hecks 3.4.2 → 3.6.0

data/lib/hecks/projections/deploy/fargate/settings.rb

@@ -4,6 +4,8 @@ require_relative "containers"
 require_relative "cdn"
 require_relative "monitoring"
 require_relative "extras"
+require_relative "settings/ids"
+require_relative "settings/tuning"
 
 module Hecks
   module Projections
@@ -14,8 +16,6 @@ module Hecks
         #
         # A world that sets none of these keys resolves entirely to the generator's own defaults.
         module Settings
-          module_function
-
           Plan = Struct.new(
             :ids, :names, :layout, :cdn, :alerts, :extras, :execute_command, :health_check_grace_period,
             :deregistration_delay, :desired_count_parameter, :domain_env, :install_dir, :build_context_dir,
@@ -38,15 +38,18 @@ module Hecks
           NAME_ROLES = [:cluster, :log_group, :service, :alb, :family, :alb_security_group_description, :db_secret_policy].freeze
           DEFAULT_INSTALL_DIR = "/usr/local/bin".freeze
 
+          extend Ids
+          extend Tuning
+
+          module_function
+
           # Reads and checks every optional setting into a frozen `Plan`, applying every default.
           def resolve(settings, base)
             ids = logical_ids(settings[:logical_ids], base)
             layout = Containers.normalize(settings, infra_name: base[:infra_name], port: base[:port], ids: ids)
             cdn = Cdn.normalize(settings[:cdn], default_origin_id: "#{ids[:alb]}Origin")
-            alerts = Monitoring.normalize(settings[:alerts], containers: layout.balanced.map(&:name))
-            check_alerts!(alerts, cdn)
-            plan = Plan.new(ids: ids, names: names(settings[:names], base), layout: layout, cdn: cdn, alerts: alerts,
-                            extras: Extras.normalize(settings))
+            alerts = read_alerts(settings, layout, cdn)
+            plan = Plan.new(ids: ids, layout: layout, cdn: cdn, alerts: alerts, **plan_parts(settings, base))
             tuning(plan, settings, base)
             plan.freeze
           end
@@ -60,107 +63,17 @@ module Hecks
             ].reject(&:empty?).join
           end
 
