shadowdaoandClaude Opus 4.7
08be60e661
Adds a terraform/ directory with an opinionated module that deploys shared-memory to ECS Fargate behind an ALB. The module assumes the operator already provides the VPC, RDS Postgres, ACM cert, ECR images, and OIDC clients, and creates everything else: ECS cluster + services, ALB, Service Connect namespace for app-embedder discovery, EFS-backed model cache for the embedder, Secrets Manager entries, IAM roles, CloudWatch log groups, and a one-shot migrator task definition. Includes examples/basic/ with a worked invocation and a README covering prerequisites, quick start, the post-apply migrator run, image updates, DNS setup, and a security note. Main README gains a short Mode C pointer to the terraform/ guide. Validated with `terraform fmt -check -recursive` and `terraform validate` against AWS provider 5.x. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
72 lines
2.9 KiB
Terraform
72 lines
2.9 KiB
Terraform
# -----------------------------------------------------------------------------
|
|
# Secrets Manager — one secret per value (not one big JSON blob). Task
|
|
# definitions pull these via the `secrets` block, which injects them as
|
|
# environment variables at task start. The raw values never appear in the
|
|
# task definition, only the secret ARNs.
|
|
#
|
|
# Each secret is paired with an aws_secretsmanager_secret_version so the
|
|
# initial value is populated on apply. Rotating later is the user's call:
|
|
# either re-run `terraform apply` with a new variable, or update the secret
|
|
# value out-of-band (AWS console / CLI) and the next task placement picks
|
|
# it up automatically.
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# DATABASE_URL — full postgres://user:pw@host/db connection string.
|
|
resource "aws_secretsmanager_secret" "database_url" {
|
|
name = "${var.name_prefix}/DATABASE_URL"
|
|
description = "Postgres connection URL for shared-memory app + migrator"
|
|
tags = local.tags
|
|
}
|
|
|
|
resource "aws_secretsmanager_secret_version" "database_url" {
|
|
secret_id = aws_secretsmanager_secret.database_url.id
|
|
secret_string = var.database_url
|
|
}
|
|
|
|
# NEXTAUTH_SECRET — Auth.js cookie signing.
|
|
resource "aws_secretsmanager_secret" "nextauth_secret" {
|
|
name = "${var.name_prefix}/NEXTAUTH_SECRET"
|
|
description = "Auth.js session cookie HMAC key"
|
|
tags = local.tags
|
|
}
|
|
|
|
resource "aws_secretsmanager_secret_version" "nextauth_secret" {
|
|
secret_id = aws_secretsmanager_secret.nextauth_secret.id
|
|
secret_string = var.nextauth_secret
|
|
}
|
|
|
|
# CLI_TOKEN_SECRET — HMAC for /connect-minted bearer tokens.
|
|
resource "aws_secretsmanager_secret" "cli_token_secret" {
|
|
name = "${var.name_prefix}/CLI_TOKEN_SECRET"
|
|
description = "HMAC key for shared-memory CLI bearer tokens"
|
|
tags = local.tags
|
|
}
|
|
|
|
resource "aws_secretsmanager_secret_version" "cli_token_secret" {
|
|
secret_id = aws_secretsmanager_secret.cli_token_secret.id
|
|
secret_string = var.cli_token_secret
|
|
}
|
|
|
|
# OIDC_CLIENT_SECRET_WEB — confidential client secret for the Web UI.
|
|
resource "aws_secretsmanager_secret" "oidc_client_secret_web" {
|
|
name = "${var.name_prefix}/OIDC_CLIENT_SECRET_WEB"
|
|
description = "OIDC confidential client secret for the Web UI"
|
|
tags = local.tags
|
|
}
|
|
|
|
resource "aws_secretsmanager_secret_version" "oidc_client_secret_web" {
|
|
secret_id = aws_secretsmanager_secret.oidc_client_secret_web.id
|
|
secret_string = var.oidc_client_secret_web
|
|
}
|
|
|
|
# Convenience map — used in outputs and to feed the task execution role
|
|
# policy with the exact ARNs it needs to decrypt.
|
|
locals {
|
|
secret_arns = {
|
|
DATABASE_URL = aws_secretsmanager_secret.database_url.arn
|
|
NEXTAUTH_SECRET = aws_secretsmanager_secret.nextauth_secret.arn
|
|
CLI_TOKEN_SECRET = aws_secretsmanager_secret.cli_token_secret.arn
|
|
OIDC_CLIENT_SECRET_WEB = aws_secretsmanager_secret.oidc_client_secret_web.arn
|
|
}
|
|
}
|