<commit_before>#
# Copyright 2019 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

#
# This file contains the actual Vault server definitions
#

# Template for creating Vault nodes
locals {
  lb_scheme = upper(var.load_balancing_scheme)
  use_internal_lb = local.lb_scheme == "INTERNAL"
  use_external_lb = local.lb_scheme == "EXTERNAL"
}

resource "google_compute_instance_template" "vault" {
  project     = var.project_id
  region      = var.region
  name_prefix = "vault-"

  machine_type = var.vault_machine_type

  tags = concat(["allow-ssh", "allow-vault"], var.vault_instance_tags)

  labels = var.vault_instance_labels

  network_interface {
    subnetwork         = local.subnet
    subnetwork_project = var.project_id
  }

  disk {
    source_image = var.vault_instance_base_image
    type         = "PERSISTENT"
    disk_type    = "pd-ssd"
    mode         = "READ_WRITE"
    boot         = true
  }

  service_account {
    email  = google_service_account.vault-admin.email
    scopes = ["https://www.googleapis.com/auth/cloud-platform"]
  }

  metadata = merge(
    var.vault_instance_metadata,
    {
      "google-compute-enable-virtio-rng" = "true"
      "startup-script"                   = data.template_file.vault-startup-script.rendered
    },
  )

  lifecycle {
    create_before_destroy = true
  }

  depends_on = [google_project_service.service]
}

############################
## Internal Load Balancer ##
############################

resource "google_compute_health_check" "vault_internal" {
  count   = local.use_internal_lb ? 1 : 0
  project = var.project_id
  name    = "vault-health-internal"

  check_interval_sec  = 15
  timeout_sec         = 5
  healthy_threshold   = 2
  unhealthy_threshold = 2

  https_health_check {
    port         = var.vault_port
    request_path = "/v1/sys/health?uninitcode=200"
  }

  depends_on = [google_project_service.service]
}

resource "google_compute_region_backend_service" "vault_internal" {
  count         = local.use_internal_lb ? 1 : 0
  name          = "vault-backend-service"
  region        = var.region
  health_checks = ["${google_compute_health_check.vault_internal[0].self_link}"]
  backend {
    group = google_compute_region_instance_group_manager.vault.instance_group
  }
}

# Forward internal traffic to the backend service
resource "google_compute_forwarding_rule" "vault_internal" {
  count   = local.use_internal_lb ? 1 : 0
  project = var.project_id

  name                  = "vault-internal"
  region                = var.region
  ip_protocol           = "TCP"
  ip_address            = google_compute_address.vault_ilb[0].address
  load_balancing_scheme = local.lb_scheme
  network_tier          = "PREMIUM"
  allow_global_access   = true
  subnetwork            = local.subnet

  backend_service = google_compute_region_backend_service.vault_internal[0].self_link
  ports           = [var.vault_port]

  depends_on = [google_project_service.service]<commit_msg>fmt and newline<commit_after>#
# Copyright 2019 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

#
# This file contains the actual Vault server definitions
#

# Template for creating Vault nodes
locals {
  lb_scheme       = upper(var.load_balancing_scheme)
  use_internal_lb = local.lb_scheme == "INTERNAL"
  use_external_lb = local.lb_scheme == "EXTERNAL"
}

resource "google_compute_instance_template" "vault" {
  project     = var.project_id
  region      = var.region
  name_prefix = "vault-"

  machine_type = var.vault_machine_type

  tags = concat(["allow-ssh", "allow-vault"], var.vault_instance_tags)

  labels = var.vault_instance_labels

  network_interface {
    subnetwork         = local.subnet
    subnetwork_project = var.project_id
  }

  disk {
    source_image = var.vault_instance_base_image
    type         = "PERSISTENT"
    disk_type    = "pd-ssd"
    mode         = "READ_WRITE"
    boot         = true
  }

  service_account {
    email  = google_service_account.vault-admin.email
    scopes = ["https://www.googleapis.com/auth/cloud-platform"]
  }

  metadata = merge(
    var.vault_instance_metadata,
    {
      "google-compute-enable-virtio-rng" = "true"
      "startup-script"                   = data.template_file.vault-startup-script.rendered
    },
  )

  lifecycle {
    create_before_destroy = true
  }

  depends_on = [google_project_service.service]
}

############################
## Internal Load Balancer ##
############################

resource "google_compute_health_check" "vault_internal" {
  count   = local.use_internal_lb ? 1 : 0
  project = var.project_id
  name    = "vault-health-internal"

  check_interval_sec  = 15
  timeout_sec         = 5
  healthy_threshold   = 2
  unhealthy_threshold = 2

  https_health_check {
    port         = var.vault_port
    request_path = "/v1/sys/health?uninitcode=200"
  }

  depends_on = [google_project_service.service]
}

resource "google_compute_region_backend_service" "vault_internal" {
  count         = local.use_internal_lb ? 1 : 0
  name          = "vault-backend-service"
  region        = var.region
  health_checks = ["${google_compute_health_check.vault_internal[0].self_link}"]

  backend {
    group = google_compute_region_instance_group_manager.vault.instance_group
  }
}

# Forward internal traffic to the backend service
resource "google_compute_forwarding_rule" "vault_internal" {
  count   = local.use_internal_lb ? 1 : 0
  project = var.project_id

  name                  = "vault-internal"
  region                = var.region
  ip_protocol           = "TCP"
  ip_address            = google_compute_address.vault_ilb[0].address
  load_balancing_scheme = local.lb_scheme
  network_tier          = "PREMIUM"
  allow_global_access   = true
  subnetwork            = local.subnet

  backend_service = google_compute_region_backend_service.vault_internal[0].self_link
  ports           = [var.vault_port]

  depends_on = [google_project_service.service]
{'fraction_non_alphanumeric': 0.10030263726761782, 'fraction_numerical': 0.007493875198155354, 'mean_word_length': 3.2111650485436893, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6555069', 'n_tokens_mistral': 2219, 'n_tokens_neox': 2137, 'n_words': 477}