feat(terraform): AWS Fargate deployment module

Adds a terraform/ directory with an opinionated module that deploys shared-memory to ECS Fargate behind an ALB. The module assumes the operator already provides the VPC, RDS Postgres, ACM cert, ECR images, and OIDC clients, and creates everything else: ECS cluster + services, ALB, Service Connect namespace for app-embedder discovery, EFS-backed model cache for the embedder, Secrets Manager entries, IAM roles, CloudWatch log groups, and a one-shot migrator task definition. Includes examples/basic/ with a worked invocation and a README covering prerequisites, quick start, the post-apply migrator run, image updates, DNS setup, and a security note. Main README gains a short Mode C pointer to the terraform/ guide. Validated with `terraform fmt -check -recursive` and `terraform validate` against AWS provider 5.x. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-18 09:40:12 -07:00
parent f769daa48a
commit 08be60e661
16 changed files with 1674 additions and 0 deletions
@@ -0,0 +1,100 @@
+# -----------------------------------------------------------------------------
+# Worked example for the shared-memory Terraform module.
+#
+# This config does NOT create the VPC, RDS, ACM cert, ECR repos, or OIDC
+# clients — see ../../README.md for the prerequisite checklist. Replace the
+# placeholders below with the actual IDs from your environment.
+# -----------------------------------------------------------------------------
+
+terraform {
+  required_version = "~> 1.5"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "aws" {
+  # Region inherits from AWS_REGION / AWS_PROFILE / shared-config. Set it
+  # here only if you want to pin it explicitly.
+  # region = "us-east-1"
+}
+
+module "shared_memory" {
+  source = "../../"
+
+  # ---- Identity / wiring ----
+  name_prefix        = "shared-memory-prod"
+  vpc_id             = "vpc-0123456789abcdef0"
+  public_subnet_ids  = ["subnet-aaa", "subnet-bbb"]
+  private_subnet_ids = ["subnet-ccc", "subnet-ddd"]
+
+  # ---- TLS / DNS ----
+  acm_certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/<uuid>"
+  domain_name         = "memory.example.com"
+
+  # ---- Images (push your own, then reference here) ----
+  app_image      = "123456789012.dkr.ecr.us-east-1.amazonaws.com/shared-memory-web:v0.5.0"
+  embedder_image = "123456789012.dkr.ecr.us-east-1.amazonaws.com/shared-memory-embedder:v0.5.0"
+
+  # ---- Database (external RDS) ----
+  # Format: postgres://USER:PASSWORD@HOST:5432/DBNAME
+  # Real-world: pull from `aws_secretsmanager_secret_version` or `random_password`,
+  # don't hardcode.
+  database_url = var.database_url
+
+  # ---- OIDC ----
+  oidc_issuer            = "https://auth.example.com/application/o/shared-memory/"
+  oidc_client_id_web     = var.oidc_client_id_web
+  oidc_client_secret_web = var.oidc_client_secret_web
+  oidc_client_id_mcp     = var.oidc_client_id_mcp
+  oidc_audience          = "shared-memory"
+
+  # ---- App-level secrets ----
+  # Generate with: openssl rand -base64 32
+  nextauth_secret  = var.nextauth_secret
+  cli_token_secret = var.cli_token_secret
+
+  # ---- Sizing (defaults are fine for small deployments) ----
+  app_desired_count      = 1
+  embedder_desired_count = 1
+
+  tags = {
+    environment = "prod"
+    project     = "shared-memory"
+  }
+}
+
+# ---- Sensitive inputs surfaced as vars so they live in terraform.tfvars
+#      with 0600 perms (not in this file). See ../../README.md "Security note".
+
+variable "database_url" {
+  type      = string
+  sensitive = true
+}
+
+variable "oidc_client_id_web" {
+  type = string
+}
+
+variable "oidc_client_secret_web" {
+  type      = string
+  sensitive = true
+}
+
+variable "oidc_client_id_mcp" {
+  type = string
+}
+
+variable "nextauth_secret" {
+  type      = string
+  sensitive = true
+}
+
+variable "cli_token_secret" {
+  type      = string
+  sensitive = true
+}