hecks 3.0.5 → 3.1.1

data/lib/hecks/projections/deploy/box/templates/box.yaml.tmpl

@@ -0,0 +1,268 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Description: >
+  One EC2 box that runs @@STACK@@'s containers with Docker Compose behind Caddy, reading the RDS
+  instance from rds.yaml. No inbound rules but an optional CDN prefix list on port 80; use SSM Session
+  Manager to reach it. Secrets are read from Secrets Manager on the box at deploy time.
+
+Parameters:
+  VpcId:
+    Type: AWS::EC2::VPC::Id
+  SubnetId:
+    Type: AWS::EC2::Subnet::Id
+    Description: A public subnet. The box needs a public IP to reach ECR and Secrets Manager.
+  DbSecurityGroupId:
+    Type: AWS::EC2::SecurityGroup::Id
+    Description: DbSecurityGroupId output of the RDS stack.
+  DbSecretArn:
+    Type: String
+    Description: DbSecretArn output of the RDS stack.
+  InstanceType:
+    Type: String
+    Default: @@INSTANCE_TYPE@@
+  AmiId:
+    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
+    Default: @@AMI_PARAMETER@@
+    Description: Never re-resolve this on a live box, because a newer image replaces the instance.
+  RootVolumeGb:
+    Type: Number
+    Default: @@VOLUME_GB@@
+  AlertTopicArn:
+    Type: String
+    Default: ""
+    Description: AlertTopicArn output of the RDS stack. Blank creates the alarms with no notification target.
+  CdnPrefixListId:
+    Type: String
+    Default: ""
+    Description: >
+      A managed prefix list of the CDN's origin-facing addresses. When set, port 80 is open to it (the
+      proxy still refuses requests without the origin secret). Blank leaves the box with no inbound at all.
+  Rehearsal:
+    Type: String
+    Default: "false"
+    AllowedValues: ["true", "false"]
+    Description: true is a throwaway box with no Elastic IP.
+
+Conditions:
+  HasPrefixList: !Not [!Equals [!Ref CdnPrefixListId, ""]]
+  HasAlerts: !Not [!Equals [!Ref AlertTopicArn, ""]]
+  IsProduction: !Equals [!Ref Rehearsal, "false"]
+
+Resources:
+  BoxSecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: @@STACK@@ app box, port 80 from the CDN only, egress to RDS and 443
+      VpcId: !Ref VpcId
+      SecurityGroupIngress:
+        - !If
+          - HasPrefixList
+          - IpProtocol: tcp
+            FromPort: 80
+            ToPort: 80
+            SourcePrefixListId: !Ref CdnPrefixListId
+            Description: CDN origin-facing addresses
+          - !Ref AWS::NoValue
+      SecurityGroupEgress:
+        - IpProtocol: tcp
+          FromPort: 5432
+          ToPort: 5432
+          DestinationSecurityGroupId: !Ref DbSecurityGroupId
+        - IpProtocol: tcp
+          FromPort: 443
+          ToPort: 443
+          CidrIp: 0.0.0.0/0
+@@TUNNEL_EGRESS@@
+  BoxToDbIngress:
+    Type: AWS::EC2::SecurityGroupIngress
+    Properties:
+      GroupId: !Ref DbSecurityGroupId
+      IpProtocol: tcp
+      FromPort: 5432
+      ToPort: 5432
+      SourceSecurityGroupId: !Ref BoxSecurityGroup
+      Description: App box
+
+  BoxRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal: { Service: ec2.amazonaws.com }
+            Action: sts:AssumeRole
+      ManagedPolicyArns:
+        - !Sub arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore
+        - !Sub arn:${AWS::Partition}:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
+      Policies:
+        - PolicyName: read-secrets
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: Allow
+                Action: secretsmanager:GetSecretValue
+                Resource:
+                  - !Ref DbSecretArn
+@@SECRET_RESOURCES@@
+@@S3_POLICY@@
+
+  BoxProfile:
+    Type: AWS::IAM::InstanceProfile
+    Properties:
+      Roles: [!Ref BoxRole]
+
+  Box:
+    Type: AWS::EC2::Instance
+    Properties:
+      ImageId: !Ref AmiId
+      InstanceType: !Ref InstanceType
+      SubnetId: !Ref SubnetId
+      SecurityGroupIds: [!Ref BoxSecurityGroup]
+      IamInstanceProfile: !Ref BoxProfile
+      BlockDeviceMappings:
+        - DeviceName: /dev/xvda
+          Ebs:
+            VolumeType: gp3
+            VolumeSize: !Ref RootVolumeGb
+            Encrypted: true
+            DeleteOnTermination: true
+      MetadataOptions:
+        HttpTokens: required
+        HttpPutResponseHopLimit: 2
+      Tags:
+        - Key: Name
+          Value: @@STACK@@-box
+        - Key: Backup
+          Value: @@STACK@@-box
+      UserData:
+        Fn::Base64: |
+          #!/bin/bash
+          set -eux
+          dnf install -y docker jq
+          systemctl enable --now docker
+          mkdir -p /usr/local/lib/docker/cli-plugins
+          curl -fsSL https://github.com/docker/compose/releases/download/v2.29.7/docker-compose-linux-$(uname -m) \
+            -o /usr/local/lib/docker/cli-plugins/docker-compose
+          chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
+@@SWAP_COMMANDS@@          mkdir -p /opt/@@STACK@@
+
+  # Production only. A CDN needs an origin DNS name that survives a stop and start; an Elastic IP
+  # keeps the instance's public DNS name stable.
