From dc3c3f18470a4fbd5d2f712f4218e4c4d73daa8b Mon Sep 17 00:00:00 2001
From: "Sven (AAMOS AI)" <sven@wavult.com>
Date: Tue, 11 Aug 2026 21:32:20 +0700
Subject: [PATCH] infra: add ec2, eip, key pair and docker bootstrap

---
 infrastructure/terraform/compute.tf | 77 +++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)
 create mode 100644 infrastructure/terraform/compute.tf

diff --git a/infrastructure/terraform/compute.tf b/infrastructure/terraform/compute.tf
new file mode 100644
index 0000000..0f2e144
--- /dev/null
+++ b/infrastructure/terraform/compute.tf
@@ -0,0 +1,77 @@
+data "aws_ami" "ubuntu" {
+  most_recent = true
+  owners      = ["099720109477"] # Canonical
+
+  filter {
+    name   = "name"
+    values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
+  }
+
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
+  }
+}
+
+resource "tls_private_key" "app" {
+  algorithm = "RSA"
+  rsa_bits  = 4096
+}
+
+resource "local_file" "app_private_key" {
+  filename        = "${pathexpand("~")}/.ssh/cibello-prod-key"
+  content         = tls_private_key.app.private_key_pem
+  file_permission = "0600"
+}
+
+resource "aws_key_pair" "app" {
+  key_name   = "cibello-prod-key"
+  public_key = tls_private_key.app.public_key_openssh
+}
+
+resource "aws_eip" "app" {
+  domain = "vpc"
+  tags = {
+    Name = "cibello-prod-ip"
+  }
+}
+
+resource "aws_instance" "app" {
+  ami                    = data.aws_ami.ubuntu.id
+  instance_type          = "t3.small"
+  subnet_id              = aws_subnet.public.id
+  vpc_security_group_ids = [aws_security_group.web.id]
+  key_name               = aws_key_pair.app.key_name
+  iam_instance_profile   = aws_iam_instance_profile.app.name
+
+  root_block_device {
+    volume_size           = 30
+    volume_type           = "gp3"
+    encrypted             = true
+    delete_on_termination = true
+  }
+
+  user_data = <<-EOF
+    #!/bin/bash
+    set -e
+    apt-get update
+    apt-get install -y ca-certificates curl gnupg git
+    install -m 0755 -d /etc/apt/keyrings
+    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+    chmod a+r /etc/apt/keyrings/docker.gpg
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo $VERSION_CODENAME) stable" > /etc/apt/sources.list.d/docker.list
+    apt-get update
+    apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+    usermod -aG docker ubuntu
+    systemctl enable docker --now
+  EOF
+
+  tags = {
+    Name = "cibello-prod-app"
+  }
+}
+
+resource "aws_eip_association" "app" {
+  instance_id   = aws_instance.app.id
+  allocation_id = aws_eip.app.id
+}