hecks 3.4.2 → 3.6.0

data/lib/hecks/projections/deploy/preview/access_yaml.rb

@@ -1,3 +1,4 @@
+require_relative "../text_template"
 require_relative "yaml_text"
 
 module Hecks
@@ -15,96 +16,29 @@ module Hecks
           end
 
           def session_secret
-            <<~YAML.chomp
-              # No explicit Name: Secrets Manager keeps a deleted secret through its recovery window,
-              # and a fixed name would make destroy followed by deploy on one branch fail.
-              SessionSecret:
-                Type: AWS::SecretsManager::Secret
-                Properties:
-                  Description: !Sub "Session secret of the ${EnvName} preview."
-                  GenerateSecretString:
-                    SecretStringTemplate: '{}'
-                    GenerateStringKey: session_secret
-                    PasswordLength: 64
-                    ExcludePunctuation: true
-            YAML
+            TextTemplate.render("preview/session_secret.tmpl").chomp
           end
 
           def container_secrets(container)
             container.secrets.map do |name|
-              <<~YAML.chomp
-                #{secret_id(container, name)}:
-                  Type: AWS::SecretsManager::Secret
-                  Properties:
-                    Description: !Sub "#{name} of the ${EnvName} preview's #{container.name} container."
-                    GenerateSecretString:
-                      SecretStringTemplate: '{}'
-                      GenerateStringKey: secret
-                      PasswordLength: 64
-                      ExcludePunctuation: true
-              YAML
+              TextTemplate.render("preview/container_secret.tmpl", id: secret_id(container, name), name: name,
+                                                                   container: container.name).chomp
             end
           end
 
           def roles(settings)
-            assume = <<~YAML.chomp
-              AssumeRolePolicyDocument:
-                Version: '2012-10-17'
-                Statement:
-                  - Effect: Allow
-                    Principal: { Service: ecs-tasks.amazonaws.com }
-                    Action: sts:AssumeRole
-            YAML
+            assume = TextTemplate.render("preview/assume_role.tmpl").chomp
             [execution_role(assume), task_role(assume, settings)]
           end
 
           def execution_role(assume)
-            <<~YAML.chomp
-              # The execution role reads the database secret only so the one-shot task can be given
-              # its credentials as container secrets.
-              ExecutionRole:
-                Type: AWS::IAM::Role
-                Properties:
-              #{indent(assume, 4)}
-                  ManagedPolicyArns:
-                    - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
-                  Policies:
-                    - PolicyName: SharedDatabaseSecretRead
-                      PolicyDocument:
-                        Version: '2012-10-17'
-                        Statement:
-                          - Effect: Allow
-                            Action: secretsmanager:GetSecretValue
-                            Resource: !Ref OwningDatabaseSecretArn
-            YAML
+            TextTemplate.render("preview/execution_role.tmpl", assume: indent(assume, 4)).chomp
           end
 
           def task_role(assume, settings)
             readable = ["SessionSecret", *settings.containers.flat_map { |c| c.secrets.map { |n| secret_id(c, n) } }]
-            <<~YAML.chomp
-              # Reads the shared database secret (it connects with it and creates its database) and
-              # this preview's own secrets; nothing owned by the main stack.
-              TaskRole:
-                Type: AWS::IAM::Role
-                Properties:
-              #{indent(assume, 4)}
-                  Policies:
-                    - PolicyName: SharedDatabaseSecretRead
-                      PolicyDocument:
-                        Version: '2012-10-17'
-                        Statement:
-                          - Effect: Allow
-                            Action: secretsmanager:GetSecretValue
-                            Resource: !Ref OwningDatabaseSecretArn
-                    - PolicyName: PreviewSecretRead
-                      PolicyDocument:
-                        Version: '2012-10-17'
-                        Statement:
-                          - Effect: Allow
-                            Action: secretsmanager:GetSecretValue
-                            Resource:
-              #{indent(readable.map { |id| "- !Ref #{id}" }.join("\n"), 16)}
-            YAML
+            refs = readable.map { |id| "- !Ref #{id}" }.join("\n")
+            TextTemplate.render("preview/task_role.tmpl", assume: indent(assume, 4), readable: indent(refs, 16)).chomp
           end
         end
       end

