'apply' }}

      - name: AWS Plan Copy From S3
        id: copyfrom
        run: aws s3 cp s3://terraform-state-saving/terraform.tfstate terraform.tfstate
        continue-on-error: true
        if: ${{ github.event.inputs.terraform_operation == 'destroy' }}

      - name: Terraform Destroy
        id: destroy
        run: |
          export TF_VAR_DB_USERNAME=$DB_USERNAME
          export TF_VAR_DB_PASSWORD=$DB_PASSWORD
          export TF_VAR_S3_BUCKET_NAME=$S3_BUCKET_NAME
          export TF_VAR_S3_BUCKET_POLICY_ACTIONS=$S3_BUCKET_POLICY_ACTIONS
          export TF_VAR_DB_IDENTIFIER=$DB_IDENTIFIER
          export TF_VAR_PUBLIC_KEY=$PUBLIC_KEY
          export TF_VAR_CERTIFICATE_DOMAIN=$CERTIFICATE_DOMAIN
          export TF_VAR_DNS=$DNS
          export TF_VAR_GATEWAY_DNS=$GATEWAY_DNS

          terraform destroy -input=false -auto-approve
        env:
          DB_USERNAME: ${{secrets.DB_USERNAME}}
          DB_PASSWORD: ${{secrets.DB_PASSWORD}}
          S3_BUCKET_NAME: ${{secrets.S3_BUCKET_NAME}}
          DB_IDENTIFIER: ${{secrets.DB_IDENTIFIER}}
          PUBLIC_KEY: ${{secrets.PUBLIC_KEY}}
          CERTIFICATE_DOMAIN: ${{secrets.CERTIFICATE_DOMAIN}}
          DNS: ${{secrets.DNS}}
          GATEWAY_DNS: ${{secrets.GATEWAY_DNS}}
        if: ${{ github.event.inputs.terraform_operation == 'destroy' }}

      - name: Delete plan file
        if: steps.destroy.outcome == 'success'
        run: aws s3 rm s3://terraform-state-saving/terraform.tfstate