belt 0.4.6 → 0.4.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f29c42b3eb7869a90ab1a0a22d56fd6b1304dbd6e22f32503669b3c9b0974890
-  data.tar.gz: f313115ee77ceafb82a4c424c6721f6776f3b869c1b71cc1e458332bc16b53fd
+  metadata.gz: 21aaed39c7b6868b8c6f370cbc97a686bf369f7d3fe7a03c56b850c1bc49fd62
+  data.tar.gz: 8825ef22ce89cee45435dcd1e7b405c954c9f630e90f569ee0d575de33db5b49
 SHA512:
-  metadata.gz: 57150cb2d0934d723b6fafb9eaee652dc933c4522fcae787518d2e03990da13e1c9f229d498b990a86fb1daa90ec3916e4e049e411a418a4534e76f4274a658e
-  data.tar.gz: 8e2d42b8ba9417dacdf725a66cc0e0a0d37e3a7ae59c3085a50f40c7c1e38eb298be49fa0a0ac3d3489e445e3907d85174bc07f45959a385ccbe55a605a5016d
+  metadata.gz: 9bdf007e3adcc59dd1e852f2d9563002416272ae4f954ce72231856bead07c261cc6bad6a86a8b6bbdbc6a2896b321eb717dcf5f70bda7e77cc2538ed67b2970
+  data.tar.gz: 95c20325ca7427776e6c08dbf9c6e2ad3a8dacb4293339bf24cb48dc74021a887dfd0152865a0cc295c311314047f605119e22ea8b293ba9e9dbb977a0a8c549

data/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.4.8
+
+### Added
+
+- **`belt deploy` auto-bootstraps the ACM certificate on first deploy.** First-time
+  deploys hit the classic ACM chicken-and-egg problem: `terraform plan` fails because
+  `domain_validation_options` aren't known until the certificate is applied. Belt now
+  detects that error pattern, runs
+  `terraform apply -target=module.app.aws_acm_certificate.app` to create the certificate,
+  and re-runs the plan automatically. No manual terraform commands needed — first-time
+  deploys just work. This is a one-time bootstrap; subsequent deploys run normally since
+  the certificate already exists.
+
+## 0.4.7
+
+### Bug Fix
+
+- **`apex_dns_sync` now publishes SES DKIM CNAMEs to the root zone.** Apex
+  environments delegate the bare domain to the shared-services root zone, so DNS
+  records written only to the prod-account zone never reach the internet.
+  `ApexDnsSync` already mirrored apex/www/api A aliases and ACM validation CNAMEs
+  into the root zone, but not the 3 SES DKIM CNAMEs — leaving SES domain email at
+  the apex stuck in `PENDING` / `HOST_NOT_FOUND` with every send rejected.
+  `#run` now reads the domain identity's DKIM tokens from SES (under the prod
+  profile) and upserts `<token>._domainkey.<domain>` → `<token>.dkim.amazonses.com`
+  into the root zone via the same cross-account write path. No-ops silently when
+  the domain has no SES identity, so email-less apps are unaffected.
+
 ## 0.4.6
 
 ### Added

data/lib/belt/cli/apex_dns_sync.rb

@@ -62,6 +62,12 @@ module Belt
         # Sync ACM validation first (cert must validate before CloudFront works)
         sync_acm_validation(root_zone_id, targets[:domain])
 
+        # Sync SES DKIM CNAMEs so the email domain identity can verify. Like the
+        # apex A records, these must live in the ROOT zone (the registrar delegates
+        # the apex there) — writing them to the prod account's own zone leaves them
+        # invisible and the SES identity stuck at PENDING/HOST_NOT_FOUND.
+        sync_dkim_cnames(root_zone_id, targets[:domain])
+
         # Sync A alias records
         sync_alias_records(root_zone_id, targets)
 
