belt 0.1.8 → 0.1.9

data/lib/belt/cli/setup_command.rb

@@ -61,7 +61,7 @@ module Belt
           exit 1
         end
 
-        # Re-resolve bucket name with account ID suffix now that we have credentials
+        # Resolve final bucket name now that we have credentials
         @bucket_name = resolve_bucket_name unless @custom_bucket
 
         @bucket_name = interactive_bucket_selection if @select_mode
@@ -142,13 +142,7 @@ module Belt
         if @custom_bucket
           @custom_bucket
         else
-          base = if @env_name
-                   "#{@app_name}-terraform-state-#{@env_name}"
-                 else
-                   "#{@app_name}-terraform-state"
-                 end
-          base = "#{base}-#{@aws_account_id}-#{@region}" if @aws_account_id
-          s3_safe_name(base)
+          'belt-terraform-state'
         end
       end
 

data/lib/belt/cli/tables_command.rb

@@ -9,6 +9,7 @@ module Belt
   module CLI
     class TablesCommand
       SCHEMA_FILE = 'infrastructure/schema.tf.rb'
+      MODULE_DIR = 'infrastructure/modules/app'
 
       include AppDetection
 
@@ -16,37 +17,32 @@ module Belt
         env = EnvResolver.resolve(args)
 
         if env.nil?
-          puts 'Usage: belt setup tables <environment>'
-          puts "\nReads schema.tf.rb and generates dynamodb.tf in the environment directory."
+          puts 'Usage: belt setup tables [environment]'
+          puts "\nReads schema.tf.rb and generates dynamodb.tf in the app module."
           puts 'You can also set BELT_ENV to skip the environment argument.'
           puts "\nExamples:"
-          puts '  belt setup tables wups'
-          puts '  belt setup tables dev01'
-          puts '  BELT_ENV=wups belt setup tables'
+          puts '  belt setup tables'
+          puts '  belt setup tables dev'
+          puts '  BELT_ENV=dev belt setup tables'
           exit 1
         end
 
         new(env).run
       end
 
-      # Automatically sync dynamodb.tf for all existing environments.
+      # Automatically sync dynamodb.tf in the app module.
       # Called by generators after updating schema.tf.rb.
       def self.sync_all_environments
         return unless File.exist?(SCHEMA_FILE)
 
-        environments = TerraformCommand.list_environments
-        return if environments.empty?
-
-        environments.each do |env|
-          new(env, quiet: true).run
-        end
+        # With the module approach, we only need to generate once into modules/app/
+        new(nil, quiet: true).run
       end
 
       def initialize(env, quiet: false)
         @env = env
         @quiet = quiet
         @app_name = detect_app_name
-        @env_dir = "infrastructure/#{@env}"
       end
 
       def run
@@ -67,11 +63,11 @@ module Belt
           abort "Error: #{SCHEMA_FILE} not found. Run `belt generate resource` first." unless @quiet
           return
         end
-        return if Dir.exist?(@env_dir)
+        return if Dir.exist?(MODULE_DIR)
 
         unless @quiet
-          abort "Error: Environment '#{@env}' not found at #{@env_dir}/.\n" \
-                "Create it with: belt generate environment #{@env}"
+          abort "Error: Module directory not found at #{MODULE_DIR}/.\n" \
+                "Run `belt new` to create a project with the correct structure."
         end
       end
 
@@ -82,7 +78,6 @@ module Belt
         schema_content = File.read(SCHEMA_FILE)
 
         # Replace DSL wrapper with direct parser call
-        # Belt.application.schema.draw do ... end → parser.instance_eval do ... end
         inner = schema_content.sub(/\A(?:Belt\.application)\.schema\.draw do\n?/, '').sub(/\n?end\s*\z/, '')
         inner.strip!
 
