Skip to content

Add support for valkey and passing valkey_url in dev environment #324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hellais merged 14 commits into from
Feb 5, 2026
Merged

Add support for valkey and passing valkey_url in dev environment #324

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
8ca3e96
Add support for valkey and passing valkey_url in dev environment
hellais Feb 2, 2026
525b666
Point to rate-limiter branch
hellais Feb 2, 2026
085ff4e
Add elasticache permission
hellais Feb 2, 2026
8f6def6
Fix parameter group name
hellais Feb 2, 2026
29b7e76
Use serverless cache instead of cluster
hellais Feb 2, 2026
7c78b61
Move config into task env vars
hellais Feb 2, 2026
d211c5b
Add elastic cache security group to allow traffic in port 6379
LDiazN Feb 3, 2026
c927d08
Change valkey url format
LDiazN Feb 3, 2026
7f1f979
make valkey url use ssl
LDiazN Feb 3, 2026
54c20de
remove tony's account
LDiazN Feb 3, 2026
6e6985c
Set ACCOUNT_ID_HASHING_KEY in dev environment
hellais Feb 5, 2026
00df584
Add support for deploying oonimeasurements with elasticache in prod
hellais Feb 5, 2026
e0b3129
Point dev env to master
hellais Feb 5, 2026
a8228df
Update tf lockfile
hellais Feb 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 56 additions & 2 deletions tf/environments/dev/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,6 @@ module "adm_iam_roles" {
"arn:aws:iam::${local.ooni_main_org_id}:user/art",
"arn:aws:iam::${local.ooni_main_org_id}:user/mehul",
"arn:aws:iam::${local.ooni_main_org_id}:user/luis",
"arn:aws:iam::${local.ooni_main_org_id}:user/tony"
]
}

Expand Down Expand Up @@ -239,6 +238,10 @@ data "aws_ssm_parameter" "clickhouse_readonly_test_url" {
name = "/oonidevops/secrets/clickhouse_readonly_test_url"
}

data "aws_ssm_parameter" "account_id_hashing_key" {
name = "/oonidevops/secrets/ooni_services/account_id_hashing_key"
}

resource "random_id" "artifact_id" {
byte_length = 4
}
Expand Down Expand Up @@ -452,6 +455,54 @@ module "oonitier1plus_cluster" {

#### OONI Tier0

##### Elasticache valkey cache

resource "aws_elasticache_serverless_cache" "ooniapi" {
name = "ooniapi-${local.environment}-cache"
engine = "valkey"
cache_usage_limits {
data_storage {
maximum = 10
unit = "GB"
}
ecpu_per_second {
maximum = 5000
}
}
major_engine_version = "8"
security_group_ids = [
module.ooniapi_cluster.web_security_group_id,
aws_security_group.elasticache_sg.id
]
subnet_ids = module.network.vpc_subnet_private[*].id
}

locals {
ooniapi_valkey_url = "valkeys://${aws_elasticache_serverless_cache.ooniapi.endpoint[0].address}:${aws_elasticache_serverless_cache.ooniapi.endpoint[0].port}"
}


resource "aws_security_group" "elasticache_sg" {
description = "Allows access to port 6379 for the cache service"
name_prefix = "ooni-elasticache"

vpc_id = module.network.vpc_id

lifecycle {
create_before_destroy = true
}
}

resource "aws_security_group_rule" "elasticache_sg_rule" {

type = "ingress"
from_port = 6379
to_port = 6379
protocol = "tcp"
cidr_blocks = concat(module.network.vpc_subnet_private[*].cidr_block, module.network.vpc_subnet_public[*].cidr_block)
security_group_id = aws_security_group.elasticache_sg.id
}

#### OONI Probe service

# For accessing the s3 bucket
Expand Down Expand Up @@ -988,6 +1039,7 @@ module "ooniapi_ooniauth" {
POSTGRESQL_URL = data.aws_ssm_parameter.oonipg_url.arn
JWT_ENCRYPTION_KEY = data.aws_ssm_parameter.jwt_secret.arn
PROMETHEUS_METRICS_PASSWORD = data.aws_ssm_parameter.prometheus_metrics_password.arn
ACCOUNT_ID_HASHING_KEY = data.aws_ssm_parameter.account_id_hashing_key.arn

AWS_SECRET_ACCESS_KEY = module.ooniapi_user.aws_secret_access_key_arn
AWS_ACCESS_KEY_ID = module.ooniapi_user.aws_access_key_id_arn
Expand Down Expand Up @@ -1026,7 +1078,7 @@ module "ooniapi_oonimeasurements_deployer" {

service_name = "oonimeasurements"
repo = "ooni/backend"
branch_name = "cusum-changepoint-api"
branch_name = "master"
trigger_path = "ooniapi/services/oonimeasurements/**"
buildspec_path = "ooniapi/services/oonimeasurements/buildspec.yml"
codestar_connection_arn = aws_codestarconnections_connection.oonidevops.arn
Expand Down Expand Up @@ -1057,13 +1109,15 @@ module "ooniapi_oonimeasurements" {
JWT_ENCRYPTION_KEY = data.aws_ssm_parameter.jwt_secret.arn
PROMETHEUS_METRICS_PASSWORD = data.aws_ssm_parameter.prometheus_metrics_password.arn
CLICKHOUSE_URL = data.aws_ssm_parameter.clickhouse_readonly_test_url.arn
ACCOUNT_ID_HASHING_KEY = data.aws_ssm_parameter.account_id_hashing_key.arn
}