data/lib/hecks/projections/deploy/preview/containers.rb

@@ -44,13 +44,21 @@ module Hecks
 
             item = item.transform_keys(&:to_sym)
             name = matching(item[:name], NAME_PATTERN, "preview container name")
-            Entry.new(
-              name: name, port: port_of(item, name), health_check_path: path_of(item[:health_check_path] || "/"),
-              paths: Array(item[:paths]).map { |path| path_of(path) }, default: item[:default] == true,
-              host: item[:host] == true, database: item[:database] == true,
-              environment: environment_of(item[:environment]), secrets: Array(item[:secrets]).map(&:to_s),
-              image: matching(item[:image] || "#{name}:latest", IMAGE_PATTERN, "preview container #{name} image")
-            )
+            Entry.new(name: name, port: port_of(item, name), **routes_of(item), **flags_of(item), **contents_of(item, name))
+          end
+
+          def routes_of(item)
+            { health_check_path: path_of(item[:health_check_path] || "/"),
+              paths:             Array(item[:paths]).map { |path| path_of(path) } }
+          end
+
+          def flags_of(item)
+            { default: item[:default] == true, host: item[:host] == true, database: item[:database] == true }
+          end
+
+          def contents_of(item, name)
+            { environment: environment_of(item[:environment]), secrets: Array(item[:secrets]).map(&:to_s),
+              image: matching(item[:image] || "#{name}:latest", IMAGE_PATTERN, "preview container #{name} image") }
           end
 
           def matching(value, pattern, label)
@@ -81,12 +89,15 @@ module Hecks
               raise ArgumentError, "preview containers repeat the #{field} #{dup.first.inspect}" if dup
             end
             check_roles!(entries)
+            check_secret_names!(entries)
           end
 
           def check_roles!(entries)
             raise ArgumentError, "at most one preview container may be the default" if entries.count(&:default) > 1
             raise ArgumentError, "at most one preview container may be the host" if entries.count(&:host) > 1
+          end
 
+          def check_secret_names!(entries)
             bad = entries.flat_map(&:secrets).find { |secret| !secret.match?(ENV_NAME_PATTERN) }
             raise ArgumentError, "preview secret name #{bad.inspect} must be an environment variable name" if bad
           end

data/lib/hecks/projections/deploy/preview/routing_yaml.rb

@@ -1,4 +1,5 @@
 require "json"
+require_relative "../text_template"
 require_relative "yaml_text"
 
 module Hecks
@@ -21,34 +22,14 @@ module Hecks
 
           def networking(settings)
             ingress = settings.containers.select(&:routed?).map do |c|
-              <<~YAML.chomp
-                ComputeIngressFromAlb#{c.logical}:
-                  Type: AWS::EC2::SecurityGroupIngress
-                  Properties:
-                    GroupId: !Ref OwningSecurityGroupId
-                    IpProtocol: tcp
-                    FromPort: #{c.port}
-                    ToPort: #{c.port}
-                    SourceSecurityGroupId: !Ref AlbSecurityGroup
-              YAML
+              TextTemplate.render("preview/ingress.tmpl", logical: c.logical, port: c.port).chomp
             end
             [alb_security_group(settings), "#{INGRESS_NOTE}\n#{ingress.join("\n\n")}"]
           end
 
