<commit_before># CHEF Delivery AWS security group - https://github.com/chef-cookbooks/delivery-cluster
resource "aws_security_group" "chef-delivery" {
  name = "chef-delivery"
  description = "CHEF Delivery"
  vpc_id = "${var.aws_vpc_id}"
  tags = {
    Name = "chef-delivery security group"
  }
}
# SSH - all
resource "aws_security_group_rule" "chef-delivery_allow_22_tcp_all" {
  type = "ingress"
  from_port = 22
  to_port = 22
  protocol = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
  security_group_id = "${aws_security_group.chef-delivery.id}"
}
# HTTP (nginx)
resource "aws_security_group_rule" "chef-delivery_allow_80_tcp_all" {
  type = "ingress"
  from_port = 80
  to_port = 80
  protocol = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
  security_group_id = "${aws_security_group.chef-delivery.id}"
}
# HTTPS (nginx)
resource "aws_security_group_rule" "chef-delivery_allow_443_tcp_all" {
  type = "ingress"
  from_port = 443
  to_port = 443
  protocol = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
  security_group_id = "${aws_security_group.chef-delivery.id}"
}
# Delivery GIT
resource "aws_security_group_rule" "chef-delivery_allow_8989_tcp_all" {
  type = "ingress"
  from_port = 8989
  to_port = 8989
  protocol = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
  security_group_id = "${aws_security_group.chef-delivery.id}"
}
# Egress: ALL
resource "aws_security_group_rule" "chef-delivery_allow_all" {
  type = "egress"
  from_port = 0
  to_port = 65535
  protocol = "-1"
  cidr_blocks = ["0.0.0.0/0"]
  security_group_id = "${aws_security_group.chef-delivery.id}"
}
# CHEF Delivery
resource "aws_instance" "chef-delivery" {
  ami = "${var.aws_ami_id}"
  instance_type = "${var.aws_flavor}"
  subnet_id = "${var.aws_subnet_id}"
  vpc_security_group_ids = ["${aws_security_group.chef-delivery.id}"]
  key_name = "${var.aws_key_name}"
  tags = {
    Name = "${format("%s-%02d-%s", var.delivery_basename, count.index + 1, var.chef_org_short)}"
  }
  root_block_device = {
    delete_on_termination = true
  }
  connection {
    user = "${var.aws_ami_user}"
    private_key = "${var.aws_private_key_file}"
  }
  provisioner "remote-exec" {
    connection {
      user = "${var.aws_ami_user}"
      private_key = "${var.aws_private_key_file}"
      host = "${var.chef_server_public_dns}"
    }
    inline = [
      "echo 'Adding ${var.username}' to CHEF Server",
      "sudo chef-server-ctl user-create ${var.username} Delivery User delivery@domain.tld ${base64encode(self.id)} -f /tmp/.chef/keys/${var.username}.pem",
      "sudo chef-server-ctl org-user-add ${var.chef_org_short} ${var.username}",
      "echo Prepared for Delivery provisioning"
    ]
  }
  provisioner "local-exec" {
    command  = "scp -o StrictHostKeyChecking=no -i ${var.aws_private_key_file} ${var.aws_ami_user}@${var.chef_server_public_dns}:/tmp/.chef/keys/${var.username}.pem ${path.cwd}/.chef/keys/${var.username}.pem"
  }
  # Ugly PERL hack because you can't source file() unless it exists before runtime
  # https://github.com/hashicorp/terraform/issues/3354
  provisioner "local-exec" {
    command = <<EOF
mkdir -p ${path.cwd}/.chef/keys
cat > ${path.cwd}/.chef/delivery_builder_keys.json <<EOK
{
"id": "delivery_builder_keys",
"builder_key": "BUILDER_KEY",
"delivery_pem": "${path.cwd}/.chef/keys/${var.username}.pem"
}
EOK
ssh-keygen -t rsa -N '' -b 2048 -f .chef/keys/builder_key
perl -pe 's/BUILDER_KEY/`cat builder_key`/ge' -i delivery_builder_keys