-          def logical_ids(overrides, base)
-            given = if overrides
-                      Check.hash!(overrides, "logical_ids",
-                                  allowed: ID_ROLES.keys + FIXED_IDS.keys + [:database_prefix, :compute_prefix])
-                    else
-                      {}
-                    end
-            derived = ID_ROLES.to_h { |role, suffix| [role, suffix ? "#{base[:logical_id]}#{suffix}" : base[:logical_id]] }
-            derived.merge!(FIXED_IDS)
-            derived[:database_prefix] = base[:db_id]
-            derived[:compute_prefix] = base[:logical_id]
-            given.each { |role, id| derived[role] = Check.logical_id!(id, "logical_ids #{role}") }
-            derived.freeze
-          end
-          private_class_method :logical_ids
-
-          def names(overrides, base)
-            given = overrides ? Check.hash!(overrides, "names", allowed: NAME_ROLES) : {}
-            stack = base[:stack_name]
-            derived = {
-              cluster: stack, log_group: "/ecs/#{stack}", service: stack, alb: "#{stack}-alb",
-              family: base[:infra_name], db_secret_policy: "DbSecretRead"
-            }
-            given.each { |role, name| derived[role] = named(role, name) }
-            derived.freeze
-          end
-          private_class_method :names
-
-          def named(role, value)
-            return Check.resource_name!(value, "names #{role}") unless role == :alb_security_group_description
-
-            text = value.to_s
-            return text if text.match?(/\A[\x20-\x7e]{1,255}\z/)
-
-            raise ArgumentError,
-                  "names #{role} must be 1 to 255 printable ASCII characters (EC2 rejects anything else), got #{value.inspect}"
-          end
-          private_class_method :named
-
-          def check_alerts!(alerts, cdn)
-            return unless alerts
-            if Monitoring.cloudfront_metrics?(alerts) && cdn.nil?
-              raise ArgumentError, "alerts cloudfront_5xx needs cdn options to be set, " \
-                                   "so its metric subscription is declared with the distribution"
-            end
-          end
-          private_class_method :check_alerts!
-
-          def tuning(plan, settings, base)
-            plan.execute_command = Check.boolean!(settings.fetch(:execute_command, false), "execute_command")
-            plan.health_check_grace_period = optional_integer(settings, :health_check_grace_period, 0..2_147_483_647)
-            plan.deregistration_delay = optional_integer(settings, :deregistration_delay, 0..3600)
-            plan.desired_count_parameter = optional_id(settings, :desired_count_parameter)
-            plan.db_name_parameter = optional_id(settings, :db_name_parameter)
-            if plan.db_name_parameter && !base[:shared]
-              raise ArgumentError,
-                    "db_name_parameter applies only to database \"Shared\""
-            end
-
-            plan.execution_database_grant = Check.boolean!(settings.fetch(:execution_role_database_grant, true),
-                                                           "execution_role_database_grant")
-            if !plan.execution_database_grant && plan.extras[:execution_policies].empty?
-              raise ArgumentError, "execution_role_database_grant false leaves the execution role without a policy; " \
-                                   "add one to execution_policies"
-            end
-
-            plan.domain_env = Check.map!(settings.fetch(:domain_env, {}), "domain_env", nil_ok: true)
-            plan.install_dir = install_dir(settings.fetch(:install_dir, DEFAULT_INSTALL_DIR))
-            plan.build_context_dir = build_context_dir(settings.fetch(:build_context_dir, ""))
-          end
-          private_class_method :tuning
-
-          def optional_integer(settings, key, range)
-            settings.key?(key) ? Check.integer!(settings[key], key.to_s, range: range) : nil
-          end
-          private_class_method :optional_integer
-
-          def optional_id(settings, key)
-            settings.key?(key) ? Check.logical_id!(settings[key], key.to_s) : nil
-          end
-          private_class_method :optional_id
-
-          def install_dir(value)
-            text = value.to_s
-            unless text.match?(%r{\A/[A-Za-z0-9_./-]*[A-Za-z0-9_.-]\z})
-              raise ArgumentError,
-                    "install_dir must be an absolute path without a trailing slash, got #{value.inspect}"
-            end
-
-            text
+          def read_alerts(settings, layout, cdn)
+            alerts = Monitoring.normalize(settings[:alerts], containers: layout.balanced.map(&:name))
+            check_alerts!(alerts, cdn)
+            alerts
           end
-          private_class_method :install_dir
-
-          def build_context_dir(value)
-            text = value.to_s
-            return text if text.empty? || text.match?(%r{\A[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)*/\z})
+          private_class_method :read_alerts
 
-            raise ArgumentError,
-                  "build_context_dir must be a relative directory ending in /, such as \"build/\", got #{value.inspect}"
+          def plan_parts(settings, base)
+            { names: names(settings[:names], base), extras: Extras.normalize(settings) }
           end
-          private_class_method :build_context_dir
+          private_class_method :plan_parts
 
           def count_parameter_yaml(plan, default_count)
             return "" unless plan.desired_count_parameter

