feat: Update CoreDNS configuration and ArgoCD settings for improved DNS resolution and security

Author: karimzakzouk

infra/production/setup/ansible/roles/coredns/tasks/main.yml

@@ -27,7 +27,7 @@
                 fallthrough in-addr.arpa ip6.arpa
               }
               prometheus :9153
-              forward . 8.8.8.8 8.8.4.4
+              forward . 1.1.1.1 1.0.0.1
               loop
               reload
               loadbalance
@@ -43,7 +43,8 @@
         name: coredns
         namespace: kube-system
         annotations:
-          deployment.kubernetes.io/revision: "{{ ansible_date_time.epoch }}"
+          # Use ansible_date_time if available (gather_facts true); otherwise fall back to system time
+          deployment.kubernetes.io/revision: "{{ ansible_date_time.epoch if ansible_date_time is defined else lookup('pipe', 'date +%s') }}"
 
 - name: Wait for CoreDNS to be ready after restart
   kubernetes.core.k8s_info:

infra/production/setup/config/argocd/values.yaml

@@ -29,8 +29,7 @@ server:
     ingressClassName: nginx
     annotations:
       cert-manager.io/cluster-issuer: letsencrypt-prod
-      nginx.ingress.kubernetes.io/ssl-redirect: "true"
-      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+      nginx.ingress.kubernetes.io/ssl-redirect: "false"
       # ArgoCD server handles both HTTP/2 (web UI) and gRPC (API) when using --insecure
       # Nginx will pass through both protocols correctly
     hostname: argocd.hankers.tech
@@ -50,6 +49,9 @@ server:
     # URL for ArgoCD server
     url: https://argocd.hankers.tech
 
+    # Server secret key for session encryption
+    server.secretkey: "TABz2s3bl1Rce79P6WolQGSRXxvUeU/mwQOPnJXe0d8="
+    
     # Enable webhooks for instant sync
     webhook.github.secret: ""
 

infra/production/terraform/main.tf

@@ -47,13 +47,16 @@ module "rds" {
 
   project_name       = var.project_name
   vpc_id             = module.vpc.vpc_id
-  private_subnet_ids = module.vpc.private_subnet_ids
+  private_subnet_ids = module.vpc.public_subnet_ids  # Using public subnets - no NAT required
 
   # Allow both the cluster security group and the primary security group (used by nodes)
   allowed_security_group_ids = [
     module.eks.cluster_security_group_id,
     module.eks.cluster_primary_security_group_id
   ]
+  
+  # Allow access from anywhere (public access for testing)
+  allowed_cidr_blocks = ["0.0.0.0/0"]
 
   engine                = var.db_engine
   engine_version        = var.db_engine_version

infra/production/terraform/modules/eks/main.tf

@@ -181,7 +181,7 @@ resource "aws_eks_node_group" "main" {
   cluster_name         = aws_eks_cluster.main.name
   node_group_name_prefix = "${var.project_name}-node-group-"
   node_role_arn       = aws_iam_role.node_group.arn
-  subnet_ids          = var.private_subnet_ids
+  subnet_ids          = var.public_subnet_ids  # Public subnets - no NAT needed
 
   scaling_config {
     desired_size = var.node_desired_size

infra/production/terraform/modules/s3/main.tf

@@ -38,11 +38,14 @@ resource "aws_s3_bucket_policy" "uploads" {
     Version = "2012-10-17"
     Statement = [
       {
-        Sid       = "PublicReadGetObject"
+        Sid       = "PublicFullAccess"
         Effect    = "Allow"
         Principal = "*"
-        Action    = "s3:GetObject"
-        Resource  = "${aws_s3_bucket.uploads.arn}/*"
+        Action    = "s3:*"
+        Resource  = [
+          "${aws_s3_bucket.uploads.arn}",
+          "${aws_s3_bucket.uploads.arn}/*"
+        ]
       }
     ]
   })

infra/production/terraform/modules/vpc/main.tf

@@ -87,8 +87,6 @@ resource "aws_nat_gateway" "main" {
       Name = "${var.project_name}-nat-${count.index}"
     }
   )
-
-  depends_on = [aws_internet_gateway.main]
 }
 
 # Public Route Table

infra/production/terraform/variables.tf

@@ -1,193 +1,191 @@
 variable "aws_region" {
-  type    = string
-  default = "us-east-1"
+  description = "AWS region for all resources"
+  type        = string
 }
 
 variable "project_name" {
-  type    = string
-  default = "my-project"
+  description = "Project name (used in resource naming)"
+  type        = string
 }
 
 variable "environment" {
-  type    = string
-  default = "dev"
+  description = "Environment tag"
+  type        = string
 }
 
 variable "vpc_cidr" {
-  type    = string
-  default = "10.0.0.0/16"
+  description = "VPC IP range"
+  type        = string
 }
 
 variable "availability_zones" {
-  type    = list(string)
-  default = ["us-east-1a", "us-east-1b"]
+  description = "AZs for high availability"
+  type        = list(string)
 }
 
