belt 0.3.28 → 0.3.30

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d392dbd28d642a7f18a3087e8640ef1382b5da70199804a77232b99f365a6822
-  data.tar.gz: 791f51d17d764ada25f3ce6395a141d02f3b1474556df4299067b78726b1db3c
+  metadata.gz: 79ffa332a2eb6408d42c4652d1643009edac470adb6eabbcb9e6818286276977
+  data.tar.gz: 145edae1f0f725c16232a648d64ad3224ac93baca18273648b901e7d4ef6ad66
 SHA512:
-  metadata.gz: bc6051c477ad262a13029781cb3a12a8df262a8d3a94d9a5f8a98b3adcb379d8c4f0d761244144cac8c69a37abbf7d3a5eba88fb3b7a7f2ba21a1cc41e77e196
-  data.tar.gz: b6470146bd1920c26462f8b37279eda6c35a92f5a184e37e2171d1015e2d694ac7e5b6b07b2a34cc7bd40f1af8464d891ae4f75d9808c8ee0af956e618aa494e
+  metadata.gz: '09e7a47ed0e3d34e699cbd2e1c14785399015ea66cde8b21dfd194e86d09456df246da0363e0bc0e543ad06129938376c148e87edc6885b0b6c9d94645ffdcd3'
+  data.tar.gz: 16ec119be87259081c896497229cf3202901c3657ac4aea2f3e47e05ff3976d7130e23a99dcdf1c85b80f8d386243878e0acccd4bc9cb721b0ca8d8e189e4122

data/lib/belt/cli/destroy_command.rb

@@ -194,6 +194,26 @@ module Belt
           exit 1
         end
 
+        # Check if any environments are nested under this one
+        nested_children = find_nested_children(@name)
+        if nested_children.any?
+          puts "⚠  The following environments are nested under '#{@name}':"
+          nested_children.each { |child| puts "     - #{child}" }
+          puts ''
+          puts '   Destroying the parent will leave them with broken DNS references.'
+          puts '   Consider destroying nested environments first:'
+          nested_children.each { |child| puts "     belt destroy environment #{child}" }
+          puts ''
+          unless @force
+            print '   Continue anyway? [y/N] '
+            response = $stdin.gets&.strip&.downcase
+            unless response&.start_with?('y')
+              puts 'Cancelled.'
+              exit 0
+            end
+          end
+        end
+
         # Check if terraform state exists (infra may still be live)
         if !@skip_terraform && terraform_state_exists?(dir)
           puts "⚠  Environment '#{@name}' appears to have active infrastructure."
@@ -236,6 +256,24 @@ module Belt
         @removed << dir
         puts "  remove  #{dir}/"
         puts "\n✓ Environment '#{@name}' destroyed!"
+
+        # Check if DNS delegation exists and warn about cleanup
+        warn_about_dns_delegation(@name)
+      end
+
+      def find_nested_children(env_name)
+        nested_children = []
+        Dir.glob('infrastructure/*/terraform.tfvars').each do |tfvars_file|
+          next if tfvars_file.include?('/dns/')
+          next if tfvars_file.include?('/modules/')
+
+          content = File.read(tfvars_file)
+          next unless content =~ /^\s*parent_environment\s*=\s*"#{Regexp.escape(env_name)}"/
+
+          child_env = File.basename(File.dirname(tfvars_file))
+          nested_children << child_env
+        end
+        nested_children
       end
 
       def terraform_state_exists?(dir)
@@ -258,6 +296,62 @@ module Belt
         true
       end
 