data/lib/hecks/projections/deploy/fargate/stack/blocks.rb

@@ -0,0 +1,91 @@
+require_relative "../../text_template"
+require_relative "../../shared"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        class Stack
+          # The multi-line pieces of the template that depend on the stack's shape: its parameters,
+          # the VPC and database it owns, and the outputs the bastion reads.
+          module Blocks
+            # Always true for Fargate: unlike Lambda's opt-in NAT Gateway, a Fargate task always
+            # needs internet-facing infra (ALB ingress, ECR/Logs/Secrets egress), so
+            # `Shared.vpc_and_database_yaml`'s NAT Gateway is unconditional.
+            def network
+              Shared::Network.new(shared: shared, db_id: db_id, db_ref_id: db_ref_id, db_name: db_name,
+                                  infra_name: infra_name, aurora: aurora, google_oauth_present: true)
+            end
+
+            # @return [Array<Hash{Symbol => String}>] the stack-to-bastion contract's outputs
+            # @raise [RuntimeError] if a bastion parameter names an output the stack does not
+            #   declare
+            def stack_outputs
+              group = compute_security_group_ref
+              outputs = Shared.stack_outputs(network, secret_intrinsic: secret_intrinsic, compute_security_group_ref: group)
+              Shared.check_bastion_parameters!(bastion_parameters, outputs)
+              outputs
+            end
+
+            def bastion_parameters
+              Shared.bastion_parameters(shared: shared, google_oauth_present: true)
+            end
+
+            def parameters_block
+              yaml = [always_params_yaml, oauth_params_yaml, owning_params_yaml, extra_params_yaml].reject(&:empty?).join("\n")
+              yaml.empty? ? "" : "Parameters:\n#{yaml.each_line.map { |line| "  #{line}" }.join}"
+            end
+
+            def network_resources
+              return "" if shared
+
+              compute_id = ids[:compute_prefix]
+              description = compute_description
+              yaml = Shared.vpc_and_database_yaml(network, compute_logical_id: compute_id, compute_description: description)
+              yaml.each_line.with_index.map { |line, i| (i.zero? ? "" : "  ") + line }.join.rstrip
+            end
+
+            # Built outside the template so re-indenting it cannot shift this YAML out of sync with
+            # SessionSecretRead/env, the same pattern as `Lambda`'s own `OAUTHPOLICY`.
+            def oauth_task_policy_yaml
+              google_oauth_present ? TextTemplate.render_from("fargate/oauth_task_policy.tmpl", self).rstrip : ""
+            end
+
+            def oauth_task_env_yaml
+              google_oauth_present ? TextTemplate.render_from("fargate/oauth_task_env.tmpl", self).rstrip : ""
+            end
+
+            def oauth_task_policy_marker = oauth_task_policy_yaml.empty? ? "" : "# TMPL:oauth_task_policy"
+            def oauth_task_env_marker = oauth_task_env_yaml.empty? ? "" : "# TMPL:oauth_task_env"
+
+            def output_lines
+              stack_outputs.map { |output| "#{output[:key]}:\n    Value: #{output[:ref]}" }.join("\n  ")
+            end
+
+            private
+
+            def compute_description
+              "#{logical_id} - inbound from #{alb_sg_id} only, egress rules attached separately below"
+            end
+
+            def always_params_yaml
+              TextTemplate.render_from("fargate/always_params.tmpl", self).rstrip
+            end
+
+            def oauth_params_yaml
+              google_oauth_present ? TextTemplate.render_from("fargate/oauth_params.tmpl", self).rstrip : ""
+            end
+
+            def owning_params_yaml
+              shared ? TextTemplate.render_from("fargate/owning_params.tmpl", self).rstrip : ""
+            end
+
+            def extra_params_yaml
+              Settings.parameters_yaml(plan, default_count: desired_count, shared_db_name: owner_db_name).rstrip
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/stack/readers.rb

