@@ -54,17 +54,17 @@ Here's a list of the services we will use and their costs:
...
@@ -54,17 +54,17 @@ Here's a list of the services we will use and their costs:
## Creating an IAM EC2 instance role and profile
## Creating an IAM EC2 instance role and profile
To minimize the permissions of the user, we'll create a new IAM role with
To minimize the permissions of the user, we'll create a new [IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
limited access:
role with limited access:
1. Navigate to the IAM dashboard https://console.aws.amazon.com/iam/home and
1. Navigate to the IAM dashboard https://console.aws.amazon.com/iam/home and
click on **Create role**.
click **Create role**.
1. Create a new role by choosing to **AWS service > EC2**. Once done, click on
1. Create a new role by choosing to **AWS service > EC2**. Once done, click
**Next: Permissions**.
**Next: Permissions**.
![Create role](img/create_iam_role.png)
![Create role](img/create_iam_role.png)
1. Choose **AmazonEC2FullAccess** and **AmazonS3FullAccess** and click on**Next: Review**.
1. Choose **AmazonEC2FullAccess** and **AmazonS3FullAccess**, then click**Next: Review**.
1. Give the role the name `GitLabAdmin` and click **Create role**.
1. Give the role the name `GitLabAdmin` and click **Create role**.
![Create role](img/create_iam_role_review.png)
![Create role](img/create_iam_role_review.png)
...
@@ -73,15 +73,15 @@ limited access:
...
@@ -73,15 +73,15 @@ limited access:
We'll start by creating a VPC for our GitLab cloud infrastructure, then
We'll start by creating a VPC for our GitLab cloud infrastructure, then
we can create subnets to have public and private instances in at least
we can create subnets to have public and private instances in at least
two AZs. Public subnets will require a Route Table keep and an associated
two [Availability Zones (AZs)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html). Public subnets will require a Route Table keep and an associated
Internet Gateway.
Internet Gateway.
### VPC
### Creating the Virtual Private Cloud (VPC)
Let's create a VPC:
We'll now create a VPC, a virtual networking environment that you'll control:
1. Navigate to https://console.aws.amazon.com/vpc/home
1. Navigate to https://console.aws.amazon.com/vpc/home.
1. Select **Your VPCs** from the left menu and then click on **Create VPC**.
1. Select **Your VPCs** from the left menu and then click **Create VPC**.
At the name tag enter `gitlab-vpc` and at the IPv4 CIDR block enter `10.0.0.0/16`.
At the name tag enter `gitlab-vpc` and at the IPv4 CIDR block enter `10.0.0.0/16`.
If you don't require dedicated hardware, you can leave tenancy as default.
If you don't require dedicated hardware, you can leave tenancy as default.
Click **Yes, Create** when ready.
Click **Yes, Create** when ready.
...
@@ -99,7 +99,7 @@ We will create private and public subnets to match load balancers and
...
@@ -99,7 +99,7 @@ We will create private and public subnets to match load balancers and
RDS instances as well:
RDS instances as well:
1. Select **Subnets** from the left menu.
1. Select **Subnets** from the left menu.
1. Click on **Create subnet**. Give it a descriptive name tag based on the IP,
1. Click **Create subnet**. Give it a descriptive name tag based on the IP,
for example `gitlab-public-10.0.0.0`, select the VPC we created previously,
for example `gitlab-public-10.0.0.0`, select the VPC we created previously,
and at the IPv4 CIDR block let's give it a 24 subnet `10.0.0.0/24`:
and at the IPv4 CIDR block let's give it a 24 subnet `10.0.0.0/24`:
...
@@ -126,11 +126,11 @@ to associate an Internet Gateway. On the same VPC dashboard:
...
