belt 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a04110a957fa2d24cbca0245df1aa6aa421547ac140467cb5e6a15e9d0e1fb1
-  data.tar.gz: 17ffdd470fe0dd613ac82cd0554c12146fb527ee1a6ccd179f3de4b3e3024eab
+  metadata.gz: 846db7f1373b5bd98f3e795404b1f157825f5dd94541bd46aa76e3510ba89adf
+  data.tar.gz: 251135fea6ee2d3d55e7dcdf46b98460ddc3df50fa1e4113b561f721755c935d
 SHA512:
-  metadata.gz: 540c4da110ef61d412c09af5ce4db33bd534ec460d636ac2988e9784cb0fc58ac54e6cd9eeb201b48f863832d7d936ae5677bbcb78d37e702f04915e234ee230
-  data.tar.gz: ecc50065fcff0b93904c89cbc8c0e3c1a0c45e8f54c7c12af80d9546d894ed12b0a9f8103f8ca5eae3623c1cbd0e38d703137acf86e242ca9fe05946734ac28f
+  metadata.gz: 60b0ecf81e375ea1c219c84ccf7f90d568437cc81507c708ec56a40f903178e0611e5b6be03e1e71185ce66263d1ec0c12ddee8e1a4d2cfdc26f99dba4828c48
+  data.tar.gz: fb3fa14275a68c7e79892504d0fef2cbe86727225033a7d7bc3c1272b963413b5ed7259c3a5c2f1e202770d16b0234ff242571e4d2b7abed50a040090da250e1

data/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## Unreleased
+
+### Bug Fix
+
+- **Apply environment AWS profile in `belt deploy frontend`, `belt frontend env`, `belt logs`, and `belt server`**:
+  Standalone frontend deployment (`belt deploy frontend <env>`), frontend env generation (`belt frontend env <env>`),
+  log viewing (`belt logs`), and the local dev server (`belt server`) now load `infrastructure/<env>/belt.rb`
+  and apply its configured `aws_profile` and environment variables. Previously, running `belt deploy frontend <env>`
+  directly would query Terraform outputs without the environment's AWS profile, causing a 403 against remote S3
+  state backends and aborting with `Error: Could not determine S3 bucket. Run belt apply <env> first.`
+
+## 0.4.1
+
+### Feature
+
+- **`belt dns doctor`**: New diagnostic command that checks DNS health across all
+  environments. Shows zone status, NS delegation, ACM certificate state, and
+  API Gateway custom domain configuration. Use `--env prod` to check a specific
+  environment only.
+
+  ```bash
+  belt dns doctor
+  belt dns doctor --env prod
+  ```
+
+- **`belt dns sync-validation`**: New command to sync ACM validation CNAMEs from
+  an environment's zone to the root zone. Needed for apex domains (e.g., prod →
+  `example.com`) where the root zone is authoritative for the apex domain.
+
+  ```bash
+  belt dns sync-validation prod
+  ```
+
+- **Auto-sync ACM validation for apex environments**: `belt deploy prod` now
+  automatically syncs ACM validation CNAMEs to the root zone when deploying
+  environments that use the apex domain. No manual intervention needed — the
+  "prod is special" logic is handled by Belt internally.
+
+  This fixes the issue where prod ACM certificates would timeout waiting for
+  validation because the validation CNAMEs were created in the prod zone, but
+  ACM validates against the authoritative zone (the root zone managed by
+  `infrastructure/dns`).
+
+### Bug Fix
+
+- **Fix misleading nested environment domain announcement**: `belt generate
+  environment <name> <parent>` printed `Domain will be:
+  api.<env>.<parent>.<domain>`, but the deployed infrastructure actually uses
+  the single-level `api-<env>.<parent>.<domain>` form (the `api-` prefix keeps
+  the host under the parent's `*.<parent>.<domain>` wildcard cert). The message
+  now matches the real deployed domain. Infrastructure was already correct —
+  only the CLI output was wrong.
+
 ## 0.4.0
 
 ### New Features

data/lib/belt/cli/deploy_command.rb

@@ -14,6 +14,7 @@ require_relative 'zip_artifact_builder'
 require_relative 'nested_environment'
 require_relative 'cognito_sharer'
 require_relative 'dynamo_copier'
+require_relative 'dns_command'
 require_relative 'apex_dns_sync'
 
 module Belt
@@ -177,6 +178,11 @@ module Belt
         # Sync apex DNS records to root zone (if this is a prod/apex environment)
         run_apex_dns_sync
 
+        # Sync ACM validation CNAMEs for apex domains (e.g., prod)
+        # This handles the case where prod uses the apex domain (example.com)
+        # and needs validation CNAMEs in the root zone, not the env's zone.
+        sync_acm_validation_if_apex
+
         puts "\n✅ Deployed #{@env} successfully!"
         print_outputs(env_dir)
 