mv delivery_builder_keys ${path.cwd}/.chef
# Encryption key
openssl rand -base64 512 | tr -d '\r\n' > ${path.cwd}/.chef/keys/encrypted_data_bag_secret
# Create the data-bag keys
knife data bag create keys 
knife data bag from file keys ${path.cwd}/.chef/delivery_builder_keys.json --encrypt --secret-file ${path.cwd}/.chef/keys/encrypted_data_bag_secret
EOF
  }
  provisioner "file" {
    source = "${path.cwd}/.chef"
    destination = "/tmp"
  }
  # Basic Setup
  provisioner "remote-exec" {
    inline = [
      "EC2IPV4=$(curl http://169.254.169.254/latest/meta-data/public-ipv4)",
      "echo $EC2IPV4",
      "EC2FQDN=$(curl http://169.254.169.254/latest/meta-data/public-hostname)",
      "EC2HOST=$(echo $EC2FQDN | sed 's/..*//')",
      "EC2DOMA=$(echo $EC2FQDN | sed \"s/$EC2HOST.//\")",
      "sudo sed -i '/localhost/{n;s/^/${self.public_ip} ${self.public_dns}\\n/}' /etc/hosts",
      "[ -f /etc/sysconfig/network ] && sudo hostname ${self.public_dns} || sudo hostname $EC2HOST",
      "echo ${self.public_dns}|sed 's/\\..*//' > /tmp/hostname",
      "sudo chown root:root /tmp/hostname",
      "[ -f /etc/sysconfig/network ] && sudo sed -i 's/^HOSTNAME.*/HOSTNAME=${self.public_dns}/' /etc/sysconfig/network || sudo cp /tmp/hostname /etc/hostname",
      "sudo rm /tmp/hostname",
      "sudo iptables -F",
      "sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT",
      "sudo iptables -A INPUT -p icmp -j ACCEPT",
      "sudo iptables -A INPUT -i lo -j ACCEPT",
      "sudo iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT",
      "sudo iptables -A INPUT -p tcp -m multiport --dports 80,443,8989 -j ACCEPT",
      "sudo iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited",
      "sudo iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited",
      "sudo service iptables save",
      "sudo service iptables restart"
    ]
  }
  # Setup Packages
  provisioner "remote-exec" {
    inline = [
      "[ -x /usr/sbin/apt-get ] && sudo apt-get install -y git || sudo yum install -y git",
      "sudo mkdir -p /var/opt/delivery/license /etc/delivery /etc/chef",
      "sudo chown -R root:root /tmp/.chef",
      "sudo mv /tmp/.chef/* /etc/delivery/",
      "sudo mv /etc/delivery/trusted_certs /etc/chef/",
      "echo Prepared for Chef Provisioner run"
    ]
  }
  provisioner "file" {
    source = "${var.license_file}"
    destination = "/tmp/.chef/delivery.license"
  }
  provisioner "remote-exec" {
    inline = [
      "sudo mv /tmp/.chef/delivery.license /var/opt/delivery/license/",
      "sudo chown root:root /var/opt/delivery/license/delivery.license"
    ]
  }
  provisioner "chef" {
    attributes {
      "delivery-cluster" {
        "delivery" {
          "chef_server" = "${var.chef_server_url}"
          "fqdn" = "${self.public_dns}"
        }
      }
    }
    # environment = "_default"
    run_list = ["delivery-cluster::delivery"]
    node_name = "${format("%s-%02d-%s", var.delivery_basename, count.index + 1, var.enterprise)}"
    secret_key = "${path.cwd}/.chef/encrypted_data_bag_secret"
    server_url = "${var.chef_server_url}"
    validation_client_name = "${var.chef_org_short}-validator"<commit_msg>Moved provisioners around and tune-ups<commit_after># CHEF Delivery AWS security group - https://github.com/chef-cookbooks/delivery-cluster
resource "aws_security_group" "chef-delivery" {
  name = "chef-delivery"
  description = "CHEF Delivery"
  vpc_id = "${var.aws_vpc_id}"
