snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

terraform/modules/aws/main.tf

@@ -0,0 +1,205 @@
+# ---- step 1: reserve stable addressing (ENIs with fixed private IPs) -------
+# These exist BEFORE the core renders config, so the address map is known and
+# the core <- wrapper dependency is one-way (no apply-time cycle).
+
+resource "aws_network_interface" "master" {
+  for_each        = var.masters
+  subnet_id       = each.value.subnet_id
+  private_ips     = [each.value.private_ip]
+  security_groups = [aws_security_group.cluster.id]
+  tags            = merge(var.tags, { Name = "${var.name}-master-${each.key}", Role = "master" })
+}
+
+resource "aws_network_interface" "volume" {
+  for_each        = var.volumes
+  subnet_id       = each.value.subnet_id
+  private_ips     = [each.value.private_ip]
+  security_groups = [aws_security_group.cluster.id]
+  tags            = merge(var.tags, { Name = "${var.name}-volume-${each.key}", Role = "volume" })
+}
+
+resource "aws_network_interface" "filer" {
+  for_each        = var.filers
+  subnet_id       = each.value.subnet_id
+  private_ips     = [each.value.private_ip]
+  security_groups = [aws_security_group.cluster.id]
+  tags            = merge(var.tags, { Name = "${var.name}-filer-${each.key}", Role = "filer" })
+}
+
+resource "aws_network_interface" "s3" {
+  for_each        = var.s3_nodes
+  subnet_id       = each.value.subnet_id
+  private_ips     = [each.value.private_ip]
+  security_groups = [aws_security_group.cluster.id]
+  tags            = merge(var.tags, { Name = "${var.name}-s3-${each.key}", Role = "s3" })
+}
+
+# ---- step 2: render config with the cloud-agnostic core --------------------
+module "core" {
+  source = "../core"
+
+  weed_binary        = var.weed_binary
+  monitoring_enabled = var.monitoring_enabled
+  enable_security    = var.enable_security
+  security           = local.core_security
+
+  # Keep secrets out of cloud-init user_data when security is on; deliver them
+  # from SSM via the boot fetch script instead.
+  render_secret_files = !var.enable_security
+  boot_fetch_script   = local.fetch_script
+
+  master = {
+    nodes = { for k, v in var.masters : k => { address = v.private_ip } }
+  }
+
+  volume = {
+    enabled = length(var.volumes) > 0
+    nodes = { for k, v in var.volumes : k => {
+      address     = v.private_ip
+      rack        = v.rack
+      data_center = v.data_center
+      data_dirs   = [{ path = "/data", max_volumes = 0 }]
+      # auto-discover the single attached data disk and mount it at /data
+      disk_mounts = [{ mountpoint = "/data", fstype = "xfs" }]
+    } }
+  }
+
+  filer = {
+    enabled = length(var.filers) > 0
+    nodes = { for k, v in var.filers : k => {
+      address     = v.private_ip
+      data_dir    = "/data/filerldb2"
+      disk_mounts = [{ mountpoint = "/data", fstype = "xfs" }]
+    } }
+    s3 = var.embedded_s3
+  }
+
+  s3 = {
+    enabled = length(var.s3_nodes) > 0
+    nodes   = { for k, v in var.s3_nodes : k => { address = v.private_ip } }
+  }
+
+  s3_identities = var.s3_identities
+}
+
+# ---- step 3: instances (keyed for_each; user_data = rendered cloud-init) ----
+resource "aws_instance" "master" {
+  for_each                = var.masters
+  ami                     = var.ami_id
+  instance_type           = each.value.instance_type
+  key_name                = var.key_name
+  user_data               = module.core.cloud_init_by_node["master-${each.key}"]
+  iam_instance_profile    = var.enable_security ? aws_iam_instance_profile.node[0].name : null
+  disable_api_termination = var.termination_protection
+
+  network_interface {
+    network_interface_id = aws_network_interface.master[each.key].id
+    device_index         = 0
+  }
+  metadata_options {
+    http_tokens = "required" # IMDSv2
+  }
+  tags = merge(var.tags, { Name = "${var.name}-master-${each.key}", Role = "master" })
