|
| 1 | +# ------------------------------------------------------------------------------ |
| 2 | +# 核心资源定义 (Main Resource Definitions) |
| 3 | +# |
| 4 | +# 本文件包含了模块的核心基础设施资源。 |
| 5 | +# 这里的代码负责根据输入变量来创建和配置所有云资源。 |
| 6 | +# ------------------------------------------------------------------------------ |
| 7 | + |
| 8 | +# 配置阿里云提供商 (Provider) |
| 9 | +provider "alicloud" { |
| 10 | + region = "cn-hangzhou" |
| 11 | +} |
| 12 | + |
| 13 | +# 查询当前部署地域 |
| 14 | +data "alicloud_regions" "current_region_ds" { |
| 15 | + current = true |
| 16 | +} |
| 17 | + |
| 18 | +# 查询支持指定ECS实例规格和磁盘类型的可用区 |
| 19 | +data "alicloud_zones" "default" { |
| 20 | + available_disk_category = "cloud_essd" |
| 21 | + available_resource_creation = "VSwitch" |
| 22 | + available_instance_type = var.ecs_instance_type |
| 23 | +} |
| 24 | + |
| 25 | +# 创建一个随机ID，用于生成唯一的资源名称后缀，避免命名冲突 |
| 26 | +resource "random_string" "suffix" { |
| 27 | + length = 8 |
| 28 | + lower = true |
| 29 | + upper = false |
| 30 | + numeric = false |
| 31 | + special = false |
| 32 | +} |
| 33 | + |
| 34 | +# 定义一个局部变量，将随机ID用作通用名称后缀 |
| 35 | +locals { |
| 36 | + common_name = random_string.suffix.id |
| 37 | + region = data.alicloud_regions.current_region_ds.regions.0.id |
| 38 | +} |
| 39 | + |
| 40 | +# 创建一个专有网络（VPC），为云资源提供一个隔离的网络环境 |
| 41 | +resource "alicloud_vpc" "vpc" { |
| 42 | + cidr_block = "192.168.0.0/16" |
| 43 | + vpc_name = "vpc-${local.common_name}" |
| 44 | +} |
| 45 | + |
| 46 | +# 创建一个交换机（VSwitch），用于在VPC内划分一个子网 |
| 47 | +resource "alicloud_vswitch" "vswitch" { |
| 48 | + vpc_id = alicloud_vpc.vpc.id |
| 49 | + cidr_block = "192.168.0.0/24" |
| 50 | + zone_id = data.alicloud_zones.default.zones.0.id |
| 51 | + vswitch_name = "vswitch-${local.common_name}" |
| 52 | +} |
| 53 | + |
| 54 | +# 创建一个安全组，作为虚拟防火墙来控制ECS实例的网络访问 |
| 55 | +resource "alicloud_security_group" "security_group" { |
| 56 | + vpc_id = alicloud_vpc.vpc.id |
| 57 | + security_group_name = "sg-${local.common_name}" |
| 58 | +} |
| 59 | + |
| 60 | +# 在安全组中添加入方向规则，允许外部流量访问80端口 |
| 61 | +resource "alicloud_security_group_rule" "allow_80" { |
| 62 | + type = "ingress" |
| 63 | + ip_protocol = "tcp" |
| 64 | + nic_type = "intranet" |
| 65 | + policy = "accept" |
| 66 | + port_range = "80/80" |
| 67 | + priority = 1 |
| 68 | + security_group_id = alicloud_security_group.security_group.id |
| 69 | + cidr_ip = "192.168.0.0/24" |
| 70 | + # 如需允许从公网访问ECS，请将cidr_ip修改为0.0.0.0/0 |
| 71 | + # cidr_ip = "0.0.0.0/0" |
| 72 | +} |
| 73 | + |
| 74 | +# 查询可用的阿里云镜像 |
| 75 | +data "alicloud_images" "default" { |
| 76 | + name_regex = "^aliyun_3_x64_20G_alibase_.*" |
| 77 | + # name_regex = "^ubuntu_24_04_x64_20G_alibase_.*" |
| 78 | + most_recent = true |
| 79 | + owners = "system" |
| 80 | +} |
| 81 | + |
| 82 | +# 创建一个RAM用户，用于后续给ECS实例授权访问其他云服务 |
| 83 | +resource "alicloud_ram_user" "ram_user" { |
| 84 | + name = "ram-user-${local.common_name}" |
| 85 | +} |
| 86 | + |
| 87 | +# 为前面创建的RAM用户生成一个Access Key |
| 88 | +resource "alicloud_ram_access_key" "ramak" { |
| 89 | + user_name = alicloud_ram_user.ram_user.name |
| 90 | +} |
| 91 | + |
| 92 | +# 为RAM用户附加一个系统策略 |
| 93 | +resource "alicloud_ram_user_policy_attachment" "attach_policy_to_user" { |
| 94 | + user_name = alicloud_ram_user.ram_user.name |
| 95 | + # 策略类型为系统预设策略 |
| 96 | + policy_type = "System" |
| 97 | + # 授予日志服务的完全访问权限 |
| 98 | + policy_name = "AliyunLogFullAccess" |
| 99 | +} |
| 100 | + |
| 101 | +# 创建一台ECS实例（云服务器） |
| 102 | +resource "alicloud_instance" "ecs_instance" { |
| 103 | + instance_name = "ecs-${local.common_name}" |
| 104 | + image_id = data.alicloud_images.default.images[0].id |
| 105 | + instance_type = var.ecs_instance_type |
| 106 | + system_disk_category = "cloud_essd" |
| 107 | + security_groups = [alicloud_security_group.security_group.id] |
| 108 | + vswitch_id = alicloud_vswitch.vswitch.id |
| 109 | + password = var.ecs_instance_password |
| 110 | + internet_max_bandwidth_out = 5 |
| 111 | +} |
| 112 | + |
| 113 | +# 创建一个云助手命令，指令用于：部署示例应用，并通过应用接口来调用大模型 |
| 114 | +resource "alicloud_ecs_command" "run_command" { |
| 115 | + name = "command-run-${local.common_name}" |
| 116 | + command_content = base64encode(<<EOF |
| 117 | +cat << EOT >> ~/.bash_profile |
| 118 | +export LICENSE_KEY=${var.mse_license_key} |
| 119 | +EOT |
| 120 | +
|
| 121 | +source ~/.bash_profile |
| 122 | +
|
| 123 | +curl -fsSL https://static-aliyun-doc.oss-cn-hangzhou.aliyuncs.com/install-script/use-mse-to-implement-comprehensive-traffic-protection/install.sh | bash |
| 124 | +
|
| 125 | +EOF |
| 126 | + ) |
| 127 | + working_dir = "/root" |
| 128 | + type = "RunShellScript" |
| 129 | + timeout = 3600 |
| 130 | +} |
| 131 | + |
| 132 | +# 在指定的ECS实例上执行上面创建的云助手命令 |
| 133 | +resource "alicloud_ecs_invocation" "invoke_script" { |
| 134 | + instance_id = [alicloud_instance.ecs_instance.id] |
| 135 | + command_id = alicloud_ecs_command.run_command.id |
| 136 | + timeouts { |
| 137 | + create = "15m" |
| 138 | + } |
| 139 | +} |
0 commit comments