ethereum-network/main.tf at main · valentevidal/ethereum-network · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
provider "aws" {
  region  = "eu-west-2"
  profile = "ethereum-network"
}

provider "tls" {}

data "aws_caller_identity" "current" {}

output "account_id" {
  description = "The AWS account ID"
  value       = data.aws_caller_identity.current.account_id
}

output "private_key_pem" {
  value     = tls_private_key.eth_ssh_key.private_key_pem
  sensitive = true
}

output "public_ip" {
  value = aws_instance.ethereum_node.public_ip
}


resource "tls_private_key" "eth_ssh_key" {
  algorithm = "RSA"
  rsa_bits  = 4096
}


resource "local_file" "private_key" {
  content         = tls_private_key.eth_ssh_key.private_key_pem
  filename        = "${path.module}/private_key.pem"
  file_permission = "0600"
}

resource "aws_key_pair" "eth_ssh_key" {
  key_name   = "ethereum-network"
  public_key = tls_private_key.eth_ssh_key.public_key_openssh
}

resource "aws_security_group" "ethereum_sg" {
  name        = "ethereum_security_group"
  description = "Allow Ethereum and SSH inbound traffic"

  # SSH access
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = var.allowed_ssh_cidr
  }

  # Ethereum P2P
  ingress {
    from_port   = 30303
    to_port     = 30303
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 30303
    to_port     = 30303
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # Ethereum HTTP-RPC (Be very careful with this one)
  ingress {
    from_port   = 8545
    to_port     = 8545
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"] # Restrict this to specific IPs for better security
  }

  ingress {
    from_port   = 8551
    to_port     = 8551
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"] # Restrict this to specific IPs for better security
  }

  # Ethereum WebSocket-RPC (Again, be careful)
  # ingress {
  #   from_port   = 8546
  #   to_port     = 8546
  #   protocol    = "tcp"
  #   cidr_blocks = ["YOUR_KNOWN_IP/32"] # Restrict this to specific IPs for better security
  # }

  # Default egress rule to allow all outbound traffic
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}


resource "aws_instance" "ethereum_node" {
  ami             = "ami-0eb260c4d5475b901" # Ubuntu 22.04 LTS in eu-west-2
  instance_type   = "t2.micro"
  key_name        = aws_key_pair.eth_ssh_key.key_name
  security_groups = [aws_security_group.ethereum_sg.name]

  tags = {
    Name = "ethereum-network"
  }

  provisioner "remote-exec" {
    inline = [
      "sudo apt-get update",
      "sudo apt-get install -y software-properties-common",
      "sudo add-apt-repository -y ppa:ethereum/ethereum",
      "sudo apt-get update",
      "sudo apt-get install -y ethereum",

      "mkdir ~/myethprivatenet",
      "echo '${file(var.genesis_file_path)}' > ~/myethprivatenet/genesis.json",
      "echo '${file(var.password_file_path)}' > ~/myethprivatenet/password",
      "geth --datadir ~/myethprivatenet/mydata init ~/myethprivatenet/genesis.json",
      "echo '${file(var.keystore_file_path)}' > ~/myethprivatenet/mydata/keystore/${var.keystore_file_name}",

      "sudo touch /etc/systemd/system/ethnode.service",
      "echo '${file(var.service_file_path)}' | sudo tee /etc/systemd/system/ethnode.service",
      "sudo sed -i 's/<Your Public IP>/${self.public_ip}/g' /etc/systemd/system/ethnode.service",
      "sudo systemctl daemon-reload",
      "sudo systemctl unmask ethnode",
      "sudo systemctl enable ethnode",
      "sudo systemctl start ethnode",
      "sleep 10",
      "tail -n 40 ~/myethprivatenet/geth.log"
    ]


    connection {
      type        = "ssh"
      user        = "ubuntu"
      private_key = file(var.ssh_private_key_path)
      host        = self.public_ip
      timeout     = "3m" # Wait up to 5 minutes for connection
    }
  }
}