infra: Terraform module for the vpcopilot-lab (AWAF BIG-IP + Larkspur) - #38
Merged
Conversation
Adds infra/vpcopilot-lab/ — the copilot's own validation lab as Terraform, adapted from nimbus-demo/infra for the new AWS account. Fixes the "no IaC in the repo" gap so the estate is codified and travels to the new laptop. - Advanced-WAF BIG-IP VE (AMI auto-resolved from F5's Marketplace owner, or pinned), 2-NIC, public VIP EIP, management reachable ONLY via an SSM tunnel. - Larkspur origin (t3.small, Docker) behind the appliance, fixed 10.30.10.22 so `vpcopilot bigip-lab create` examples copy-paste. - Dedicated VPC 10.30.0.0/16, deliberately separate from nimbus-demo. - onboard/bigip-onboard.sh scripts the two documented traps: poll mcp-state before provisioning asm:nominal, then curl-install AS3. - Makefile cost controls (lab-up / lab-down / lab-nuke), tag-scoped to Project=vpcopilot-lab so a stop can never touch another estate. - No load generators; no credentials or state in the tree (see .gitignore). terraform validate passes; plan = 20 to add against account 113938649684. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
infra/vpcopilot-lab/— the copilot's own validation lab as Terraform, so the estate is codified (fixing the "no IaC in the repo" gap) and travels to the new laptop via git.What it stands up (new AWS account, us-east-2, tag
Project=vpcopilot-lab)bigip_ami).t3.small, Docker) behind the appliance at the fixed10.30.10.22:8080, sovpcopilot bigip-lab createexamples copy-paste.10.30.0.0/16, deliberately separate fromnimbus-demo.Adapted from
nimbus-demo/infra, with three deliberate changesAWAF SKU (not GOOD — GOOD has no ASM), Larkspur as the origin, and no load generators.
Operability
onboard/bigip-onboard.shscripts the two documented onboarding traps: pollmcp-stateforrunningbefore provisioningasm:nominal, thencurl-install AS3.Makefile—make lab-down/lab-up/lab-nuke, every target scoped toProject=vpcopilot-labso a stop can never touch another estate.Safety
No credentials or state in the tree —
.gitignorecovers.secrets/,*.tfstate,terraform.tfvars,.terraform/.terraform validatepasses;plan= 20 to add against account113938649684. Theterraform applyis run by the operator.Part of the laptop + AWS-account migration (runbook rev. 3).
🤖 Generated with Claude Code