+  BoxAddress:
+    Type: AWS::EC2::EIP
+    Condition: IsProduction
+    Properties:
+      Domain: vpc
+      Tags:
+        - Key: Name
+          Value: @@STACK@@-box
+
+  BoxAddressAssociation:
+    Type: AWS::EC2::EIPAssociation
+    Condition: IsProduction
+    Properties:
+      AllocationId: !GetAtt BoxAddress.AllocationId
+      InstanceId: !Ref Box
+
+  # Daily snapshot of every volume on the instance. The database has its own RDS backups; this makes
+  # rebuilding the box fast.
+  SnapshotRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal: { Service: dlm.amazonaws.com }
+            Action: sts:AssumeRole
+      ManagedPolicyArns:
+        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSDataLifecycleManagerServiceRole
+
+  SnapshotPolicy:
+    Type: AWS::DLM::LifecyclePolicy
+    Properties:
+      # DLM allows only letters, digits, spaces, underscores and hyphens here.
+      Description: Daily snapshots of the @@STACK@@ app box - keep @@SNAPSHOTS_KEEP@@
+      State: ENABLED
+      ExecutionRoleArn: !GetAtt SnapshotRole.Arn
+      PolicyDetails:
+        ResourceTypes: [INSTANCE]
+        TargetTags:
+          - Key: Backup
+            Value: @@STACK@@-box
+        Schedules:
+          - Name: daily
+            CopyTags: true
+            CreateRule:
+              Interval: 24
+              IntervalUnit: HOURS
+              Times: ["07:00"]
+            RetainRule:
+              Count: @@SNAPSHOTS_KEEP@@
+
+  # A hardware fault on the host: EC2 moves the instance to healthy hardware (same disk, same
+  # address) and the topic is told.
+  SystemStatusAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Properties:
+      AlarmDescription: EC2 system status check failing, recovering the instance
+      Namespace: AWS/EC2
+      MetricName: StatusCheckFailed_System
+      Dimensions: [{ Name: InstanceId, Value: !Ref Box }]
+      Statistic: Maximum
+      Period: 60
+      EvaluationPeriods: 2
+      Threshold: 0
+      ComparisonOperator: GreaterThanThreshold
+      TreatMissingData: notBreaching
+      AlarmActions: !If
+        - HasAlerts
+        - [!Ref AlertTopicArn, !Sub "arn:${AWS::Partition}:automate:${AWS::Region}:ec2:recover"]
+        - [!Sub "arn:${AWS::Partition}:automate:${AWS::Region}:ec2:recover"]
+
+  # The OS or networking inside the instance is unhealthy. Not auto-fixed: a reboot can lose state
+  # worth looking at.
