initial version

.editorconfig

@@ -0,0 +1,22 @@
+# EditorConfig is awesome: http://EditorConfig.org
+# Uses editorconfig to maintain consistent coding styles
+
+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 2
+indent_style = space
+insert_final_newline = true
+max_line_length = 120
+trim_trailing_whitespace = true
+
+[*.md]
+max_line_length = 0
+trim_trailing_whitespace = false
+
+[COMMIT_EDITMSG]
+max_line_length = 0

.github/workflows/deploy-terraform.yaml

@@ -0,0 +1,37 @@
+name: deploy terraform
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - 'terraform/**'
+      - 'atlantis/**'
+
+jobs:
+  deployment:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Login to Docker Hub
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u $ --password-stdin
+      - name: Terraform-CI
+        uses: docker/build-push-action@v3
+        with:
+          context: ./terraform
+          push: true
+          tags: ghcr.io/${{ github.repository_owner }}/terraform-ci:latest
+      - name: Atlantis
+        uses: docker/build-push-action@v3
+        with:
+          context: ./atlantis
+          push: true
+          tags: ghcr.io/${{ github.repository_owner }}/terraform-ci:atlantis

.gitignore

@@ -0,0 +1 @@
+*.iml

.hadolint.yaml

@@ -0,0 +1,6 @@
+ignored:
+  - DL3003
+  - DL3007
+  - DL3013
+  - DL3018
+  - SC1091

.pre-commit-config.yaml

@@ -0,0 +1,25 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: trailing-whitespace
+      - id: check-merge-conflict
+      - id: end-of-file-fixer
+      - id: check-added-large-files
+      - id: check-yaml
+      - id: detect-aws-credentials
+        args: [--allow-missing-credentials]
+  - repo: https://github.com/hadolint/hadolint
+    rev: v2.12.1-beta
+    hooks:
+      - id: hadolint-docker
+  - repo: https://github.com/gruntwork-io/pre-commit
+    rev: v0.1.23
+    hooks:
+      - id: terragrunt-hclfmt
+        files: (\.hcl)$
+      - id: shellcheck
+        types: [shell]
+
+ci:
+  autoupdate_schedule: monthly

LICENSE

@@ -0,0 +1,7 @@
+Copyright 2023 Alexander Dobrodey
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

atlantis/Dockerfile

@@ -0,0 +1,48 @@
+ARG ATLANTIS_VERSION=v0.26.0
+FROM ghcr.io/runatlantis/atlantis:${ATLANTIS_VERSION} AS tools
+
+ARG GOSU_VERSION=1.16
+RUN \
+    wget -qO /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-amd64" && \
+    chmod +x /usr/local/bin/gosu
+
+# Install infracost
+ARG INFRACOST_VERSION=v0.10.30
+RUN \
+    wget -qO infracost-linux-amd64.tar.gz "https://github.com/infracost/infracost/releases/download/${INFRACOST_VERSION}/infracost-linux-amd64.tar.gz" && \
+    tar xzf infracost-linux-amd64.tar.gz && \
+    mv infracost-linux-amd64 /usr/local/bin/infracost && \
+    rm -f infracost-linux-amd64.tar.gz
+
+
+# Install Atlantis
+FROM cerebellumnetwork/terraform-ci:latest
+
+RUN \
+    addgroup atlantis && \
+    adduser -S atlantis -G atlantis && \
+    cp -R /root/.terraform.d /home/atlantis/ && \
+    cp /root/.terraformrc /home/atlantis/
+
+ENV TF_PLUGIN_CACHE_DIR="/home/atlantis/.terraform.d/plugins"
+ENV ATLANTIS_TERRAFORM_VERSION=${TERRAFORM_VERSION}
+ENV DEFAULT_TERRAFORM_VERSION=$TERRAFORM_VERSION
+ENV TERRAGRUNT_TFPATH="terraform${TERRAFORM_VERSION}"
+ENV TF_PLUGIN_CACHE_MAY_BREAK_DEPENDENCY_LOCK_FILE=true
+ENV DEFAULT_CONFTEST_VERSION=0.35.0
+
+COPY /root/.terraformrc /home/atlantis/
+COPY terragrunt-core-atlantis.hcl /home/atlantis/.terraform.d/terragrunt-core.hcl
+COPY atlantis-config.yaml /etc/atlantis/repos.yaml
+
+COPY --from=tools /usr/local/bin/gosu /usr/local/bin/gosu
+COPY --from=tools /usr/local/bin/atlantis /usr/local/bin/atlantis
+COPY --from=tools /usr/bin/dumb-init /usr/local/bin/dumb-init
+COPY --from=tools /usr/local/bin/conftest /usr/local/bin/conftest
+COPY --from=tools /usr/local/bin/infracost /usr/local/bin/infracost
+
+COPY --from=tools /usr/bin/dumb-init /usr/bin/dumb-init
+COPY --from=tools /usr/local/bin/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
+
+ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
+CMD ["server"]