+      def warn_about_dns_delegation(env_name)
+        # Check if this is a nested environment (DNS records are in parent's zone, handled by terraform)
+        tfvars_file = "infrastructure/#{env_name}/terraform.tfvars"
+        if File.exist?(tfvars_file)
+          tfvars_content = File.read(tfvars_file)
+          if tfvars_content =~ /^\s*parent_environment\s*=\s*"([^"]+)"/
+            parent_env = ::Regexp.last_match(1)
+            puts ''
+            puts "ℹ  This was a nested environment under '#{parent_env}'."
+            puts '   The DNS A record in the parent zone was deleted by terraform destroy.'
+            return
+          end
+        end
+
+        # Check if any other environments are nested under this one
+        warn_about_nested_children(env_name)
+
+        # Check for standalone environment DNS delegation
+        dns_tfvars = 'infrastructure/dns/terraform.tfvars'
+        return unless File.exist?(dns_tfvars)
+
+        content = File.read(dns_tfvars)
+        # Only match a real HCL entry (e.g. "  dev = [") at the start of a line,
+        # not the commented-out examples in the tfvars template (e.g. "#   dev = [").
+        # This mirrors the anchored patterns DNSCommand uses when writing entries.
+        return unless content =~ /^\s*#{Regexp.escape(env_name)}\s*=/
+
+        puts ''
+        puts '⚠  DNS delegation still exists for this environment.'
+        puts '   To clean up the root zone delegation:'
+        puts ''
+        puts "     belt dns remove #{env_name}"
+        puts '     belt dns deploy'
+      end
+
+      def warn_about_nested_children(env_name)
+        nested_children = []
+        Dir.glob('infrastructure/*/terraform.tfvars').each do |tfvars_file|
+          next if tfvars_file.include?('/dns/')
+
+          content = File.read(tfvars_file)
+          next unless content =~ /^\s*parent_environment\s*=\s*"#{Regexp.escape(env_name)}"/
+
+          child_env = File.basename(File.dirname(tfvars_file))
+          nested_children << child_env
+        end
+
+        return if nested_children.empty?
+
+        puts ''
+        puts '⚠  The following environments were nested under this one:'
+        nested_children.each { |child| puts "     - #{child}" }
+        puts '   They may have dangling DNS references. Consider destroying them first,'
+        puts '   or manually cleaning up their Route53 records.'
+      end
+
       def run_terraform_destroy(dir)
         puts "\n━━━ terraform destroy (#{@name}) ━━━"
 

data/lib/belt/cli/dns_command.rb

@@ -25,6 +25,8 @@ module Belt
           new.generate(args)
         when 'add'
           new.add_environment(args)
+        when 'remove', 'rm'
+          new.remove_environment(args)
         when 'show', 'list'
           new.show(args)
         when '--help', '-h', 'help'
@@ -43,6 +45,7 @@ module Belt
             deploy              Deploy the dns infrastructure (init → plan → apply)
             generate            Create the infrastructure/dns directory (same as belt generate dns)
             add <env>           Add an environment's NS records to dns/terraform.tfvars
+            remove <env>        Remove an environment's NS records from dns/terraform.tfvars
             show                Show root zone name servers (for registrar configuration)
             help                Show this help
 
@@ -55,6 +58,7 @@ module Belt
             belt dns generate               # Scaffold infrastructure/dns (prompts for profile)
             belt dns generate --aws-profile fpshared  # Non-interactive with profile
             belt dns add staging            # Add staging's NS records to tfvars
+            belt dns remove staging         # Remove staging's NS delegation
             belt dns show                   # Show root name servers to configure at registrar
 
           The dns directory manages your root domain and delegates subdomains to
@@ -67,6 +71,11 @@ module Belt
             3. belt dns add dev             # Add dev's NS records
             4. belt dns deploy              # Deploy root zone
             5. Update registrar NS records to output values
+
+          When destroying an environment:
+            1. belt destroy environment dev # Destroy the environment
+            2. belt dns remove dev          # Remove DNS delegation
+            3. belt dns deploy              # Apply the change
         HELP
       end
 
@@ -208,6 +217,37 @@ module Belt
         puts "\nRun 'belt dns deploy' to apply the changes."
       end
 
