PyTerraBackTYL is a generic Terraform HTTP backend for managing Terraform locking and state.
942
PyTerraBackTYL is an HTTP backend for Terraform that allows you to control how locking and state are managed. This container ships with three persistent plugins:
pyshelve_backend.PyShelveBackend (default) to save state to disk as a binary PyShelve object.
/opt/pyterrabacktyl/data to persist your state data (e.g. --mount type=bind,src="/pyterrabacktyl_data",dst="/opt/pyterrabacktyl/data")git_backend.GitBackend store state in a Git repository.aes_backend.AESBackend 256bit CBC mode AES encrypted JSON file to disk.You can also create your own persistent backend plugin to handle locks and store state however you like by implementing the TYLPersistent abstract class.
NOTE: The Docker image for PyTerraBackTYL has HTTPS enabled by default. If Terraform gives you the error Error: Error acquiring the state lock then ensure that the URLs in your backend "http" Terraform code begin with https:// (not http://) and that it includes the line skip_cert_verification = "true". The certificates are automatically generated every time a new container is created (you can docker rm the container to force new certs to be generated). If you want to manage your own SSL certificates, mount /opt/pyterrabacktyl/ssl. By default, the service expects these files to be named public.key and private.key, but these values can be changed in the config.yaml configuration file.
This is the default configuration and requires that you mount /opt/pyterrabacktyl/data for data to persist.
Example run command:
docker run -d --mount type=bind,src="/my_pyterrabacktyl_data",dst="/opt/pyterrabacktyl/data" --name pyterrabacktyl -p 2442:2442 pyterrabacktylYou will need to mount a new copy of the configuration file that sets BACKEND_CLASS: 'git_backend.GitBackend'. You can read more about the required configuration for the GitBackend module in the PyTerraBackTYL documentation, but a sample is provided below with the recommended parameters.
NOTE: New SSH keys used to authenticate with the Git repository are generated every time a new container is invoked (running docker rm on the container will force new keys to be generated). To find the the public key, start the container and check the log (e.g. docker logs pyterrabacktyl). If you want to manage the keys yourself, mount /home/tfbackendsvc/.ssh.
data directory for this module.Example run command:
docker run -d --mount type=bind,src="/my_custom_config.yaml",dst="/opt/pyterrabacktyl/config.yaml" --name pyterrabacktyl -p 2442:2442 pyterrabacktylExample config.yaml:
BACKEND_SERVICE_IP: '0.0.0.0'
BACKEND_SERVICE_PORT: 2442
BACKEND_PLUGINS_PATH: 'backends' # Where to find persistent and non-persistent plugins
BACKEND_CLASS: 'git_backend.GitBackend' # The persistent plugin that controls locking and state.
POST_PROCESS_CLASSES: [] # A list of non-persistant plugins that let you perform extra tasks based on locking and state.
LOG_LEVEL: 'INFO' # INFO, DEBUG, WARNING, ERROR
USE_SSL: true # Disabled by default -- generate SSL key pair then set this to 'true'
SSL_PUBLIC_KEY: 'ssl/public.key' # The path and filename of the public SSL key -- 'ssl/' is a subdirectory where PyTerraBackTYL is installed.
SSL_PRIVATE_KEY: 'ssl/private.key' # The path and file name of the private SSL key.
# Key:Value pairs where the key matches a Terraform provider, and key is a jsonPath to fetch hostnames from the terraform state
HELPER_HOSTNAME_QUERY_MAP:
digitalocean_droplet: 'modules[*].resources.*.primary.attributes.name'
vsphere_virtual_machine: '$.modules[*].resources.[?(@.type == "vsphere_virtual_machine")].primary[?(@.memory != 0)].name'
# The repo to use to store tfstate, lock status, and logs.
GIT_REPOSITORY: '[email protected]:dev-dull/backend_test.git' # No HTTP/S yet.
# Directory where Git should clone state data into.
GIT_WORKING_PATH: /opt/pyterrabacktyl/data
# The branch to clone when creating a new environment with Terraform.
GIT_DEFAULT_CLONE_BRANCH: 'origin/master'
# The format to use for commit messages. Options are case sensitive.
# Valid values: ID, Operation, Info, Who, Version, Created, Path
GIT_COMMIT_MESSAGE_FORMAT: '{Who}, {Operation} - {ID}'
# Maximum number of log messages to keep in the GIT_STATE_CHANGE_LOG_FILENAME file.
GIT_STATE_CHANGE_LOG_SCROLLBACK: 300
# Name of the log file to commit to record locks/unlocks
GIT_STATE_CHANGE_LOG_FILENAME: 'state_change.log'
# The format to use for logging messages. Options are case sensitive.
# Valid values: ID, Operation, Info, Who, Version, Created, Path
GIT_STATE_CHANGE_LOG_FORMAT: '{Created} - {Operation}: {Who} {ID}'
You will need to mount a new copy of the configuration file that sets BACKEND_CLASS: 'aes_backend.AESBackend'. You can read more about the required configuration for the AESBackend module in the PyTerraBackTYL documentation, but a sample is provided below with the recommended parameters. The AESBackend module requires that you mount /opt/pyterrabacktyl/data for data to persist.
AES_SECRET_KEYto something unique to your organization. Try to make it at least 30 characters long.Example run command:
docker run -d --mount type=bind,src="/my_custom_config.yaml",dst="/opt/pyterrabacktyl/config.yaml" --mount type=bind,src="/my_pyterrabacktyl_data",dst="/opt/pyterrabacktyl/data" --name pyterrabacktyl -p 2442:2442 pyterrabacktyl
Example config.yaml:
BACKEND_SERVICE_IP: '0.0.0.0'
BACKEND_SERVICE_PORT: 2442
BACKEND_PLUGINS_PATH: 'backends' # Where to find persistent and non-persistent plugins
BACKEND_CLASS: 'aes_backend.AESBackend' # The persistent plugin that controls locking and state.
POST_PROCESS_CLASSES: [] # A list of non-persistant plugins that let you perform extra tasks based on locking and state.
LOG_LEVEL: 'INFO' # INFO, DEBUG, WARNING, ERROR
USE_SSL: true # Disabled by default -- generate SSL key pair then set this to 'true'
SSL_PUBLIC_KEY: 'ssl/public.key' # The path and filename of the public SSL key -- 'ssl/' is a subdirectory where PyTerraBackTYL is installed.
SSL_PRIVATE_KEY: 'ssl/private.key' # The path and file name of the private SSL key.
# Key:Value pairs where the key matches a Terraform provider, and key is a jsonPath to fetch hostnames from the terraform state
HELPER_HOSTNAME_QUERY_MAP:
digitalocean_droplet: 'modules[*].resources.*.primary.attributes.name'
vsphere_virtual_machine: '$.modules[*].resources.[?(@.type == "vsphere_virtual_machine")].primary[?(@.memory != 0)].name'
##
## aes_backend.AESBackend configuration
##
AES_DATA_PATH: '/opt/pyterrabacktyl/data' # Path where the encrypted files will be kept.
AES_TFSTATE_FILENAME: '_aes_tfstate.bin' # The name of the state file with the environment prepended.
AES_TFLOCK_FILENAME: '_LOCKED.bin' # The name of the lock file with the environment prepended.
AES_SECRET_KEY: 'This value will be used to encrypt data' # String value used to encrypt and decrypt data. If you change this, you will break things.
Content type
Image
Digest
sha256:d13d31671…
Size
48.9 MB
Last updated
9 months ago
docker pull devdull/pyterrabacktyl