Backend Containerizado en EC2

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
    tls = {
      source  = "hashicorp/tls"
      version = "~> 4.0"
    }
    local = {
      source  = "hashicorp/local"
      version = "~> 2.0"
    }
  }

  required_version = ">= 1.4.0"
}

provider "aws" {
  region  = "us-east-1"
  profile = "leader-developer-personal"
}

variable "env"              { type = string; default = "dev" }
variable "ssh_allowed_cidr" { type = string; default = "0.0.0.0/0" }
variable "app_port"         { type = number; default = 3000 }
variable "domain"           { type = string }

# Última AMI Amazon Linux 2023 ARM64
data "aws_ami" "al2023" {
  most_recent = true
  owners      = ["amazon"]

  filter { name = "name";              values = ["al2023-ami-*-arm64"] }
  filter { name = "virtualization-type"; values = ["hvm"] }
  filter { name = "architecture";      values = ["arm64"] }
}

# VPC mínima: 1 subnet pública con salida a internet
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
  tags = { Name = "vpc-backend-${var.env}", Env = var.env }
}

resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.main.id
  tags   = { Name = "igw-backend-${var.env}", Env = var.env }
}

resource "aws_subnet" "public" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "us-east-1a"
  map_public_ip_on_launch = true
  tags = { Name = "subnet-public-backend-${var.env}", Env = var.env }
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  route  { cidr_block = "0.0.0.0/0"; gateway_id = aws_internet_gateway.igw.id }
  tags   = { Name = "rt-public-backend-${var.env}", Env = var.env }
}

resource "aws_route_table_association" "public" {
  subnet_id      = aws_subnet.public.id
  route_table_id = aws_route_table.public.id
}

resource "aws_security_group" "ec2_sg" {
  name   = "ec2-backend-${var.env}-sg"
  vpc_id = aws_vpc.main.id

  ingress { description = "SSH";   from_port = 22;  to_port = 22;  protocol = "tcp"; cidr_blocks = [var.ssh_allowed_cidr] }
  ingress { description = "HTTP";  from_port = 80;  to_port = 80;  protocol = "tcp"; cidr_blocks = ["0.0.0.0/0"] }
  ingress { description = "HTTPS"; from_port = 443; to_port = 443; protocol = "tcp"; cidr_blocks = ["0.0.0.0/0"] }
  egress  { from_port = 0; to_port = 0; protocol = "-1"; cidr_blocks = ["0.0.0.0/0"] }

  tags = { Name = "ec2-backend-${var.env}-sg", Env = var.env }
}

# Par de claves ED25519 generado en runtime
resource "tls_private_key" "ec2_key" { algorithm = "ED25519" }

resource "aws_key_pair" "deployer" {
  key_name   = "ec2-backend-${var.env}-key"
  public_key = tls_private_key.ec2_key.public_key_openssh
  tags       = { Name = "ec2-backend-${var.env}-key", Env = var.env }
}

resource "local_file" "private_key_pem" {
  content         = tls_private_key.ec2_key.private_key_openssh
  filename        = "${path.module}/ec2-backend-${var.env}.pem"
  file_permission = "0600"
}

resource "aws_instance" "backend" {
  ami                         = data.aws_ami.al2023.id
  instance_type               = "t4g.micro"
  key_name                    = aws_key_pair.deployer.key_name
  vpc_security_group_ids      = [aws_security_group.ec2_sg.id]
  subnet_id                   = aws_subnet.public.id
  user_data                   = templatefile("${path.module}/user_data.sh", {})
  user_data_replace_on_change = true

  root_block_device {
    volume_type = "gp3"
    volume_size = 30
    encrypted   = true
  }

  tags = { Name = "ec2-backend-${var.env}", Env = var.env }
}

resource "aws_eip" "backend_eip" {
  instance = aws_instance.backend.id
  domain   = "vpc"
  tags     = { Name = "ec2-backend-${var.env}-eip", Env = var.env }
}

output "elastic_ip"   { value = aws_eip.backend_eip.public_ip }
output "ssh_command"  { value = "ssh -i ec2-backend-${var.env}.pem ec2-user@${aws_eip.backend_eip.public_ip}" }
output "api_url"      { value = "https://${var.domain}/api/v1" }

#!/bin/bash
set -euo pipefail

# Sistema
dnf update -y

# Docker
dnf install -y docker
systemctl start docker && systemctl enable docker
usermod -aG docker ec2-user

# Nginx con configuración base
dnf install -y nginx
cat > /etc/nginx/nginx.conf << 'NGINX_MAIN'
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /run/nginx.pid;
include /usr/share/nginx/modules/*.conf;

events { worker_connections 1024; }

http {
    log_format main '$remote_addr - $remote_user [$time_local] "$request" $status';
    access_log /var/log/nginx/access.log main;
    sendfile on; keepalive_timeout 65;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    include /etc/nginx/conf.d/*.conf;
}
NGINX_MAIN

systemctl start nginx && systemctl enable nginx

# Certbot para Let's Encrypt
dnf install -y python3-certbot-nginx

# deploy.sh — actualiza o despliega un contenedor Docker
cat > /home/ec2-user/deploy.sh << 'DEPLOY_SCRIPT'
#!/bin/bash
set -euo pipefail

