Multi-cloud app deployment with Terraform & cloud-init

terraform {
  required_version = ">= 1.5.0"

  # All four providers are used (one per child module). terraform init installs
  # them; each child module configures its own provider from the variables passed
  # in below.
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    google = {
      source  = "hashicorp/google"
      version = "~> 6.0"
    }
    oci = {
      source  = "oracle/oci"
      version = "~> 6.0"
    }
  }
}

# Required cloud identifiers (everything else uses the child module defaults).
# No secrets — these are account-scoping identifiers.

variable "gcp_project_id" {
  description = "GCP project id. Get it with: gcloud config get-value project"
  type        = string
}

variable "oci_compartment_id" {
  description = "OCI compartment OCID (tenancy root is fine for Always Free). From ~/.oci/config (tenancy=) or: oci iam compartment list"
  type        = string
}

variable "azure_subscription_id" {
  description = "Azure subscription id. Leave null to use the ARM_SUBSCRIPTION_ID env var. Get it with: az account show --query id -o tsv"
  type        = string
  default     = null
}

variable "name" {
  description = "Name / prefix for the VM and its resources in every cloud."
  type        = string
  default     = "poli-tracker"
}

variable "public_key_path" {
  description = "Path to the SSH PUBLIC key injected into every VM. The private key stays on your machine."
  type        = string
  default     = "~/.ssh/id_rsa.pub"
}

# Multi-cloud app deployment: one free-tier VM in each of AWS, Azure, GCP and OCI,
# each bootstrapped with the poli-tracker app (cloned from the public repo and
# served on port 80). Reuses the four standalone VM modules, passing the same
# cloud-init bootstrap script to every one via their `user_data` input.
#
# SERIALIZATION / NO RACE CONDITIONS:
#   The child modules carry their own provider blocks, so Terraform forbids
#   depends_on/count/for_each on them. Run apply/destroy with -parallelism=1 to
#   process one operation at a time (no concurrent cross-cloud calls).

locals {
  # The same bootstrap runs on every cloud (it detects dnf vs apt internally).
  app_bootstrap = file("${path.module}/cloud-init.sh")
}

# --- AWS: t3.micro, Amazon Linux 2023 (free tier), default VPC ---
module "aws" {
  source          = "../aws-freetier-vm"
  name            = var.name
  public_key_path = var.public_key_path
  user_data       = local.app_bootstrap
}

# --- Azure: Spot Standard_B2ats_v2 in westcentralus (free B-series is capacity-
#     restricted on this subscription, so the working recipe is Spot) ---
module "azure" {
  source               = "../azure-freetier-vm"
  name                 = var.name
  public_key_path      = var.public_key_path
  subscription_id      = var.azure_subscription_id
  location             = "westcentralus"
  vm_size              = "Standard_B2ats_v2"
  spot_enabled         = true
  spot_eviction_policy = "Deallocate"
  spot_max_bid_price   = -1
  user_data            = local.app_bootstrap
}

# --- GCP: e2-micro in us-west1, Ubuntu 24.04 (Always Free) ---
module "gcp" {
  source          = "../gcp-freetier-vm"
  name            = var.name
  public_key_path = var.public_key_path
  project_id      = var.gcp_project_id
  user_data       = local.app_bootstrap
}

# --- OCI: VM.Standard.E2.1.Micro, Ubuntu 24.04 (Always Free) ---
module "oci" {
  source              = "../oci-freetier-vm"
  name                = var.name
  ssh_public_key_path = var.public_key_path
  compartment_id      = var.oci_compartment_id
  user_data           = local.app_bootstrap
}

#!/bin/bash
# Bootstrap the poli-tracker app on first boot: install Python + git, clone the
# PUBLIC repo, install deps, do an initial data load, and serve it over HTTPS on
# port 443 with a SELF-SIGNED certificate (gunicorn's built-in TLS — no nginx, so
# it works identically on Amazon Linux 2023 (dnf) and Ubuntu (apt)).
#
# Self-signed (not Let's Encrypt) because this deploy isn't always online and DNS
# is hand-managed; browsers show a one-time "unknown issuer" warning.
set -eux
export DEBIAN_FRONTEND=noninteractive

