Files

T

shadowdaoandClaude Opus 4.7 08be60e661 feat(terraform): AWS Fargate deployment module

Adds a terraform/ directory with an opinionated module that deploys
shared-memory to ECS Fargate behind an ALB. The module assumes the
operator already provides the VPC, RDS Postgres, ACM cert, ECR images,
and OIDC clients, and creates everything else: ECS cluster + services,
ALB, Service Connect namespace for app-embedder discovery, EFS-backed
model cache for the embedder, Secrets Manager entries, IAM roles,
CloudWatch log groups, and a one-shot migrator task definition.

Includes examples/basic/ with a worked invocation and a README covering
prerequisites, quick start, the post-apply migrator run, image updates,
DNS setup, and a security note. Main README gains a short Mode C
pointer to the terraform/ guide.

Validated with `terraform fmt -check -recursive` and
`terraform validate` against AWS provider 5.x.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-18 09:40:12 -07:00

2.0 KiB

Raw Permalink Blame History

Basic example — shared-memory on AWS Fargate

Minimal invocation of ../../. Fill in your real IDs and run.

Prereqs

Before you terraform apply, you need (see the module README for the long version):

A VPC with two public + two private subnets
An RDS Postgres ≥ 15.5 instance with pgvector, pg_trgm, pgcrypto available (or creatable by the migrator on first run)
An ACM certificate in the same region as the ALB, covering domain_name
ECR repos populated with images for apps/web and apps/embedder
OIDC clients registered (web confidential + MCP public/PKCE)

Configure

Open main.tf and replace the placeholder vpc-… / subnet-… / arn:aws:acm:… / image URIs with your real values.

Create terraform.tfvars with the sensitive inputs and chmod it:

umask 077
cat > terraform.tfvars <<EOF
database_url            = "postgres://memory:CHANGEME@my-rds-host.us-east-1.rds.amazonaws.com:5432/memory"
oidc_client_id_web      = "abc123…"
oidc_client_secret_web  = "secretvalue"
oidc_client_id_mcp      = "def456…"
nextauth_secret         = "$(openssl rand -base64 32)"
cli_token_secret        = "$(openssl rand -base64 32)"
EOF
chmod 600 terraform.tfvars

Apply

terraform init
terraform plan -out plan.out
terraform apply plan.out

Post-apply

Open the module README for the migrator aws ecs run-task invocation and the DNS setup.

The shortcut, using outputs from this directory:

CLUSTER=$(terraform output -raw ecs_cluster_name)
FAMILY=$(terraform output -raw migrator_task_definition_family)
SG=$(terraform output -raw migrator_security_group_id)
SUBNETS=$(terraform output -json private_subnet_ids | jq -r 'join(",")')

aws ecs run-task \
  --cluster "$CLUSTER" \
  --task-definition "$FAMILY" \
  --launch-type FARGATE \
  --network-configuration "awsvpcConfiguration={subnets=[$SUBNETS],securityGroups=[$SG],assignPublicIp=DISABLED}"

2.0 KiB Raw Permalink Blame History