+}
+
+resource "aws_instance" "volume" {
+  for_each                = var.volumes
+  ami                     = var.ami_id
+  instance_type           = each.value.instance_type
+  key_name                = var.key_name
+  user_data               = module.core.cloud_init_by_node["volume-${each.key}"]
+  iam_instance_profile    = var.enable_security ? aws_iam_instance_profile.node[0].name : null
+  disable_api_termination = var.termination_protection
+
+  network_interface {
+    network_interface_id = aws_network_interface.volume[each.key].id
+    device_index         = 0
+  }
+  metadata_options {
+    http_tokens = "required"
+  }
+  tags = merge(var.tags, { Name = "${var.name}-volume-${each.key}", Role = "volume" })
+}
+
+resource "aws_instance" "filer" {
+  for_each                = var.filers
+  ami                     = var.ami_id
+  instance_type           = each.value.instance_type
+  key_name                = var.key_name
+  user_data               = module.core.cloud_init_by_node["filer-${each.key}"]
+  iam_instance_profile    = var.enable_security ? aws_iam_instance_profile.node[0].name : null
+  disable_api_termination = var.termination_protection
+
+  network_interface {
+    network_interface_id = aws_network_interface.filer[each.key].id
+    device_index         = 0
+  }
+  metadata_options {
+    http_tokens = "required"
+  }
+  tags = merge(var.tags, { Name = "${var.name}-filer-${each.key}", Role = "filer" })
+}
+
+resource "aws_instance" "s3" {
+  for_each             = var.s3_nodes
+  ami                  = var.ami_id
+  instance_type        = each.value.instance_type
+  key_name             = var.key_name
+  user_data            = module.core.cloud_init_by_node["s3-${each.key}"]
+  iam_instance_profile = var.enable_security ? aws_iam_instance_profile.node[0].name : null
+
+  network_interface {
+    network_interface_id = aws_network_interface.s3[each.key].id
+    device_index         = 0
+  }
+  metadata_options {
+    http_tokens = "required"
+  }
+  tags = merge(var.tags, { Name = "${var.name}-s3-${each.key}", Role = "s3" })
+}
+
+# ---- step 4: protected data disks (decoupled; survive instance replacement) -
+# The core's mount-disks.sh (wired via disk_mounts above) mkfs+mounts these at
+# /data before the weed unit starts.
+resource "aws_ebs_volume" "volume_data" {
+  for_each          = var.volumes
+  availability_zone = each.value.availability_zone
+  size              = each.value.data_volume_size_gb
+  type              = each.value.data_volume_type
+  iops              = each.value.data_volume_iops
+  encrypted         = true
+  tags              = merge(var.tags, { Name = "${var.name}-volume-${each.key}-data", Role = "volume" })
+
+  lifecycle {
+    prevent_destroy = true # break-glass: remove to allow destroy
+  }
+}
+
+resource "aws_volume_attachment" "volume_data" {
+  for_each                       = var.volumes
+  device_name                    = "/dev/xvdf"
+  volume_id                      = aws_ebs_volume.volume_data[each.key].id
+  instance_id                    = aws_instance.volume[each.key].id
+  stop_instance_before_detaching = true
+}
+
+resource "aws_ebs_volume" "filer_data" {
+  for_each          = var.filers
+  availability_zone = each.value.availability_zone
+  size              = each.value.data_volume_size_gb
+  type              = "gp3"
+  encrypted         = true
+  tags              = merge(var.tags, { Name = "${var.name}-filer-${each.key}-data", Role = "filer" })
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "aws_volume_attachment" "filer_data" {
+  for_each                       = var.filers
+  device_name                    = "/dev/xvdf"
+  volume_id                      = aws_ebs_volume.filer_data[each.key].id
+  instance_id                    = aws_instance.filer[each.key].id
+  stop_instance_before_detaching = true
+}

