xdr-terraform-modules/base/repo_server/lb_internal.tf

#----------------------------------------------------------------------------
# INTERNAL LB
#----------------------------------------------------------------------------
resource "aws_lb" "internal" {
  name_prefix                = substr(var.instance_name, 0, 6)
  security_groups            = [aws_security_group.alb_internal.id]
  internal                   = true
  subnets                    = var.public_subnets
  load_balancer_type         = "application"
  drop_invalid_header_fields = true

  access_logs {
    bucket  = "xdr-elb-${var.environment}"
    enabled = true
  }

  idle_timeout = 1200

  tags = merge(local.standard_tags, var.tags, { Name = "reposerver-internal-${var.environment}" })
}

# Create a new target group
resource "aws_lb_target_group" "internal" {
  name_prefix = substr(var.instance_name, 1, 6)
  port        = 80
  protocol    = "HTTP"
  vpc_id      = var.vpc_id

  health_check {
    protocol            = "HTTP"
    port                = "80"
    path                = "/epel/7/repodata/repomd.xml"
    matcher             = "200,302"
    timeout             = "4"
    interval            = "5"
    unhealthy_threshold = 2
    healthy_threshold   = 2
  }

  #stickiness {
  #  type    = "lb_cookie"
  #  enabled = false 
  #}

  tags = merge(local.standard_tags, var.tags, { Name = "reposerver-internal-${var.environment}" })
}

resource "aws_lb_target_group_attachment" "internal" {
  target_group_arn = aws_lb_target_group.internal.arn
  target_id        = aws_instance.instance.id
  port             = 80
}

# Create a new alb listener
resource "aws_lb_listener" "https_internal" {
  load_balancer_arn = aws_lb.internal.arn
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-FS-1-2-Res-2020-10" # PFS, TLS1.2, and GCM; most "restrictive" policy
  certificate_arn   = aws_acm_certificate.cert_private.arn

  default_action {
    target_group_arn = aws_lb_target_group.internal.arn
    type             = "forward"
  }
}

resource "aws_lb_listener" "listener_http" {
  load_balancer_arn = aws_lb.internal.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

# #########################
# # DNS Entry
module "internal_lb_private_dns_record" {
  source = "../../submodules/dns/private_CNAME_record"

  name             = "reposerver"
  target_dns_names = [aws_lb.internal.dns_name]
  dns_info         = var.dns_info

  providers = {
    aws.c2 = aws.c2
  }
}

#----------------------------------------------------------------------------
# ALB Security Group
#----------------------------------------------------------------------------
resource "aws_security_group" "alb_internal" {
  vpc_id      = var.vpc_id
  name_prefix = "repo_alb"
  description = "ALB for Repo Server Internal ALB"
  tags        = merge(local.standard_tags, var.tags)
}

#----------------------------------------------------------------------------
# INGRESS
#----------------------------------------------------------------------------
resource "aws_security_group_rule" "http_from_local" {
  description       = "HTTP inbound from Private Servers"
  type              = "ingress"
  from_port         = "80"
  to_port           = "80"
  protocol          = "tcp"
  cidr_blocks       = ["10.0.0.0/8"]
  security_group_id = aws_security_group.alb_internal.id
}

resource "aws_security_group_rule" "https_from_local" {
  description       = "HTTPS inbound from private servers"
  type              = "ingress"
  from_port         = "443"
  to_port           = "443"
  protocol          = "tcp"
  cidr_blocks       = ["10.0.0.0/8"]
  security_group_id = aws_security_group.alb_internal.id
}

#----------------------------------------------------------------------------
# EGRESS
#----------------------------------------------------------------------------
resource "aws_security_group_rule" "alb_to_server" {
  description              = "HTTP to the Server"
  type                     = "egress"
  from_port                = "80"
  to_port                  = "80"
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.repo_server_security_group.id
  security_group_id        = aws_security_group.alb_internal.id
}