@@ -0,0 +1,87 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        class Stack
+          # The ids, names and references of a stack's resources, derived from its plan. Each method
+          # is also the value of the template marker of the same name.
+          module Readers
+            def ids = plan.ids
+            def names = plan.names
+            def layout = plan.layout
+            def domain_container = layout.domain
+
+            def db_id = ids[:database_prefix]
+            def db_ref_id = aurora ? "#{db_id}Cluster" : db_id
+            def secret_sub = aurora ? "#{db_id}Secret" : "#{db_ref_id}.MasterUserSecret.SecretArn"
+            def secret_intrinsic = aurora ? "!Ref #{db_id}Secret" : "!GetAtt #{db_ref_id}.MasterUserSecret.SecretArn"
+            def db_secret_ref = shared ? "OwningDatabaseSecretArn" : secret_sub
+            def db_name_ref = plan.db_name_parameter ? "!Ref #{plan.db_name_parameter}" : nil
+
+            # Never created when `shared`: this domain's own VPC (and its compute security group) is
+            # skipped entirely; the task and ALB-ingress rule reach through the borrowed owner's
+            # security group instead.
+            def compute_security_group_ref = shared ? "!Ref OwningSecurityGroupId" : "!Ref #{ids[:compute_prefix]}SecurityGroup"
+
+            # `logical_id` stays the derived name in prose (descriptions, comments); the ids below
+            # are what the resources are actually declared with, which the world's `logical_ids`
+            # setting may replace.
+            def service_id = ids[:service]
+            def ecr_repository_id = ids[:ecr_repository]
+            def cluster_id = ids[:cluster]
+            def task_definition_id = ids[:task_definition]
+            def execution_role_id = ids[:execution_role]
+            def task_role_id = ids[:task_role]
+            def log_group_id = ids[:log_group]
+            def target_group_id = ids[:target_group]
+            def alb_id = ids[:alb]
+            def alb_sg_id = ids[:alb_security_group]
+            def listener_id = ids[:listener]
+            def distribution_id = ids[:distribution]
+            def session_secret_id = ids[:session_secret]
+            def ingress_from_alb_id = ids[:ingress_from_alb]
+            def default_target_group_id = layout.default.target_group_id
+
+            def cluster_name = names[:cluster]
+            def log_group_name = names[:log_group]
+            def family_name = names[:family]
+            def alb_name = names[:alb]
+            def service_name = names[:service]
+            def db_secret_policy_name = names[:db_secret_policy]
+
+            def alb_sg_description
+              names[:alb_security_group_description] ||
+                "#{alb_sg_id} - HTTP ingress from CloudFront only, forwarded to #{logical_id} only"
+            end
+
+            def repository_name = domain_container.repository_name
+            def container_name = domain_container.name
+            def tag_parameter = domain_container.tag_parameter
+            def health_path = domain_container.health_path
+
+            def port_min = Containers.port_range(layout).min
+            def port_max = Containers.port_range(layout).max
+            def depends_on = Containers.depends_on(layout, listener_id)
+            def vpc_ref = shared ? "!Ref OwningVpcId" : "!Ref #{db_id}Vpc"
+            def sidecar_dir = plan.install_dir
+            def build_context_dir = plan.build_context_dir
+            def cmd_binary = sidecar_dir == Settings::DEFAULT_INSTALL_DIR ? domain_name : "#{sidecar_dir}/#{domain_name}"
+            def desired_count_value = plan.desired_count_parameter ? "!Ref #{plan.desired_count_parameter}" : desired_count
+            def declared_domain_literal = declared_domain_name.inspect
+            def schema_setting = hecks_schema ? ", schema: #{hecks_schema.inspect}" : ""
+
+            def alb_subnets
+              return "[!Ref OwningPublicSubnetAId, !Ref OwningPublicSubnetBId]" if shared
+
+              "[!Ref #{db_id}PublicSubnet, !Ref #{db_id}BastionPublicSubnet]"
+            end
+
+            def service_subnets
+              shared ? "[!Ref OwningSubnetAId, !Ref OwningSubnetBId]" : "[!Ref #{db_id}SubnetA, !Ref #{db_id}SubnetB]"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/stack/recipes.rb