atlantis/atlantis-config.yaml

@@ -0,0 +1,117 @@
+---
+repos:
+  - id: "/.*/"
+    apply_requirements:
+      - approved
+      - mergeable
+      - undiverged
+    workflow: terragrunt
+    allowed_workflows:
+      - terragrunt
+#      - terragrunt-run-all
+    delete_source_branch_on_merge: true
+    repo_locking: false
+    post_workflow_hooks:
+      - run: |
+          if [ ! -d "/tmp/$BASE_REPO_OWNER-$BASE_REPO_NAME-$PULL_NUM" ]; then
+            exit 0
+          fi
+          infracost comment github \
+            --repo "${BASE_REPO_OWNER}/${BASE_REPO_NAME}" \
+            --pull-request "${PULL_NUM}" \
+            --path /tmp/${BASE_REPO_OWNER}-${BASE_REPO_NAME}-${PULL_NUM}/'*'-infracost.json \
+            --github-token "${INFRACOST_GITHUB_TOKEN}" \
+            --behavior delete-and-new
+          rm -rf "/tmp/${BASE_REPO_OWNER}-${BASE_REPO_NAME}-${PULL_NUM}"
+          mkdir -p "/tmp/${BASE_REPO_OWNER}-${BASE_REPO_NAME}-${PULL_NUM}"
+
+workflows:
+  terragrunt:
+    plan:
+      steps:
+        - env:
+            name: TERRAGRUNT_TFPATH
+            command: 'echo "terraform${ATLANTIS_TERRAFORM_VERSION}"'
+        - env:
+            name: TF_IN_AUTOMATION
+            value: 'true'
+        - env:
+            name: TF_PLUGIN_CACHE_MAY_BREAK_DEPENDENCY_LOCK_FILE
+            value: 'true'
+        - env:
+            name: INFRACOST_OUTPUT
+            command: 'echo "/tmp/$BASE_REPO_OWNER-$BASE_REPO_NAME-$PULL_NUM/$WORKSPACE-${REPO_REL_DIR//\//-}-infracost.json"'
+        - run: |
+            mkdir -p "/tmp/${BASE_REPO_OWNER}-${BASE_REPO_NAME}-${PULL_NUM}"
+
+            if ! [[ "${BASE_BRANCH_NAME}" == "production" || "${BASE_BRANCH_NAME}" == "develop" ]]; then
+              echo "Environment skipped. Please open a Pull Request to production or develop branch to plan and apply infrastructure changes."
+              exit 0
+            elif [[ "${REPO_REL_DIR}" == *"prod"* && "${BASE_BRANCH_NAME}" != "production" ]]; then
+              echo "Environment skipped. Please open a Pull Request to production branch to plan and apply production changes."
+              exit 0
+            else
+              cp "${HOME}/.terraform.d/terragrunt-core.hcl" "${DIR/\/${REPO_REL_DIR}/}"
+              terragrunt plan -input=false -out=$PLANFILE
+              terragrunt show -json $PLANFILE > $SHOWFILE
+              infracost breakdown \
+                --path=$SHOWFILE \
+                --format=json \
+                --log-level=info \
+                --out-file=${INFRACOST_OUTPUT} \
+                --project-name=$REPO_REL_DIR
+            fi
+    apply:
+      steps:
+        - env:
+            name: TERRAGRUNT_TFPATH
+            command: 'echo "terraform${ATLANTIS_TERRAFORM_VERSION}"'
+        - env:
+            name: TF_IN_AUTOMATION
+            value: 'true'
+        - env:
+            name: TF_PLUGIN_CACHE_MAY_BREAK_DEPENDENCY_LOCK_FILE
+            value: 'true'
+        - run: |
+            if ! [[ "${BASE_BRANCH_NAME}" == "production" || "${BASE_BRANCH_NAME}" == "develop" ]]; then
+              echo "Environment skipped. Please open a Pull Request to production or develop branch to plan and apply infrastructure changes."
+              exit 0
+            elif [[ "${REPO_REL_DIR}" == *"prod"* && "${BASE_BRANCH_NAME}" != "production" ]]; then
+              echo "Environment skipped. Please open a Pull Request to production branch to plan and apply production changes."
+              exit 0
+            else
+              cp "${HOME}/.terraform.d/terragrunt-core.hcl" "${DIR/\/${REPO_REL_DIR}/}"
+              terragrunt terragrunt apply -input=false $PLANFILE
+            fi
+
+#  terragrunt-run-all:
+#    plan:
+#      steps:
+#        - run: |
+#            mkdir -p "/tmp/${BASE_REPO_OWNER}-${BASE_REPO_NAME}-${PULL_NUM}"
+#            if ! [[ "${BASE_BRANCH_NAME}" == "production" || "${BASE_BRANCH_NAME}" == "develop" ]]; then
+#              echo "Environment skipped. Please open a Pull Request to production or develop branch to plan and apply infrastructure changes."
+#              exit 0
+#            elif [[ "${REPO_REL_DIR}" == *"prod"* ]]; then
+#              if ! [[ "${BASE_BRANCH_NAME}" == "production" ]]; then
+#                echo "Environment skipped. Please open a Pull Request to production branch to plan and apply production changes."
+#                exit 0
+#              fi
+#            else
+#              cp "${HOME}/.terraform.d/terragrunt-core.hcl" "${DIR/\/${REPO_REL_DIR}/}"
+#              terragrunt run-all plan -out plan.out"
+#            fi
+#    apply:
+#      steps:
+#        - run: |
+#            if ! [[ "${BASE_BRANCH_NAME}" == "production" || "${BASE_BRANCH_NAME}" == "develop" ]]; then
+#              echo "Environment skipped. Please open a Pull Request to production or develop branch to plan and apply infrastructure changes."
+#              exit 0
+#            elif [[ "${REPO_REL_DIR}" == *"prod"* ]]; then
+#              if ! [[ "${BASE_BRANCH_NAME}" == "production" ]]; then
+#                echo "Environment skipped. Please open a Pull Request to production branch to plan and apply production changes."
+#                exit 0
+#              fi
+#            else
+#              terragrunt run-all apply plan.out --terragrunt-non-interactive
+#            fi