           def alb_security_group(settings)
-            <<~YAML.chomp
-              AlbSecurityGroup:
-                Type: AWS::EC2::SecurityGroup
-                Properties:
-                  VpcId: !Ref OwningVpcId
-                  GroupDescription: !Sub "#{settings.infra_name} preview ${EnvName} ALB - HTTP ingress from CloudFront only"
-                  SecurityGroupIngress:
-                    # The AWS-managed com.amazonaws.global.cloudfront.origin-facing prefix list.
-                    - IpProtocol: tcp
-                      FromPort: 80
-                      ToPort: 80
-                      SourcePrefixListId: #{CLOUDFRONT_PREFIX_LIST}
-            YAML
+            TextTemplate.render("preview/alb_security_group.tmpl", infra_name:  settings.infra_name,
+                                                                   prefix_list: CLOUDFRONT_PREFIX_LIST).chomp
           end
 
           def load_balancing(settings)
@@ -57,45 +38,17 @@ module Hecks
           end
 
           def target_group(container)
-            <<~YAML.chomp
-              #{container.logical}TargetGroup:
-                Type: AWS::ElasticLoadBalancingV2::TargetGroup
-                Properties:
-                  TargetType: ip
-                  Port: #{container.port}
-                  Protocol: HTTP
-                  VpcId: !Ref OwningVpcId
-                  HealthCheckPath: #{container.health_check_path}
-                  HealthCheckPort: "#{container.port}"
-            YAML
+            TextTemplate.render("preview/target_group.tmpl", logical: container.logical, port: container.port,
+                                                             health_check_path: container.health_check_path).chomp
           end
 
           def alb(settings)
-            <<~YAML.chomp
-              Alb:
-                Type: AWS::ElasticLoadBalancingV2::LoadBalancer
-                Properties:
-                  Name: !Sub "#{settings.alb_prefix}-${EnvName}"
-                  Scheme: internet-facing
-                  Type: application
-                  SecurityGroups: [!Ref AlbSecurityGroup]
-                  Subnets: [!Ref OwningPublicSubnetAId, !Ref OwningPublicSubnetBId]
-            YAML
+            TextTemplate.render("preview/alb.tmpl", alb_prefix: settings.alb_prefix).chomp
           end
 
           # The default action goes to the default container.
           def listener(settings)
-            <<~YAML.chomp
-              Listener:
-                Type: AWS::ElasticLoadBalancingV2::Listener
-                Properties:
-                  LoadBalancerArn: !Ref Alb
-                  Port: 80
-                  Protocol: HTTP
-                  DefaultActions:
-                    - Type: forward
-                      TargetGroupArn: !Ref #{settings.default_container.logical}TargetGroup
-            YAML
+            TextTemplate.render("preview/listener.tmpl", default_logical: settings.default_container.logical).chomp
           end
 
           def rule_specs(settings)
@@ -112,44 +65,19 @@ module Hecks
           end
 
           def listener_rule(spec, priority)
-            <<~YAML.chomp
-              #{spec[:id]}:
-                Type: AWS::ElasticLoadBalancingV2::ListenerRule
-                Properties:
-                  ListenerArn: !Ref Listener
-                  Priority: #{priority}
-                  Conditions:
-                    - Field: path-pattern
-                      Values: [#{spec[:paths].map { |p| JSON.generate(p) }.join(', ')}]
-                  Actions:
-                    - Type: forward
-                      TargetGroupArn: !Ref #{spec[:container].logical}TargetGroup
-            YAML
+            TextTemplate.render("preview/listener_rule.tmpl", id: spec[:id], priority: priority,
+                                                              paths: spec[:paths].map { |p| JSON.generate(p) }.join(", "),
+                                                              logical: spec[:container].logical).chomp
           end
 
           def rule_id(container, slice) = "ListenerRule#{container.logical}#{slice + 1}"
 