+      # --- Remove Environment ---
+      def remove_environment(args)
+        env_name = args.shift
+
+        if env_name.nil? || env_name.start_with?('-')
+          puts 'Usage: belt dns remove <env>'
+          puts "\nExample: belt dns remove staging"
+          exit 1
+        end
+
+        tfvars_path = "#{DNS_DIR}/terraform.tfvars"
+        unless File.exist?(tfvars_path)
+          puts "#{tfvars_path} not found."
+          puts "\nNo DNS infrastructure to modify."
+          exit 1
+        end
+
+        content = File.read(tfvars_path)
+
+        # Check if the environment exists in the tfvars
+        unless content.include?("#{env_name} =")
+          puts "Environment '#{env_name}' not found in #{tfvars_path}."
+          puts "\nNothing to remove."
+          exit 0
+        end
+
+        remove_env_from_tfvars(tfvars_path, env_name)
+        puts "✓ Removed #{env_name} NS records from #{tfvars_path}"
+        puts "\nRun 'belt dns deploy' to apply the changes."
+      end
+
       # --- Show ---
       def show(_args)
         require 'open3'
@@ -399,6 +439,31 @@ module Belt
         File.write(path, content)
       end
 
+      def remove_env_from_tfvars(path, env_name)
+        content = File.read(path)
+
+        # Match the environment entry: "  env_name = [\n    ...\n  ]" with optional trailing comma
+        # The entry can be followed by another entry, a closing brace, or whitespace
+        #
+        # Pattern breakdown:
+        # - ^(\s*)#{env_name}\s*= matches "  env_name =" at start of line
+        # - \s*\[\s* matches " [" with optional whitespace
+        # - [^\]]* matches everything inside brackets (the NS records)
+        # - \]\s*,?\s* matches "]" with optional trailing comma and whitespace
+        # - (?=\n|\s*[}\w]) lookahead for newline or closing brace/next entry
+        entry_pattern = /^\s*#{Regexp.escape(env_name)}\s*=\s*\[[^\]]*\]\s*,?\s*\n?/m
+
+        content.gsub!(entry_pattern, '')
+
+        # Clean up any double newlines that may have been created
+        content.gsub!(/\n{3,}/, "\n\n")
+
+        # If the environment_zones block is now empty (just whitespace), clean it up
+        content.gsub!(/^environment_zones\s*=\s*\{\s*\n\s*\}/, 'environment_zones = {}')
+
+        File.write(path, content)
+      end
+
       # Resolve the state bucket name to use in backend.tf.
       # Priority: existing sibling backend.tf → AWS account ID → bare placeholder.
       def resolve_state_bucket

data/lib/belt/cli/environment_command.rb

@@ -3,6 +3,7 @@
 require 'fileutils'
 require 'erb'
 require_relative 'app_detection'
+require_relative 'environment_config'
 require_relative 'frontend_registry'
 require_relative 'frontend_setup_command'
 
@@ -15,26 +16,49 @@ module Belt
 
       def self.run(args)
         env_name = args.shift
+        parent_env = args.shift # Optional: parent environment for nested subdomains
 
         if env_name.nil? || env_name.empty?
-          puts 'Usage: belt generate environment <name>'
+          puts 'Usage: belt generate environment <name> [parent]'
           puts "\nExamples:"
           puts '  belt generate environment dev01'
           puts '  belt generate environment staging'
           puts '  belt generate environment prod'
+          puts ''
+          puts 'Nested environments (subdomain of existing environment):'
+          puts '  belt generate environment fizzy123 dev'
+          puts '    → Creates fizzy123.dev.example.com using dev\'s wildcard cert'
           exit 1
         end
 
-        new(env_name).generate
+        # Validate parent environment exists if provided
+        if parent_env && !parent_env.empty?
+          parent_dir = "infrastructure/#{parent_env}"
+          unless Dir.exist?(parent_dir)
+            puts "✗ Parent environment '#{parent_env}' not found at #{parent_dir}/"
+            puts '  The parent environment must exist before creating a nested environment.'
+            exit 1
+          end
+        end
+
+        new(env_name, parent_environment: parent_env).generate
       end
 