  tags = {
    Name = "chef-delivery security group"
  }
}
# SSH - all
resource "aws_security_group_rule" "chef-delivery_allow_22_tcp_all" {
  type = "ingress"
  from_port = 22
  to_port = 22
  protocol = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
  security_group_id = "${aws_security_group.chef-delivery.id}"
}
# HTTP (nginx)
resource "aws_security_group_rule" "chef-delivery_allow_80_tcp_all" {
  type = "ingress"
  from_port = 80
  to_port = 80
  protocol = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
  security_group_id = "${aws_security_group.chef-delivery.id}"
}
# HTTPS (nginx)
resource "aws_security_group_rule" "chef-delivery_allow_443_tcp_all" {
  type = "ingress"
  from_port = 443
  to_port = 443
  protocol = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
  security_group_id = "${aws_security_group.chef-delivery.id}"
}
# Delivery GIT
resource "aws_security_group_rule" "chef-delivery_allow_8989_tcp_all" {
  type = "ingress"
  from_port = 8989
  to_port = 8989
  protocol = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
  security_group_id = "${aws_security_group.chef-delivery.id}"
}
# Egress: ALL
resource "aws_security_group_rule" "chef-delivery_allow_all" {
  type = "egress"
  from_port = 0
  to_port = 65535
  protocol = "-1"
  cidr_blocks = ["0.0.0.0/0"]
  security_group_id = "${aws_security_group.chef-delivery.id}"
}
# CHEF Delivery
resource "aws_instance" "chef-delivery" {
  ami = "${var.aws_ami_id}"
  instance_type = "${var.aws_flavor}"
  subnet_id = "${var.aws_subnet_id}"
  vpc_security_group_ids = ["${aws_security_group.chef-delivery.id}"]
  key_name = "${var.aws_key_name}"
  tags = {
    Name = "${format("%s-%02d-%s", var.delivery_basename, count.index + 1, var.chef_org_short)}"
  }
  root_block_device = {
    delete_on_termination = true
  }
  connection {
    user = "${var.aws_ami_user}"
    private_key = "${var.aws_private_key_file}"
  }
  provisioner "local-exec" {
    command = "mkdir -p ${path.cwd}/.chef/keys"
  }
  provisioner "remote-exec" {
    connection {
      user = "${var.aws_ami_user}"
      private_key = "${var.aws_private_key_file}"
      host = "${var.chef_server_public_dns}"
    }
    inline = [
      "echo 'Adding ${var.username}' to CHEF Server",
      "sudo chef-server-ctl user-create ${var.username} Delivery User <EMAIL> ${base64encode(self.id)} -f /tmp/.chef/keys/${var.username}.pem",
      "sudo chef-server-ctl org-user-add ${var.chef_org_short} ${var.username}",
      "echo Prepared for Delivery provisioning"
    ]
  }
  provisioner "local-exec" {
    command  = "scp -o StrictHostKeyChecking=no -i ${var.aws_private_key_file} ${var.aws_ami_user}@${var.chef_server_public_dns}:/tmp/.chef/keys/${var.username}.pem ${path.cwd}/.chef/keys/${var.username}.pem"
  }
  # Ugly PERL hack because you can't source file() unless it exists before runtime
  # https://github.com/hashicorp/terraform/issues/3354
  provisioner "local-exec" {
    command = <<EOF
cat > ${path.cwd}/.chef/delivery_builder_keys.json <<EOK
{
"id": "delivery_builder_keys",
"builder_key": "BUILDER_KEY",
"delivery_pem": "${path.cwd}/.chef/keys/${var.username}.pem"
}
EOK
ssh-keygen -t rsa -N '' -b 2048 -f ${path.cwd}/.chef/keys/builder_key
cd ${path.cwd}/.chef/keys
cp builder_key builder_key_databag
perl -pe 's/\n/\\n/g' -i builder_key_databag
perl -pe 's/BUILDER_KEY/`cat builder_key_databag`/ge' -i ${path.cwd}/.chef/delivery_builder_keys.json
rm builder_key_databag
cd ../..
