Terraform & IaC
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
Terraform and Infrastructure as Code (IaC) within the ClassMate project provide a standardized, reproducible method for deploying the application's cloud infrastructure. The primary focus is on AWS, where Terraform is used to provision an isolated network environment, managed databases, caching layers, and compute resources required to run the AI backend and workers.
This infrastructure is designed to support the ClassMate "Hybrid Scalable Architecture," which transitions from local development using Docker Compose to production-grade cloud environments. By using IaC, the project ensures that the production environment—comprising VPCs, RDS instances, and ElastiCache clusters—remains consistent and version-controlled. Sources: infra/README.md, README.md:10-12
Network Architecture
The infrastructure utilizes an AWS Virtual Private Cloud (VPC) to provide an isolated network environment. This network is divided into public and private subnets to balance accessibility with security.
VPC and Subnet Configuration
- VPC: A CIDR block of
10.0.0.0/16is used with DNS hostnames and support enabled. - Public Subnet: Located in
us-west-2a, this subnet hosts the EC2 API server and allows public IP mapping on launch. - Private Subnet: Located in
us-west-2b, this subnet hosts sensitive resources like the RDS PostgreSQL database and ElastiCache Redis cluster, isolating them from direct internet access. - Connectivity: An Internet Gateway and Route Tables are configured to allow outbound traffic and provide the public subnet with internet access.
Sources: infra/terraform/main.tf:20-72
Network Layout Diagram
The following diagram illustrates the relationship between the VPC components and the resources they contain.
Sources: infra/terraform/main.tf:20-170
Managed Cloud Resources
ClassMate leverages managed AWS services to reduce operational overhead for data persistence and caching.
Database and Cache
Terraform manages the lifecycle of the production database and message broker:
- RDS PostgreSQL: Configured with engine version 15.4 on a
db.t3.microinstance. It includes storage encryption, automated backups (7-day retention), and is housed within a private DB subnet group. - ElastiCache Redis: Uses a
cache.t3.micronode running Redis 7. This serves as the message broker for Celery AI workers.
Sources: infra/terraform/main.tf:109-170, infra/README.md
Object Storage
An S3 bucket is provisioned for storing audio files. To ensure uniqueness, a random suffix is appended to the bucket name.
- Versioning: Enabled to track changes and prevent accidental deletions.
- Encryption: Server-side encryption using AES256 is enforced by default.
Sources: infra/terraform/main.tf:192-218
Compute and Orchestration
The primary compute resource is an AWS EC2 instance running Ubuntu 22.04, which serves as the host for the Dockerized application components.
EC2 Initialization
The EC2 instance is bootstrapped using a user-data.sh script. This script performs the following actions:
- System Updates: Installs
docker.io,docker-compose, andgit. - Deployment: Clones the ClassMate repository to
/opt/classmate. - Service Launch: Executes
docker-composeto start the backend services. - Reverse Proxy: Installs Nginx and configures it to proxy traffic to the API.
- Maintenance: Sets up basic log rotation and monitoring tools (
htop,iotop).
Sources: infra/terraform/user-data.sh:1-35, infra/terraform/main.tf:221-236
Security Groups
Access to compute and data resources is strictly controlled through Security Groups.
| Security Group | Purpose | Inbound Rules |
|---|---|---|
classmate-api-sg | API Server Access | Port 8000 (API), Port 22 (SSH) |
classmate-postgres-sg | Database Access | Port 5432 (from API Security Group only) |
classmate-redis-sg | Cache Access | Port 6379 (from API Security Group only) |
Sources: infra/terraform/main.tf:75-107, infra/terraform/main.tf:172-190
Infrastructure Management
The Terraform configuration provides specific outputs to facilitate connection by the application and developers.
| Output Name | Description | Source Resource |
|---|---|---|
api_public_ip | Public IP for the API server | aws_instance.api.public_ip |
postgres_endpoint | Endpoint for the RDS instance | aws_db_instance.postgres.endpoint |
redis_endpoint | Address of the Redis cache node | aws_elasticache_cluster.redis.cache_nodes |
s3_bucket_name | Name of the audio storage bucket | aws_s3_bucket.classmate.id |
Sources: infra/terraform/main.tf:239-258
Deployment Workflow
Deploying the infrastructure involves the standard Terraform lifecycle via the CLI:
terraform init: Initialize providers and backend.terraform plan: Preview changes.terraform apply: Provision the resources.
Sources: infra/README.md
Summary
The ClassMate IaC implementation provides a robust foundation for production deployments on AWS. By automating the provisioning of VPC networking, managed RDS/Redis instances, and EC2 compute, it ensures that the AI-powered backend can scale horizontally and maintain high availability within a secure, isolated environment.