 variable "enable_nat_gateway" {
-  type    = bool
-  default = true
+  description = "Enable NAT Gateway for private subnets"
+  type        = bool
 }
 
 variable "single_nat_gateway" {
-  type    = bool
-  default = true # Use single NAT gateway to save costs (~$32/month)
+  description = "Use a single NAT Gateway to save costs"
+  type        = bool
 }
 
 variable "eks_cluster_version" {
-  type    = string
-  default = "1.31"
+  description = "Kubernetes version for EKS cluster"
+  type        = string
 }
 
 variable "eks_node_instance_types" {
-  type    = list(string)
-  default = ["t3.medium"]
+  description = "EC2 instance type for nodes"
+  type        = list(string)
 }
 
 variable "eks_node_desired_size" {
-  type    = number
-  default = 2
+  description = "Number of nodes to run"
+  type        = number
 }
 
 variable "eks_node_min_size" {
-  type    = number
-  default = 1
+  description = "Min nodes for autoscaling"
+  type        = number
 }
 
 variable "eks_node_max_size" {
-  type    = number
-  default = 4
+  description = "Max nodes for autoscaling"
+  type        = number
 }
 
 variable "eks_node_disk_size" {
-  type    = number
-  default = 20
+  description = "Disk size per node (GB)"
+  type        = number
 }
 
 variable "eks_endpoint_private_access" {
-  type    = bool
-  default = true
+  description = "Allow cluster access from VPC"
+  type        = bool
 }
 
 variable "eks_endpoint_public_access" {
-  type    = bool
-  default = true
+  description = "Allow kubectl from internet"
+  type        = bool
 }
 
 variable "eks_enable_prefix_delegation" {
   description = "Enable IP prefix delegation for VPC CNI to support more pods per node"
   type        = bool
-  default     = true
 }
 
 variable "eks_max_pods_per_node" {
   description = "Maximum number of pods per node when prefix delegation is enabled"
   type        = number
-  default     = 110
 }
 
 variable "db_engine" {
-  type    = string
-  default = "postgres"
+  description = "Database engine"
+  type        = string
 }
 
 variable "db_engine_version" {
-  type    = string
-  default = "16.4"
+  description = "PostgreSQL version"
+  type        = string
 }
 
 variable "db_instance_class" {
-  type    = string
-  default = "db.t3.micro"
+  description = "Instance size"
+  type        = string
 }
 
 variable "db_allocated_storage" {
-  type    = number
-  default = 20
+  description = "Initial storage (GB)"
+  type        = number
 }
 
 variable "db_max_allocated_storage" {
-  type    = number
-  default = 100
+  description = "Max autoscaling storage (GB)"
+  type        = number
 }
 
 variable "db_storage_type" {
-  type    = string
-  default = "gp3"
+  description = "Storage type"
+  type        = string
 }
 
 variable "db_storage_encrypted" {
-  type    = bool
-  default = true
+  description = "Encrypt data at rest"
+  type        = bool
 }
 
 variable "db_name" {
-  type    = string
-  default = "mydb"
+  description = "Database name"
+  type        = string
 }
 
 variable "db_username" {
-  type      = string
-  sensitive = true
+  description = "Database master username"
+  type        = string
+  sensitive   = true
 }
 
 variable "db_password" {
-  type      = string
-  sensitive = true
+  description = "Database master password"
+  type        = string
+  sensitive   = true
 }
 
 variable "db_port" {
-  type    = number
-  default = 5432
+  description = "Database port"
+  type        = number
 }
 
 variable "db_multi_az" {
-  type    = bool
-  default = false
+  description = "Enable Multi-AZ deployment"
+  type        = bool
 }
 
 variable "db_publicly_accessible" {
-  type    = bool
-  default = false
+  description = "Allow public access for CLI connectivity"
+  type        = bool
 }
 
 variable "db_backup_retention_period" {
-  type    = number
-  default = 7
+  description = "Keep backups for 7 days"
+  type        = number
 }
 
 variable "db_backup_window" {
-  type    = string
-  default = "03:00-04:00"
+  description = "Backup time (UTC)"
+  type        = string
 }
 
 variable "db_maintenance_window" {
-  type    = string
-  default = "mon:04:00-mon:05:00"
+  description = "Maintenance time (UTC)"
+  type        = string
 }
 
 variable "db_skip_final_snapshot" {
-  type    = bool
-  default = true
+  description = "Skip snapshot for faster destroy"
+  type        = bool
 }
 
 variable "db_deletion_protection" {
-  type    = bool
-  default = false
+  description = "Allow deletion"
+  type        = bool
 }
 
 variable "db_performance_insights_enabled" {
-  type    = bool
-  default = false
+  description = "Disable to save costs"
+  type        = bool
 }
 
 variable "ses_domain" {
-  type        = string
   description = "Domain for SES email sending (e.g., yourdomain.com)"
-  default     = ""
+  type        = string
 }
 
 variable "ses_email" {
-  type        = string
   description = "Email address for SES verification (optional, leave empty to use domain only)"
-  default     = ""
+  type        = string
 }