@@ -0,0 +1,106 @@
+require_relative "../../text_template"
+require_relative "../../bastion_lines"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        class Stack
+          # The pieces of the generated Makefile that depend on the stack's shape: how `make deploy`
+          # finds the stack's parameters and how `make mint-era` boots it.
+          module Recipes
+            include BastionLines
+
+            def deploy_command
+              file = shared ? "fargate/deploy_shared.tmpl" : "fargate/deploy_plain.tmpl"
+              TextTemplate.render_from(file, self).chomp
+            end
+
+            # `mint-era` isn't automated for a Shared-mode domain; the other mode runs the same
+            # bastion/tunnel/retry/teardown chain `Lambda`'s own generated Makefile uses.
+            def mint_era
+              file = shared ? "fargate/mint_era_shared.tmpl" : "fargate/mint_era_own.tmpl"
+              TextTemplate.render_from(file, self).rstrip
+            end
+
+            # @return [Hash{Symbol => String}] the ids `Assembly.apply` fills the template's
+            #   sections from
+            def assembly_context
+              { stack_name: stack_name, vpc_ref: vpc_ref, listener_id: listener_id, alb_id: alb_id,
+                distribution_id: distribution_id, db_secret_ref: db_secret_ref }
+            end
+
+            # @return [Hash{Symbol => Object}] what a preview stack borrows from this one
+            def preview_main
+              {
+                infra_name: infra_name, stack_name: stack_name, stack_prefix: stack_prefix, region: region,
+                cpu: cpu, memory: memory, db_name: shared ? owner_db_name : db_name,
+                owner_stack: shared ? owner_stack_name : nil, name: infra_name, port: port,
+                **preview_image
+              }
+            end
+
+            # Renders DB_HOST/DB_NAME/DB_SECRET_ARN, spliced in after the template renders.
+            #
+            # @param base [String] the indentation of the `# TMPL:db_env` marker line
+            def db_env_yaml(base)
+              lines = shared ? shared_db_lines : own_db_lines
+              lines += ["- Name: HECKS_SCHEMA", "  Value: #{hecks_schema}"] if hecks_schema
+              "#{lines.map { |line| "#{base}#{line}" }.join("\n")}\n"
+            end
+
+            # Renders one `AWS::IAM::Role` `Policies` entry per cross-domain target, the shape that
+            # resource type requires, unlike the bare shorthand
+            # `Shared.cross_domain_invoke_policy_yaml` renders for SAM.
+            #
+            # @param base [String] the indentation of the marker line
+            def cross_domain_policy_yaml(base)
+              resources = cross_domain_targets.map do |target|
+                "#{base}          - !Sub \"arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:hecks-#{target.downcase}\""
+              end
+              "#{[*cross_domain_comment(base), *cross_domain_statement(base), *resources].join("\n")}\n"
+            end
+
+            private
+
+            def preview_image
+              {
+                image: "#{repository_name}:latest", domain: declared_domain_name, web: web,
+                wasm_path: "/usr/local/bin/#{domain_name}.wasm", ir_path: "/usr/local/bin/#{domain_name}.ir.json",
+                schema: hecks_schema
+              }
+            end
+
+            def shared_db_lines
+              [
+                "- Name: DB_HOST", "  Value: !Ref OwningDatabaseEndpoint",
+                "- Name: DB_NAME", "  Value: #{db_name_ref || owner_db_name}",
+                "- Name: DB_SECRET_ARN", "  Value: !Sub \"${OwningDatabaseSecretArn}\""
+              ]
+            end
+
+            def own_db_lines
+              [
+                "- Name: DB_HOST", "  Value: !GetAtt #{db_ref_id}.Endpoint.Address",
+                "- Name: DB_NAME", "  Value: #{db_name}",
+                "- Name: DB_SECRET_ARN", "  Value: !Sub \"${#{secret_sub}}\""
+              ]
+            end
+
+            def cross_domain_comment(base)
+              ["#{base}# Least-privilege, one ARN per declared `across:` target — see",
+               "#{base}# Shared.cross_domain_invoke_policy_yaml's own comment for the full",
+               "#{base}# reasoning; this domain's own task role needs the identical grant."]
+            end
+
+            def cross_domain_statement(base)
+              ["#{base}- PolicyName: CrossDomainInvoke", "#{base}  PolicyDocument:", "#{base}    Version: '2012-10-17'",
+               "#{base}    Statement:", "#{base}      - Effect: Allow", "#{base}        Action: lambda:InvokeFunction",
+               "#{base}        Resource:"]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/stack.rb

