Validated variants of this template, each adding one capability the base does not include.

• Vector searchfull-stack-app-vector

  PostgreSQL with pgvector on the database tier for embeddings

  Show source and downloadHide source

  10 files. Download the zip or copy any file.Download full-stack-app-vector.zip

  main.tf·HCL

  data "openstack_images_image_v2" "image" {
    name        = var.image_name
    most_recent = true
  }
  
  data "openstack_networking_network_v2" "external" {
    name = var.external_network
  }
  
  resource "openstack_networking_network_v2" "private" {
    name           = "full-stack-app-private"
    admin_state_up = true
  }
  
  resource "openstack_networking_subnet_v2" "private" {
    name            = "full-stack-app-private-subnet"
    network_id      = openstack_networking_network_v2.private.id
    cidr            = var.private_cidr
    ip_version      = 4
    enable_dhcp     = true
    dns_nameservers = var.dns_nameservers
  }
  
  resource "openstack_networking_router_v2" "router" {
    name                = "full-stack-app-router"
    admin_state_up      = true
    external_network_id = data.openstack_networking_network_v2.external.id
  }
  
  resource "openstack_networking_router_interface_v2" "private" {
    router_id = openstack_networking_router_v2.router.id
    subnet_id = openstack_networking_subnet_v2.private.id
  }
  
  resource "openstack_networking_secgroup_v2" "web" {
    name        = "full-stack-app-web"
    description = "Web: SSH, HTTP, HTTPS from any IPv4"
  }
  
  resource "openstack_networking_secgroup_rule_v2" "web_ssh" {
    direction         = "ingress"
    ethertype         = "IPv4"
    protocol          = "tcp"
    port_range_min    = 22
    port_range_max    = 22
    remote_ip_prefix  = "0.0.0.0/0"
    security_group_id = openstack_networking_secgroup_v2.web.id
  }
  
  resource "openstack_networking_secgroup_rule_v2" "web_http" {
    direction         = "ingress"
    ethertype         = "IPv4"
    protocol          = "tcp"
    port_range_min    = 80
    port_range_max    = 80
    remote_ip_prefix  = "0.0.0.0/0"
    security_group_id = openstack_networking_secgroup_v2.web.id
  }
  
  resource "openstack_networking_secgroup_rule_v2" "web_https" {
    direction         = "ingress"
    ethertype         = "IPv4"
    protocol          = "tcp"
    port_range_min    = 443
    port_range_max    = 443
    remote_ip_prefix  = "0.0.0.0/0"
    security_group_id = openstack_networking_secgroup_v2.web.id
  }
  
  resource "openstack_networking_secgroup_v2" "app" {
    name        = "full-stack-app-app"
    description = "App: 8080 and SSH from private network only"
  }
  
  resource "openstack_networking_secgroup_rule_v2" "app_http_alt" {
    direction         = "ingress"
    ethertype         = "IPv4"
    protocol          = "tcp"
    port_range_min    = 8080
    port_range_max    = 8080
    remote_ip_prefix  = var.private_cidr
    security_group_id = openstack_networking_secgroup_v2.app.id
  }
  
  resource "openstack_networking_secgroup_rule_v2" "app_ssh" {
    direction         = "ingress"
    ethertype         = "IPv4"
    protocol          = "tcp"
    port_range_min    = 22
    port_range_max    = 22
    remote_ip_prefix  = var.private_cidr
    security_group_id = openstack_networking_secgroup_v2.app.id
  }
  
  resource "openstack_networking_secgroup_v2" "db" {
    name        = "full-stack-app-db"
    description = "DB: MySQL and SSH from private network only"
  }
  
  resource "openstack_networking_secgroup_rule_v2" "db_postgres" {
    direction         = "ingress"
    ethertype         = "IPv4"
    protocol          = "tcp"
    port_range_min    = 5432
    port_range_max    = 5432
    remote_ip_prefix  = var.private_cidr
    security_group_id = openstack_networking_secgroup_v2.db.id
  }
  
