Deploy Website High-Availability di AWS dengan Terraform, Docker (Nginx) & Load Balancer (ALB + HTTPS/ACM)

aws-lb/
├─ main.tf
├─ variables.tf
├─ outputs.tf
└─ terraform.tfvars

variable "key_name" {
  description = "Nama Key Pair EC2 untuk SSH"
  type        = string
}

variable "certificate_arn" {
  description = "ARN sertifikat ACM (region sama dengan ALB: ap-southeast-1)"
  type        = string
}

output "alb_dns" {
  description = "DNS publik ALB"
  value       = aws_lb.app_lb.dns_name
}

output "alb_zone_id" {
  description = "Hosted zone id ALB (untuk alias record)"
  value       = aws_lb.app_lb.zone_id
}

key_name        = "masdika-key"
# ARN diisi setelah ACM Issued (sementara kosongkan, atau isi bila sudah ada)
certificate_arn = "arn:aws:acm:ap-southeast-1:123456789012:certificate/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

rovider "aws" {
  region  = "ap-southeast-1" # ganti region kalau mau
  profile = "default"        # sesuai aws configure
}

# Ambil VPC & Subnets default
data "aws_vpc" "default" {
  default = true
}

data "aws_subnets" "default" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.default.id]
  }
}

# Security Group (HTTP, HTTPS, SSH dari IP kamu)
resource "aws_security_group" "web_sg" {
  name        = "web-sg"
  description = "Allow HTTP, HTTPS & SSH"
  vpc_id      = data.aws_vpc.default.id

  # HTTP (80)
  ingress {
    description = "HTTP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # HTTPS (443)
  ingress {
    description = "HTTPS"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # SSH (22) hanya dari IP kamu
  ingress {
    description = "SSH from my IP"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["206.237.105.16/32"] # ganti kalau IP berubah
  }

  # Egress bebas
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# EC2 Instances (2 server dengan Docker + Nginx)
resource "aws_instance" "web" {
  count         = 2
  ami           = "ami-0933f1385008d33c4" # Ubuntu Server 24.04 LTS
  instance_type = "t2.micro"
  subnet_id     = element(data.aws_subnets.default.ids, count.index)
  vpc_security_group_ids      = [aws_security_group.web_sg.id]
  associate_public_ip_address = true
  key_name      = var.key_name

  # Kalau script user_data berubah, EC2 otomatis recreate
  user_data_replace_on_change = true

  user_data = <<-EOF
              #!/bin/bash
              set -eux

              # Update & install dependencies
              apt-get update -y
              apt-get install -y ca-certificates curl gnupg lsb-release

              # Setup Docker repo
              install -m 0755 -d /etc/apt/keyrings
              curl -fsSL https://download.docker.com/linux/ubuntu/gpg | tee /etc/apt/keyrings/docker.asc > /dev/null
              chmod a+r /etc/apt/keyrings/docker.asc

              CODENAME=$(lsb_release -cs)
              echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $${CODENAME} stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null

              apt-get update -y
              apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

              systemctl enable docker
              systemctl start docker

              # Tunggu Docker benar-benar siap
              sleep 10
              systemctl is-active --quiet docker || (echo "Docker gagal start" && exit 1)

              # Jalankan Nginx di port 80
              docker run -d -p 80:80 --restart always --name web nginx

              # Tambahkan halaman index
              echo "<h1>Hello from Server $(hostname)</h1>" > /tmp/index.html
              docker cp /tmp/index.html web:/usr/share/nginx/html/index.html
              EOF

  tags = {
    Name = "web-${count.index + 1}"
  }
}

# Load Balancer
resource "aws_lb" "app_lb" {
  name               = "web-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.web_sg.id]
  subnets            = data.aws_subnets.default.ids
}

# Target Group
resource "aws_lb_target_group" "tg" {
  name     = "web-tg"
  port     = 80
  protocol = "HTTP"
  vpc_id   = data.aws_vpc.default.id

  health_check {
    path                = "/"
    interval            = 30
    timeout             = 5
    healthy_threshold   = 2
    unhealthy_threshold = 2
    matcher             = "200"
  }
}

# Listener HTTP -> Redirect ke HTTPS
resource "aws_lb_listener" "http" {
  load_balancer_arn = aws_lb.app_lb.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

# Listener HTTPS (pakai sertifikat ACM)
resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.app_lb.arn
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-2016-08"
  certificate_arn   = var.certificate_arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.tg.arn
  }
}

# Attach EC2 ke Target Group
resource "aws_lb_target_group_attachment" "attach" {
  count            = 2
  target_group_arn = aws_lb_target_group.tg.arn
  target_id        = aws_instance.web[count.index].id
  port             = 80
}

cd aws-lb
terraform init
terraform plan -var="key_name=masdika-key"
terraform apply -auto-approve -var="key_name=masdika-key"

Type:   CNAME
Name:   lab
Value:  <alb_dns>   # contoh: web-alb-1151437619.ap-southeast-1.elb.amazonaws.com
Proxy:  DNS Only (Cloudflare: abu-abu)
TTL:    Auto

aws elbv2 describe-target-health --target-group-arn <TG_ARN>

"TargetHealth": { "State": "healthy" }

curl -I http://lab.syslab.my.id
# Expect: HTTP/1.1 301 Moved Permanently → Location: https://lab.syslab.my.id/

curl -I https://lab.syslab.my.id
# Expect: HTTP/2 200 (atau HTTP/1.1 200) dari Nginx

# Contoh (butuh hosted zone Anda)
resource "aws_route53_record" "lab_alias" {
  zone_id = "ZXXXXXXXXXXXXX"   # ganti dengan hosted zone ID domain Anda
  name    = "lab.syslab.my.id"
  type    = "A"
  alias {
    name                   = aws_lb.app_lb.dns_name
    zone_id                = aws_lb.app_lb.zone_id
    evaluate_target_health = true
  }
}

terraform destroy -auto-approve