@@ -93,7 +88,7 @@ module Belt
       end
 
       def generate_dynamodb_tf(models)
-        dest = File.join(@env_dir, 'dynamodb.tf')
+        dest = File.join(MODULE_DIR, 'dynamodb.tf')
         existing_content = File.exist?(dest) ? File.read(dest) : nil
         new_content = render_dynamodb(models)
 
@@ -108,7 +103,7 @@ module Belt
         else
           puts "  create  #{dest}"
           puts "\n✓ Generated DynamoDB tables for #{models.size} model(s):"
-          models.each { |m| puts "    • #{table_name(m[:name])}" }
+          models.each { |m| puts "    • #{Belt::Inflector.pluralize(m[:name])}" }
           puts "\nRun `belt deploy` to create them."
         end
       end
@@ -116,7 +111,7 @@ module Belt
       def render_dynamodb(models)
         blocks = models.map { |m| render_table(m) }
         "# Auto-generated by Belt from schema.tf.rb\n" \
-          "# Do not edit manually — re-run `belt setup tables #{@env}`\n\n#{blocks.join("\n\n")}\n"
+          "# Do not edit manually — re-run `belt setup tables`\n\n#{blocks.join("\n\n")}\n"
       end
 
       def render_table(model)
@@ -142,7 +137,7 @@ module Belt
       end
 
       def table_name(model_name)
-        "#{@app_name}-#{@env}-#{Belt::Inflector.pluralize(model_name)}"
+        "#{@app_name}-${var.environment}-#{Belt::Inflector.pluralize(model_name)}"
       end
 
       # Minimal DSL parser for schema.tf.rb

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.1.8'
+  VERSION = '0.1.9'
 end

data/lib/templates/environment/backend.tf.erb

@@ -1,7 +1,7 @@
 terraform {
   backend "s3" {
-    bucket  = "<%= s3_safe_name(@app_name) %>-terraform-state"
-    key     = "<%= @env_name %>/terraform.tfstate"
+    bucket  = "belt-terraform-state"
+    key     = "<%= s3_safe_name(@app_name) %>/<%= @env_name %>/terraform.tfstate"
     region  = "us-east-1"
     encrypt = true
   }

data/lib/templates/environment/main.tf.erb

@@ -32,25 +32,21 @@ provider "conveyor-belt" {
   aws_region  = var.aws_region
 }
 
-resource "conveyor_belt" "main" {
-  provider          = conveyor-belt
-  source            = "${path.module}/../routes.tf.rb"
-  app_name          = var.app_name
-  lambda_source_dir = "${path.module}/../../lambda"
-  lambda_shared_dirs = ["controllers", "helpers", "lib", "models", "views"]
-  frontend_urls     = var.environment == "prod" ? [] : ["http://localhost:3000"]
-  friendly_errors   = var.environment != "prod"
+module "app" {
+  source = "../modules/app"
 
-  # Per-lambda configuration: env vars, timeouts, memory
-  lambda_config = {
-    api = {
-      # timeout     = 30
-      # memory_size = 256
+  app_name     = var.app_name
+  environment  = var.environment
+  aws_region   = var.aws_region
+  domain       = var.domain
+  frontend_urls = concat(
+    var.domain != "" ? ["https://${var.environment == "prod" ? var.domain : "${var.environment}.${var.domain}"}"] : [],
+    var.environment == "prod" ? [] : ["http://localhost:3000"]
+  )
 
-      env_vars = {
-        WELCOME_TITLE    = "Welcome to ${var.app_name}"
-        WELCOME_SUBTITLE = "API Gateway → Lambda → DynamoDB — all connected."
-      }
-    }
+  providers = {
+    aws           = aws
+    random        = random
+    conveyor-belt = conveyor-belt
   }
 }

data/lib/templates/environment/outputs.tf.erb

@@ -1,14 +1,39 @@
 output "api_url" {
   description = "API Gateway base URL"
-  value       = values(conveyor_belt.main.api_gateway_urls)[0]
+  value       = module.app.api_url
 }
 
 output "api_urls" {
   description = "Map of gateway names to API Gateway URLs"
-  value       = conveyor_belt.main.api_gateway_urls
+  value       = module.app.api_urls
 }
 