APP_DOMAIN="${APP_DOMAIN:-poli-tracker.rpg4you.com}"

if command -v dnf >/dev/null 2>&1; then
  dnf install -y python3 python3-pip git openssl
elif command -v apt-get >/dev/null 2>&1; then
  apt-get update -y
  apt-get install -y python3 python3-venv python3-pip git openssl
fi

APP_DIR=/opt/poli-tracker
rm -rf "$APP_DIR"
git clone --depth 1 https://github.com/beknar/poli-tracker.git "$APP_DIR"
cd "$APP_DIR"

python3 -m venv .venv
.venv/bin/pip install --upgrade pip
.venv/bin/pip install -r requirements.txt gunicorn

# Initial data load. CT_MAX_TICKERS bounds yfinance work so first boot on a 1 GB
# free-tier VM stays reasonable; '|| true' so a slow/rate-limited fetch doesn't
# fail the boot (the service still starts and the UI's Refresh button can retry).
CT_MAX_TICKERS=40 .venv/bin/python -m backend.ingest || true

# Self-signed TLS cert (domain as CN + SAN, ~10-year validity).
mkdir -p "$APP_DIR/tls"
openssl req -x509 -nodes -newkey rsa:2048 \
  -keyout "$APP_DIR/tls/selfsigned.key" \
  -out    "$APP_DIR/tls/selfsigned.crt" \
  -days 3650 -subj "/CN=${APP_DOMAIN}" -addext "subjectAltName=DNS:${APP_DOMAIN}"
chmod 600 "$APP_DIR/tls/selfsigned.key"

# Serve HTTPS directly from gunicorn on :443 (1 worker to fit 1 GB RAM; runs as
# root for the privileged port — fine for this demo).
cat >/etc/systemd/system/poli-tracker.service <<'UNIT'
[Unit]
Description=poli-tracker (gunicorn, self-signed HTTPS)
After=network-online.target
Wants=network-online.target

[Service]
WorkingDirectory=/opt/poli-tracker
Environment=CT_MAX_TICKERS=40
ExecStart=/opt/poli-tracker/.venv/bin/gunicorn -b 0.0.0.0:443 -w 1 --timeout 120 --certfile /opt/poli-tracker/tls/selfsigned.crt --keyfile /opt/poli-tracker/tls/selfsigned.key app:app
Restart=always

[Install]
WantedBy=multi-user.target
UNIT

systemctl daemon-reload
systemctl enable --now poli-tracker

# Open the HOST firewall for 443 (and 80). OCI's Ubuntu images ship an iptables
# firewall that only permits SSH, so without this 443 is silently dropped
# (browser timeout). Harmless on AWS/Azure/GCP images (INPUT defaults to ACCEPT).
if command -v iptables >/dev/null 2>&1; then
  for p in 80 443; do
    iptables -C INPUT -p tcp --dport "$p" -j ACCEPT 2>/dev/null \
      || iptables -I INPUT -p tcp --dport "$p" -j ACCEPT
  done
  command -v netfilter-persistent >/dev/null 2>&1 && netfilter-persistent save || true
fi
# Oracle Linux / RHEL-family images use firewalld instead.
if command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then
  firewall-cmd --permanent --add-service=https
  firewall-cmd --permanent --add-service=http
  firewall-cmd --reload
fi

output "public_ips" {
  description = "Public IP of the VM in each cloud."
  value = {
    aws   = module.aws.public_ip
    azure = module.azure.public_ip
    gcp   = module.gcp.public_ip
    oci   = module.oci.public_ip
  }
}

output "app_urls" {
  description = "URL where the poli-tracker app is served in each cloud (HTTPS :443, self-signed cert)."
  value = {
    aws   = "https://${module.aws.public_ip}"
    azure = "https://${module.azure.public_ip}"
    gcp   = "https://${module.gcp.public_ip}"
    oci   = "https://${module.oci.public_ip}"
  }
}

output "ssh_commands" {
  description = "Ready-to-run SSH command for each cloud's VM."
  value = {
    aws   = module.aws.ssh_command
    azure = module.azure.ssh_command
    gcp   = module.gcp.ssh_command
    oci   = module.oci.ssh_command
  }
}