@@ -299,6 +305,27 @@ module Belt
         end
       end
 
+      # ─── ACM Validation Sync ────────────────────────────────────────
+
+      # For apex environments (prod), ACM validation CNAMEs need to be in the
+      # root zone (managed by infrastructure/dns), not the environment's zone.
+      # This is because the registrar points to the root zone, which is
+      # authoritative for the apex domain.
+      def sync_acm_validation_if_apex
+        # Only sync if DNS infrastructure exists
+        return unless Dir.exist?(File.join(@infra_dir, '..', 'infrastructure', 'dns')) ||
+                      Dir.exist?('infrastructure/dns')
+
+        # Check if this is an apex environment
+        return unless apex_environment?
+
+        DnsCommand.sync_acm_validation_if_needed(@env)
+      end
+
+      def apex_environment?
+        %w[prod production].include?(@env)
+      end
+
       # ─── Backup Phase ───────────────────────────────────────────────
 
       def run_backups

data/lib/belt/cli/dns_command.rb

@@ -31,6 +31,8 @@ module Belt
           new.show(args)
         when 'doctor'
           new.doctor(args)
+        when 'sync-validation'
+          new.sync_validation(args)
         when '--help', '-h', 'help'
           puts help
         else
@@ -49,13 +51,17 @@ module Belt
             add <env>           Add an environment's NS records to dns/terraform.tfvars
             remove <env>        Remove an environment's NS records from dns/terraform.tfvars
             show                Show root zone name servers (for registrar configuration)
-            doctor              Diagnose DNS configuration across all environments
+            doctor              Diagnose DNS configuration for all environments
+            sync-validation     Sync ACM validation CNAMEs to root zone (for apex domains)
             help                Show this help
 
           Options for generate:
             --aws-profile NAME  AWS profile to use for DNS infrastructure
                                Sets belt.rb config and derives state bucket from account ID
 
+          Options for doctor:
+            --env ENV           Check a specific environment only
+
           Examples:
             belt dns deploy                 # Deploy the root zone
             belt dns generate               # Scaffold infrastructure/dns (prompts for profile)
@@ -64,6 +70,7 @@ module Belt
             belt dns remove staging         # Remove staging's NS delegation
             belt dns show                   # Show root name servers to configure at registrar
             belt dns doctor                 # Check DNS health for all environments
+            belt dns doctor --env prod      # Check DNS health for prod only
 
           The dns directory manages your root domain and delegates subdomains to
           per-environment hosted zones. Each environment (dev, staging, prod) gets
@@ -80,6 +87,11 @@ module Belt
             1. belt destroy environment dev # Destroy the environment
             2. belt dns remove dev          # Remove DNS delegation
             3. belt dns deploy              # Apply the change
+
+          Special handling for prod (apex domain):
+            Prod environments use the apex domain (e.g., example.com, not prod.example.com).
+            ACM certificates for apex domains need validation CNAMEs in the root zone.
+            `belt deploy prod` handles this automatically when infrastructure/dns exists.
         HELP
       end
 
@@ -90,6 +102,150 @@ module Belt
         @state_bucket = nil # Resolved during generate with profile context
       end
 
+      # --- Doctor ---
+      def doctor(args = [])
+        require 'open3'
+
+        # Parse --env flag
+        env_filter = nil
+        env_index = args.index('--env')
+        if env_index
+          env_filter = args[env_index + 1]
+          args.delete_at(env_index + 1)
+          args.delete_at(env_index)
+        end
+
+        # Load DNS config for shared account credentials
+        dns_config = load_dns_config_if_exists
+
+        # Read domain from tfvars
+        domain = read_domain_from_tfvars
+        unless domain
+          puts 'No domain configured.'
+          puts "\nSet up DNS first:"
+          puts '  belt dns generate'
+          exit 1
+        end
+
+        puts "DNS Health: #{domain}"
+        puts '═' * 60
+        puts ''
+
+        # Check root zone
+        root_zone_ok = check_root_zone(domain, dns_config)
+        puts ''
+
+        # Get list of environments to check
+        environments = discover_environments(env_filter)
+        if environments.empty?
+          puts 'No environments found to check.'
+          puts "\nDeploy an environment first:"
+          puts '  belt deploy dev'
+          return
+        end
+
+        # Check each environment
+        all_ok = root_zone_ok
+        environments.each do |env_name|
+          env_ok = check_environment(env_name, domain, dns_config)
+          all_ok &&= env_ok
+          puts ''
+        end
+
+        # Summary
+        puts '═' * 60
+        if all_ok
+          puts '✓ All DNS checks passed'
+        else
+          puts '⚠ Some DNS issues detected — see details above'
+        end
+      end
+
+      # --- Sync Validation ---
+      # Syncs ACM validation CNAMEs from an environment to the root zone.
+      # Primarily used for prod (apex domain) where the env's zone isn't authoritative.
+      def sync_validation(args = [])
+        require 'open3'
+
+        env_name = args.shift
+        if env_name.nil? || env_name.start_with?('-')
+          puts 'Usage: belt dns sync-validation <env>'
+          puts "\nThis syncs ACM certificate validation CNAMEs from the environment's"
+          puts 'zone to the root zone. Needed when the environment uses the apex domain'
+          puts '(e.g., prod → example.com) because ACM validates against the authoritative'
+          puts "zone, which is the root zone, not the environment's zone."
+          puts "\nExample:"
+          puts '  belt dns sync-validation prod'
+          exit 1
+        end
+
+        unless Dir.exist?(DNS_DIR)
+          puts 'No infrastructure/dns directory found.'
+          puts "\nCreate it first:"
+          puts '  belt dns generate'
+          exit 1
+        end
+
+        env_dir = "infrastructure/#{env_name}"
+        unless Dir.exist?(env_dir)
+          puts "Environment #{env_name} not found at #{env_dir}/"
+          exit 1
+        end
+
+        sync_acm_validation_to_root_zone!(env_name)
+      end
+
+      # Public API for deploy_command to call
+      def self.sync_acm_validation_if_needed(env_name)
+        # Only sync if DNS is configured
+        return unless Dir.exist?(DNS_DIR)
+
+        cmd = new(quiet: true)
+        cmd.sync_acm_validation_to_root_zone!(env_name)
+      end
+
+      # Core logic: sync ACM validation CNAMEs to root zone
+      def sync_acm_validation_to_root_zone!(env_name)
+        require 'open3'
+
+        env_config = EnvironmentConfig.load(env_name)
+        dns_config = load_dns_config_if_exists
+
+        # Get domain from tfvars
+        domain = read_domain_from_tfvars
+        return unless domain
+
+        # Determine if this is an apex environment
+        is_apex = apex_environment?(env_name, domain)
+        unless is_apex
+          puts "  ℹ #{env_name} uses subdomain (#{env_name}.#{domain}) — no root zone sync needed" unless @quiet
+          return
+        end
+
+        puts "  🔄 Syncing ACM validation for #{env_name} (apex domain) to root zone..." unless @quiet
+
+        # Get pending ACM validation records from the environment
+        validation_records = fetch_pending_acm_validation(env_name, env_config)
+        if validation_records.nil? || validation_records.empty?
+          puts '     No pending ACM validation records found' unless @quiet
+          return
+        end
+
+        # Get root zone ID
+        root_zone_id = fetch_root_zone_id(dns_config)
+        unless root_zone_id
+          puts '     ⚠ Could not find root zone ID — run `belt dns deploy` first' unless @quiet
+          return
+        end
+
+        # Create/update the validation CNAMEs in the root zone
+        validation_records.each do |record|
+          create_validation_cname_in_root_zone(root_zone_id, record, dns_config)
+        end
+
+        puts '     ✓ ACM validation CNAMEs synced to root zone' unless @quiet
+      end
+
       # --- Generate ---
       def generate(args = [])
         # Parse --aws-profile flag
@@ -347,334 +503,447 @@ module Belt
         end
       end
 