@@ -0,0 +1,146 @@
+require_relative "../text_template"
+require_relative "settings"
+require_relative "stack/readers"
+require_relative "stack/blocks"
+require_relative "stack/recipes"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        # Everything the Fargate generator knows about one stack, read and checked once from the
+        # world: the target's declared sizes, the plan, the owner a Shared database borrows. The
+        # templates under `templates/fargate/` read each marker's value from the method of the same
+        # name.
+        class Stack
+          include Readers
+          include Blocks
+          include Recipes
+
+          attr_reader :domain, :root, :world_file, :domain_name, :declared_domain_name, :deploy_settings, :infra_name,
+                      :db_name, :region, :cpu, :memory, :port, :web, :aurora, :shared, :google_oauth_present,
+                      :owner_domain_name, :owner_stack_name, :owner_db_name, :hecks_schema, :logical_id,
+                      :stack_prefix, :stack_name, :desired_count, :plan, :cross_domain_targets
+
+          # @param options [Hash] the generation options `Fargate.call` receives
+          # @raise [ArgumentError] if the domain's deploy settings are invalid or conflict
+          def initialize(options)
+            read_options(options)
+            declare_target
+            read_flags
+            read_owner
+            resolve_plan
+          end
+
+          private
+
+          def read_options(options)
+            world = options.fetch(:world)
+            @domain = options.fetch(:domain_dir)
+            @root = options.fetch(:root)
+            @world_file = options.fetch(:world_file)
+            registry = options.fetch(:cross_domain_registry)
+            @domain_name = File.basename(domain)
+            @declared_domain_name = world.domain
+            @deploy_settings = tenant_settings(world.for_verb("deployed_to"), options[:tenant] || {})
+            read_names(registry)
+          end
+
+          def read_names(registry)
+            @infra_name = deploy_settings[:stack_name] || domain_name
+            @db_name = infra_name.gsub(/[^a-zA-Z0-9]/, "")
+            @cross_domain_targets = registry.bluebooks.flat_map do |_name, chapter|
+              chapter.policies.select(&:target_domain).map(&:target_domain)
+            end.uniq.sort
+          end
+
+          # Same tenant override `Lambda.call` applies; see that method's comment.
+          def tenant_settings(settings, tenant)
+            return settings unless tenant[:tenant]
+
+            settings.merge(stack_name: "#{settings[:stack_name] || domain_name}-#{tenant[:tenant]}",
+                           schema:     tenant.key?(:schema) ? tenant[:schema] : tenant[:tenant])
+          end
+
+          # Validated the same way `Lambda.call` validates its own target: `deploy.bluebook`'s own
+          # `FargateTarget.Declare`, not a hand-checked `fetch(:cpu) { raise ... }` chain.
+          def declare_target
+            dispatcher = Hecks.boot(File.expand_path("../../../deploy", __dir__))
+            target = dispatcher.dispatch("Deploy::FargateTarget.Declare", with: declare_arguments).instance
+            read_target(target.state)
+          rescue *Hecks::Runtime::DOMAIN_REFUSALS => e
+            raise ArgumentError, "#{world_file}'s deployed_to(\"AwsFargate\") is invalid: #{e.message}"
+          end
+
+          def declare_arguments
+            {
+              domain:   { value: declared_domain_name },
+              region:   { value: deploy_settings[:region] },
+              cpu:      { value: deploy_settings.fetch(:cpu, 256) },
+              memory:   { value: deploy_settings.fetch(:memory, 512) },
+              database: { value: deploy_settings.fetch(:database, "Postgres") },
+              web:      { value: deploy_settings.fetch(:web, "None") },
+              port:     { value: deploy_settings.fetch(:port, 8080) }
+            }
+          end
+
+          def read_target(state)
+            @region = state[:region].value
+            @cpu = state[:cpu].value
+            @memory = state[:memory].value
+            @port = state[:port].value
+            @web = state[:web].value
+            @aurora = state[:database].value == "Aurora"
+            @shared = state[:database].value == "Shared"
+          end
+
+          # Same `.env.local` convention `Lambda` uses; `make sync-google-oauth` owns the secret's
+          # lifecycle. Fargate only declares GOOGLE_OAUTH_SECRET_ID: the secret itself is never a
+          # stack resource.
+          def read_flags
+            env_file = File.join(domain, ".env.local")
+            @google_oauth_present = web == "Rust" && File.exist?(env_file) &&
+                                    File.read(env_file).match?(/^GOOGLE_CLIENT_ID=\S/)
+          end
+
+          # Same "Shared" borrowing `Lambda.call` supports. `owner`/`owner_stack` stay plain
+          # `deploy_settings` reads, never validated attributes: ownership is a deploy-time wiring
+          # fact.
+          def read_owner
+            if shared
+              @owner_domain_name = deploy_settings[:owner] or raise ArgumentError, missing_owner_message
+              @owner_stack_name = deploy_settings[:owner_stack] || "hecks-#{owner_domain_name.downcase}"
+              @owner_db_name = owner_domain_name.downcase
+            end
+            @hecks_schema = shared ? infra_name : deploy_settings[:schema]
+          end
+
+          def missing_owner_message
+            TextTemplate.render_from("fargate/missing_owner.tmpl", self)
+          end
+
+          def derive_names
+            @logical_id = "#{infra_name.split(/[_-]/).map(&:capitalize).join}Service"
+            @stack_prefix = deploy_settings[:stack_prefix] || "hecks"
+            @stack_name = "#{stack_prefix}-#{infra_name}"
+            @desired_count = deploy_settings.fetch(:desired_count, 1)
+          end
+
+          # Every optional setting, checked; a world that sets none resolves to the derived ids and
+          # names the generator has always used.
+          def resolve_plan
+            derive_names
+            @plan = Settings.resolve(deploy_settings, plan_base)
+          rescue ArgumentError => e
+            raise ArgumentError, "#{world_file}'s deployed_to(\"AwsFargate\"): #{e.message}"
+          end
+
+          def plan_base
+            { infra_name: infra_name, logical_id: logical_id, db_id: "#{logical_id.delete_suffix("Service")}Db",
+              stack_name: stack_name, port: port, shared: shared }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/task_sections.rb