+  InstanceStatusAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Condition: HasAlerts
+    Properties:
+      AlarmDescription: EC2 instance status check failing for 5 minutes
+      Namespace: AWS/EC2
+      MetricName: StatusCheckFailed_Instance
+      Dimensions: [{ Name: InstanceId, Value: !Ref Box }]
+      Statistic: Maximum
+      Period: 60
+      EvaluationPeriods: 5
+      Threshold: 0
+      ComparisonOperator: GreaterThanThreshold
+      TreatMissingData: notBreaching
+      AlarmActions: [!Ref AlertTopicArn]
+      OKActions: [!Ref AlertTopicArn]
+
+  CpuHighAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Condition: HasAlerts
+    Properties:
+      AlarmDescription: "Box CPU above 80% for 30 minutes"
+      Namespace: AWS/EC2
+      MetricName: CPUUtilization
+      Dimensions: [{ Name: InstanceId, Value: !Ref Box }]
+      Statistic: Average
+      Period: 300
+      EvaluationPeriods: 6
+      Threshold: 80
+      ComparisonOperator: GreaterThanThreshold
+      TreatMissingData: notBreaching
+      AlarmActions: [!Ref AlertTopicArn]
+      OKActions: [!Ref AlertTopicArn]
+@@ECR_REPOSITORIES@@
+Outputs:
+  InstanceId:
+    Value: !Ref Box
+  AppOriginDomain:
+    Condition: IsProduction
+    Description: The box's stable public DNS name, for a CDN's origin.
+    Value: !Join ["", ["ec2-", !Join ["-", !Split [".", !Ref BoxAddress]], ".@@COMPUTE_DOMAIN@@"]]
+  BoxSecurityGroupId:
+    Value: !Ref BoxSecurityGroup
+@@ECR_OUTPUTS@@

data/lib/hecks/projections/deploy/box/templates/deploy-box.sh.tmpl

@@ -0,0 +1,68 @@
+#!/bin/bash
+# Roll @@STACK@@'s app box: render the compose files, push them over SSM, start the containers and check
+# them. Exits non-zero if the roll fails or the box does not answer as expected.
+#
+@@USAGE@@
+set -euo pipefail
+HERE=$(cd "$(dirname "$0")" && pwd)
+BOX_STACK=@@BOX_STACK@@
+RDS_STACK=@@RDS_STACK@@
+REGION=@@REGION@@
+DIR=/opt/@@STACK@@
+out() { aws cloudformation describe-stacks --stack-name "$1" --query "Stacks[0].Outputs[?OutputKey==\`$2\`].OutputValue" --output text; }
+
+BOX=$(out "$BOX_STACK" InstanceId)
+DB_HOST=$(out "$RDS_STACK" DbEndpoint)
+DB_SECRET=$(out "$RDS_STACK" DbSecretArn)
+[ -n "$BOX" ] && [ "$BOX" != None ] || { echo "no instance in stack $BOX_STACK" >&2; exit 1; }
+ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
+
+WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
+( cd "$WORK" && bash "$HERE/render-compose.sh" "$DB_HOST" "$DB_SECRET" "$@" )
+
+# Run a script on the box over SSM, wait for it, print its output, return its status.
+run_on_box() {
+  local cid st i
+  cid=$(aws ssm send-command --instance-ids "$BOX" --document-name AWS-RunShellScript --timeout-seconds 900 \
+    --parameters "$1" --query 'Command.CommandId' --output text)
+  sleep 3
+  for i in $(seq 1 150); do
+    st=$(aws ssm get-command-invocation --command-id "$cid" --instance-id "$BOX" --query Status --output text)
+    [ "$st" != InProgress ] && [ "$st" != Pending ] && break
+    sleep 5
+  done
+  aws ssm get-command-invocation --command-id "$cid" --instance-id "$BOX" --query StandardOutputContent --output text
+  [ "$st" = Success ]
+}
+
+B64() { base64 < "$1" | tr -d '\n'; }
+ROLL=$(jq -n --arg compose "$(B64 "$WORK/compose.json")" --arg secrets "$(B64 "$WORK/secrets.json")" \
+  --arg caddy "$(B64 "$HERE/Caddyfile")" --arg fetch "$(B64 "$HERE/fetch-secrets.sh")" \
+  --arg registry "$ACCOUNT.dkr.ecr.$REGION.amazonaws.com" --arg dir "$DIR" '
+  {commands: ["cloud-init status --wait >/dev/null 2>&1 || true",
+    "set -e", "mkdir -p \($dir)/caddy-extra && cd \($dir)", "umask 077",
+    "echo \($compose) | base64 -d > compose.json; echo \($secrets) | base64 -d > secrets.json",