terraform/modules/aws/outputs.tf

@@ -0,0 +1,34 @@
+output "security_group_id" {
+  description = "Cluster security group id."
+  value       = aws_security_group.cluster.id
+}
+
+output "master_private_ips" {
+  description = "Master private IPs keyed by node id."
+  value       = { for k, v in var.masters : k => v.private_ip }
+}
+
+output "master_peers" {
+  description = "Master peer list passed to the weed processes."
+  value       = module.core.master_peers
+}
+
+output "filer_private_ips" {
+  description = "Filer private IPs keyed by node id."
+  value       = { for k, v in var.filers : k => v.private_ip }
+}
+
+output "s3_private_ips" {
+  description = "Standalone S3 gateway private IPs keyed by node id."
+  value       = { for k, v in var.s3_nodes : k => v.private_ip }
+}
+
+output "instance_ids" {
+  description = "All instance ids keyed by role-node."
+  value = merge(
+    { for k, v in aws_instance.master : "master-${k}" => v.id },
+    { for k, v in aws_instance.volume : "volume-${k}" => v.id },
+    { for k, v in aws_instance.filer : "filer-${k}" => v.id },
+    { for k, v in aws_instance.s3 : "s3-${k}" => v.id },
+  )
+}

terraform/modules/aws/security.tf

@@ -0,0 +1,136 @@
+# =============================================================================
+# mTLS + JWT generation and secret delivery (active when enable_security=true).
+#
+# Generates the CA + per-component certs + JWT keys with the security submodule,
+# stores them (plus the rendered security.toml / S3 config) in SSM Parameter
+# Store as SecureString, and renders a boot fetch-secrets.sh that pulls them via
+# the instance role. This keeps secrets OUT of cloud-init user_data / IMDS.
+# Secrets still live in Terraform state (TF-generated); prefer Vault PKI for the
+# CA in production.
+# =============================================================================
+
+locals {
+  all_private_ips = concat(
+    [for k, v in var.masters : v.private_ip],
+    [for k, v in var.volumes : v.private_ip],
+    [for k, v in var.filers : v.private_ip],
+    [for k, v in var.s3_nodes : v.private_ip],
+  )
+
+  ssm_prefix        = "/seaweedfs/${var.name}"
+  deliver_s3_config = length(var.s3_nodes) > 0 || var.embedded_s3.enabled
+
+  # security.toml is identical across nodes; take it from the first master.
+  first_master       = var.enable_security ? sort(keys(var.masters))[0] : ""
+  security_toml_path = "/etc/seaweedfs/security.toml"
+  s3_config_path     = "/etc/seaweedfs/s3_config.json"
+
+  # Boot fetch entries: cert files + security.toml + (optional) S3 config.
+  fetch_entries = var.enable_security ? concat(
+    [for m in module.security[0].secret_manifest : { param = "${local.ssm_prefix}/certs/${m.key}", path = m.path, mode = m.mode }],
+    [{ param = "${local.ssm_prefix}/security.toml", path = local.security_toml_path, mode = "0600" }],
+    local.deliver_s3_config ? [{ param = "${local.ssm_prefix}/s3_config.json", path = local.s3_config_path, mode = "0600" }] : [],
+  ) : []
+
+  fetch_script = var.enable_security ? templatefile("${path.module}/templates/fetch-secrets.sh.tftpl", {
+    run_as_user = "seaweedfs"
+    entries     = local.fetch_entries
+  }) : ""
+
