Skip to main content
The Lerian Terraform Foundation repository holds Terraform templates for the infrastructure that Midaz runs on: the network, the Kubernetes cluster, and the datastores. It supports AWS, GCP, and Azure. The repository uses the Apache License 2.0.

​
What the templates create

On GCP, the templates create no MongoDB-compatible database and no RabbitMQ broker. On Azure, they create no RabbitMQ broker. Provision these services yourself on those clouds.
Treat the instance classes in the example files as a starting point, not as a capacity plan. Before a production deployment, review the instance classes, storage, and connection limits against your transaction volume. Then read the important information section of the repository README.

​
AWS

On AWS, a command-line tool runs the templates. It runs each stack in order and makes sure that the live credentials match the AWS account of the environment. To install the tool and run it, follow the AWS section of the repository README. You need Terraform 1.10.0 or later, the aws CLI, and git. The deployment of one environment runs these stacks in this order:
  1. bootstrap: the state bucket and the lock table. Run it once per environment.
  2. infra-base: the VPC, then the EKS cluster.
  3. midaz: the Midaz datastores.
After the midaz stack, a separate run of the tool with --action helm-values writes a Helm values file from the stack outputs. The file contains no passwords. It references the secrets that the templates store in AWS Secrets Manager.
Amazon MQ accepts AMQPS connections only. If you write the values yourself, set RABBITMQ_URI to amqps.

​
GCP and Azure

On GCP and Azure, an interactive script runs the templates. Each component directory has its own backend.tf and midaz.tfvars files. You need Terraform and the CLI of your cloud provider: gcloud for GCP or az for Azure.
1

Create the state bucket

GCP:
Azure:
2

Configure each component

Replace the placeholders in backend.tf with your state bucket details. Then replace the placeholders in midaz.tfvars with your values.
3

Run the script

From the repository root, run:
Select the cloud provider and the action: deploy or destroy.
The script stops before it runs Terraform if a backend.tf file still contains a placeholder. It deploys every component in a fixed order and stops at the first failure. A destroy runs in the reverse order.

​
Authenticate to your cloud provider

Use the authentication tools of your cloud provider CLI instead of raw credentials:
Follow the guidance of your cloud provider: Do not commit credentials to version control.

​
Install Midaz

After the infrastructure is ready, install Midaz on the cluster with Helm. On AWS, use the values file that the tool writes. On GCP and Azure, read the endpoints with terraform output and set them in your values file. For the chart and its values, see Deploying using Helm.

​
Security tips

To keep your Midaz infrastructure secure, follow these recommendations:
  • Use private Kubernetes clusters to limit public exposure. The templates do not create a VPN.
  • Set up and enforce RBAC (Role-Based Access Control) to manage user permissions.
  • Store all secrets in the cloud provider’s secret management service.
  • Give service accounts only the permissions they need.

​
Need help?

  • Read the README inside the directory that you deploy.
  • Search the existing issues, or open a new issue.