           def service(settings)
             rule_ids = rule_specs(settings).map { |spec| spec[:id] }
-            <<~YAML.chomp
-              Service:
-                Type: AWS::ECS::Service
-                DependsOn: [#{(['Listener'] + rule_ids).join(', ')}]
-                Properties:
-                  ServiceName: !Sub "#{settings.prefix}-${EnvName}"
-                  Cluster: !Ref Cluster
-                  TaskDefinition: !Ref TaskDefinition
-                  DesiredCount: !Ref DesiredCount
-                  LaunchType: FARGATE
-                  EnableExecuteCommand: true
-                  NetworkConfiguration:
-                    AwsvpcConfiguration:
-                      AssignPublicIp: DISABLED
-                      Subnets: [!Ref OwningSubnetAId, !Ref OwningSubnetBId]
-                      SecurityGroups: [!Ref OwningSecurityGroupId]
-                  LoadBalancers:
-              #{indent(service_load_balancers(settings), 6)}
-            YAML
+            balancers = indent(service_load_balancers(settings), 6)
+            TextTemplate.render("preview/service.tmpl", depends_on:     (["Listener"] + rule_ids).join(", "),
+                                                        prefix:         settings.prefix,
+                                                        load_balancers: balancers).chomp
           end
 
           def service_load_balancers(settings)

data/lib/hecks/projections/deploy/preview/settings.rb

@@ -29,7 +29,7 @@ module Hecks
             raw = raw.is_a?(Hash) ? raw.transform_keys(&:to_sym) : {}
             unknown = raw.keys - KEYS
             unless unknown.empty?
-              raise ArgumentError, "unknown preview setting(s): #{unknown.join(', ')} (known: #{KEYS.join(', ')})"
+              raise ArgumentError, "unknown preview setting(s): #{unknown.join(", ")} (known: #{KEYS.join(", ")})"
             end
 
             new(raw, deploy_settings, main)
@@ -57,8 +57,11 @@ module Hecks
           def assign_names(raw, main)
             prefix_default = "#{main.fetch(:stack_prefix)}-#{infra_name}-preview".downcase.gsub(/[^a-z0-9-]+/, "-")
             @prefix = pick(raw, :prefix, prefix_default, PREFIX_PATTERN)
-            alb_default = "#{infra_name.downcase.gsub(/[^a-z0-9]/, '')[0, 8]}pv"
-            @alb_prefix = pick(raw, :alb_prefix, alb_default, ALB_PREFIX_PATTERN)
+            @alb_prefix = pick(raw, :alb_prefix, "#{infra_name.downcase.gsub(/[^a-z0-9]/, "")[0, 8]}pv", ALB_PREFIX_PATTERN)
+            assign_stacks(raw, main)
+          end
+
+          def assign_stacks(raw, main)
             @owner_stack = pick(raw, :owner_stack, main[:owner_stack] || stack_name, STACK_PATTERN)
             @database_stack = pick(raw, :database_stack, owner_stack, STACK_PATTERN)
             @database_endpoint_output = pick(raw, :database_endpoint_output, "DatabaseEndpoint", OUTPUT_PATTERN)
@@ -78,7 +81,7 @@ module Hecks
             @log_retention_days = Integer(raw.fetch(:log_retention_days, 7))
             return if RETENTION_DAYS.include?(log_retention_days)
 
-            raise ArgumentError, "preview log_retention_days must be one of #{RETENTION_DAYS.join(', ')}"
+            raise ArgumentError, "preview log_retention_days must be one of #{RETENTION_DAYS.join(", ")}"
           end
 
           def assign_behaviour(raw)

data/lib/hecks/projections/deploy/preview/task_yaml.rb

@@ -1,4 +1,5 @@
 require "json"
+require_relative "../text_template"
 require_relative "yaml_text"
 