-      def initialize(env_name, quiet: false, domain: nil, announce: true)
+      def initialize(env_name, quiet: false, domain: nil, announce: true, parent_environment: nil)
         @env_name = env_name.downcase.gsub(/[^a-z0-9_-]/, '')
         @app_name = detect_app_name
-        @domain = domain
         @quiet = quiet
         @announce = announce
+        @parent_environment = parent_environment&.downcase&.gsub(/[^a-z0-9_-]/, '')
         @state_bucket = resolve_state_bucket
+
+        # For nested envs, inherit domain and aws_profile from parent
+        if @parent_environment
+          load_parent_config
+          @domain = domain || @parent_domain
+        else
+          @domain = domain
+        end
       end
 
       def generate
@@ -46,6 +70,7 @@ module Belt
         end
 
         puts "Creating environment: #{@env_name}" unless @quiet
+        puts "  (nested under #{@parent_environment})" if @parent_environment && !@quiet
         FileUtils.mkdir_p(dest_dir)
 
         templates.each do |template_name, dest_file|
@@ -54,19 +79,40 @@ module Belt
           puts "  create  #{dest_path}" unless @quiet
         end
 
+        # Generate belt.rb if we have an inherited aws_profile
+        if @parent_aws_profile
+          belt_rb_path = File.join(dest_dir, 'belt.rb')
+          write_belt_rb(belt_rb_path)
+          puts "  create  #{belt_rb_path}" unless @quiet
+        end
+
         append_extra_frontend_outputs(File.join(dest_dir, 'outputs.tf'))
 
         return if @quiet || !@announce
 
         puts "\n✓ Environment '#{@env_name}' created!"
-        puts "\nReview your settings in #{dest_dir}/terraform.tfvars:"
-        puts '  environment = "..."   # environment name (defaults to directory name)'
-        puts '  domain      = "..."   # your domain (e.g., "myapp.com")'
-        puts "\nThen deploy:"
-        puts "  belt deploy #{@env_name}"
-        puts "\nIf using multiple environments with a custom domain, run:"
-        puts '  belt dns generate'
-        puts 'to manage root domain delegation to per-environment zones.'
+
+        if @parent_environment
+          puts "\nThis is a nested environment under '#{@parent_environment}'."
+          puts "It will use the parent's wildcard certificate and hosted zone."
+          if @domain
+            puts "Domain will be: api.#{@env_name}.#{@parent_environment}.#{@domain}"
+          else
+            puts "Domain will be: #{@env_name}.#{@parent_environment}.<your-domain>"
+          end
+          puts "\nDeploy with:"
+          puts "  belt deploy #{@env_name}"
+          puts "\nNo DNS delegation needed — the parent environment handles DNS."
+        else
+          puts "\nReview your settings in #{dest_dir}/terraform.tfvars:"
+          puts '  environment = "..."   # environment name (defaults to directory name)'
+          puts '  domain      = "..."   # your domain (e.g., "myapp.com")'
+          puts "\nThen deploy:"
+          puts "  belt deploy #{@env_name}"
+          puts "\nIf using multiple environments with a custom domain, run:"
+          puts '  belt dns generate'
+          puts 'to manage root domain delegation to per-environment zones.'
+        end
       end
 
       private
@@ -101,6 +147,35 @@ module Belt
         bucket_from_sibling || bucket_from_aws || 'belt-terraform-state'
       end
 
+      # Load domain and aws_profile from parent environment for nested envs
+      def load_parent_config
+        parent_dir = "infrastructure/#{@parent_environment}"
+
+        # Load domain from parent's terraform.tfvars
+        tfvars_path = File.join(parent_dir, 'terraform.tfvars')
+        if File.exist?(tfvars_path)
+          content = File.read(tfvars_path)
+          domain_match = content.match(/^\s*domain\s*=\s*"([^"]+)"/)
+          @parent_domain = domain_match[1] if domain_match
+        end
+
+        # Load aws_profile from parent's belt.rb
+        parent_config = EnvironmentConfig.load(@parent_environment)
+        @parent_aws_profile = parent_config.aws_profile if parent_config.aws_profile?
+      end
+
+      # Generate belt.rb with inherited aws_profile from parent
+      def write_belt_rb(path)
+        content = <<~RUBY
+          # frozen_string_literal: true
+
+          Belt.configure do |config|
+            config.aws_profile = "#{@parent_aws_profile}"
+          end
+        RUBY
+        File.write(path, content)
+      end
+
       def bucket_from_sibling
         Dir.glob('infrastructure/*/backend.tf').each do |f|
           match = File.read(f).match(/bucket\s*=\s*"([^"]+)"/)

data/lib/belt/cli/environment_config.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative 'backup_config'
+
 module Belt
   module CLI
     class EnvironmentConfig