+  core_security = var.enable_security ? module.security[0].core_security : var.security
+}
+
+module "security" {
+  count           = var.enable_security ? 1 : 0
+  source          = "../security"
+  internal_domain = var.internal_domain
+  cert_dir        = var.cert_dir
+  ip_sans         = local.all_private_ips
+}
+
+# ---- SSM SecureString parameters -------------------------------------------
+resource "aws_ssm_parameter" "cert" {
+  for_each = var.enable_security ? { for m in module.security[0].secret_manifest : m.key => m } : {}
+  name     = "${local.ssm_prefix}/certs/${each.key}"
+  type     = "SecureString"
+  value    = module.security[0].secret_contents[each.key]
+  tags     = var.tags
+}
+
+resource "aws_ssm_parameter" "security_toml" {
+  count = var.enable_security ? 1 : 0
+  name  = "${local.ssm_prefix}/security.toml"
+  type  = "SecureString"
+  value = module.core.secret_files_by_node["master-${local.first_master}"][local.security_toml_path]
+  tags  = var.tags
+}
+
+resource "aws_ssm_parameter" "s3_config" {
+  count = var.enable_security && local.deliver_s3_config ? 1 : 0
+  name  = "${local.ssm_prefix}/s3_config.json"
+  type  = "SecureString"
+  # identical content across s3/filer nodes; render once via the security module's
+  # JSON is not available here, so read it back from any node that carries it.
+  value = local.s3_config_source
+  tags  = var.tags
+}
+
+locals {
+  # Pull the rendered S3 identity JSON from whichever node carries it.
+  s3_config_source = !local.deliver_s3_config ? "" : (
+    length(var.s3_nodes) > 0 ?
+    module.core.secret_files_by_node["s3-${sort(keys(var.s3_nodes))[0]}"][local.s3_config_path] :
+    (length(var.filers) > 0 ? module.core.secret_files_by_node["filer-${sort(keys(var.filers))[0]}"][local.s3_config_path] : "")
+  )
+}
+
+# ---- IAM: instance role allowed to read the SSM params ----------------------
+data "aws_iam_policy_document" "assume" {
+  count = var.enable_security ? 1 : 0
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["ec2.amazonaws.com"]
+    }
+  }
+}
+
+data "aws_iam_policy_document" "ssm_read" {
+  count = var.enable_security ? 1 : 0
+  statement {
+    sid       = "ReadSeaweedfsParams"
+    actions   = ["ssm:GetParameter", "ssm:GetParameters"]
+    resources = ["arn:aws:ssm:*:*:parameter${local.ssm_prefix}/*"]
+  }
+  statement {
+    sid       = "DecryptSecureStrings"
+    actions   = ["kms:Decrypt"]
+    resources = [var.kms_key_arn] # defaults to "*"; set a CMK ARN in production
+    condition {
+      test     = "StringEquals"
+      variable = "kms:ViaService"
+      values   = ["ssm.*.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "node" {
+  count              = var.enable_security ? 1 : 0
+  name_prefix        = "${var.name}-node-"
+  assume_role_policy = data.aws_iam_policy_document.assume[0].json
+  tags               = var.tags
+}
+
+resource "aws_iam_role_policy" "ssm_read" {
+  count  = var.enable_security ? 1 : 0
+  name   = "ssm-read"
+  role   = aws_iam_role.node[0].id
+  policy = data.aws_iam_policy_document.ssm_read[0].json
+}
+
+resource "aws_iam_instance_profile" "node" {
+  count       = var.enable_security ? 1 : 0
+  name_prefix = "${var.name}-node-"
+  role        = aws_iam_role.node[0].name
+}

