snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

terraform/examples/aws-all-in-one/main.tf

@@ -0,0 +1,133 @@
+# SeaweedFS all-in-one on a single AWS instance.
+#
+# Demonstrates the layered design directly: call the cloud-agnostic core to
+# render cloud-init for a `weed server` node, then attach it to one instance
+# with a protected data disk. No wrapper module needed for the simple case.
+#
+#   tofu init && tofu validate
+#   tofu apply   # requires AWS credentials + a weed AMI
+
+terraform {
+  required_version = ">= 1.3.0"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 5.40"
+    }
+  }
+}
+
+provider "aws" {
+  region = var.region
+}
+
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+variable "vpc_id" {
+  type = string
+}
+variable "subnet_id" {
+  type = string
+}
+variable "availability_zone" {
+  type    = string
+  default = "us-east-1a"
+}
+variable "ami_id" {
+  type = string
+}
+variable "private_ip" {
+  type    = string
+  default = "10.0.1.50"
+}
+
+module "core" {
+  source      = "../../modules/core"
+  weed_binary = "/usr/bin/weed"
+
+  # disable the distributed tiers; run a single all-in-one process
+  master = { enabled = false }
+  volume = { enabled = false }
+  filer  = { enabled = false }
+
+  all_in_one = {
+    enabled = true
+    nodes   = { a0 = { address = var.private_ip, data_dir = "/data" } }
+    s3      = { enabled = true }
+  }
+
+  s3_identities = [{
+    name       = "anonymous"
+    access_key = ""
+    secret_key = ""
+    actions    = ["Read", "List"]
+  }]
+}
+
+resource "aws_network_interface" "aio" {
+  subnet_id       = var.subnet_id
+  private_ips     = [var.private_ip]
+  security_groups = [aws_security_group.aio.id]
+  tags            = { Name = "seaweedfs-all-in-one" }
+}
+
+resource "aws_security_group" "aio" {
+  name_prefix = "seaweedfs-aio-"
+  vpc_id      = var.vpc_id
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_vpc_security_group_ingress_rule" "s3" {
+  security_group_id = aws_security_group.aio.id
+  cidr_ipv4         = "10.0.0.0/8"
+  ip_protocol       = "tcp"
+  from_port         = 8333
+  to_port           = 8333
+}
+
+resource "aws_vpc_security_group_egress_rule" "all" {
+  security_group_id = aws_security_group.aio.id
+  cidr_ipv4         = "0.0.0.0/0"
+  ip_protocol       = "-1"
+}
+
+resource "aws_instance" "aio" {
+  ami           = var.ami_id
+  instance_type = "m5.large"
+  user_data     = module.core.cloud_init_by_node["all-in-one-a0"]
+
+  network_interface {
+    network_interface_id = aws_network_interface.aio.id
+    device_index         = 0
+  }
+  metadata_options {
+    http_tokens = "required"
+  }
+  tags = { Name = "seaweedfs-all-in-one", Role = "all-in-one" }
+}
+
+resource "aws_ebs_volume" "data" {
+  availability_zone = var.availability_zone
+  size              = 200
+  type              = "gp3"
+  encrypted         = true
+  tags              = { Name = "seaweedfs-all-in-one-data" }
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "aws_volume_attachment" "data" {
+  device_name                    = "/dev/xvdf"
+  volume_id                      = aws_ebs_volume.data.id
+  instance_id                    = aws_instance.aio.id
+  stop_instance_before_detaching = true
+}
+
+output "instance_id" {
+  value = aws_instance.aio.id
+}

terraform/examples/aws-ha-distributed/main.tf

@@ -0,0 +1,117 @@
+# SeaweedFS HA on AWS: 3-master quorum + 3 volume servers (one per AZ) + 2
+# filers (leveldb2-replicated HA) + 1 standalone S3 gateway.
+#
+#   tofu init && tofu validate
+#   tofu apply   # requires AWS credentials, a VPC, subnets, and a weed AMI
+#
+# This is a scaffold: it provisions instances, protected EBS data disks, and the
+# security group. Mounting the EBS disk at /data and secret-store cert delivery
+# are documented follow-ups (see terraform/README.md).
+
+terraform {
+  required_version = ">= 1.3.0"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 5.40"
+    }
+  }
+}
+
+provider "aws" {
+  region = var.region
+}
+
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+variable "vpc_id" {
+  type = string
+}
+
+variable "ami_id" {
+  description = "AMI with the weed binary at /usr/bin/weed."
+  type        = string
+}
+
+# subnet per AZ
+variable "subnet_a" { type = string }
+variable "subnet_b" { type = string }
+variable "subnet_c" { type = string }
+
+# AZ defaults assume region us-east-1. When you change `region`, override az_a/az_b/az_c
+# (and the matching subnets) with AZs that belong to that region, or the volume/filer
+# EBS volumes will fail to create in a mismatched AZ.
+variable "az_a" {
+  type    = string
+  default = "us-east-1a"
+}
+variable "az_b" {
+  type    = string
+  default = "us-east-1b"
+}
+variable "az_c" {
+  type    = string
+  default = "us-east-1c"
+}
+
+variable "client_ingress_cidrs" {
+  type    = list(string)
+  default = ["10.0.0.0/8"]
+}
+
+variable "ssh_ingress_cidrs" {
+  type    = list(string)
+  default = []
+}
+
+module "seaweedfs" {
+  source = "../../modules/aws"
+
+  name   = "seaweedfs"
+  vpc_id = var.vpc_id
+  ami_id = var.ami_id
+
+  # secure-by-default flagship: mTLS (certs + JWT generated by the security
+  # submodule, delivered via SSM and fetched at boot) plus monitoring.
+  enable_security    = true
+  monitoring_enabled = true
+
+  masters = {
+    m0 = { subnet_id = var.subnet_a, private_ip = "10.0.1.10" }
+    m1 = { subnet_id = var.subnet_b, private_ip = "10.0.2.10" }
+    m2 = { subnet_id = var.subnet_c, private_ip = "10.0.3.10" }
+  }
+
+  volumes = {
+    v0 = { subnet_id = var.subnet_a, availability_zone = var.az_a, private_ip = "10.0.1.20", rack = var.az_a, data_center = var.region, data_volume_size_gb = 500 }
+    v1 = { subnet_id = var.subnet_b, availability_zone = var.az_b, private_ip = "10.0.2.20", rack = var.az_b, data_center = var.region, data_volume_size_gb = 500 }
+    v2 = { subnet_id = var.subnet_c, availability_zone = var.az_c, private_ip = "10.0.3.20", rack = var.az_c, data_center = var.region, data_volume_size_gb = 500 }
+  }
+
+  filers = {
+    f0 = { subnet_id = var.subnet_a, availability_zone = var.az_a, private_ip = "10.0.1.30" }
+    f1 = { subnet_id = var.subnet_b, availability_zone = var.az_b, private_ip = "10.0.2.30" }
+  }
+
+  s3_nodes = {
+    s0 = { subnet_id = var.subnet_a, private_ip = "10.0.1.40" }
+  }
+
+  client_ingress_cidrs = var.client_ingress_cidrs
+  ssh_ingress_cidrs    = var.ssh_ingress_cidrs
+}
+
+output "master_peers" {
+  value = module.seaweedfs.master_peers
+}
+
+output "instance_ids" {
+  value = module.seaweedfs.instance_ids
+}
+
+output "security_group_id" {
+  value = module.seaweedfs.security_group_id
+}