shadowdaoandClaude Opus 4.7
08be60e661
Adds a terraform/ directory with an opinionated module that deploys shared-memory to ECS Fargate behind an ALB. The module assumes the operator already provides the VPC, RDS Postgres, ACM cert, ECR images, and OIDC clients, and creates everything else: ECS cluster + services, ALB, Service Connect namespace for app-embedder discovery, EFS-backed model cache for the embedder, Secrets Manager entries, IAM roles, CloudWatch log groups, and a one-shot migrator task definition. Includes examples/basic/ with a worked invocation and a README covering prerequisites, quick start, the post-apply migrator run, image updates, DNS setup, and a security note. Main README gains a short Mode C pointer to the terraform/ guide. Validated with `terraform fmt -check -recursive` and `terraform validate` against AWS provider 5.x. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
37 lines
1.3 KiB
Terraform
37 lines
1.3 KiB
Terraform
# -----------------------------------------------------------------------------
|
|
# shared-memory — AWS Fargate deployment module
|
|
#
|
|
# Deploys the three runtime components (app, embedder, migrator) as ECS
|
|
# tasks behind an internet-facing ALB. The user is responsible for the VPC,
|
|
# RDS Postgres, ACM cert, ECR images, and OIDC clients (see README).
|
|
#
|
|
# Region is inherited from the configured AWS provider — do not hardcode.
|
|
# -----------------------------------------------------------------------------
|
|
|
|
data "aws_region" "current" {}
|
|
data "aws_caller_identity" "current" {}
|
|
|
|
locals {
|
|
# Merged tag set applied to every resource in the module. Callers can pin
|
|
# cost-allocation tags / environment markers via var.tags.
|
|
tags = merge(
|
|
{
|
|
"managed-by" = "terraform"
|
|
"module" = "shared-memory"
|
|
},
|
|
var.tags,
|
|
)
|
|
|
|
# Public URL is the canonical external origin — feeds PUBLIC_URL, AUTH_URL,
|
|
# and OIDC redirect URIs alike.
|
|
public_url = "https://${var.domain_name}"
|
|
|
|
# Service Connect namespace name. One per module instance so multiple
|
|
# deployments (e.g. staging + prod in one cluster) don't collide.
|
|
service_connect_namespace = "${var.name_prefix}.internal"
|
|
|
|
# Port constants — keep these aligned with the Dockerfiles.
|
|
app_port = 3000
|
|
embedder_port = 8080
|
|
}
|