terraform/Dockerfile

@@ -0,0 +1,119 @@
+#################################################################################
+# Inspired by
+# https://github.com/cloudbees/java-build-tools-dockerfile/blob/master/Dockerfile
+#################################################################################
+ARG ALPINE_VERSION=3.16
+FROM python:3.10.5-alpine${ALPINE_VERSION} as awscli
+
+ARG AWS_CLI_VERSION=2.13.37
+RUN \
+  apk add --no-cache \
+    build-base \
+    cmake \
+    git \
+    groff \
+    libffi-dev \
+    unzip \
+  && git clone --single-branch --depth 1 -b ${AWS_CLI_VERSION} https://github.com/aws/aws-cli.git \
+  && cd aws-cli \
+  && python -m venv venv \
+  && . venv/bin/activate \
+  && scripts/installers/make-exe \
+  && unzip -q dist/awscli-exe.zip \
+  && aws/install --bin-dir /aws-cli-bin \
+  && /aws-cli-bin/aws --version \
+  && rm -rf \
+    /usr/local/aws-cli/v2/current/dist/aws_completer \
+    /usr/local/aws-cli/v2/current/dist/awscli/data/ac.index \
+    /usr/local/aws-cli/v2/current/dist/awscli/examples \
+  && find /usr/local/aws-cli/v2/current/dist/awscli/data -name 'completions-1*.json' -delete \
+  && find /usr/local/aws-cli/v2/current/dist/awscli/botocore/data -name examples-1.json -delete
+
+
+FROM alpine:${ALPINE_VERSION} as main
+
+ENV LANG=C.UTF-8 \
+    PROFILE="~/.bashrc"
+
+RUN \
+  apk add --no-cache \
+    bash \
+    curl \
+    git \
+    git-crypt \
+    gnupg \
+    jq \
+    python3 \
+    py3-pip \
+    shadow \
+    openssh \
+    openssh-client \
+    unzip \
+    wget \
+  && pip3 install  --no-cache-dir -U \
+    ansible \
+    hvac \
+    pip \
+    yq \
+    wheel \
+  && rm -rf /var/cache/apk/*
+
+#=======================================
+# AWS Cli
+#=======================================
+COPY --from=awscli /usr/local/aws-cli/ /usr/local/aws-cli/
+COPY --from=awscli /aws-cli-bin/ /usr/local/bin/
+
+#=======================================
+# Terraform install
+#=======================================
+ARG TERRAFORM_VERSION=1.6.4
+ENV TERRAFORM_VERSION=$TERRAFORM_VERSION
+RUN wget --quiet -O /tmp/terraform.zip \
+    "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \
+  && unzip -p /tmp/terraform.zip terraform > /tmp/terraform \
+  && chmod +x /tmp/terraform \
+  && mv /tmp/terraform /usr/bin/terraform \
+  && ln -s /usr/bin/terraform "/usr/bin/terraform${TERRAFORM_VERSION}" \
+  && rm -rf /tmp/terraform.zip
+
+#=======================================
+# Terragrunt install
+#=======================================
+ENV TERRAGRUNT_VERSION=0.53.5
+RUN wget --quiet -O /tmp/terragrunt \
+    "https://github.com/gruntwork-io/terragrunt/releases/download/v${TERRAGRUNT_VERSION}/terragrunt_linux_amd64" \
+  && chmod +x /tmp/terragrunt \
+  && mv /tmp/terragrunt /usr/bin/terragrunt
+
+#=======================================
+# Terraform providers cache
+#=======================================
+ENV TF_PLUGIN_CACHE_DIR="/root/.terraform.d/plugins"
+COPY install-providers.sh /tmp/install-providers.sh
+COPY providers.txt ${TF_PLUGIN_CACHE_DIR}/../
+COPY terraform.rc /root/.terraformrc
+RUN /tmp/install-providers.sh \
+  "${TF_PLUGIN_CACHE_DIR}/../providers.txt"
+COPY terragrunt-core.hcl ${TF_PLUGIN_CACHE_DIR}/../
+
+# GOLANG support
+COPY --from=golang:1.19-alpine /usr/local/go/ /usr/local/go/
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+#=======================================
+# Known Hosts authentication
+#=======================================
+RUN mkdir -p ~/.ssh > /dev/null \
+   && ssh-keyscan "github.com" >> ~/.ssh/known_hosts 2> /dev/null
+
+#=======================================
+# Validate installation
+#=======================================
+RUN \
+  terraform --version \
+  && terragrunt --version \
+  && yq --version \
+  && aws --version \
+  && go version
+CMD [ "bash" ]