 output "lambda_functions" {
   description = "Map of action names to Lambda function ARNs"
-  value       = conveyor_belt.main.lambda_functions
+  value       = module.app.lambda_functions
+}
+
+output "app_domain" {
+  description = "The application domain for this environment"
+  value       = module.app.app_domain
+}
+
+output "name_servers" {
+  description = "NS records to configure at your domain registrar (only when domain is set)"
+  value       = try(module.app.name_servers, [])
+}
+
+output "frontend_bucket_name" {
+  description = "S3 bucket for frontend assets"
+  value       = try(module.app.frontend_bucket_name, "")
+}
+
+output "frontend_distribution_id" {
+  description = "CloudFront distribution ID"
+  value       = try(module.app.frontend_distribution_id, "")
+}
+
+output "frontend_url" {
+  description = "Frontend URL"
+  value       = try(module.app.frontend_url, "")
 }

data/lib/templates/environment/terraform.tfvars.erb

@@ -1 +1,6 @@
 environment = "<%= @env_name %>"
+<% if @domain && !@domain.empty? -%>
+domain      = "<%= @domain %>"
+<% else -%>
+# domain      = "myapp.com"
+<% end -%>

data/lib/templates/environment/variables.tf.erb

@@ -14,3 +14,9 @@ variable "aws_region" {
   type        = string
   default     = "us-east-1"
 }
+
+variable "domain" {
+  description = "Root domain (e.g., myapp.com). Leave empty to use default CloudFront/API Gateway URLs."
+  type        = string
+  default     = ""
+}

data/lib/templates/module/dns.tf.erb

@@ -0,0 +1,83 @@
+# DNS configuration for Belt application
+# Convention: prod → mydomain.com, other envs → <env>.mydomain.com
+
+locals {
+  # Determine the domain for this environment
+  app_domain = var.domain != "" ? (
+    var.environment == "prod" ? var.domain : "${var.environment}.${var.domain}"
+  ) : ""
+
+  # API subdomain: api.mydomain.com (prod) or api.<env>.mydomain.com (non-prod)
+  api_domain = var.domain != "" ? "api.${local.app_domain}" : ""
+
+  # Whether DNS is enabled
+  dns_enabled = var.domain != ""
+}
+
+# --- Route53 Hosted Zone ---
+# One zone per environment subdomain (or root domain for prod)
+resource "aws_route53_zone" "app" {
+  count = local.dns_enabled ? 1 : 0
+  name  = local.app_domain
+}
+
+# --- ACM Certificate ---
+# Wildcard cert covers the app domain + all subdomains (api.*, www.*, etc.)
+resource "aws_acm_certificate" "app" {
+  count                     = local.dns_enabled ? 1 : 0
+  domain_name               = local.app_domain
+  subject_alternative_names = ["*.${local.app_domain}"]
+  validation_method         = "DNS"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# DNS validation record for the certificate
+resource "aws_route53_record" "cert_validation" {
+  for_each = local.dns_enabled ? {
+    for dvo in aws_acm_certificate.app[0].domain_validation_options : dvo.domain_name => {
+      name   = dvo.resource_record_name
+      type   = dvo.resource_record_type
+      record = dvo.resource_record_value
+    }
+  } : {}
+
+  zone_id = aws_route53_zone.app[0].zone_id
+  name    = each.value.name
+  type    = each.value.type
+  ttl     = 300
+  records = [each.value.record]
+}
+
+resource "aws_acm_certificate_validation" "app" {
+  count                   = local.dns_enabled ? 1 : 0
+  certificate_arn         = aws_acm_certificate.app[0].arn
+  validation_record_fqdns = [for record in aws_route53_record.cert_validation : record.fqdn]
+}
+
+# --- API Gateway Custom Domain ---
+resource "aws_api_gateway_domain_name" "api" {
+  count                    = local.dns_enabled ? 1 : 0
+  domain_name              = local.api_domain
+  regional_certificate_arn = aws_acm_certificate_validation.app[0].certificate_arn
+
+  endpoint_configuration {
+    types = ["REGIONAL"]
+  }
+}
+
+# Route53 A record for api.<domain>
+resource "aws_route53_record" "api" {
+  count   = local.dns_enabled ? 1 : 0
+  zone_id = aws_route53_zone.app[0].zone_id
+  name    = local.api_domain
+  type    = "A"
+
+  alias {
+    name                   = aws_api_gateway_domain_name.api[0].regional_domain_name
+    zone_id                = aws_api_gateway_domain_name.api[0].regional_zone_id
+    evaluate_target_health = false
+  }
+}