@@ -303,6 +309,75 @@ module Belt
         end
       end
 
+      # Publish the SES Easy-DKIM CNAMEs for the apex email domain into the root
+      # zone. SES issues three tokens per domain identity; each maps to a CNAME
+      # "<token>._domainkey.<domain>" -> "<token>.dkim.amazonses.com". Publishing
+      # them where the domain is actually delegated (the root zone) is what flips
+      # the identity from PENDING/HOST_NOT_FOUND to verified so sends are accepted.
+      # No-ops quietly when the domain has no SES identity (email not enabled).
+      def sync_dkim_cnames(root_zone_id, domain)
+        return unless domain
+
+        tokens = fetch_dkim_tokens(domain)
+        return if tokens.empty?
+
+        changes = build_dkim_changes(domain, tokens)
+        upsert_dkim_cnames(root_zone_id, changes, tokens.size)
+      end
+
+      # Read the domain identity's DKIM tokens from SES under the PROD profile
+      # (that's the account that owns the identity). Returns [] if there's no
+      # identity or SES call fails, so email-less apps skip silently.
+      def fetch_dkim_tokens(domain)
+        env = aws_env_for(@env_config)
+
+        output, status = Open3.capture2e(
+          env,
+          'aws', 'sesv2', 'get-email-identity',
+          '--email-identity', domain,
+          '--output', 'json'
+        )
+        return [] unless status.success?
+
+        data = parse_json(output) || {}
+        data.dig('DkimAttributes', 'Tokens') || []
+      end
+
+      def build_dkim_changes(domain, tokens)
+        tokens.map do |token|
+          {
+            Action: 'UPSERT',
+            ResourceRecordSet: {
+              Name: "#{token}._domainkey.#{domain}",
+              Type: 'CNAME',
+              TTL: 300,
+              ResourceRecords: [{ Value: "#{token}.dkim.amazonses.com" }]
+            }
+          }
+        end
+      end
+
+      def upsert_dkim_cnames(root_zone_id, changes, count)
+        change_batch = {
+          Comment: 'Belt SES DKIM sync',
+          Changes: changes
+        }
+
+        dns_env = aws_env_for(@dns_config)
+        _, status = Open3.capture2e(
+          dns_env,
+          'aws', 'route53', 'change-resource-record-sets',
+          '--hosted-zone-id', root_zone_id,
+          '--change-batch', JSON.generate(change_batch)
+        )
+
+        if status.success?
+          puts "    ✓ SES DKIM CNAMEs synced (#{count})" unless @quiet
+        else
+          puts '    ⚠ Failed to sync SES DKIM CNAMEs' unless @quiet
+        end
+      end
+
       def alias_change(action, name, target_domain, target_zone_id)
         {
           Action: action,

data/lib/belt/cli/deploy_command.rb

@@ -731,9 +731,87 @@ module Belt
 
       def run_plan
         puts '━━━ terraform plan ━━━'
-        success = system('terraform', 'plan', '-out=tfplan', *@extra_args)
-        abort "\n✗ terraform plan failed" unless success
+
+        stderr_buffer = run_terraform_plan
+        return if stderr_buffer.nil? # Success
+
+        # If ACM for_each error, auto-bootstrap and retry
+        return if acm_for_each_error?(stderr_buffer) && acm_bootstrap_succeeded?
+
+        abort "\n✗ terraform plan failed"
+      end
+
+      # Returns nil on success, stderr buffer on failure
+      def run_terraform_plan
+        require 'open3'
+        stderr_buffer = +''
+
+        Open3.popen3('terraform', 'plan', '-out=tfplan', *@extra_args) do |_stdin, stdout, stderr, wait_thr|
+          stdout_thread = Thread.new do
+            while (line = stdout.gets)
+              print line
+            end
+          end
+
+          stderr_thread = Thread.new do
+            while (line = stderr.gets)
+              stderr_buffer << line
+              $stderr.print line
+            end
+          end
+
+          stdout_thread.join
+          stderr_thread.join
+
+          return nil if wait_thr.value.success?
+        end
+
+        stderr_buffer
+      end
+
+      def acm_for_each_error?(output)
+        # Detect the ACM certificate for_each chicken-and-egg error
+        output.include?('for_each') &&
+          output.include?('domain_validation_options') &&
+          output.include?('cannot be determined until apply')
+      end
+
+      # Returns true if bootstrap succeeded and retry plan passed
+      def acm_bootstrap_succeeded?
+        puts ''
+        puts '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'
+        puts '  ACM CERTIFICATE BOOTSTRAP'
+        puts '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'
+        puts ''
+        puts '  First-time deploy detected. Terraform needs the ACM certificate'
+        puts '  to exist before it can create DNS validation records.'
+        puts ''
+        puts '  Creating certificate now...'
         puts ''
+
+        # Phase 1: Create the certificate only
+        success = system('terraform', 'apply', '-target=module.app.aws_acm_certificate.app', '-auto-approve')
+        unless success
+          puts ''
+          puts '  ✗ Certificate creation failed.'
+          return false
+        end
+
+        puts ''
+        puts '  ✓ Certificate created. Re-running plan...'
+        puts ''
+
+        # Phase 2: Retry the plan
+        stderr_buffer = run_terraform_plan
+        if stderr_buffer.nil?
+          puts ''
+          return true # Success!
+        end
+
+        # Still failing - something else is wrong
+        puts ''
+        puts '  ✗ Plan still failing after bootstrap. Check the errors above.'
+        false
       end
 
       def confirm_apply?

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.4.6'
+  VERSION = '0.4.8'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.4.6
+  version: 0.4.8
 platform: ruby
 authors:
 - Stowzilla