openhands-infrastructure.tf

# OpenHands Isolated AWS Infrastructure - Terraform Configuration
# This template creates a secure, isolated environment for OpenHands with LLM-only access

terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# Variables
variable "aws_region" {
  description = "AWS region for deployment"
  type        = string
  default     = "us-west-2"
}

variable "your_ip_cidr" {
  description = "Your IP address in CIDR format for access"
  type        = string
  # Get your IP: curl ifconfig.me
  validation {
    condition     = can(cidrhost(var.your_ip_cidr, 0))
    error_message = "Must be a valid CIDR block (e.g., 1.2.3.4/32)."
  }
}

variable "llm_endpoint_url" {
  description = "LLM endpoint URL"
  type        = string
  default     = "https://api.openai.com"
}

variable "key_pair_name" {
  description = "AWS key pair name for EC2 instances"
  type        = string
}

variable "environment" {
  description = "Environment name"
  type        = string
  default     = "production"
}

variable "project_name" {
  description = "Project name for resource naming"
  type        = string
  default     = "openhands"
}

# Provider configuration
provider "aws" {
  region = var.aws_region

  default_tags {
    tags = {
      Project     = var.project_name
      Environment = var.environment
      ManagedBy   = "Terraform"
      Purpose     = "OpenHands-Isolated-Environment"
    }
  }
}

# Data sources
data "aws_availability_zones" "available" {
  state = "available"
}

data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"] # Canonical

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-22.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

# VPC
resource "aws_vpc" "openhands_vpc" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name = "${var.project_name}-isolated-vpc"
  }
}

# Internet Gateway
resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.openhands_vpc.id

  tags = {
    Name = "${var.project_name}-igw"
  }
}

# Public Subnet
resource "aws_subnet" "public_subnet" {
  vpc_id                  = aws_vpc.openhands_vpc.id
  cidr_block              = "10.0.0.0/24"
  availability_zone       = data.aws_availability_zones.available.names[0]
  map_public_ip_on_launch = true

  tags = {
    Name = "${var.project_name}-public-subnet"
    Type = "Public"
  }
}

# Private Subnet
resource "aws_subnet" "private_subnet" {
  vpc_id            = aws_vpc.openhands_vpc.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = data.aws_availability_zones.available.names[0]

  tags = {
    Name = "${var.project_name}-private-subnet"
    Type = "Private"
  }
}

# Elastic IP for NAT Gateway
resource "aws_eip" "nat_eip" {
  domain = "vpc"
  depends_on = [aws_internet_gateway.igw]

  tags = {
    Name = "${var.project_name}-nat-eip"
  }
}

# NAT Gateway
resource "aws_nat_gateway" "nat_gw" {
  allocation_id = aws_eip.nat_eip.id
  subnet_id     = aws_subnet.public_subnet.id

  tags = {
    Name = "${var.project_name}-nat-gateway"
  }

  depends_on = [aws_internet_gateway.igw]
}

# Route Table for Public Subnet
resource "aws_route_table" "public_rt" {
  vpc_id = aws_vpc.openhands_vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }

  tags = {
    Name = "${var.project_name}-public-rt"
  }
}

# Route Table for Private Subnet
resource "aws_route_table" "private_rt" {
  vpc_id = aws_vpc.openhands_vpc.id

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.nat_gw.id
  }

  tags = {
    Name = "${var.project_name}-private-rt"
  }
}

# Route Table Associations
resource "aws_route_table_association" "public_rta" {
  subnet_id      = aws_subnet.public_subnet.id
  route_table_id = aws_route_table.public_rt.id
}

resource "aws_route_table_association" "private_rta" {
  subnet_id      = aws_subnet.private_subnet.id
  route_table_id = aws_route_table.private_rt.id
}

# Security Group for Web Proxy
resource "aws_security_group" "web_proxy_sg" {
  name_prefix = "${var.project_name}-web-proxy-"
  description = "Security group for OpenHands web proxy"
  vpc_id      = aws_vpc.openhands_vpc.id

  # SSH access
  ingress {
    description = "SSH access"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [var.your_ip_cidr]
  }

  # HTTP access
  ingress {
    description = "HTTP access"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = [var.your_ip_cidr]
  }

  # HTTPS access
  ingress {
    description = "HTTPS access"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = [var.your_ip_cidr]
  }