IMAGE="${1:?Uso: ./deploy.sh <imagen> <contenedor> <puerto_host>}"
CONTAINER="${2:?Uso: ./deploy.sh <imagen> <contenedor> <puerto_host>}"
HOST_PORT="${3:?Uso: ./deploy.sh <imagen> <contenedor> <puerto_host>}"

ENV_FILE="/home/ec2-user/.env.$CONTAINER"
[ ! -f "$ENV_FILE" ] && ENV_FILE="/home/ec2-user/.env"

docker stop "$CONTAINER" 2>/dev/null || true
docker rm   "$CONTAINER" 2>/dev/null || true

if [ -f "$ENV_FILE" ]; then
  docker run -d --name "$CONTAINER" --restart unless-stopped \
    -p "$HOST_PORT:3000" --env-file "$ENV_FILE" \
    -v /home/ec2-user/key:/home/ec2-user/key:ro "$IMAGE"
else
  docker run -d --name "$CONTAINER" --restart unless-stopped \
    -p "$HOST_PORT:3000" \
    -v /home/ec2-user/key:/home/ec2-user/key:ro "$IMAGE"
fi

docker image prune -f
echo "[deploy] Listo: $CONTAINER en :$HOST_PORT"
DEPLOY_SCRIPT

# add-api.sh — registra subdominio en Nginx y obtiene certificado SSL
cat > /home/ec2-user/add-api.sh << 'ADD_API_SCRIPT'
#!/bin/bash
set -euo pipefail

SUBDOMAIN="${1:?Uso: ./add-api.sh <subdominio> <puerto> [email]}"
PORT="${2:?Uso: ./add-api.sh <subdominio> <puerto> [email]}"
EMAIL="${3:[email protected]}"
CONF="/etc/nginx/conf.d/$SUBDOMAIN.conf"

if [ ! -f "$CONF" ]; then
  sudo tee "$CONF" > /dev/null << NGINX_VHOST
server {
    listen 80;
    server_name $SUBDOMAIN;
    location / {
        proxy_pass         http://localhost:$PORT;
        proxy_set_header   Host               $host;
        proxy_set_header   X-Real-IP          $remote_addr;
        proxy_set_header   X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto  $scheme;
    }
}
NGINX_VHOST
  sudo nginx -t && sudo systemctl reload nginx
fi

sudo certbot --nginx -d "$SUBDOMAIN" --non-interactive --agree-tos -m "$EMAIL" --redirect
echo "[add-api] HTTPS activo en https://$SUBDOMAIN"
ADD_API_SCRIPT

chmod +x /home/ec2-user/deploy.sh /home/ec2-user/add-api.sh
chown ec2-user:ec2-user /home/ec2-user/deploy.sh /home/ec2-user/add-api.sh

# 1. Aplicar la infraestructura
terraform init && terraform apply

# 2. Ver los outputs
terraform output
# elastic_ip  = "44.206.195.129"
# ssh_command = "ssh -i ec2-backend-dev.pem [email protected]"
# api_url     = "https://api.alfredo-dominguez.dev/api/v1"

# 3. Conectarse por SSH (esperar ~2 min a que user_data.sh termine)
ssh -i ec2-backend-dev.pem [email protected]

# 4. Configurar DNS: crear registro A en tu proveedor DNS
#    api.alfredo-dominguez.dev → 44.206.195.129

# 5. Registrar el subdominio con HTTPS
./add-api.sh api.alfredo-dominguez.dev 3001
# → Crea /etc/nginx/conf.d/api.alfredo-dominguez.dev.conf
# → Obtiene certificado Let's Encrypt
# → Configura redirección HTTP → HTTPS

# 6. Crear archivo de variables de entorno para el contenedor
cat > .env.my-api << 'EOF'
NODE_ENV=production
PORT=3000
DB_URL=postgresql://user:pass@host:5432/db
JWT_SECRET=supersecret
EOF

# 7. Desplegar el contenedor
./deploy.sh ghcr.io/org/my-api:latest my-api 3001
# → docker pull ghcr.io/org/my-api:latest
# → docker run -d --name my-api --restart unless-stopped -p 3001:3000 ...

# 8. Verificar
curl https://api.alfredo-dominguez.dev/health
# {"status":"ok"}

# Para agregar una segunda API en el mismo servidor:
./add-api.sh api2.alfredo-dominguez.dev 3002
./deploy.sh ghcr.io/org/another-api:latest another-api 3002