-      # --- Doctor ---
-      # Diagnose DNS configuration across all environments
-      def doctor(args)
+      private
+
+      # ═══════════════════════════════════════════════════════════════════════════
+      # Doctor helpers
+      # ═══════════════════════════════════════════════════════════════════════════
+
+      def check_root_zone(domain, dns_config)
         require 'open3'
-        require_relative 'terraform_command'
 
-        # Parse --env flag for filtering to a specific environment
-        env_filter = nil
-        if args.include?('--env')
-          idx = args.index('--env')
-          env_filter = args[idx + 1]
-        end
+        puts 'Root Zone (shared account)'
+        puts '-' * 40
 
-        # Read domain from dns/terraform.tfvars
-        domain = read_domain_from_dns_tfvars
-        unless domain
-          puts 'Could not determine domain.'
-          puts "\nEnsure infrastructure/dns/terraform.tfvars has:"
-          puts '  domain = "example.com"'
-          exit 1
-        end
+        env = {}
+        env['AWS_PROFILE'] = dns_config.aws_profile if dns_config&.aws_profile?
 
-        puts "DNS Health: #{domain}"
-        puts '═' * 64
-        puts ''
+        all_ok = true
 
-        # Check root zone
-        if Dir.exist?(DNS_DIR)
-          check_root_zone(domain)
+        # Check if root zone exists
+        zone_id = fetch_root_zone_id(dns_config)
+        if zone_id
+          puts "  ✓ Zone ID: #{zone_id}"
         else
-          puts 'Root Zone (infrastructure/dns)'
-          puts '────────────────────────────────────────'
-          puts '  ⚠ Not configured'
-          puts '    Run: belt dns generate'
-          puts ''
+          puts '  ✗ Root zone not found'
+          puts '    Run: belt dns deploy'
+          return false
         end
 
-        # Check each environment
-        environments = if env_filter
-                         [env_filter]
-                       else
-                         TerraformCommand.list_environments
-                       end
+        # Get NS records from root zone
+        ns_output, ns_status = Open3.capture2e(
+          env,
+          'aws', 'route53', 'list-resource-record-sets',
+          '--hosted-zone-id', zone_id,
+          '--query', "ResourceRecordSets[?Type=='NS' && Name=='#{domain}.'].ResourceRecords[].Value",
+          '--output', 'json'
+        )
 
-        environments.each do |env_name|
-          check_environment(env_name, domain)
+        if ns_status.success?
+          ns_records = begin
+            JSON.parse(ns_output)
+          rescue StandardError
+            []
+          end
+          if ns_records.any?
+            puts "  ✓ NS records configured (#{ns_records.size} servers)"
+          else
+            puts '  ⚠ No NS records found'
+          end
         end
-      end
 
-      private
+        # Check delegated environments
+        delegated = fetch_delegated_environments(dns_config)
+        if delegated.any?
+          puts "  ✓ Delegated: #{delegated.join(', ')}"
+        else
+          puts '  ⚠ No environments delegated yet'
+          puts '    Run: belt dns add <env>'
+        end
 
-      def parse_json(output)
-        JSON.parse(output)
-      rescue JSON::ParserError
-        nil
+        all_ok
       end
 
-      def check_root_zone(domain)
-        puts 'Root Zone (shared account)'
-        puts '────────────────────────────────────────'
+      def check_environment(env_name, domain, dns_config)
+        require 'open3'
 
-        dns_config = load_dns_config
+        env_config = EnvironmentConfig.load(env_name)
         env = {}
-        env['AWS_PROFILE'] = dns_config.aws_profile if dns_config.aws_profile?
+        env['AWS_PROFILE'] = env_config.aws_profile if env_config.aws_profile?
 