data/lib/templates/module/frontend.tf.erb

@@ -0,0 +1,179 @@
+# Frontend hosting — S3 + CloudFront
+# Custom domain attached when var.domain is set
+
+resource "random_string" "frontend_suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
+# S3 bucket for frontend static assets
+resource "aws_s3_bucket" "frontend" {
+  bucket = "${var.app_name}-frontend-${var.environment}-${random_string.frontend_suffix.result}"
+
+  lifecycle {
+    ignore_changes = [bucket]
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "frontend" {
+  bucket = aws_s3_bucket.frontend.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "frontend" {
+  bucket = aws_s3_bucket.frontend.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+    bucket_key_enabled = true
+  }
+}
+
+# CloudFront OAC
+resource "aws_cloudfront_origin_access_control" "frontend" {
+  name                              = "${var.app_name}-${var.environment}-frontend-oac"
+  description                       = "OAC for frontend bucket"
+  origin_access_control_origin_type = "s3"
+  signing_behavior                  = "always"
+  signing_protocol                  = "sigv4"
+}
+
+# CloudFront distribution
+resource "aws_cloudfront_distribution" "frontend" {
+  origin {
+    domain_name              = aws_s3_bucket.frontend.bucket_regional_domain_name
+    origin_id                = "S3-${aws_s3_bucket.frontend.id}"
+    origin_access_control_id = aws_cloudfront_origin_access_control.frontend.id
+  }
+
+  enabled             = true
+  is_ipv6_enabled     = true
+  default_root_object = "index.html"
+
+  # Custom domain aliases (if DNS configured)
+  aliases = local.dns_enabled ? compact([
+    local.app_domain,
+    var.environment == "prod" ? "www.${var.domain}" : ""
+  ]) : []
+
+  default_cache_behavior {
+    allowed_methods        = ["GET", "HEAD", "OPTIONS"]
+    cached_methods         = ["GET", "HEAD"]
+    target_origin_id       = "S3-${aws_s3_bucket.frontend.id}"
+    compress               = true
+    viewer_protocol_policy = "redirect-to-https"
+
+    forwarded_values {
+      query_string = false
+      cookies {
+        forward = "none"
+      }
+    }
+  }
+
+  # SPA routing — serve index.html for 404/403
+  custom_error_response {
+    error_code         = 404
+    response_code      = 200
+    response_page_path = "/index.html"
+  }
+
+  custom_error_response {
+    error_code         = 403
+    response_code      = 200
+    response_page_path = "/index.html"
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    cloudfront_default_certificate = !local.dns_enabled
+    acm_certificate_arn            = local.dns_enabled ? aws_acm_certificate_validation.app[0].certificate_arn : null
+    ssl_support_method             = local.dns_enabled ? "sni-only" : null
+    minimum_protocol_version       = local.dns_enabled ? "TLSv1.2_2021" : null
+  }
+
+  tags = {
+    Name        = "${var.app_name}-${var.environment}-frontend"
+    Environment = var.environment
+    ManagedBy   = "Terraform"
+  }
+}
+
+# S3 bucket policy — CloudFront OAC access only
+resource "aws_s3_bucket_policy" "frontend" {
+  bucket = aws_s3_bucket.frontend.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "AllowCloudFrontServicePrincipal"
+        Effect = "Allow"
+        Principal = {
+          Service = "cloudfront.amazonaws.com"
+        }
+        Action   = "s3:GetObject"
+        Resource = "${aws_s3_bucket.frontend.arn}/*"
+        Condition = {
+          StringEquals = {
+            "AWS:SourceArn" = aws_cloudfront_distribution.frontend.arn
+          }
+        }
+      }
+    ]
+  })
+
+  depends_on = [aws_s3_bucket_public_access_block.frontend]
+}
+
+# Route53 record for frontend (app domain → CloudFront)
+resource "aws_route53_record" "frontend" {
+  count   = local.dns_enabled ? 1 : 0
+  zone_id = aws_route53_zone.app[0].zone_id
+  name    = local.app_domain
+  type    = "A"
+
+  alias {
+    name                   = aws_cloudfront_distribution.frontend.domain_name
+    zone_id                = aws_cloudfront_distribution.frontend.hosted_zone_id
+    evaluate_target_health = false
+  }
+}
+
+# www record for prod only
+resource "aws_route53_record" "frontend_www" {
+  count   = local.dns_enabled && var.environment == "prod" ? 1 : 0
+  zone_id = aws_route53_zone.app[0].zone_id
+  name    = "www.${var.domain}"
+  type    = "A"
+
+  alias {
+    name                   = aws_cloudfront_distribution.frontend.domain_name
+    zone_id                = aws_cloudfront_distribution.frontend.hosted_zone_id
+    evaluate_target_health = false
+  }
+}
+
+output "frontend_bucket_name" {
+  value = aws_s3_bucket.frontend.id
+}
+
+output "frontend_distribution_id" {
+  value = aws_cloudfront_distribution.frontend.id
+}
+
+output "frontend_url" {
+  value = local.dns_enabled ? "https://${local.app_domain}" : "https://${aws_cloudfront_distribution.frontend.domain_name}"
+}