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.3.28'
+  VERSION = '0.3.30'
 end

data/lib/templates/environment/main.tf.erb

@@ -35,14 +35,15 @@ provider "conveyor-belt" {
 module "app" {
   source = "../modules/app"
 
-  app_name     = var.app_name
-  environment  = var.environment
-  aws_region   = var.aws_region
-  domain       = var.domain
-  enable_pitr  = var.enable_pitr
+  app_name            = var.app_name
+  environment         = var.environment
+  parent_environment  = var.parent_environment
+  aws_region          = var.aws_region
+  domain              = var.domain
+  enable_pitr         = var.enable_pitr
   deletion_protection = var.deletion_protection
   frontend_urls = concat(
-    var.domain != "" ? ["https://${var.environment == "prod" ? var.domain : "${var.environment}.${var.domain}"}"] : [],
+    var.domain != "" ? ["https://${var.parent_environment != "" ? "${var.environment}.${var.parent_environment}.${var.domain}" : (var.environment == "prod" ? var.domain : "${var.environment}.${var.domain}")}"] : [],
     var.environment == "prod" ? [] : ["http://localhost:3000"]
   )
 

data/lib/templates/environment/terraform.tfvars.erb

@@ -1,4 +1,7 @@
 environment = "<%= @env_name %>"
+<% if @parent_environment && !@parent_environment.empty? -%>
+parent_environment = "<%= @parent_environment %>"
+<% end -%>
 <% if @domain && !@domain.empty? -%>
 domain      = "<%= @domain %>"
 <% else -%>

data/lib/templates/environment/variables.tf.erb

@@ -9,6 +9,12 @@ variable "environment" {
   type        = string
 }
 
+variable "parent_environment" {
+  description = "Parent environment for nested subdomains (e.g., 'dev' creates fizzy123.dev.example.com). Leave empty for standalone environments."
+  type        = string
+  default     = ""
+}
+
 variable "aws_region" {
   description = "AWS region"
   type        = string

data/lib/templates/module/dns.tf.erb

@@ -1,30 +1,58 @@
 # DNS configuration for Belt application
-# Convention: prod → mydomain.com, other envs → <env>.mydomain.com
+# Convention:
+#   prod           → api.mydomain.com (standalone, creates own zone + cert)
+#   dev            → api.dev.mydomain.com (standalone, creates own zone + cert)
+#   fizzy123 (dev) → api-fizzy123.dev.mydomain.com (nested, uses parent zone + cert)
+#
+# Note: Nested envs use api-<env> prefix (not api.<env>) because SSL wildcards are
+# single-level. The parent's *.dev.mydomain.com covers api-fizzy123.dev.mydomain.com
+# but NOT api.fizzy123.dev.mydomain.com.
 
 locals {
+  # S3 bucket names follow DNS rules — underscores are not allowed.
+  s3_safe_name = replace(var.app_name, "_", "-")
+
+  # Is this a nested environment?
+  is_nested = var.parent_environment != ""
+
+  # Parent domain for nested envs (e.g., "dev.featureparity.dev")
+  parent_domain = local.is_nested ? "${var.parent_environment}.${var.domain}" : ""
+
   # Determine the domain for this environment
+  # Nested: fizzy123.dev.mydomain.com
+  # Standalone: dev.mydomain.com (or mydomain.com for prod)
   app_domain = var.domain != "" ? (
-    var.environment == "prod" ? var.domain : "${var.environment}.${var.domain}"
+    local.is_nested ? "${var.environment}.${local.parent_domain}" : (
+      var.environment == "prod" ? var.domain : "${var.environment}.${var.domain}"
+    )
   ) : ""
 