terraform/modules/aws/security_group.tf

@@ -0,0 +1,62 @@
+# Cluster security group + the SeaweedFS port matrix.
+# Intra-cluster: all TCP allowed within the SG (master 9333/19333, volume
+# 8080/18080, filer 8888/18888, admin 33646, ...). Client-facing: only S3 (8333)
+# and filer (8888). Metrics ports (9327) are never opened to clients.
+
+resource "aws_security_group" "cluster" {
+  name_prefix = "${var.name}-cluster-"
+  description = "SeaweedFS cluster"
+  vpc_id      = var.vpc_id
+  tags        = merge(var.tags, { Name = "${var.name}-cluster" })
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# All intra-cluster TCP via SG self-reference.
+resource "aws_vpc_security_group_ingress_rule" "intra_cluster" {
+  security_group_id            = aws_security_group.cluster.id
+  referenced_security_group_id = aws_security_group.cluster.id
+  ip_protocol                  = "tcp"
+  from_port                    = 0
+  to_port                      = 65535
+  description                  = "intra-cluster (http + gRPC for all roles)"
+}
+
+resource "aws_vpc_security_group_ingress_rule" "s3" {
+  for_each          = toset(var.client_ingress_cidrs)
+  security_group_id = aws_security_group.cluster.id
+  cidr_ipv4         = each.value
+  ip_protocol       = "tcp"
+  from_port         = 8333
+  to_port           = 8333
+  description       = "S3 gateway"
+}
+
+resource "aws_vpc_security_group_ingress_rule" "filer" {
+  for_each          = toset(var.client_ingress_cidrs)
+  security_group_id = aws_security_group.cluster.id
+  cidr_ipv4         = each.value
+  ip_protocol       = "tcp"
+  from_port         = 8888
+  to_port           = 8888
+  description       = "filer HTTP"
+}
+
+resource "aws_vpc_security_group_ingress_rule" "ssh" {
+  for_each          = toset(var.ssh_ingress_cidrs)
+  security_group_id = aws_security_group.cluster.id
+  cidr_ipv4         = each.value
+  ip_protocol       = "tcp"
+  from_port         = 22
+  to_port           = 22
+  description       = "SSH"
+}
+
+resource "aws_vpc_security_group_egress_rule" "all" {
+  security_group_id = aws_security_group.cluster.id
+  cidr_ipv4         = "0.0.0.0/0"
+  ip_protocol       = "-1"
+  description       = "all egress"
+}

terraform/modules/aws/templates/fetch-secrets.sh.tftpl

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Rendered by terraform-aws-seaweedfs. Pulls certs + secret config from SSM
+# Parameter Store (SecureString) at boot using the instance role. Region is
+# auto-resolved by the AWS CLI from IMDS, so no region is baked in. Requires
+# the AWS CLI and a working instance profile (see security.tf).
+set -euo pipefail
+
+run_as_user="${run_as_user}"
+
+fetch() {
+  local param="$1" dest="$2" mode="$3"
+  mkdir -p "$(dirname "$dest")"
+  aws ssm get-parameter --with-decryption --name "$param" \
+    --query 'Parameter.Value' --output text > "$dest"
+  chmod "$mode" "$dest"
+  chown "$run_as_user:$run_as_user" "$dest" 2>/dev/null || true
+}
+
+%{ for e in entries ~}
+fetch "${e.param}" "${e.path}" "${e.mode}"
+%{ endfor ~}