@@ -0,0 +1,56 @@
+require_relative "yaml"
+
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        # The text of the optional sections that sit inside the task definition and the service:
+        # the domain container's own settings, policies and tuning. Extended onto `Sections`.
+        module TaskSections
+          private
+
+          def execution_grant_yaml(plan, context)
+            return "" unless plan.execution_database_grant
+
+            <<~GRANT
+              - PolicyName: DbSecretRead
+                PolicyDocument:
+                  Version: '2012-10-17'
+                  Statement:
+                    - Effect: Allow
+                      Action: secretsmanager:GetSecretValue
+                      Resource: !Sub "${#{context[:db_secret_ref]}}"
+            GRANT
+          end
+
+          def domain_essential_yaml(domain)
+            domain.essential.nil? ? "" : "Essential: #{domain.essential}\n"
+          end
+
+          def domain_env_yaml(domain_env)
+            domain_env.compact.map do |name, value|
+              "- Name: #{name}\n  Value: #{Yaml.string(value)}\n"
+            end.join
+          end
+
+          def session_secret_yaml(given)
+            [("Name: #{given[:name]}\n" if given[:name]),
+             ("Description: #{Yaml.string(given[:description])}\n" if given[:description])].compact.join
+          end
+
+          def task_policies_yaml(plan)
+            execute = plan.execute_command ? Extras.execute_command_policy_yaml : ""
+            "#{Extras.policies_yaml(plan.extras[:task_policies])}#{execute}"
+          end
+
+          def service_tuning_yaml(plan)
+            lines = []
+            lines << "EnableExecuteCommand: true" if plan.execute_command
+            lines << "HealthCheckGracePeriodSeconds: #{plan.health_check_grace_period}" if plan.health_check_grace_period
+            lines.empty? ? "" : "#{lines.join("\n")}\n"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/yaml.rb

@@ -30,7 +30,7 @@ module Hecks
           # Writes a list as a YAML flow sequence, rendering each item with `scalar`
           # unless it is a bare word, so a numeric-looking string stays quoted.
           def flow_list(values)
-            "[#{values.map { |value| plain_word?(value) ? value : scalar(value) }.join(', ')}]"
+            "[#{values.map { |value| plain_word?(value) ? value : scalar(value) }.join(", ")}]"
           end
 
           def plain_word?(value)