-        outputs = Dir.chdir(DNS_DIR) do
-          output, status = Open3.capture2e(env, 'terraform', 'output', '-json')
-          unless status.success?
-            puts '  ⚠ Cannot read terraform state'
-            puts '    Run: belt dns deploy'
-            return
-          end
+        is_apex = apex_environment?(env_name, domain)
+        env_domain = is_apex ? domain : "#{env_name}.#{domain}"
 
-          parse_json(output)
-        end
+        puts "#{env_name} (#{env_domain})#{' [apex]' if is_apex}"
+        puts '-' * 40
 
-        unless outputs
-          puts '  ⚠ Failed to parse terraform outputs'
-          return
-        end
-
-        zone_id = outputs.dig('root_zone_id', 'value')
-        name_servers = outputs.dig('root_name_servers', 'value') || []
-        delegated = outputs.dig('delegated_environments', 'value') || []
+        all_ok = true
 
+        # Check zone exists
+        zone_id = fetch_env_zone_id(env_name, env_config)
         if zone_id
-          if zone_exists_in_aws?(zone_id, env)
-            puts "  ✓ Zone ID: #{zone_id}"
-          else
-            puts "  ✗ Zone #{zone_id} not found in AWS (state stale?)"
-          end
+          puts "  ✓ Zone ID: #{zone_id}"
         else
-          puts '  ⚠ Zone not created yet'
+          puts '  ✗ Hosted zone not found'
+          puts "    Run: belt deploy #{env_name}"
+          return false
         end
 
-        if name_servers.any?
-          puts "  ✓ NS records configured (#{name_servers.length} servers)"
+        # Check NS delegation in root zone
+        delegated = fetch_delegated_environments(dns_config)
+        if delegated.include?(env_name)
+          puts '  ✓ NS delegation in root zone'
+        else
+          puts '  ⚠ Not delegated in root zone'
+          puts "    Run: belt dns add #{env_name} && belt dns deploy"
+          all_ok = false
+        end
 
-          # Check if registrar NS matches (via DNS lookup)
-          actual_ns = lookup_ns_records(domain)
-          if actual_ns.sort == name_servers.sort
-            puts '  ✓ Registrar NS records match'
-          elsif actual_ns.any?
-            puts '  ⚠ Registrar NS records differ from root zone'
-            puts "    Expected: #{name_servers.first}..."
-            puts "    Got:      #{actual_ns.first}..."
+        # Check ACM certificate
+        cert_status, cert_domain = fetch_acm_cert_status(env_name, env_config)
+        case cert_status
+        when 'ISSUED'
+          puts "  ✓ ACM certificate: ISSUED (#{cert_domain})"
+        when 'PENDING_VALIDATION'
+          puts "  ⚠ ACM certificate: PENDING_VALIDATION (#{cert_domain})"
+          if is_apex
+            # Check if validation CNAME is in root zone
+            validation_in_root = check_acm_validation_in_root(env_name, env_config, dns_config)
+            if validation_in_root
+              puts '    ✓ Validation CNAME in root zone — waiting for DNS propagation'
+            else
+              puts '    ✗ Validation CNAME NOT in root zone'
+              puts '      Apex domains need validation CNAMEs in the root zone.'
+              puts "      Run: belt dns sync-validation #{env_name} && belt dns deploy"
+            end
           else
-            puts '  ⚠ Could not verify registrar NS records (DNS lookup failed)'
+            puts '    Validation CNAME should be in environment zone — waiting for DNS propagation'
           end
+          all_ok = false
+        when 'FAILED'
+          puts "  ✗ ACM certificate: FAILED (#{cert_domain})"
+          all_ok = false
+        when nil
+          puts '  ⚠ ACM certificate not found'
+          all_ok = false
         else
-          puts '  ⚠ No NS records found'
+          puts "  ⚠ ACM certificate: #{cert_status} (#{cert_domain})"
         end
 
-        if delegated.any?
-          puts "  ✓ Delegated: #{delegated.join(', ')}"
-        else
-          puts '  ⚠ No environments delegated'
+        # Check API Gateway custom domain
+        api_domain_status = fetch_api_gateway_domain_status(env_name, env_config, domain)
+        case api_domain_status
+        when :available
+          puts '  ✓ API Gateway custom domain: available'
+        when :pending
+          puts '  ⚠ API Gateway custom domain: pending (waiting for cert)'
+        when :not_found
+          puts '  ⚠ API Gateway custom domain: not configured'
+          all_ok = false
         end
 
-        # Check for apex records (should exist if prod is deployed)
-        check_root_zone_apex_records(zone_id, domain, env) if zone_id
+        all_ok
+      end
 
-        puts ''
+      def apex_environment?(env_name, _domain)
+        # Convention: 'prod' or 'production' uses the apex domain
+        %w[prod production].include?(env_name)
       end
 
