MusicCPR Infrastructure on AWS via OpenTofu

tfvars

Make a file called terraform.tfvars in the root of this repo with content like:

aws_profile = "cprprod" # should correspond to a profile name in ~/.aws/creds or similar
# aws_region = "us-east-1" # default
project_name = "cpr"
# instance_type = "t3.micro" # default# db_instance_class = "db.t3.micro" # default
db_username = "STRING"
db_password = "STRING"
ses_domain = "musiccpr.org"
ses_email = "aws@musiccpr.org"

Process resulting in this repo:

1. Ray said we should use OpenTofu.

2. I asked claude to

   ec2-with-rds.tf to use opentofu to define infrastructure to host a full stack web app (django): an ec2 instance with an s3 bucket and an rds instance (postgres)

3. it did, and told me

   Done. I've created a complete OpenTofu configuration for your Django stack with:
   **Resources created:*** VPC with public and private subnets across 2 availability zones
   * EC2 instance (Ubuntu 22.04) with:
   * Security group allowing SSH, HTTP, and HTTPS
   * IAM role for S3 access
   * User data script installing Python, nginx, and PostgreSQL client
   * RDS PostgreSQL 15 instance with:
   * Encrypted storage
   * Private subnet placement (only accessible from EC2)
   * Auto-scaling storage up to 100GB
   * S3 bucket for static/media files with:
   * Versioning enabled
   * Public access blocked
   * IAM policy granting EC2 access
   **To use this:**1. Create a terraform.tfvars file with your credentials:
    > db_username = "your_db_admin"> db_password = "your_secure_password"2. Ensure you have an SSH key at ~/.ssh/id_rsa.pub (or update line 303) [sic]3. Run:
    > tofu init> tofu plan> tofu apply
   The outputs will give you the EC2 public IP, RDS endpoint, and S3 bucket name to configure in your Django settings.

4. I created an ssh key and called it cpr_tofu and updated the corresponding line (323 at the time)

5. I updated my ~/.aws/credentials file with current keys for cprprod profile

6. I replaced the generated provider config with

   provider "aws" {
   shared_config_files = ["~/.aws/config"]
   shared_credentials_files = ["~/.aws/credentials"]
   profile = "cprprod"
   }

7. I was getting permissions errors so i attached a new policy

   {
   "Effect": "Allow",
   "Action": [
   "ec2:DescribeAvailabilityZones",
   "ec2:DescribeImages"
   ],
   "Resource": "*"
   }

8. i asked claude to add backup to ec2 and rds. needed more perms

   "backup:CreateBackupVault",
   "backup:DeleteBackupVault",
   "backup:DescribeBackupVault",
   "backup:ListBackupVaults",
   "backup:CreateBackupPlan",
   "backup:DeleteBackupPlan",
   "backup:GetBackupPlan",
   "backup:ListBackupPlans",
   "backup:CreateBackupSelection",
   "backup:DeleteBackupSelection",
   "backup:GetBackupSelection",
   "backup:ListBackupSelections",
   "backup:TagResource",
   "backup:UntagResource",
   "backup:ListTags"

9. asked claude to add ses identity domain and identity email address. it let me know:

   **New variables (add to your terraform.tfvars):**
   ses_domain = "yourdomain.com"
   ses_email = "noreply@yourdomain.com"
   **Resources added:*** Domain identity with DKIM signing and custom MAIL FROM domain
   * Email identity for a specific email address
   * IAM policy allowing EC2 to send emails via SES (restricted to your specified sender address)
   **DNS records you'll need to add after apply:**
   1. TXT record for domain verification (value in ses_domain_verification_token output)
   2. 3 CNAME records for DKIM (values in ses_dkim_tokens output)
   3. MX record for mail-from domain: mail.yourdomain.com → feedback-smtp.<region>.amazonses.com
   4. TXT record for mail-from SPF: mail.yourdomain.com → v=spf1 include:amazonses.com ~all
   The email identity will receive a verification email from AWS that must be clicked to confirm.