task_environment = {
# it has to be a json-compliant array
OTHER_COLLECTORS = jsonencode(["http://fastpath.${local.environment}.ooni.io:8475", "https://backend-hel.ooni.org"])
BASE_URL = "https://api.${local.environment}.ooni.io"
S3_BUCKET_NAME = "ooni-data-eu-fra-test"
VALKEY_URL = local.ooniapi_valkey_url
}

ooniapi_service_security_groups = [
Expand Down
9 changes: 9 additions & 0 deletions tf/environments/prod/.terraform.lock.hcl
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

56 changes: 56 additions & 0 deletions tf/environments/prod/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,6 +238,10 @@ data "aws_ssm_parameter" "clickhouse_readonly_url" {
name = "/oonidevops/secrets/clickhouse_readonly_url"
}

data "aws_ssm_parameter" "account_id_hashing_key" {
name = "/oonidevops/secrets/ooni_services/account_id_hashing_key"
}

# Manually managed with the AWS console
data "aws_ssm_parameter" "prometheus_metrics_password" {
name = "/oonidevops/ooni_services/prometheus_metrics_password"
Expand Down Expand Up @@ -674,6 +678,55 @@ module "oonitier1plus_cluster" {

#### OONI Tier0

##### Elasticache valkey cache

resource "aws_elasticache_serverless_cache" "ooniapi" {
name = "ooniapi-${local.environment}-cache"
engine = "valkey"
cache_usage_limits {
data_storage {
maximum = 10
unit = "GB"
}
ecpu_per_second {
maximum = 5000
}
}
major_engine_version = "8"
security_group_ids = [
module.ooniapi_cluster.web_security_group_id,
aws_security_group.elasticache_sg.id
]
subnet_ids = module.network.vpc_subnet_private[*].id
}

locals {
ooniapi_valkey_url = "valkeys://${aws_elasticache_serverless_cache.ooniapi.endpoint[0].address}:${aws_elasticache_serverless_cache.ooniapi.endpoint[0].port}"
}


resource "aws_security_group" "elasticache_sg" {
description = "Allows access to port 6379 for the cache service"
name_prefix = "ooni-elasticache"

vpc_id = module.network.vpc_id

lifecycle {
create_before_destroy = true
}
}

resource "aws_security_group_rule" "elasticache_sg_rule" {

type = "ingress"
from_port = 6379
to_port = 6379
protocol = "tcp"
cidr_blocks = concat(module.network.vpc_subnet_private[*].cidr_block, module.network.vpc_subnet_public[*].cidr_block)
security_group_id = aws_security_group.elasticache_sg.id
}


#### OONI Probe service

# For accessing the s3 bucket
Expand Down Expand Up @@ -1015,6 +1068,7 @@ module "ooniapi_ooniauth" {
POSTGRESQL_URL = data.aws_ssm_parameter.oonipg_url.arn
JWT_ENCRYPTION_KEY = data.aws_ssm_parameter.jwt_secret.arn
PROMETHEUS_METRICS_PASSWORD = data.aws_ssm_parameter.prometheus_metrics_password.arn
ACCOUNT_ID_HASHING_KEY = data.aws_ssm_parameter.account_id_hashing_key.arn

AWS_SECRET_ACCESS_KEY = module.ooniapi_user.aws_secret_access_key_arn
AWS_ACCESS_KEY_ID = module.ooniapi_user.aws_access_key_id_arn
Expand Down Expand Up @@ -1086,6 +1140,7 @@ module "ooniapi_oonimeasurements" {
JWT_ENCRYPTION_KEY = data.aws_ssm_parameter.jwt_secret.arn
PROMETHEUS_METRICS_PASSWORD = data.aws_ssm_parameter.prometheus_metrics_password.arn
CLICKHOUSE_URL = data.aws_ssm_parameter.clickhouse_readonly_url.arn
ACCOUNT_ID_HASHING_KEY = data.aws_ssm_parameter.account_id_hashing_key.arn
}

task_environment = {
Expand All @@ -1096,6 +1151,7 @@ module "ooniapi_oonimeasurements" {
])
BASE_URL = "https://api.ooni.io"
S3_BUCKET_NAME = "ooni-data-eu-fra"
VALKEY_URL = local.ooniapi_valkey_url
}

ooniapi_service_security_groups = [
Expand Down
1 change: 1 addition & 0 deletions tf/modules/adm_iam_roles/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ resource "aws_iam_policy" "oonidevops" {
"autoscaling:*",
"application-autoscaling:*",
"elasticloadbalancing:*",
"elasticache:*",
"acm:*",
"cloudformation:*",
"cloudtrail:*",
Expand Down