terraform/modules/aws/variables.tf

@@ -0,0 +1,171 @@
+# =============================================================================
+# terraform-aws-seaweedfs - thin AWS wrapper around the cloud-agnostic core.
+#
+# Reserves stable per-node addressing (ENIs with fixed private IPs) FIRST, feeds
+# that address map to the core to render cloud-init, then creates instances and
+# protected EBS data disks. All tiers are keyed for_each (never count), so a
+# middle node can be replaced without reindexing its peers/disks.
+# =============================================================================
+
+variable "name" {
+  description = "Name prefix for all resources."
+  type        = string
+  default     = "seaweedfs"
+}
+
+variable "vpc_id" {
+  description = "VPC to deploy into."
+  type        = string
+}
+
+variable "ami_id" {
+  description = "AMI with the weed binary installed (e.g. baked with Packer)."
+  type        = string
+}
+
+variable "weed_binary" {
+  description = "Path to weed on the AMI."
+  type        = string
+  default     = "/usr/bin/weed"
+}
+
+variable "key_name" {
+  description = "EC2 key pair for SSH (optional)."
+  type        = string
+  default     = null
+}
+
+variable "monitoring_enabled" {
+  description = "Bind metrics ports and pass them through to the core."
+  type        = bool
+  default     = false
+}
+
+variable "enable_security" {
+  description = "Enable mTLS (security.toml). Cert material must be supplied via the security variable / secret store."
+  type        = bool
+  default     = false
+}
+
+variable "security" {
+  description = "Passed through to the core security variable when enable_security=false. When enable_security=true this is ignored and certs/JWT are generated by the security submodule."
+  type        = any
+  default     = {}
+}
+
+variable "internal_domain" {
+  description = "Internal domain for generated component cert CNs / peer-auth wildcard (enable_security=true)."
+  type        = string
+  default     = "seaweedfs.internal"
+}
+
+variable "cert_dir" {
+  description = "On-host directory where certs are fetched/placed."
+  type        = string
+  default     = "/usr/local/share/ca-certificates"
+}
+
+variable "kms_key_arn" {
+  description = "KMS key ARN the instance role may use to decrypt SSM SecureStrings. Defaults to \"*\" (the SSM default key); set to a specific CMK ARN in production."
+  type        = string
+  default     = "*"
+}
+
+variable "termination_protection" {
+  description = "Set disable_api_termination on stateful instances (masters, volumes)."
+  type        = bool
+  default     = true
+}
+
+# ---- stateful tiers: keyed node maps ---------------------------------------
+variable "masters" {
+  description = "Master nodes keyed by stable id (m0/m1/m2). Quorum size must be odd."
+  type = map(object({
+    subnet_id     = string
+    private_ip    = string
+    instance_type = optional(string, "t3.medium")
+  }))
+  validation {
+    condition     = length(var.masters) % 2 == 1
+    error_message = "Master quorum must be an odd number of nodes (1, 3, 5)."
+  }
+}
+
+variable "volumes" {
+  description = "Volume nodes keyed by stable id. Each owns one protected EBS data disk."
+  type = map(object({
+    subnet_id           = string
+    availability_zone   = string
+    private_ip          = string
+    instance_type       = optional(string, "m5.large")
+    rack                = optional(string)
+    data_center         = optional(string)
+    data_volume_size_gb = optional(number, 100)
+    data_volume_type    = optional(string, "gp3")
+    data_volume_iops    = optional(number, null)
+  }))
+  default = {}
+}
+
+variable "filers" {
+  description = "Filer nodes keyed by stable id. Each owns a protected EBS disk for its leveldb2 store."
+  type = map(object({
+    subnet_id           = string
+    availability_zone   = string
+    private_ip          = string
+    instance_type       = optional(string, "t3.medium")
+    data_volume_size_gb = optional(number, 50)
+  }))
+  default = {}
+}
+
+variable "s3_nodes" {
+  description = "Standalone S3 gateway nodes keyed by stable id (stateless)."
+  type = map(object({
+    subnet_id     = string
+    private_ip    = string
+    instance_type = optional(string, "t3.medium")
+  }))
+  default = {}
+}
+
+variable "embedded_s3" {
+  description = "Embed the S3 gateway in the filer instead of standalone nodes."
+  type = object({
+    enabled     = optional(bool, false)
+    port        = optional(number, 8333)
+    domain_name = optional(string, "")
+  })
+  default = {}
+}
+
+variable "s3_identities" {
+  description = "Non-admin S3 identities for the gateway config (admin key goes via EnvironmentFile)."
+  type = list(object({
+    name       = string
+    access_key = string
+    secret_key = string
+    actions    = list(string)
+  }))
+  default   = []
+  sensitive = true
+}
+
+# ---- networking ------------------------------------------------------------
+variable "client_ingress_cidrs" {
+  description = "CIDRs allowed to reach the client-facing S3 (8333) and filer (8888) ports."
+  type        = list(string)
+  default     = []
+}
+
+variable "ssh_ingress_cidrs" {
+  description = "CIDRs allowed SSH (22)."
+  type        = list(string)
+  default     = []
+}
+
+variable "tags" {
+  description = "Extra tags applied to all resources."
+  type        = map(string)
+  default     = {}
+}

terraform/modules/aws/versions.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_version = ">= 1.3.0"
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+      # >= 5.40 for the modern aws_vpc_security_group_*_rule resources.
+      # Provider >= 6.0 is recommended for the EBS-attachment no-replace behavior;
+      # bump the floor here once you standardize on it.
+      version = ">= 5.40"
+    }
+  }
+}