+    "echo \($caddy) | base64 -d > Caddyfile; echo \($fetch) | base64 -d > fetch-secrets.sh",
+    "bash fetch-secrets.sh",
+    "aws ecr get-login-password --region '"$REGION"' | docker login --username AWS --password-stdin \($registry) >/dev/null",
+    "docker compose -f compose.json pull --quiet",
+    "docker compose -f compose.json up -d --remove-orphans",
+    "sleep 20; docker compose -f compose.json ps --format \"table {{.Service}}\\t{{.Status}}\""],
+   executionTimeout: ["900"]}')
+
+echo "==> rolling $BOX_STACK ($BOX) at $(date -u +%H:%M:%SZ)"
+run_on_box "$ROLL" || { echo "==> the roll did not succeed" >&2; exit 1; }
+
+echo "==> checking the box"
+CHECK=$(cat <<'CHECK_EOF'
+cd @@DIR@@
+BAD=0
+@@HEALTH_CHECKS@@
+DOWN=$(docker compose -f compose.json ps --format "{{.Service}} {{.Status}}" | grep -vE " Up " || true)
+if [ -z "$DOWN" ]; then echo "ok   every container is up"; else echo "FAIL containers not up: $DOWN"; BAD=1; fi
+[ "$BAD" = 0 ]
+CHECK_EOF
+)
+CHECK_JSON=$(jq -n --arg c "$(printf '%s' "$CHECK" | base64 | tr -d '\n')" '{commands: ["echo \($c) | base64 -d | bash"]}')
+run_on_box "$CHECK_JSON" || { echo "==> the box is NOT healthy after the roll" >&2; exit 1; }
+echo "==> box roll done ($(date -u +%H:%M:%SZ))"

data/lib/hecks/projections/deploy/box/templates/fetch-secrets.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Runs ON the box. Resolves secrets.json into per-service env files that compose reads, using the
+# instance role, so secret values never pass through SSM command text.
+#
+# secrets.json: [{"service":"web","name":"AUTH_SECRET","valueFrom":"myapp/auth"}]
+# valueFrom is a secret name (its whole string is the value) or a full ARN, optionally with a JSON
+# key (arn:...:secret:NAME:jsonkey::) to pick one field of a JSON secret.
+set -eu
+cd "$(dirname "$0")"
+umask 077
+rm -f ./*.secrets.env
+jq -r '.[] | [.service, .name, .valueFrom] | @tsv' secrets.json | while IFS=$'\t' read -r svc name from; do
+  case "$from" in
+    arn:*) id=$(echo "$from" | cut -d: -f1-7); region=$(echo "$from" | cut -d: -f4); jkey=$(echo "$from" | cut -d: -f8) ;;
+    *) id=$from; region=""; jkey="" ;;
+  esac
+  val=$(aws secretsmanager get-secret-value ${region:+--region "$region"} --secret-id "$id" --query SecretString --output text)
+  if [ -n "$jkey" ]; then val=$(printf %s "$val" | jq -r --arg k "$jkey" '.[$k]'); fi
+  [ -n "$val" ] && [ "$val" != null ] || { echo "empty secret for $svc/$name" >&2; exit 1; }
+  printf '%s=%s\n' "$name" "$val" >> "$svc.secrets.env"
+done

data/lib/hecks/projections/deploy/box/templates/rds.yaml.tmpl

@@ -0,0 +1,181 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Description: >
+  Plain RDS Postgres for @@STACK@@, read by the app box (box.yaml). Private subnets only; the box's own
+  stack admits itself on 5432, so nothing else can reach it. The master password is managed by RDS in
+  Secrets Manager ({username, password}), which the box reads at deploy time.
+
+Parameters:
+  VpcId:
+    Type: AWS::EC2::VPC::Id
+  BastionSecurityGroupId:
+    Type: String
+    Default: ""
+    Description: >
+      A security group allowed to reach the database on 5432, for the bastion that restore-to-rds.sh
+      tunnels through. Blank admits nothing but the app box.
+  PrivateSubnetIds:
+    Type: List<AWS::EC2::Subnet::Id>
+    Description: At least two subnets in different availability zones (an RDS subnet group needs them).
+  InstanceClass:
+    Type: String
+    Default: @@DB_CLASS@@
+  AllocatedStorageGb:
+    Type: Number
+    Default: @@STORAGE_GB@@
+  DatabaseName:
+    Type: String
+    Default: @@DB_NAME@@
+  EngineVersion:
+    Type: String
+    Default: "@@ENGINE_VERSION@@"
+    Description: A major version ("16") lets RDS pick its current minor release.