-      def check_root_zone_apex_records(zone_id, domain, env)
-        # List records in root zone to see if apex A records exist
-        output, status = Open3.capture2e(
-          env,
-          'aws', 'route53', 'list-resource-record-sets',
-          '--hosted-zone-id', zone_id,
-          '--query', "ResourceRecordSets[?Type=='A'].Name",
-          '--output', 'json'
-        )
-        return unless status.success?
+      def discover_environments(filter = nil)
+        return [filter] if filter && Dir.exist?("infrastructure/#{filter}")
 
-        records = begin
-          JSON.parse(output)
-        rescue JSON::ParserError
-          []
+        env_dirs = Dir.glob('infrastructure/*').select do |path|
+          next false unless File.directory?(path)
+
+          env_name = File.basename(path)
+          next false if %w[modules dns].include?(env_name)
+          next false unless File.exist?(File.join(path, 'main.tf'))
+
+          true
         end
+        env_dirs.map { |path| File.basename(path) }.sort
+      end
 
-        apex_exists = records.any? { |r| r.chomp('.') == domain }
-        www_exists = records.any? { |r| r.chomp('.') == "www.#{domain}" }
-        api_exists = records.any? { |r| r.chomp('.') == "api.#{domain}" }
+      def read_domain_from_tfvars
+        tfvars_path = "#{DNS_DIR}/terraform.tfvars"
+        return nil unless File.exist?(tfvars_path)
 
-        if apex_exists && www_exists && api_exists
-          puts "  ✓ Apex A records present (#{domain}, www, api)"
-        elsif apex_exists || www_exists || api_exists
-          missing = []
-          missing << domain unless apex_exists
-          missing << "www.#{domain}" unless www_exists
-          missing << "api.#{domain}" unless api_exists
-          puts "  ⚠ Some apex A records missing: #{missing.join(', ')}"
-        else
-          puts '  ⚠ No apex A records (prod not synced? run: belt deploy prod)'
+        content = File.read(tfvars_path)
+        match = content.match(/domain\s*=\s*"([^"]+)"/)
+        match[1] if match
+      end
+
+      def load_dns_config_if_exists
+        return nil unless Dir.exist?(DNS_DIR)
+
+        load_dns_config
+      rescue StandardError
+        nil
+      end
+
+      def fetch_root_zone_id(dns_config)
+        require 'open3'
+
+        return nil unless Dir.exist?(DNS_DIR)
+
+        env = {}
+        env['AWS_PROFILE'] = dns_config.aws_profile if dns_config&.aws_profile?
+
+        output, status = Dir.chdir(DNS_DIR) do
+          Open3.capture2e(env, 'terraform', 'output', '-raw', 'root_zone_id')
         end
+
+        status.success? ? output.strip : nil
       end
 
-      def check_environment(env_name, domain)
-        env_dir = "infrastructure/#{env_name}"
-        return unless Dir.exist?(env_dir)
+      def fetch_delegated_environments(dns_config)
+        require 'open3'
 
-        # Determine expected domain for this env
-        tfvars_path = File.join(env_dir, 'terraform.tfvars')
-        env_domain = nil
-        is_prod = env_name == 'prod'
+        return [] unless Dir.exist?(DNS_DIR)
 
-        if File.exist?(tfvars_path)
-          content = File.read(tfvars_path)
-          domain_match = content.match(/^\s*domain\s*=\s*"([^"]+)"/)
-          env_match = content.match(/^\s*environment\s*=\s*"([^"]+)"/)
-          parent_match = content.match(/^\s*parent_environment\s*=\s*"([^"]+)"/)
-
-          configured_domain = domain_match ? domain_match[1] : nil
-          actual_env = env_match ? env_match[1] : env_name
-          parent = parent_match ? parent_match[1] : nil
-          is_prod = actual_env == 'prod'
-          is_nested = parent && !parent.empty?
-
-          if configured_domain
-            env_domain = if is_nested
-                           "#{actual_env}.#{parent}.#{configured_domain}"
-                         elsif is_prod
-                           configured_domain
-                         else
-                           "#{actual_env}.#{configured_domain}"
-                         end
-          end
+        env = {}
+        env['AWS_PROFILE'] = dns_config.aws_profile if dns_config&.aws_profile?
+
+        output, status = Dir.chdir(DNS_DIR) do
+          Open3.capture2e(env, 'terraform', 'output', '-json', 'delegated_environments')
         end
 
-        label = if is_prod
-                  "#{env_name} (#{env_domain || domain}) [apex]"
-                else
-                  "#{env_name} (#{env_domain || "#{env_name}.#{domain}"})"
-                end
-        puts label
-        puts '────────────────────────────────────────'
+        return [] unless status.success?
 
-        env_config = begin
-          EnvironmentConfig.load(env_name)
+        begin
+          JSON.parse(output)
         rescue StandardError
-          nil
+          []
         end
+      end
 
-        unless env_config
-          puts '  ⚠ No belt.rb config found'
-          puts ''
-          return
-        end
+      def fetch_env_zone_id(env_name, env_config)
+        require 'open3'
+
+        env_dir = "infrastructure/#{env_name}"
+        return nil unless Dir.exist?(env_dir)
 
         env = {}
         env['AWS_PROFILE'] = env_config.aws_profile if env_config.aws_profile?
 