  # SSH to private subnet
  egress {
    description = "SSH to private subnet"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.1.0/24"]
  }

  # OpenHands web interface
  egress {
    description = "OpenHands web interface"
    from_port   = 3000
    to_port     = 3000
    protocol    = "tcp"
    cidr_blocks = ["10.0.1.0/24"]
  }

  # HTTPS outbound for updates and certificates
  egress {
    description = "HTTPS outbound"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # HTTP outbound for updates
  egress {
    description = "HTTP outbound"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # DNS
  egress {
    description = "DNS"
    from_port   = 53
    to_port     = 53
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # NTP
  egress {
    description = "NTP"
    from_port   = 123
    to_port     = 123
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${var.project_name}-web-proxy-sg"
  }

  lifecycle {
    create_before_destroy = true
  }
}

# Security Group for OpenHands Server
resource "aws_security_group" "openhands_server_sg" {
  name_prefix = "${var.project_name}-server-"
  description = "Security group for isolated OpenHands server"
  vpc_id      = aws_vpc.openhands_vpc.id

  # SSH from web proxy
  ingress {
    description     = "SSH from web proxy"
    from_port       = 22
    to_port         = 22
    protocol        = "tcp"
    security_groups = [aws_security_group.web_proxy_sg.id]
  }

  # OpenHands web interface from proxy
  ingress {
    description     = "OpenHands web interface"
    from_port       = 3000
    to_port         = 3000
    protocol        = "tcp"
    security_groups = [aws_security_group.web_proxy_sg.id]
  }

  # HTTPS outbound (restricted by iptables)
  egress {
    description = "HTTPS outbound"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # HTTP outbound (restricted by iptables)
  egress {
    description = "HTTP outbound"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # DNS to VPC resolver
  egress {
    description = "DNS to VPC"
    from_port   = 53
    to_port     = 53
    protocol    = "udp"
    cidr_blocks = ["10.0.0.0/16"]
  }

  # NTP
  egress {
    description = "NTP"
    from_port   = 123
    to_port     = 123
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${var.project_name}-server-sg"
  }

  lifecycle {
    create_before_destroy = true
  }
}

# Network ACL for Private Subnet (Additional Security Layer)
resource "aws_network_acl" "private_nacl" {
  vpc_id     = aws_vpc.openhands_vpc.id
  subnet_ids = [aws_subnet.private_subnet.id]

  # Allow SSH from public subnet
  ingress {
    rule_no    = 100
    protocol   = "tcp"
    from_port  = 22
    to_port    = 22
    cidr_block = "10.0.0.0/24"
    action     = "allow"
  }

  # Allow OpenHands web interface from public subnet
  ingress {
    rule_no    = 110
    protocol   = "tcp"
    from_port  = 3000
    to_port    = 3000
    cidr_block = "10.0.0.0/24"
    action     = "allow"
  }

  # Allow return traffic
  ingress {
    rule_no    = 200
    protocol   = "tcp"
    from_port  = 1024
    to_port    = 65535
    cidr_block = "0.0.0.0/0"
    action     = "allow"
  }

  # Allow HTTPS outbound
  egress {
    rule_no    = 100
    protocol   = "tcp"
    from_port  = 443
    to_port    = 443
    cidr_block = "0.0.0.0/0"
    action     = "allow"
  }

  # Allow HTTP outbound
  egress {
    rule_no    = 110
    protocol   = "tcp"
    from_port  = 80
    to_port    = 80
    cidr_block = "0.0.0.0/0"
    action     = "allow"
  }

  # Allow DNS
  egress {
    rule_no    = 200
    protocol   = "udp"
    from_port  = 53
    to_port    = 53
    cidr_block = "10.0.0.0/16"
    action     = "allow"
  }

  # Allow NTP
  egress {
    rule_no    = 210
    protocol   = "udp"
    from_port  = 123
    to_port    = 123
    cidr_block = "0.0.0.0/0"
    action     = "allow"
  }

  # Allow SSH to public subnet
  egress {
    rule_no    = 300
    protocol   = "tcp"
    from_port  = 22
    to_port    = 22
    cidr_block = "10.0.0.0/24"
    action     = "allow"
  }