  resource "openstack_networking_secgroup_rule_v2" "db_ssh" {
    direction         = "ingress"
    ethertype         = "IPv4"
    protocol          = "tcp"
    port_range_min    = 22
    port_range_max    = 22
    remote_ip_prefix  = var.private_cidr
    security_group_id = openstack_networking_secgroup_v2.db.id
  }
  
  
  resource "openstack_compute_instance_v2" "web" {
    name        = "full-stack-app-web"
    flavor_name = var.web_flavor
    key_pair    = var.key_name
  
    user_data = templatefile("${path.module}/cloud-init/web.yaml", {
      app_ip = openstack_compute_instance_v2.app.network[0].fixed_ip_v4
    })
  
    block_device {
      uuid                  = data.openstack_images_image_v2.image.id
      source_type           = "image"
      destination_type      = "volume"
      volume_size           = 20
      boot_index            = 0
      delete_on_termination = true
    }
  
    network {
      port = openstack_networking_port_v2.web.id
    }
  
    depends_on = [openstack_networking_router_interface_v2.private]
  }
  
  resource "openstack_networking_port_v2" "app" {
    name               = "full-stack-app-app-port"
    network_id         = openstack_networking_network_v2.private.id
    security_group_ids = [openstack_networking_secgroup_v2.app.id]
  
    fixed_ip {
      subnet_id = openstack_networking_subnet_v2.private.id
    }
  
    depends_on = [openstack_networking_router_interface_v2.private]
  }
  
  resource "openstack_compute_instance_v2" "app" {
    name        = "full-stack-app-app"
    flavor_name = var.app_flavor
    key_pair    = var.key_name
  
    user_data = templatefile("${path.module}/cloud-init/app.yaml", {
      db_ip       = openstack_compute_instance_v2.db.network[0].fixed_ip_v4
      db_name     = var.db_name
      db_user     = var.db_user
      db_password = var.db_password
    })
  
    block_device {
      uuid                  = data.openstack_images_image_v2.image.id
      source_type           = "image"
      destination_type      = "volume"
      volume_size           = 20
      boot_index            = 0
      delete_on_termination = true
    }
  
    network {
      port = openstack_networking_port_v2.app.id
    }
  
    depends_on = [openstack_networking_router_interface_v2.private]
  }
  
  resource "openstack_networking_port_v2" "web" {
    name               = "full-stack-app-web-port"
    network_id         = openstack_networking_network_v2.private.id
    security_group_ids = [openstack_networking_secgroup_v2.web.id]
  
    fixed_ip {
      subnet_id = openstack_networking_subnet_v2.private.id
    }
  
    depends_on = [openstack_networking_router_interface_v2.private]
  }
  
  resource "openstack_networking_port_v2" "db" {
    name               = "full-stack-app-db-port"
    network_id         = openstack_networking_network_v2.private.id
    security_group_ids = [openstack_networking_secgroup_v2.db.id]
  
    fixed_ip {
      subnet_id = openstack_networking_subnet_v2.private.id
    }
  
    depends_on = [openstack_networking_router_interface_v2.private]
  }
  
  resource "openstack_compute_instance_v2" "db" {
    name        = "full-stack-app-db"
    flavor_name = var.db_flavor
    key_pair    = var.key_name
  
    user_data = templatefile("${path.module}/cloud-init/postgres.yaml", {
      pg_version      = var.pg_version
      backup_schedule = var.backup_schedule
      private_cidr    = var.private_cidr
      db_name         = var.db_name
      db_user         = var.db_user
      db_password     = var.db_password
    })
  
    block_device {
      uuid                  = data.openstack_images_image_v2.image.id
      source_type           = "image"
      destination_type      = "volume"
      volume_size           = 20
      boot_index            = 0
      delete_on_termination = true
    }
  
    network {
      port = openstack_networking_port_v2.db.id
    }
  
    depends_on = [openstack_networking_router_interface_v2.private]
  }
  
  resource "openstack_blockstorage_volume_v3" "db_data" {
    name = "full-stack-app-db-data"
    size = var.db_volume_size
  }
  