-        # Check terraform state
-        Dir.chdir(env_dir) do
-          output, status = Open3.capture2e(env, 'terraform', 'output', '-json')
-          unless status.success?
-            puts '  ⚠ Cannot read terraform state (not deployed?)'
-            puts ''
-            return
-          end
-
-          outputs = parse_json(output)
-          unless outputs
-            puts '  ⚠ Failed to parse terraform outputs'
-            puts ''
-            return
-          end
-
-          report_environment_status(outputs, env_name, env_dir, env, domain, env_domain, is_prod)
+        output, status = Dir.chdir(env_dir) do
+          Open3.capture2e(env, 'terraform', 'output', '-raw', 'zone_id')
         end
 
-        puts ''
+        status.success? && !output.strip.empty? ? output.strip : nil
       end
 
-      def report_environment_status(outputs, env_name, env_dir, env, domain, env_domain, is_prod)
-        # Zone info
-        name_servers = outputs.dig('name_servers', 'value') || []
-        if name_servers.any?
-          puts "  ✓ Zone deployed (#{name_servers.length} NS records)"
-        else
-          puts '  ⚠ No hosted zone found'
+      def fetch_acm_cert_status(env_name, env_config)
+        require 'open3'
+
+        env_dir = "infrastructure/#{env_name}"
+        return [nil, nil] unless Dir.exist?(env_dir)
+
+        env = {}
+        env['AWS_PROFILE'] = env_config.aws_profile if env_config.aws_profile?
+
+        # Get cert ARN from terraform
+        arn_output, arn_status = Dir.chdir(env_dir) do
+          Open3.capture2e(env, 'terraform', 'output', '-raw', 'certificate_arn')
         end
 
-        # Check ACM certificate
-        check_acm_cert(env_dir, env)
+        return [nil, nil] unless arn_status.success? && !arn_output.strip.empty?
+
+        cert_arn = arn_output.strip
+
+        # Get cert details from ACM
+        cert_output, cert_status = Open3.capture2e(
+          env,
+          'aws', 'acm', 'describe-certificate',
+          '--certificate-arn', cert_arn,
+          '--output', 'json'
+        )
 
-        # Check delegation in root zone (for non-apex envs)
-        check_delegation(env_name, domain, name_servers) unless is_prod
+        return [nil, nil] unless cert_status.success?
 
-        # For apex (prod), check if DNS resolves
-        check_dns_resolution(env_domain) if is_prod && env_domain
+        cert_data = begin
+          JSON.parse(cert_output)
+        rescue StandardError
+          nil
+        end
+        return [nil, nil] unless cert_data
+
+        status = cert_data.dig('Certificate', 'Status')
+        domain = cert_data.dig('Certificate', 'DomainName')
+        [status, domain]
       end
 
-      def check_acm_cert(_env_dir, aws_env)
-        # Try to get cert status from state
+      def fetch_api_gateway_domain_status(env_name, env_config, domain)
+        require 'open3'
+
+        is_apex = apex_environment?(env_name, domain)
+        api_domain = is_apex ? "api.#{domain}" : "api.#{env_name}.#{domain}"
+
+        env = {}
+        env['AWS_PROFILE'] = env_config.aws_profile if env_config.aws_profile?
+
         output, status = Open3.capture2e(
-          aws_env,
-          'terraform', 'state', 'show', '-json', 'module.app.aws_acm_certificate.app[0]'
+          env,
+          'aws', 'apigateway', 'get-domain-name',
+          '--domain-name', api_domain,
+          '--output', 'json'
         )
-        return unless status.success?
 
-        cert_data = parse_json(output)
-        return unless cert_data
+        return :not_found unless status.success?
 
-        cert_domain = cert_data.dig('values', 'domain_name')
-        cert_status = cert_data.dig('values', 'status')
+        data = begin
+          JSON.parse(output)
+        rescue StandardError
+          nil
+        end
+        return :not_found unless data
 
-        case cert_status
-        when 'ISSUED'
-          puts "  ✓ ACM certificate: ISSUED (#{cert_domain})"
-        when 'PENDING_VALIDATION'
-          puts "  ⚠ ACM certificate: PENDING_VALIDATION (#{cert_domain})"
-          puts '    Validation CNAME may need to be in root zone for apex domains'
+        # Check if it has an endpoint
+        if data['regionalDomainName'] || data['distributionDomainName']
+          :available
         else
-          puts "  ⚠ ACM certificate: #{cert_status || 'unknown'}"
+          :pending
         end
       end
 
-      def check_delegation(env_name, _domain, _expected_ns)
-        return unless Dir.exist?(DNS_DIR)
+      def check_acm_validation_in_root(env_name, env_config, dns_config)
+        require 'open3'
+
+        validation_records = fetch_pending_acm_validation(env_name, env_config)
+        return false if validation_records.nil? || validation_records.empty?
+
+        root_zone_id = fetch_root_zone_id(dns_config)
+        return false unless root_zone_id
 
-        dns_config = load_dns_config
         env = {}
-        env['AWS_PROFILE'] = dns_config.aws_profile if dns_config.aws_profile?
+        env['AWS_PROFILE'] = dns_config.aws_profile if dns_config&.aws_profile?
 