+  BackupRetentionDays:
+    Type: Number
+    Default: @@BACKUP_DAYS@@
+  ExistingAlertTopicArn:
+    Type: String
+    Default: ""
+    Description: An SNS topic that already has subscribers. Blank creates a new topic.
+  AlertEmail:
+    Type: String
+    Default: ""
+    Description: Subscribed to a new topic (AWS sends one confirmation link). Ignored when ExistingAlertTopicArn is set.
+  Rehearsal:
+    Type: String
+    Default: "false"
+    AllowedValues: ["true", "false"]
+    Description: >
+      true is a throwaway copy (no deletion protection, no final snapshot). false is the real
+      database: deletion protection on and a snapshot taken on delete.
+
+Conditions:
+  NewTopic: !Equals [!Ref ExistingAlertTopicArn, ""]
+  NewTopicWithEmail: !And [!Condition NewTopic, !Not [!Equals [!Ref AlertEmail, ""]]]
+  IsRehearsal: !Equals [!Ref Rehearsal, "true"]
+  HasBastion: !Not [!Equals [!Ref BastionSecurityGroupId, ""]]
+
+Resources:
+  DbSecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: @@STACK@@ RDS, 5432 from the app box (the box stack adds the rule) and a bastion if given
+      VpcId: !Ref VpcId
+      SecurityGroupIngress:
+        - !If
+          - HasBastion
+          - IpProtocol: tcp
+            FromPort: 5432
+            ToPort: 5432
+            SourceSecurityGroupId: !Ref BastionSecurityGroupId
+            Description: Bastion for restore-to-rds.sh
+          - !Ref AWS::NoValue
+
+  DbSubnetGroup:
+    Type: AWS::RDS::DBSubnetGroup
+    Properties:
+      DBSubnetGroupDescription: @@STACK@@ RDS subnets
+      SubnetIds: !Ref PrivateSubnetIds
+
+  Database:
+    Type: AWS::RDS::DBInstance
+    DeletionPolicy: !If [IsRehearsal, Delete, Snapshot]
+    UpdateReplacePolicy: !If [IsRehearsal, Delete, Snapshot]
+    Properties:
+      Engine: postgres
+      EngineVersion: !Ref EngineVersion
+      DBInstanceClass: !Ref InstanceClass
+      AllocatedStorage: !Ref AllocatedStorageGb
+      StorageType: gp3
+      StorageEncrypted: true
+      DBName: !Ref DatabaseName
+      MasterUsername: postgres
+      ManageMasterUserPassword: true
+      DBSubnetGroupName: !Ref DbSubnetGroup
+      VPCSecurityGroups: [!Ref DbSecurityGroup]
+      PubliclyAccessible: false
+      MultiAZ: false
+      BackupRetentionPeriod: !Ref BackupRetentionDays
+      DeletionProtection: !If [IsRehearsal, false, true]
+      AutoMinorVersionUpgrade: true
+      CopyTagsToSnapshot: true
+      Tags:
+        - Key: Name
+          Value: @@STACK@@-rds
+
+  AlertTopic:
+    Type: AWS::SNS::Topic
+    Condition: NewTopic
+    Properties:
+      DisplayName: @@STACK@@-alerts
+
+  AlertSubscription:
+    Type: AWS::SNS::Subscription
+    Condition: NewTopicWithEmail
+    Properties:
+      TopicArn: !Ref AlertTopic
+      Protocol: email
+      Endpoint: !Ref AlertEmail
+
+  # The journal only grows, and RDS stops accepting writes when storage is full.