-  # API subdomain: api.mydomain.com (prod) or api.<env>.mydomain.com (non-prod)
-  api_domain = var.domain != "" ? "api.${local.app_domain}" : ""
+  # API subdomain: 
+  # Standalone: api.dev.mydomain.com (covered by *.dev.mydomain.com)
+  # Nested: api-fizzy123.dev.mydomain.com (api- prefix keeps it single-level under wildcard)
+  api_domain = var.domain != "" ? (
+    local.is_nested ? "api-${var.environment}.${local.parent_domain}" : "api.${local.app_domain}"
+  ) : ""
 
   # Whether DNS is enabled
   dns_enabled = var.domain != ""
 }
 
+# =============================================================================
+# STANDALONE ENVIRONMENTS (no parent)
+# =============================================================================
+
 # --- Route53 Hosted Zone ---
 # One zone per environment subdomain (or root domain for prod)
 resource "aws_route53_zone" "app" {
-  count = local.dns_enabled ? 1 : 0
+  count = local.dns_enabled && !local.is_nested ? 1 : 0
   name  = local.app_domain
 }
 
 # --- ACM Certificate ---
 # Wildcard cert covers the app domain + all subdomains (api.*, www.*, etc.)
 resource "aws_acm_certificate" "app" {
-  count                     = local.dns_enabled ? 1 : 0
+  count                     = local.dns_enabled && !local.is_nested ? 1 : 0
   domain_name               = local.app_domain
   subject_alternative_names = ["*.${local.app_domain}"]
   validation_method         = "DNS"
@@ -41,7 +69,7 @@ resource "aws_acm_certificate" "app" {
 # Use ellipsis (...) to group duplicates, then take the first element since
 # they're identical anyway.
 resource "aws_route53_record" "cert_validation" {
-  for_each = local.dns_enabled ? {
+  for_each = local.dns_enabled && !local.is_nested ? {
     for dvo in aws_acm_certificate.app[0].domain_validation_options : dvo.resource_record_name => {
       name   = dvo.resource_record_name
       type   = dvo.resource_record_type
@@ -49,24 +77,53 @@ resource "aws_route53_record" "cert_validation" {
     }...
   } : {}
 
-  zone_id = aws_route53_zone.app[0].zone_id
-  name    = each.value[0].name
-  type    = each.value[0].type
-  ttl     = 300
-  records = [each.value[0].record]
+  zone_id         = aws_route53_zone.app[0].zone_id
+  name            = each.value[0].name
+  type            = each.value[0].type
+  ttl             = 300
+  records         = [each.value[0].record]
+  allow_overwrite = true
 }
 
 resource "aws_acm_certificate_validation" "app" {
-  count                   = local.dns_enabled ? 1 : 0
+  count                   = local.dns_enabled && !local.is_nested ? 1 : 0
   certificate_arn         = aws_acm_certificate.app[0].arn
   validation_record_fqdns = [for record in aws_route53_record.cert_validation : record.fqdn]
 }
 
+# =============================================================================
+# NESTED ENVIRONMENTS (uses parent zone + wildcard cert)
+# =============================================================================
+
+# Look up parent's hosted zone
+data "aws_route53_zone" "parent" {
+  count = local.dns_enabled && local.is_nested ? 1 : 0
+  name  = local.parent_domain
+}
+
+# Look up parent's wildcard certificate
+data "aws_acm_certificate" "parent" {
+  count       = local.dns_enabled && local.is_nested ? 1 : 0
+  domain      = local.parent_domain
+  statuses    = ["ISSUED"]
+  most_recent = true
+}
+
+# =============================================================================
+# API GATEWAY (shared logic, uses appropriate cert/zone)
+# =============================================================================
+
 # --- API Gateway Custom Domain ---
 resource "aws_api_gateway_domain_name" "api" {
-  count                    = local.dns_enabled ? 1 : 0
-  domain_name              = local.api_domain
-  regional_certificate_arn = aws_acm_certificate_validation.app[0].certificate_arn
+  count       = local.dns_enabled ? 1 : 0
+  domain_name = local.api_domain
+
+  # Use parent's cert for nested, own cert for standalone
+  regional_certificate_arn = local.is_nested ? (
+    data.aws_acm_certificate.parent[0].arn
+    ) : (
+    aws_acm_certificate_validation.app[0].certificate_arn
+  )
 
   endpoint_configuration {
     types = ["REGIONAL"]
@@ -74,9 +131,10 @@ resource "aws_api_gateway_domain_name" "api" {
 }
 