-        # Read tfvars to check if this env is delegated
-        tfvars_path = "#{DNS_DIR}/terraform.tfvars"
-        return unless File.exist?(tfvars_path)
+        # Check if the validation CNAME exists in the root zone
+        validation_records.all? do |record|
+          output, status = Open3.capture2e(
+            env,
+            'aws', 'route53', 'list-resource-record-sets',
+            '--hosted-zone-id', root_zone_id,
+            '--query', "ResourceRecordSets[?Name=='#{record[:name]}' && Type=='CNAME']",
+            '--output', 'json'
+          )
 
-        content = File.read(tfvars_path)
-        if content.include?("#{env_name} =")
-          puts '  ✓ NS delegation configured in root zone'
-        else
-          puts '  ⚠ NS delegation not configured in root zone'
-          puts "    Run: belt dns add #{env_name}"
+          next false unless status.success?
+
+          records = begin
+            JSON.parse(output)
+          rescue StandardError
+            []
+          end
+          records.any?
         end
       end
 
-      def check_dns_resolution(domain)
-        # Try to resolve the domain
-        output, status = Open3.capture2e('dig', '+short', domain)
-        if status.success? && output.strip.length.positive?
-          ips = output.strip.split("\n")
-          puts "  ✓ DNS resolves: #{ips.first}"
-        else
-          puts "  ⚠ DNS does not resolve for #{domain}"
-          puts '    Apex A records may be missing from root zone'
+      # ═══════════════════════════════════════════════════════════════════════════
+      # ACM validation sync helpers
+      # ═══════════════════════════════════════════════════════════════════════════
+
+      def fetch_pending_acm_validation(env_name, env_config)
+        require 'open3'
+
+        env_dir = "infrastructure/#{env_name}"
+        return nil unless Dir.exist?(env_dir)
+
+        env = {}
+        env['AWS_PROFILE'] = env_config.aws_profile if env_config.aws_profile?
+
+        # Get cert ARN from terraform
+        arn_output, arn_status = Dir.chdir(env_dir) do
+          Open3.capture2e(env, 'terraform', 'output', '-raw', 'certificate_arn')
         end
-      end
 
-      def read_domain_from_dns_tfvars
-        tfvars_path = "#{DNS_DIR}/terraform.tfvars"
-        return nil unless File.exist?(tfvars_path)
+        return nil unless arn_status.success? && !arn_output.strip.empty?
 
-        content = File.read(tfvars_path)
-        match = content.match(/^\s*domain\s*=\s*"([^"]+)"/)
-        match ? match[1] : nil
+        cert_arn = arn_output.strip
+
+        # Get cert details from ACM
+        cert_output, cert_status = Open3.capture2e(
+          env,
+          'aws', 'acm', 'describe-certificate',
+          '--certificate-arn', cert_arn,
+          '--output', 'json'
+        )
+
+        return nil unless cert_status.success?
+
+        cert_data = begin
+          JSON.parse(cert_output)
+        rescue StandardError
+          nil
+        end
+        return nil unless cert_data
+
+        # Extract validation options
+        validation_options = cert_data.dig('Certificate', 'DomainValidationOptions') || []
+
+        # Return records that need DNS validation
+        validation_options.filter_map do |opt|
+          next unless opt['ValidationMethod'] == 'DNS'
+          next if opt['ValidationStatus'] == 'SUCCESS'
+
+          resource_record = opt['ResourceRecord']
+          next unless resource_record
+
+          {
+            name: resource_record['Name'],
+            type: resource_record['Type'],
+            value: resource_record['Value']
+          }
+        end
       end
 
-      def lookup_ns_records(domain)
-        output, status = Open3.capture2e('dig', '+short', 'NS', domain)
-        return [] unless status.success?
+      def create_validation_cname_in_root_zone(root_zone_id, record, dns_config)
+        require 'open3'
 
-        output.strip.split("\n").map { |ns| ns.chomp('.') }.sort
+        env = {}
+        env['AWS_PROFILE'] = dns_config.aws_profile if dns_config&.aws_profile?
+
+        # Create a change batch to upsert the CNAME
+        change_batch = {
+          'Changes' => [
+            {
+              'Action' => 'UPSERT',
+              'ResourceRecordSet' => {
+                'Name' => record[:name],
+                'Type' => 'CNAME',
+                'TTL' => 300,
+                'ResourceRecords' => [
+                  { 'Value' => record[:value] }
+                ]
+              }
+            }
+          ]
+        }
+
+        require 'tempfile'
+        Tempfile.create(['change-batch', '.json']) do |f|
+          f.write(JSON.generate(change_batch))
+          f.flush
+
+          output, status = Open3.capture2e(
+            env,
+            'aws', 'route53', 'change-resource-record-sets',
+            '--hosted-zone-id', root_zone_id,
+            '--change-batch', "file://#{f.path}"
+          )
+
+          unless status.success?
+            puts "     ⚠ Failed to create validation CNAME: #{record[:name]}" unless @quiet
+            puts "       #{output}" unless @quiet
+          end
+        end
       end
 