# Copy to terraform.tfvars and set the two required identifiers. No secrets here.
# terraform.tfvars is gitignored.

# REQUIRED
gcp_project_id     = "my-project-123456"                                          # gcloud config get-value project
oci_compartment_id = "ocid1.tenancy.oc1..xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" # ~/.oci/config tenancy=, or oci iam compartment list

# OPTIONAL — leave unset to use the ARM_SUBSCRIPTION_ID env var instead
# azure_subscription_id = "00000000-0000-0000-0000-000000000000"                  # az account show --query id -o tsv

name            = "poli-tracker"
public_key_path = "~/.ssh/id_rsa.pub"

# Never commit Terraform state (can contain resource details / sensitive values),
# local provider plugins, crash logs, plan files, or your local variable choices
# (terraform.tfvars holds your project id / compartment OCID).
.terraform/
.terraform.lock.hcl
*.tfstate
*.tfstate.*
crash.log
*.tfplan
terraform.tfvars
*.auto.tfvars

cd terraform/app-multi-cloud

# pull the required ids straight from your configured CLIs
export TF_VAR_gcp_project_id="$(gcloud config get-value project)"
export TF_VAR_oci_compartment_id="$(grep '^tenancy=' ~/.oci/config | cut -d= -f2)"
export ARM_SUBSCRIPTION_ID="$(az account show --query id -o tsv)"
# AWS needs nothing — it uses the `freetier` profile in ~/.aws/credentials

terraform init                     # download the four providers, link the modules
terraform fmt -check -recursive    # optional: canonical style
terraform plan                     # preview: VMs + networking across all four clouds
terraform apply -parallelism=1     # create everything, one operation at a time

# give each VM a minute or two to finish cloud-init, then:
terraform output app_urls          # the four dashboard URLs (https://<ip>)
./list-app-vms.sh                  # name + IP + app URL per cloud

terraform destroy -parallelism=1   # tear it all down

#!/usr/bin/env bash
# List the running app VMs in all four clouds, with each VM's public IP and the
# URL the poli-tracker app is served on (https://<ip>, port 443).
# Requires each cloud's CLI authenticated and on PATH. OCI compartment is read
# from ~/.oci/config (tenancy root).
set -u

line() { printf '  %-22s %-16s %s\n' "$1" "$2" "$3"; }

echo "=== AWS (EC2, profile ${AWS_PROFILE:-freetier}) ==="
line "NAME" "PUBLIC IP" "APP URL"
aws ec2 describe-instances --profile "${AWS_PROFILE:-freetier}" \
  --filters Name=instance-state-name,Values=running \
  --query 'Reservations[].Instances[].[Tags[?Key==`Name`]|[0].Value, PublicIpAddress]' \
  --output text 2>/dev/null \
| while read -r name ip; do line "${name:-?}" "${ip:-none}" "https://${ip}"; done

echo "=== Azure ==="
line "NAME" "PUBLIC IP" "APP URL"
az vm list -d --query "[?powerState=='VM running'].[name, publicIps]" -o tsv 2>/dev/null \
| while read -r name ip; do line "${name:-?}" "${ip:-none}" "https://${ip}"; done

echo "=== GCP ==="
line "NAME" "PUBLIC IP" "APP URL"
gcloud compute instances list --filter='status=RUNNING' \
  --format='value(name, networkInterfaces[0].accessConfigs[0].natIP)' 2>/dev/null \
| while read -r name ip; do line "${name:-?}" "${ip:-none}" "https://${ip}"; done

echo "=== OCI ==="
line "NAME" "PUBLIC IP" "APP URL"
TENANCY=$(awk -F= '/^tenancy=/{print $2}' ~/.oci/config 2>/dev/null)
oci compute instance list --compartment-id "$TENANCY" --lifecycle-state RUNNING \
  --query 'data[].id' --raw-output 2>/dev/null \
| grep -oE 'ocid1\.instance\.[a-z0-9.]+' \
| while read -r iid; do
    name=$(oci compute instance get --instance-id "$iid" \
             --query 'data."display-name"' --raw-output 2>/dev/null)
    ip=$(oci compute instance list-vnics --instance-id "$iid" \
           --query 'data[0]."public-ip"' --raw-output 2>/dev/null)
    line "${name:-?}" "${ip:-none}" "https://${ip}"
  done