data/lib/templates/module/main.tf.erb

@@ -0,0 +1,42 @@
+# Belt application module — defines all shared infrastructure.
+# Environments call this module with different variables.
+
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
+    conveyor-belt = {
+      source  = "stowzilla/conveyor-belt"
+      version = "~> 0.0.1"
+    }
+  }
+}
+
+resource "conveyor_belt" "main" {
+  provider = conveyor-belt
+
+  source            = "${path.module}/../../routes.tf.rb"
+  app_name          = var.app_name
+  lambda_source_dir = "${path.module}/../../../lambda"
+  lambda_shared_dirs = ["controllers", "helpers", "lib", "models", "views"]
+  frontend_urls     = var.frontend_urls
+  friendly_errors   = var.environment != "prod"
+
+  custom_domain_name = local.dns_enabled ? local.api_domain : ""
+
+  # Per-lambda configuration: env vars, timeouts, memory
+  lambda_config = {
+    api = {
+      env_vars = {
+        WELCOME_TITLE    = "Welcome to ${var.app_name}"
+        WELCOME_SUBTITLE = "API Gateway → Lambda → DynamoDB — all connected."
+      }
+    }
+  }
+}

data/lib/templates/module/outputs.tf.erb

@@ -0,0 +1,24 @@
+output "api_url" {
+  description = "API Gateway base URL (custom domain if configured, otherwise default)"
+  value       = var.domain != "" ? "https://${local.api_domain}" : values(conveyor_belt.main.api_gateway_urls)[0]
+}
+
+output "api_urls" {
+  description = "Map of gateway names to API Gateway URLs"
+  value       = conveyor_belt.main.api_gateway_urls
+}
+
+output "lambda_functions" {
+  description = "Map of action names to Lambda function ARNs"
+  value       = conveyor_belt.main.lambda_functions
+}
+
+output "app_domain" {
+  description = "The application domain for this environment"
+  value       = local.app_domain
+}
+
+output "name_servers" {
+  description = "NS records to configure at your registrar"
+  value       = local.dns_enabled ? aws_route53_zone.app[0].name_servers : []
+}

data/lib/templates/module/variables.tf.erb

@@ -0,0 +1,27 @@
+variable "app_name" {
+  description = "Name of the application"
+  type        = string
+}
+
+variable "environment" {
+  description = "Environment name (e.g., dev, prod, staging)"
+  type        = string
+}
+
+variable "aws_region" {
+  description = "AWS region"
+  type        = string
+  default     = "us-east-1"
+}
+
+variable "domain" {
+  description = "Root domain for the application (e.g., myapp.com). Leave empty to skip DNS."
+  type        = string
+  default     = ""
+}
+
+variable "frontend_urls" {
+  description = "URLs allowed for CORS frontend access"
+  type        = list(string)
+  default     = []
+}