  resource "openstack_compute_volume_attach_v2" "db_data" {
    instance_id = openstack_compute_instance_v2.db.id
    volume_id   = openstack_blockstorage_volume_v3.db_data.id
  }
  
  resource "openstack_networking_floatingip_v2" "web" {
    pool = var.external_network
  }
  
  resource "openstack_networking_floatingip_associate_v2" "web" {
    floating_ip = openstack_networking_floatingip_v2.web.address
    port_id     = openstack_networking_port_v2.web.id
  }
  

  variables.tf·HCL

  variable "web_flavor" {
    type    = string
    default = "s1a.small"
  }
  
  variable "app_flavor" {
    type    = string
    default = "s1a.medium"
  }
  
  variable "db_flavor" {
    type    = string
    default = "m2a.large"
  }
  
  variable "db_volume_size" {
    type    = number
    default = 50
  }
  
  variable "image_name" {
    type    = string
    default = "Ubuntu-24.04"
  }
  
  variable "key_name" {
    description = "Existing SSH keypair name in the project for compute instances"
    type        = string
  }
  
  variable "external_network" {
    description = "Shared external network for router gateway and floating IPs; defaults to PublicStatic (persisted FIP / production pattern). Override with PublicEphemeral for ephemeral demos."
    type        = string
    default     = "PublicStatic"
  }
  
  variable "private_cidr" {
    type    = string
    default = "192.168.50.0/24"
  }
  
  variable "dns_nameservers" {
    description = "Resolvers for the private subnet so instances can reach package mirrors during cloud-init"
    type        = list(string)
    default     = ["8.8.8.8", "8.8.4.4"]
  }
  
  variable "db_name" {
    description = "Application database name created on the db tier"
    type        = string
    default     = "appdb"
  }
  
  variable "db_user" {
    description = "Application database user the app tier connects as"
    type        = string
    default     = "appuser"
  }
  
  variable "db_password" {
    description = "Password for the application database user. Set this to a strong value; no default is shipped."
    type        = string
    sensitive   = true
  }
  
  variable "pg_version" {
    description = "PostgreSQL major version installed on the db tier with pgvector"
    type        = string
    default     = "16"
  }
  
  variable "backup_schedule" {
    description = "Cron schedule for PostgreSQL backups on the db tier"
    type        = string
    default     = "0 2 * * *"
  }
  

  outputs.tf·HCL

  output "web_floating_ip" {
    description = "Floating IPv4 address of the web instance"
    value       = openstack_networking_floatingip_v2.web.address
  }
  
  output "app_private_ip" {
    description = "Fixed IPv4 address of the app instance on the private network"
    value       = openstack_compute_instance_v2.app.network[0].fixed_ip_v4
  }
  
  output "db_private_ip" {
    description = "Fixed IPv4 address of the db instance on the private network"
    value       = openstack_compute_instance_v2.db.network[0].fixed_ip_v4
  }
  

  versions.tf·HCL

  terraform {
    required_version = ">= 1.6.0"
  
    required_providers {
      openstack = {
        source  = "terraform-provider-openstack/openstack"
        version = "~> 2.0"
      }
    }
  }
  
  provider "openstack" {}
  

  terraform.tfvars.example·HCL

  # Required
  key_name = "YOUR_KEY_NAME"
  
  # web_flavor = "s1a.small"
  # app_flavor = "s1a.medium"
  # db_flavor = "m2a.large"
  # db_volume_size = 50
  # image_name = "Ubuntu-24.04"
  # external_network = "PublicStatic"
  # private_cidr = "192.168.50.0/24"
  

  cloud-init/app.yaml·YAML

  #cloud-config
  package_update: true
  packages:
    - python3-psycopg2
  write_files:
    - path: /opt/app/app.py
      permissions: "0755"
      content: |
        import http.server
        import socketserver
        import psycopg2
  