@@ -126,11 +126,11 @@ to associate an Internet Gateway. On the same VPC dashboard:
### Internet Gateway
### Internet Gateway
Now, still on the same dashboard head over to Internet Gateways and
Now, still on the same dashboard, go to Internet Gateways and
create a new one:
create a new one:
1. Select **Internet Gateways** from the left menu.
1. Select **Internet Gateways** from the left menu.
1. Click on **Create internet gateway**, give it the name `gitlab-gateway` and
1. Click **Create internet gateway**, give it the name `gitlab-gateway` and
click **Create**.
click **Create**.
1. Select it from the table, and then under the **Actions** dropdown choose
1. Select it from the table, and then under the **Actions** dropdown choose
"Attach to VPC".
"Attach to VPC".
...
@@ -168,7 +168,7 @@ Now that we're done with the network, let's create a security group.
...
@@ -168,7 +168,7 @@ Now that we're done with the network, let's create a security group.
The security group is basically the firewall:
The security group is basically the firewall:
1. Select **Security Groups** from the left menu.
1. Select **Security Groups** from the left menu.
1. Click on **Create Security Group** and fill in the details. Give it a name,
1. Click **Create Security Group** and fill in the details. Give it a name,
add a description, and choose the VPC we created previously
add a description, and choose the VPC we created previously
1. Select the security group from the list and at the the bottom select the
1. Select the security group from the list and at the the bottom select the
Inbound Rules tab. You will need to open the SSH, HTTP, and HTTPS ports. Set
Inbound Rules tab. You will need to open the SSH, HTTP, and HTTPS ports. Set
...
@@ -181,7 +181,7 @@ The security group is basically the firewall:
...
@@ -181,7 +181,7 @@ The security group is basically the firewall:
host or CIDR block. In that case, change the SSH source to be custom and give
host or CIDR block. In that case, change the SSH source to be custom and give
it the IP you want to SSH from.
it the IP you want to SSH from.
1. When done, click on **Save**.
1. When done, click **Save**.
## PostgreSQL with RDS
## PostgreSQL with RDS
...
@@ -194,7 +194,7 @@ create the actual RDS instance.
...
@@ -194,7 +194,7 @@ create the actual RDS instance.
1. Navigate to the RDS dashboard and select **Subnet Groups** from the left menu.
1. Navigate to the RDS dashboard and select **Subnet Groups** from the left menu.
1. Give it a name (`gitlab-rds-group`), a description, and choose the VPC from
1. Give it a name (`gitlab-rds-group`), a description, and choose the VPC from
the VPC dropdown.
the VPC dropdown.
1. Click on "Add all the subnets related to this VPC" and
1. Click "Add all the subnets related to this VPC" and
remove the public ones, we only want the **private subnets**.
remove the public ones, we only want the **private subnets**.
In the end, you should see `10.0.1.0/24` and `10.0.3.0/24` (as
In the end, you should see `10.0.1.0/24` and `10.0.3.0/24` (as
we defined them in the [subnets section](#subnets)).
we defined them in the [subnets section](#subnets)).
...
@@ -206,7 +206,7 @@ create the actual RDS instance.
...
@@ -206,7 +206,7 @@ create the actual RDS instance.
Now, it's time to create the database:
Now, it's time to create the database:
1. Select **Instances** from the left menu and click on **Create database**.
1. Select **Instances** from the left menu and click **Create database**.
1. Select PostgreSQL and click **Next**.
1. Select PostgreSQL and click **Next**.
1. Since this is a production server, let's choose "Production". Click **Next**.
1. Since this is a production server, let's choose "Production". Click **Next**.
1. Let's see the instance specifications:
1. Let's see the instance specifications:
...
@@ -225,7 +225,7 @@ Now, it's time to create the database:
...
@@ -225,7 +225,7 @@ Now, it's time to create the database:
1. The rest of the settings on this page request a DB isntance identifier, username
1. The rest of the settings on this page request a DB isntance identifier, username
and a master password. We've chosen to use `gitlab-db-ha`, `gitlab` and a
and a master password. We've chosen to use `gitlab-db-ha`, `gitlab` and a
very secure password respectively. Keep these in hand for later.
very secure password respectively. Keep these in hand for later.