 # Route53 A record for api.<domain>
+# For nested envs, this goes in the parent zone
 resource "aws_route53_record" "api" {
   count   = local.dns_enabled ? 1 : 0
-  zone_id = aws_route53_zone.app[0].zone_id
+  zone_id = local.is_nested ? data.aws_route53_zone.parent[0].zone_id : aws_route53_zone.app[0].zone_id
   name    = local.api_domain
   type    = "A"
 

data/lib/templates/module/frontend.tf.erb

@@ -102,7 +102,7 @@ resource "aws_cloudfront_distribution" "<%= @tf_name %>" {
 
   viewer_certificate {
     cloudfront_default_certificate = <%= @include_dns ? '!local.dns_enabled' : 'true' %>
-    acm_certificate_arn            = <%= @include_dns ? 'local.dns_enabled ? aws_acm_certificate_validation.app[0].certificate_arn : null' : 'null' %>
+    acm_certificate_arn            = <%= @include_dns ? 'local.dns_enabled ? (local.is_nested ? data.aws_acm_certificate.parent[0].arn : aws_acm_certificate_validation.app[0].certificate_arn) : null' : 'null' %>
     ssl_support_method             = <%= @include_dns ? 'local.dns_enabled ? "sni-only" : null' : 'null' %>
     minimum_protocol_version       = <%= @include_dns ? 'local.dns_enabled ? "TLSv1.2_2021" : null' : 'null' %>
   }
@@ -144,7 +144,7 @@ resource "aws_s3_bucket_policy" "<%= @tf_name %>" {
 # Route53 record for frontend (app domain → CloudFront)
 resource "aws_route53_record" "<%= @tf_name %>" {
   count   = local.dns_enabled ? 1 : 0
-  zone_id = aws_route53_zone.app[0].zone_id
+  zone_id = local.is_nested ? data.aws_route53_zone.parent[0].zone_id : aws_route53_zone.app[0].zone_id
   name    = local.app_domain
   type    = "A"
 
@@ -155,9 +155,9 @@ resource "aws_route53_record" "<%= @tf_name %>" {
   }
 }
 
-# www record for prod only
+# www record for prod only (standalone envs only — nested envs don't need www)
 resource "aws_route53_record" "<%= @tf_name %>_www" {
-  count   = local.dns_enabled && var.environment == "prod" ? 1 : 0
+  count   = local.dns_enabled && var.environment == "prod" && !local.is_nested ? 1 : 0
   zone_id = aws_route53_zone.app[0].zone_id
   name    = "www.${var.domain}"
   type    = "A"

data/lib/templates/module/outputs.tf.erb

@@ -19,6 +19,6 @@ output "app_domain" {
 }
 
 output "name_servers" {
-  description = "NS records to configure at your registrar"
-  value       = local.dns_enabled ? aws_route53_zone.app[0].name_servers : []
+  description = "NS records to configure at your registrar (standalone envs only)"
+  value       = local.dns_enabled && !local.is_nested ? aws_route53_zone.app[0].name_servers : []
 }

data/lib/templates/module/variables.tf.erb

@@ -8,6 +8,12 @@ variable "environment" {
   type        = string
 }
 
+variable "parent_environment" {
+  description = "Parent environment for nested subdomains (e.g., 'dev' creates fizzy123.dev.example.com). Leave empty for standalone environments."
+  type        = string
+  default     = ""
+}
+
 variable "aws_region" {
   description = "AWS region"
   type        = string

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.3.28
+  version: 0.3.30
 platform: ruby
 authors:
 - Stowzilla