        DB = dict(
            host="${db_ip}",
            user="${db_user}",
            password="${db_password}",
            dbname="${db_name}",
            connect_timeout=3,
        )
  
  
        class Handler(http.server.BaseHTTPRequestHandler):
            def do_GET(self):
                try:
                    conn = psycopg2.connect(**DB)
                    cur = conn.cursor()
                    cur.execute("SELECT extname FROM pg_extension WHERE extname = 'vector'")
                    ext = cur.fetchone()
                    conn.close()
                    body = "app tier OK; pgvector extension: {}".format(ext[0] if ext else "pending")
                    self.send_response(200)
                except Exception as exc:
                    body = "app tier up; db not ready yet: {}".format(exc)
                    self.send_response(503)
                self.send_header("Content-Type", "text/plain")
                self.end_headers()
                self.wfile.write(body.encode())
  
            def log_message(self, *args):
                pass
  
  
        socketserver.TCPServer.allow_reuse_address = True
        with socketserver.TCPServer(("0.0.0.0", 8080), Handler) as httpd:
            httpd.serve_forever()
    - path: /etc/systemd/system/app.service
      permissions: "0644"
      content: |
        [Unit]
        Description=full-stack-app-vector application tier
        After=network-online.target
        Wants=network-online.target
  
        [Service]
        ExecStart=/usr/bin/python3 /opt/app/app.py
        Restart=always
        RestartSec=3
  
        [Install]
        WantedBy=multi-user.target
  runcmd:
    - systemctl daemon-reload
    - systemctl enable --now app
  

  cloud-init/db.yaml·YAML

  #cloud-config
  package_update: true
  runcmd:
    - |
      set -e
      export DEBIAN_FRONTEND=noninteractive
      DEV=/dev/sdb
      # The data volume attaches as /dev/sdb on this platform (not /dev/vdb).
      for i in $(seq 1 30); do [ -b "$DEV" ] && break; sleep 5; done
      if ! blkid "$DEV" >/dev/null 2>&1; then mkfs.ext4 -F "$DEV"; fi
      mkdir -p /var/lib/mysql
      mount "$DEV" /var/lib/mysql
      grep -q "$DEV" /etc/fstab || echo "$DEV /var/lib/mysql ext4 defaults,nofail 0 2" >> /etc/fstab
      apt-get update
      apt-get install -y mariadb-server
      printf '[mysqld]\nbind-address = 0.0.0.0\n' > /etc/mysql/mariadb.conf.d/99-bind.cnf
      systemctl enable mariadb
      systemctl restart mariadb
      mysql -e "CREATE DATABASE IF NOT EXISTS ${db_name};"
      mysql -e "CREATE USER IF NOT EXISTS '${db_user}'@'%' IDENTIFIED BY '${db_password}';"
      mysql -e "GRANT ALL PRIVILEGES ON ${db_name}.* TO '${db_user}'@'%'; FLUSH PRIVILEGES;"
      mysql ${db_name} -e "CREATE TABLE IF NOT EXISTS status (id INT PRIMARY KEY, note VARCHAR(255)); INSERT IGNORE INTO status VALUES (1, 'full-stack-app database tier online');"
  