  # Allow OpenHands responses to public subnet
  egress {
    rule_no    = 310
    protocol   = "tcp"
    from_port  = 3000
    to_port    = 3000
    cidr_block = "10.0.0.0/24"
    action     = "allow"
  }

  # Allow ephemeral ports
  egress {
    rule_no    = 400
    protocol   = "tcp"
    from_port  = 1024
    to_port    = 65535
    cidr_block = "0.0.0.0/0"
    action     = "allow"
  }

  tags = {
    Name = "${var.project_name}-private-nacl"
  }
}

# User Data Templates
locals {
  web_proxy_user_data = base64encode(templatefile("${path.module}/scripts/web-proxy-userdata.sh", {
    project_name = var.project_name
  }))

  openhands_server_user_data = base64encode(templatefile("${path.module}/scripts/openhands-server-userdata.sh", {
    project_name    = var.project_name
    llm_endpoint    = var.llm_endpoint_url
  }))
}

# Web Proxy Instance
resource "aws_instance" "web_proxy" {
  ami                    = data.aws_ami.ubuntu.id
  instance_type          = "t3.small"
  key_name              = var.key_pair_name
  subnet_id             = aws_subnet.public_subnet.id
  vpc_security_group_ids = [aws_security_group.web_proxy_sg.id]

  user_data = local.web_proxy_user_data

  root_block_device {
    volume_type = "gp3"
    volume_size = 20
    encrypted   = true
  }

  tags = {
    Name = "${var.project_name}-web-proxy"
    Role = "WebProxy"
  }
}

# OpenHands Server Instance
resource "aws_instance" "openhands_server" {
  ami                    = data.aws_ami.ubuntu.id
  instance_type          = "t3.large"
  key_name              = var.key_pair_name
  subnet_id             = aws_subnet.private_subnet.id
  vpc_security_group_ids = [aws_security_group.openhands_server_sg.id]

  user_data = local.openhands_server_user_data

  root_block_device {
    volume_type = "gp3"
    volume_size = 50
    encrypted   = true
  }

  tags = {
    Name = "${var.project_name}-server"
    Role = "OpenHandsServer"
  }
}

# CloudWatch Log Groups
resource "aws_cloudwatch_log_group" "openhands_logs" {
  name              = "/aws/ec2/${var.project_name}-server"
  retention_in_days = 30

  tags = {
    Name = "${var.project_name}-logs"
  }
}

resource "aws_cloudwatch_log_group" "web_proxy_logs" {
  name              = "/aws/ec2/${var.project_name}-web-proxy"
  retention_in_days = 30

  tags = {
    Name = "${var.project_name}-web-proxy-logs"
  }
}

# Outputs
output "web_proxy_public_ip" {
  description = "Public IP address of the web proxy"
  value       = aws_instance.web_proxy.public_ip
}

output "web_proxy_public_dns" {
  description = "Public DNS name of the web proxy"
  value       = aws_instance.web_proxy.public_dns
}

output "openhands_server_private_ip" {
  description = "Private IP address of the OpenHands server"
  value       = aws_instance.openhands_server.private_ip
}

output "vpc_id" {
  description = "ID of the VPC"
  value       = aws_vpc.openhands_vpc.id
}

output "public_subnet_id" {
  description = "ID of the public subnet"
  value       = aws_subnet.public_subnet.id
}

output "private_subnet_id" {
  description = "ID of the private subnet"
  value       = aws_subnet.private_subnet.id
}

output "web_proxy_security_group_id" {
  description = "ID of the web proxy security group"
  value       = aws_security_group.web_proxy_sg.id
}

output "openhands_server_security_group_id" {
  description = "ID of the OpenHands server security group"
  value       = aws_security_group.openhands_server_sg.id
}

output "access_instructions" {
  description = "Instructions for accessing the OpenHands interface"
  value = <<-EOT
    1. SSH to web proxy: ssh -i ${var.key_pair_name}.pem ubuntu@${aws_instance.web_proxy.public_ip}
    2. Update Nginx config: sudo /root/update_openhands_ip.sh ${aws_instance.openhands_server.private_ip}
    3. SSH to OpenHands server: ssh openhands@${aws_instance.openhands_server.private_ip}
    4. Set API key and start service
    5. Access web interface: https://${aws_instance.web_proxy.public_ip}
  EOT
}