+      # ═══════════════════════════════════════════════════════════════════════════
+      # Original private methods
+      # ═══════════════════════════════════════════════════════════════════════════
+
       def templates
         {
           'main.tf.erb' => 'main.tf',

data/lib/belt/cli/environment_command.rb

@@ -95,11 +95,11 @@ module Belt
         if @parent_environment
           puts "\nThis is a nested environment under '#{@parent_environment}'."
           puts "It will use the parent's wildcard certificate and hosted zone."
-          if @domain
-            puts "Domain will be: api.#{@env_name}.#{@parent_environment}.#{@domain}"
-          else
-            puts "Domain will be: #{@env_name}.#{@parent_environment}.<your-domain>"
-          end
+          # Nested envs use an `api-<env>` prefix (not `api.<env>`) so the API
+          # host stays a single level under the parent's *.<parent>.<domain>
+          # wildcard cert. See lib/templates/module/dns.tf.erb (api_domain).
+          puts "Frontend will be: https://#{@env_name}.#{@parent_environment}.#{@domain}"
+          puts "API will be: https://api-#{@env_name}.#{@parent_environment}.#{@domain}"
           puts "\nDeploy with:"
           puts "  belt deploy #{@env_name}"
           puts "\nNo DNS delegation needed — the parent environment handles DNS."

data/lib/belt/cli/frontend_deploy_command.rb

@@ -75,6 +75,12 @@ module Belt
 
       private
 
+      # Load infrastructure/<env>/belt.rb and apply its aws_profile + env vars
+      # to the current process. Without this, `terraform output` can't reach the
+      # S3 state backend (403), fetch_tf_output returns nil, and the deploy aborts
+      # with a misleading "Could not determine S3 bucket" error. The full
+      # `belt deploy` path applies this before invoking the frontend deploy;
+      # standalone `belt deploy frontend` must do it too.
       def load_and_apply_env_config!
         env_config = EnvironmentConfig.load(@env, infra_dir: @infra_dir)
         env_config.apply!

data/lib/belt/cli/frontend_env_command.rb

@@ -2,8 +2,10 @@
 
 require_relative 'app_detection'
 require_relative 'env_resolver'
+require_relative 'environment_config'
 require_relative 'frontend_env_map'
 require_relative 'frontend_registry'
+require_relative 'terraform_command'
 
 module Belt
   module CLI
@@ -111,18 +113,19 @@ module Belt
       def initialize(env, frontend: nil)
         @env = env
         @app_name = detect_app_name
-        @env_dir = "infrastructure/#{@env}"
+        @infra_dir = TerraformCommand.find_infrastructure_dir || 'infrastructure'
+        @env_dir = File.join(@infra_dir, @env)
         @frontend = frontend || FrontendRegistry.new.resolve!
       end
 
       def run
+        load_and_apply_env_config!
+
         unless Dir.exist?(@frontend.path)
           abort "Error: No #{@frontend.path}/ directory found. Run `belt generate frontend react` first."
         end
 
-        unless Dir.exist?(@env_dir)
-          abort "Error: infrastructure/#{@env} not found. Run `belt generate environment #{@env}` first."
-        end
+        abort "Error: #{@env_dir} not found. Run `belt generate environment #{@env}` first." unless Dir.exist?(@env_dir)
 
         map = FrontendEnvMap.new(@env, env_dir: @env_dir, frontend_path: @frontend.path)
 
@@ -142,6 +145,12 @@ module Belt
           puts "✅ Updated #{result[:path]} (#{updated.join(', ')})"
         end
       end
+
+      private
+
+      def load_and_apply_env_config!
+        EnvironmentConfig.load(@env, infra_dir: @infra_dir).apply!
+      end
     end
   end
 end

data/lib/belt/cli/logs_command.rb

@@ -2,6 +2,8 @@
 
 require 'json'
 require 'open3'
+require_relative 'environment_config'
+require_relative 'terraform_command'
 
 module Belt
   module CLI
@@ -76,6 +78,8 @@ module Belt
         @env ||= detect_environment
         abort 'Error: Cannot determine environment. Pass -e ENV or set BELT_ENV.' unless @env
 
+        apply_env_config!
+
         @app_name = detect_app_name
         abort 'Error: Cannot determine app name.' unless @app_name
 
@@ -88,6 +92,13 @@ module Belt
 
       private
 
+      def apply_env_config!
+        infra_dir = TerraformCommand.find_infrastructure_dir || find_infra_dir
+        env_config = EnvironmentConfig.load(@env, infra_dir: infra_dir)
+        env_config.apply!
+        puts "  🔑 Using AWS profile: #{env_config.aws_profile}" if env_config.aws_profile?
+      end
+
       def parse_args(args)
         i = 0
         while i < args.length

data/lib/belt/cli/server_command.rb

@@ -3,6 +3,7 @@
 require 'base64'
 require 'json'
 require_relative 'app_detection'
+require_relative 'environment_config'
 require_relative 'frontend_env_map'
 require_relative 'frontend_registry'
 require_relative 'terraform_command'
@@ -125,6 +126,9 @@ module Belt
         env_name = @deploy_env || ENV.fetch('BELT_ENV', nil) || TerraformCommand.list_environments.first
         return {} unless env_name
 
+        infra_dir = TerraformCommand.find_infrastructure_dir
+        EnvironmentConfig.load(env_name, infra_dir: infra_dir).apply!
+
         FrontendEnvMap.new(env_name, frontend_path: @frontend.path).process_env
       rescue StandardError
         # Fall back to legacy api_url detection if map resolution fails
@@ -274,6 +278,7 @@ module Belt
           next unless Dir.exist?(env_dir)
           next unless File.exist?(File.join(env_dir, '.terraform'))
 
+          EnvironmentConfig.load(env, infra_dir: infra_dir).apply!
           url = read_api_url_from_outputs(env_dir)
           if url
             @deploy_env = env

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.4.0'
+  VERSION = '0.4.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Stowzilla