  cloud-init/postgres.yaml·YAML

  #cloud-config
  package_update: true
  write_files:
    - path: /tmp/zz-template.conf
      content: |
        listen_addresses = '*'
        archive_mode = on
        archive_command = 'test ! -f /var/lib/postgresql/wal_archive/%f && cp %p /var/lib/postgresql/wal_archive/%f'
      owner: root:root
      permissions: "0644"
    - path: /usr/local/bin/pg-backup.sh
      permissions: "0755"
      content: |
        #!/bin/bash
        set -e
        install -d -o postgres -g postgres /var/lib/postgresql/backups
        ts=$(date +%Y%m%d-%H%M%S)
        sudo -u postgres pg_dumpall | gzip > /var/lib/postgresql/backups/pgdumpall-$ts.sql.gz
    - path: /etc/cron.d/pg-backup
      owner: root:root
      permissions: "0644"
      content: |
        ${backup_schedule} root /usr/local/bin/pg-backup.sh
  runcmd:
    - |
      set -e
      export DEBIAN_FRONTEND=noninteractive
      DEV=/dev/sdb
      for i in $(seq 1 30); do [ -b "$DEV" ] && break; sleep 5; done
      if ! blkid "$DEV" >/dev/null 2>&1; then mkfs.ext4 -F -L pgdata "$DEV"; fi
      mkdir -p /var/lib/postgresql
      mount "$DEV" /var/lib/postgresql
      grep -q "$DEV" /etc/fstab || echo "$DEV /var/lib/postgresql ext4 defaults,nofail 0 2" >> /etc/fstab
      for i in 1 2 3; do apt-get update && break; sleep 10; done
      apt-get install -y postgresql-${pg_version} postgresql-${pg_version}-pgvector
      install -d -o postgres -g postgres /var/lib/postgresql/wal_archive /var/lib/postgresql/backups
      cp /tmp/zz-template.conf /etc/postgresql/${pg_version}/main/conf.d/zz-template.conf
      echo "host all all ${private_cidr} scram-sha-256" >> /etc/postgresql/${pg_version}/main/pg_hba.conf
      systemctl enable postgresql
      systemctl restart postgresql
      sudo -u postgres psql -v ON_ERROR_STOP=0 -c "CREATE DATABASE ${db_name};"
      sudo -u postgres psql -v ON_ERROR_STOP=0 -c "CREATE USER ${db_user} WITH PASSWORD '${db_password}';"
      sudo -u postgres psql -v ON_ERROR_STOP=0 -c "GRANT ALL PRIVILEGES ON DATABASE ${db_name} TO ${db_user};"
      sudo -u postgres psql -d ${db_name} -v ON_ERROR_STOP=1 -c "CREATE EXTENSION IF NOT EXISTS vector;"
  

  cloud-init/web.yaml·YAML

  #cloud-config
  package_update: true
  packages:
    - nginx
  write_files:
    - path: /etc/nginx/sites-available/default
      permissions: "0644"
      content: |
        server {
            listen 80 default_server;
            server_name _;
  
            location / {
                proxy_pass http://${app_ip}:8080;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
            }
        }
  runcmd:
    - systemctl enable --now nginx
    - systemctl restart nginx
  

  README.md·Markdown

  # Full Stack App
  
  Web, application, and database tiers on a private network behind a router, with security groups isolating traffic between layers.
  
  
  **Network class:** production — `external_network` defaults to `PublicStatic` for persisted floating IPs and multi-tier stacks; override with `PublicEphemeral` for ephemeral demos.
  
  ## Prerequisites
  
  - OpenTofu >= 1.6.0 or Terraform >= 1.6.0
  - Quake AI account with OpenStack credentials
  - Quota for multiple instances and at least one block volume for the database tier
  
  ## Usage
  
  1. Clone or copy this template directory
  2. Copy `terraform.tfvars.example` to `terraform.tfvars` and fill in your values
  3. Source your OpenStack credentials: `source openrc.sh`
  4. Initialize: `tofu init`
  5. Preview: `tofu plan`
  6. Apply: `tofu apply`
  
  ## Variables
  
  | Name | Type | Required | Default | Description |
  | --- | --- | --- | --- | --- |
  | `key_name` | string | yes | n/a | Existing SSH keypair name in the project for compute instances |
  | `web_flavor` | string | no | `s1a.small` | Flavor for web tier instances |
  | `app_flavor` | string | no | `s1a.medium` | Flavor for application tier instances |
  | `db_flavor` | string | no | `m2a.large` | Flavor for database tier instances |
  | `db_volume_size` | number | no | `50` | Database data volume size in GB |
  | `image_name` | string | no | `Ubuntu-24.04` | Boot image name |
  | `external_network` | string | no | `PublicStatic` | Persisted FIP / production default; override with `PublicEphemeral` for demos |
  | `private_cidr` | string | no | `192.168.50.0/24` | Private network CIDR for the stack |
  
  ## Documentation
  
  Full documentation: [Full stack app template](/docs/automation/templates/full-stack-app)