+  StorageLowAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Properties:
+      AlarmDescription: RDS free storage under 3 GB
+      Namespace: AWS/RDS
+      MetricName: FreeStorageSpace
+      Dimensions: [{ Name: DBInstanceIdentifier, Value: !Ref Database }]
+      Statistic: Minimum
+      Period: 300
+      EvaluationPeriods: 3
+      Threshold: 3221225472
+      ComparisonOperator: LessThanThreshold
+      TreatMissingData: breaching
+      AlarmActions: [!If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]]
+      OKActions: [!If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]]
+
+  CpuHighAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Properties:
+      AlarmDescription: "RDS CPU above 80% for 15 minutes (a burstable class may be out of credits)"
+      Namespace: AWS/RDS
+      MetricName: CPUUtilization
+      Dimensions: [{ Name: DBInstanceIdentifier, Value: !Ref Database }]
+      Statistic: Average
+      Period: 300
+      EvaluationPeriods: 3
+      Threshold: 80
+      ComparisonOperator: GreaterThanThreshold
+      TreatMissingData: notBreaching
+      AlarmActions: [!If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]]
+      OKActions: [!If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]]
+
+  MemoryLowAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Properties:
+      AlarmDescription: RDS freeable memory under 100 MB for 15 minutes
+      Namespace: AWS/RDS
+      MetricName: FreeableMemory
+      Dimensions: [{ Name: DBInstanceIdentifier, Value: !Ref Database }]
+      Statistic: Minimum
+      Period: 300
+      EvaluationPeriods: 3
+      Threshold: 104857600
+      ComparisonOperator: LessThanThreshold
+      TreatMissingData: notBreaching
+      AlarmActions: [!If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]]
+      OKActions: [!If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]]
+
+Outputs:
+  AlertTopicArn:
+    Description: Pass as AlertTopicArn to the box stack.
+    Value: !If [NewTopic, !Ref AlertTopic, !Ref ExistingAlertTopicArn]
+  DbEndpoint:
+    Value: !GetAtt Database.Endpoint.Address
+  DbName:
+    Value: !Ref DatabaseName
+  DbSecretArn:
+    Description: RDS-managed master secret ({username, password}).
+    Value: !GetAtt Database.MasterUserSecret.SecretArn
+  DbSecurityGroupId:
+    Description: Pass as DbSecurityGroupId to the box stack.
+    Value: !Ref DbSecurityGroup

data/lib/hecks/projections/deploy/box/templates/render-compose-taskdef.sh.tmpl

@@ -0,0 +1,49 @@
+#!/bin/bash
+# Render compose.json and secrets.json for @@STACK@@'s app box from an ECS task definition.
+#
+#   render-compose.sh <db-host> <db-secret-arn> [task-definition]
+#
+# The task definition (a family or family:revision; default: the latest active revision of @@FAMILY@@)
+# is the source of truth for each container's image, environment and secrets, so the box starts with
+# what the task would have. A container the box runs must be named in it. DB_HOST and DB_SECRET_ARN
+# are replaced with the RDS stack's values where the task defines them, and every container runs on
+# the box's own network, so the proxy reaches each one on 127.0.0.1:<port>. Secrets (name + valueFrom)
+# are written to secrets.json for fetch-secrets.sh to resolve on the box.
+set -euo pipefail
+HERE=$(cd "$(dirname "$0")" && pwd)
+DB_HOST=${1:?rds endpoint}
+DB_SECRET=${2:?rds secret arn}
+TD=${3:-@@FAMILY@@}
+
+DEF=$(aws ecs describe-task-definition --task-definition "$TD" --query 'taskDefinition.containerDefinitions' --output json)
+echo "rendering from task definition $TD" >&2
+
+jq --argjson def "$DEF" --arg host "$DB_HOST" --arg secret "$DB_SECRET" '
+  def log: {driver: "json-file", options: {"max-size": "10m", "max-file": "3"}};
+  def env(c): ((c.environment // []) | map({(.name): .value}) | add // {})
+    | (if has("DB_HOST") then .DB_HOST = $host | .DB_SECRET_ARN = $secret else . end);
+  . as $in
+  | {services: (
+      ($in.services | with_entries(.value |= (. as $s
+        | ($def | map(select(.name == $s.name)) | first) as $c
+        | if $c == null then error("task definition has no container named " + $s.name) else
+            {image: $c.image, network_mode: "host", restart: "unless-stopped", logging: log,
+             environment: ({PORT: ($s.port | tostring)} + env($c))}
+            + (if (($c.secrets // []) | length) > 0 then {env_file: [($s.name + ".secrets.env")]} else {} end)
+          end)))
+      + {caddy: ({image: "@@PROXY_IMAGE@@", network_mode: "host", restart: "unless-stopped",
+                  volumes: ["./Caddyfile:/etc/caddy/Caddyfile:ro", "./caddy-extra:/etc/caddy/extra:ro"], logging: log}
+                 + (if $in.origin then {env_file: ["caddy.secrets.env"]} else {} end))}
+      + (if $in.tunnel then {cloudflared: {image: $in.tunnel.image, network_mode: "host", restart: "unless-stopped",
+                  command: ["tunnel", "--no-autoupdate", "--url", $in.tunnel.url, "run"],
+                  env_file: ["cloudflared.secrets.env"], logging: log}} else {} end))}' \
+  "$HERE/services.json" > compose.json
+
+jq --argjson def "$DEF" '. as $in
+    | [ ($in.services | keys[]) as $n | $def[] | select(.name == $n) | (.secrets // [])[]
+        | {service: $n, name: .name, valueFrom: .valueFrom} ]
+      + [ (if $in.origin then {service: "caddy", name: "ORIGIN_SECRET", valueFrom: $in.origin.secret} else empty end),
+          (if $in.tunnel then {service: "cloudflared", name: "TUNNEL_TOKEN", valueFrom: $in.tunnel.token_secret} else empty end) ]' \
+  "$HERE/services.json" > secrets.json
+
+echo "rendered compose.json and secrets.json ($(jq '.services | length' compose.json) services)"

data/lib/hecks/projections/deploy/box/templates/render-compose.sh.tmpl

@@ -0,0 +1,43 @@
+#!/bin/bash
+# Render compose.json and secrets.json for @@STACK@@'s app box from services.json.