# Encryption key
openssl rand -base64 512 | tr -d '\r\n' > ${path.cwd}/.chef/keys/encrypted_data_bag_secret
# Create the data-bag keys
knife data bag create keys 
knife data bag from file keys ${path.cwd}/.chef/delivery_builder_keys.json --encrypt --secret-file ${path.cwd}/.chef/keys/encrypted_data_bag_secret
EOF
  }
  # Copy over .chef to /tmp
  provisioner "file" {
    source = "${path.cwd}/.chef"
    destination = "/tmp"
  }
  # Copy in license file
  provisioner "file" {
    source = "${var.license_file}"
    destination = "/tmp/.chef/delivery.license"
  }
  # Basic Setup
  provisioner "remote-exec" {
    inline = [
      "EC2IPV4=$(curl http://169.254.169.254/latest/meta-data/public-ipv4)",
      "echo $EC2IPV4",
      "EC2FQDN=$(curl http://169.254.169.254/latest/meta-data/public-hostname)",
      "EC2HOST=$(echo $EC2FQDN | sed 's/..*//')",
      "EC2DOMA=$(echo $EC2FQDN | sed \"s/$EC2HOST.//\")",
      "sudo sed -i '/localhost/{n;s/^/${self.public_ip} ${self.public_dns}\\n/}' /etc/hosts",
      "[ -f /etc/sysconfig/network ] && sudo hostname ${self.public_dns} || sudo hostname $EC2HOST",
      "echo ${self.public_dns}|sed 's/\\..*//' > /tmp/hostname",
      "sudo chown root:root /tmp/hostname",
      "[ -f /etc/sysconfig/network ] && sudo sed -i 's/^HOSTNAME.*/HOSTNAME=${self.public_dns}/' /etc/sysconfig/network || sudo cp /tmp/hostname /etc/hostname",
      "sudo rm /tmp/hostname",
      "sudo iptables -F",
      "sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT",
      "sudo iptables -A INPUT -p icmp -j ACCEPT",
      "sudo iptables -A INPUT -i lo -j ACCEPT",
      "sudo iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT",
      "sudo iptables -A INPUT -p tcp -m multiport --dports 80,443,8989 -j ACCEPT",
      "sudo iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited",
      "sudo iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited",
      "sudo service iptables save",
      "sudo service iptables restart"
    ]
  }
  # Setup
  provisioner "remote-exec" {
    inline = [
      "[ -x /usr/sbin/apt-get ] && sudo apt-get install -y git || sudo yum install -y git",
      "sudo mkdir -p /var/opt/delivery/license /etc/delivery /etc/chef",
      "sudo mv /tmp/.chef/delivery.license /var/opt/delivery/license",
      "sudo mv /tmp/.chef/* /etc/delivery/",
      "sudo mv /etc/delivery/keys/${var.username}.pem /etc/delivery",
      "sudo mv /etc/delivery/keys/encrypted_data_bag_secret /etc/delivery",
      "sudo mv /etc/delivery/keys/${var.chef_org_short}-validator.pem /etc/delivery",
      "sudo mv /etc/delivery/keys/builder* /etc/delivery",
      "sudo rm -rf /etc/delivery/keys",
      "sudo mv /etc/delivery/trusted_certs /etc/chef/",
      "sudo chown -R root:root /etc/delivery /etc/chef /var/opt/delivery",
      "echo Prepared for Chef Provisioner run"
    ]
  }
  provisioner "chef" {
    attributes {
      "delivery-cluster" {
        "delivery" {
          "chef_server" = "${var.chef_server_url}"
          "fqdn" = "${self.public_dns}"
        }
      }
    }
    # environment = "_default"
    run_list = ["delivery-cluster::delivery"]
    node_name = "${format("%s-%02d-%s", var.delivery_basename, count.index + 1, var.enterprise)}"
    secret_key = "${path.cwd}/.chef/encrypted_data_bag_secret"
    server_url = "${var.chef_server_url}"
    validation_client_name = "${var.chef_org_short}-validator"
{'fraction_non_alphanumeric': 0.16262950532613454, 'fraction_numerical': 0.01940755873340143, 'mean_word_length': 3.2847764926539544, 'pattern_counts': {'":': 6, '<': 12, '<?xml version=': 0, '>': 10, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 15, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1702383', 'n_tokens_mistral': 5477, 'n_tokens_neox': 5279, 'n_words': 1013}