create-network-ec2.yml

---
#
# Creates a VPC network, subnets et al for use w/build-cluster-ec.yml
#
- name: Create Lightbend PS EC2 network
  hosts: localhost
  connection: local
  gather_facts: False

  vars:
    node_sg_name: Lightbend Node SG
    EC2_REGION: us-east-1

  tasks:
    - name: Create VPC
      local_action:
        module: ec2_vpc
        cidr_block: 10.0.0.0/16     
        resource_tags:
          Name: "Lightbend Cluster VPC"
        region: "{{ EC2_REGION }}"
        dns_hostnames: yes
        dns_support: yes
        internet_gateway: True
        route_tables:
          - subnets:
              - 10.0.1.0/24
              - 10.0.2.0/24
              - 10.0.3.0/24
            routes:
              - dest: 0.0.0.0/0
                gw: igw
        subnets:
          - cidr: 10.0.1.0/24
            az: "{{ EC2_REGION }}a"
            resource_tags:
               Name: "Lightbend {{ EC2_REGION }}a SN"
          - cidr: 10.0.2.0/24
            az: "{{ EC2_REGION }}b"
            resource_tags:
                Name: "Lightbend {{ EC2_REGION }}b SN"
            # Use 'a' or 'b' again for 2 AZs
          - cidr: 10.0.3.0/24
            az: "{{ EC2_REGION }}c"
            resource_tags:
                Name: "Lightbend {{ EC2_REGION }}c SN"
        state: present
      register: vpc

    - name: Create Ingress SG
      local_action:
        module: ec2_group
        name: Lightbend Ingress SG
        description: Ingress SG to Lightbend Cluster
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ vpc.vpc.region }}"
        state: present
        rules:
          - proto: tcp
            from_port: 80
            to_port: 80
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            from_port: 443
            to_port: 443
            cidr_ip: 0.0.0.0/0
      register: ingress_sg

    - name: Tag Ingress SG
      local_action:
        module: ec2_tag
        region: "{{ EC2_REGION }}"
        resource: "{{ ingress_sg.group_id }}"
        state: present
        tags:
          Name: Lightbend ELB SG

   # This can fail due to timing. Re-run playbook
    - name: Create Nodes SG
      local_action:
        module: ec2_group
        name: Lightbend Node SG
        description: SG for Lightbend Nodes
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ vpc.vpc.region }}"
        rules:
          # SSH
          - proto: tcp
            from_port: 22
            to_port: 22
            cidr_ip: 0.0.0.0/0
          # Agent Remote Port
          - proto: tcp
            from_port: 2552
            to_port: 2552
            group_name: Lightbend Node SG
          # Health
          - proto: tcp
            from_port: 9009
            to_port: 9009
            group_id: "{{ ingress_sg.group_id }}"
          # Visualizer
          - proto: tcp
            from_port: 9999
            to_port: 9999
            group_id: "{{ ingress_sg.group_id }}"
          # Akka remoting, control protocol, bundle transfer
          # Status server, service locator
          - proto: tcp
            from_port: 9004
            to_port: 9008
            group_name: Lightbend Node SG
          # Bundle endpoint assignments
          - proto: tcp
            from_port: 10000
            to_port: 10999
            group_name: Lightbend Node SG
        state: present
      register: node_sg

    - name: Tag Node SG
      local_action:
        module: ec2_tag
        region: "{{ EC2_REGION }}"
        resource: "{{ node_sg.group_id }}"
        state: present
        tags:
          Name: Lightbend Node SG

    - name: Create ELB
      local_action:
        module: ec2_elb_lb
        name: "Lightbend-PS-ELB-{{ EC2_REGION }}"
        scheme: internet-facing
        security_group_ids: "{{ ingress_sg.group_id }}"
        state: present
        cross_az_load_balancing: yes
        region: "{{ EC2_REGION }}"
        subnets:
          - "{{ vpc.subnets[0].id }}"
          - "{{ vpc.subnets[1].id }}"
          - "{{ vpc.subnets[2].id }}"
        listeners:
          # Upload a cert to use SSL
          # Example listener for Visualizer 80 -> 9999
          - protocol: http
            load_balancer_port: 80
            instance_port: 9999
        health_check:
            ping_protocol: http
            ping_port: 9009
            ping_path: /status
            response_timeout: 5
            interval: 30
            unhealthy_threshold: 2
            healthy_threshold: 3
      register: elb

    - debug: msg="ELB zone name {{ elb.elb.dns_name }}"

    - debug: msg="Add listeners to {{ elb.elb.dns_name }} to expose bundle endpoints"

    - debug: msg="Upload x.509 certificate to ELB for SSL endpoints"

    - name: Create vars file
      template:
        src: templates/vars.j2
        dest: "vars/{{ EC2_REGION }}_vars.yml"

    - debug: msg="Vars file vars/{{ EC2_REGION }}_vars.yml created. You MUST add KEYPAIR name to vars file before using!"