1. Click on **Next** to proceed to the advanced settings.
1. Click **Next** to proceed to the advanced settings.
1. Make sure to choose our gitlab VPC, our subnet group, set public accessibility to
1. Make sure to choose our gitlab VPC, our subnet group, set public accessibility to
**No**, and to leave it to create a new security group. The only additional
**No**, and to leave it to create a new security group. The only additional
change which will be helpful is the database name for which we can use
change which will be helpful is the database name for which we can use
...
@@ -274,7 +274,7 @@ To set up Redis:
...
@@ -274,7 +274,7 @@ To set up Redis:
![ElastiCache subnet](img/ec_subnet.png)
![ElastiCache subnet](img/ec_subnet.png)
1. Select **Redis** on the left menu and click on **Create** to create a new
1. Select **Redis** on the left menu and click **Create** to create a new
Redis cluster. Depending on your load, you can choose whether to enable
Redis cluster. Depending on your load, you can choose whether to enable
cluster mode or not. Even without cluster mode on, you still get the
cluster mode or not. Even without cluster mode on, you still get the
chance to deploy Redis in multi availability zones. In this guide, we chose
chance to deploy Redis in multi availability zones. In this guide, we chose
...
@@ -317,7 +317,7 @@ On the EC2 dashboard, look for Load Balancer on the left column:
...
@@ -317,7 +317,7 @@ On the EC2 dashboard, look for Load Balancer on the left column:
1. In the "Listeners" section, make sure it has HTTP and HTTPS.
1. In the "Listeners" section, make sure it has HTTP and HTTPS.
1. In the "Availability Zones" section, select the `gitlab-vpc` we have created
1. In the "Availability Zones" section, select the `gitlab-vpc` we have created
and associate the **public subnets**.
and associate the **public subnets**.
1. Click on the **Configure Security Settings** to go to the next section to
1. Click **Configure Security Settings** to go to the next section to
select the TLS certificate. When done, go to the next step.
select the TLS certificate. When done, go to the next step.
1. In the "Security Groups" section, create a new one by giving it a name
1. In the "Security Groups" section, create a new one by giving it a name
(`gitlab-loadbalancer-sec-group`) and allow both HTTP ad HTTPS traffic
(`gitlab-loadbalancer-sec-group`) and allow both HTTP ad HTTPS traffic
...
@@ -328,7 +328,7 @@ On the EC2 dashboard, look for Load Balancer on the left column:
...
@@ -328,7 +328,7 @@ On the EC2 dashboard, look for Load Balancer on the left column:
1. Leave the "Register Targets" section as is, and finally review the settings
1. Leave the "Register Targets" section as is, and finally review the settings
and create the ELB.
and create the ELB.
After the Load Balancer is up and running, you can re-visit your Security
After the Load Balancer is up and running, you can revisit your Security
Groups to improve access only through the ELB and any other requirement
Groups to improve access only through the ELB and any other requirement
you might have.
you might have.
...
@@ -340,7 +340,7 @@ configure the PostgreSQL and Redis connections.
...
@@ -340,7 +340,7 @@ configure the PostgreSQL and Redis connections.
The Auto Scaling Group option is available through the EC2 dashboard on the left
The Auto Scaling Group option is available through the EC2 dashboard on the left
sidebar.
sidebar.
1. Click on the **Create Auto Scaling group** button.
1. Click **Create Auto Scaling group**.
1. Create a new launch configuration.
1. Create a new launch configuration.
### Choose the AMI
### Choose the AMI
...
@@ -348,15 +348,15 @@ sidebar.
...
@@ -348,15 +348,15 @@ sidebar.
Choose the AMI:
Choose the AMI:
1. Go to the Community AMIs and search for `GitLab EE <version>`
1. Go to the Community AMIs and search for `GitLab EE <version>`
where `<version>` the latest version as seen in the
where `<version>` the latest version as seen on the