+#
+#   render-compose.sh <db-host> <db-secret-arn> [name=tag ...]
+#
+# Tags default to "latest". Every container gets DB_HOST, DB_NAME, DB_SECRET_ARN and PORT, and runs on the
+# box's own network, so the proxy reaches each one on 127.0.0.1:<port>. Secrets named in services.json
+# are written to secrets.json for fetch-secrets.sh to resolve on the box.
+set -euo pipefail
+HERE=$(cd "$(dirname "$0")" && pwd)
+DB_HOST=${1:?rds endpoint}
+DB_SECRET=${2:?rds secret arn}
+shift 2
+
+REGION=@@REGION@@
+ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
+ECR="$ACCOUNT.dkr.ecr.$REGION.amazonaws.com"
+TAGS=$(printf '%s\n' "$@" | jq -R 'select(length > 0) | split("=") | {(.[0]): .[1]}' | jq -s 'add // {}')
+
+jq --arg ecr "$ECR" --argjson tags "$TAGS" --arg host "$DB_HOST" --arg secret "$DB_SECRET" --arg db "@@DB_NAME@@" '
+  def log: {driver: "json-file", options: {"max-size": "10m", "max-file": "3"}};
+  . as $in
+  | {services: (
+      ($in.services | with_entries(.value |= (
+        {image: ($ecr + "/" + .repository + ":" + ($tags[.name] // "latest")),
+         network_mode: "host", restart: "unless-stopped", logging: log,
+         environment: ({PORT: (.port | tostring), DB_HOST: $host, DB_NAME: $db, DB_SECRET_ARN: $secret} + .env)}
+        + (if (.secrets | length) > 0 then {env_file: [(.name + ".secrets.env")]} else {} end))))
+      + {caddy: ({image: "@@PROXY_IMAGE@@", network_mode: "host", restart: "unless-stopped",
+                  volumes: ["./Caddyfile:/etc/caddy/Caddyfile:ro", "./caddy-extra:/etc/caddy/extra:ro"], logging: log}
+                 + (if $in.origin then {env_file: ["caddy.secrets.env"]} else {} end))}
+      + (if $in.tunnel then {cloudflared: {image: $in.tunnel.image, network_mode: "host", restart: "unless-stopped",
+                  command: ["tunnel", "--no-autoupdate", "--url", $in.tunnel.url, "run"],
+                  env_file: ["cloudflared.secrets.env"], logging: log}} else {} end))}' \
+  "$HERE/services.json" > compose.json
+
+jq '. as $in
+    | [ ($in.services[] | . as $v | ($v.secrets | to_entries[]) | {service: $v.name, name: .key, valueFrom: .value}),
+        (if $in.origin then {service: "caddy", name: "ORIGIN_SECRET", valueFrom: $in.origin.secret} else empty end),
+        (if $in.tunnel then {service: "cloudflared", name: "TUNNEL_TOKEN", valueFrom: $in.tunnel.token_secret} else empty end) ]' \
+  "$HERE/services.json" > secrets.json
+
+echo "rendered compose.json and secrets.json ($(jq '.services | length' compose.json) services)"