 module Hecks
@@ -8,110 +9,35 @@ module Hecks
         # The task definitions of a preview stack: the containers it runs and the
         # one-shot task that creates its database.
         module TaskYaml
+          extend YamlText
+
+          module_function
+
           # The one-shot task's script. Idempotent, and refuses names the preview must never touch.
-          DB_INIT_SCRIPT = <<~SH.freeze
-            set -eu
-            case "$TARGET_DB" in
-              ""|*[!a-z0-9_]*) echo "refusing TARGET_DB '$TARGET_DB': lowercase letters, digits and underscores only" >&2; exit 1 ;;
-            esac
-            [ "${#TARGET_DB}" -le 63 ] || { echo "refusing TARGET_DB '$TARGET_DB': longer than 63 characters" >&2; exit 1; }
-            for protected in $PROTECTED_DATABASES; do
-              [ "$TARGET_DB" != "$protected" ] || { echo "refusing to manage the protected database '$protected'" >&2; exit 1; }
-            done
-            export PGSSLMODE=require PGCONNECT_TIMEOUT=10
-            found=$(psql -h "$DB_HOST" -U "$PGUSER" -d postgres -Atc "SELECT 1 FROM pg_database WHERE datname = '$TARGET_DB'")
-            if [ "${ACTION:-create}" = "drop" ]; then
-              if [ "$found" = "1" ]; then
-                psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -U "$PGUSER" -d postgres -c "DROP DATABASE \\"$TARGET_DB\\" WITH (FORCE)"
-                echo "dropped database $TARGET_DB"
-              else
-                echo "database $TARGET_DB does not exist"
-              fi
-            elif [ "$found" = "1" ]; then
-              echo "database $TARGET_DB already exists"
-            else
-              psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -U "$PGUSER" -d postgres -c "CREATE DATABASE \\"$TARGET_DB\\""
-              echo "created database $TARGET_DB"
-            fi
-          SH
+          def db_init_script
+            TextTemplate.render("preview/db_init_script.sh.tmpl")
+          end
 
           # The database credentials as container secrets, so the password never appears as a plain
           # value in the task definition.
-          DB_INIT_SECRETS = <<~YAML.chomp.freeze
-            Secrets:
-              - Name: PGUSER
-                ValueFrom: !Sub "${OwningDatabaseSecretArn}:username::"
-              - Name: PGPASSWORD
-                ValueFrom: !Sub "${OwningDatabaseSecretArn}:password::"
-          YAML
-
-          extend YamlText
-
-          module_function
+          def db_init_secrets
+            TextTemplate.render("preview/db_init_secrets.tmpl").chomp
+          end
 
           # Also renders the drop path, taken when `ACTION` is `drop`.
           def db_init_task(settings)
-            <<~YAML.chomp
-              # Run by preview.sh (`aws ecs run-task`) after the images are pushed and before the
-              # service scales up: the database instance is reachable only from inside the VPC, so
-              # this is the one place a laptop-driven deploy can run CREATE DATABASE. Idempotent.
-              DbInitTaskDefinition:
-                Type: AWS::ECS::TaskDefinition
-                Properties:
-                  Family: !Sub "#{settings.prefix}-${EnvName}-dbinit"
-                  RequiresCompatibilities: [FARGATE]
-                  NetworkMode: awsvpc
-                  Cpu: "256"
-                  Memory: "512"
-                  RuntimePlatform:
-                    CpuArchitecture: ARM64
-                    OperatingSystemFamily: LINUX
-                  ExecutionRoleArn: !GetAtt ExecutionRole.Arn
-                  TaskRoleArn: !GetAtt TaskRole.Arn
-                  ContainerDefinitions:
-                    - Name: dbinit
-                      Image: #{settings.db_init_image}
-                      Essential: true
-                      Command:
-                        - sh
-                        - -c
-                        - |
-              #{indent(DB_INIT_SCRIPT.chomp, 12)}
-                      LogConfiguration:
-                        LogDriver: awslogs
-                        Options:
-                          awslogs-group: !Ref LogGroup
-                          awslogs-region: !Ref AWS::Region
-                          awslogs-stream-prefix: dbinit
-                      Environment:
-                        - Name: DB_HOST
-                          Value: !Ref OwningDatabaseEndpoint
-                        - Name: TARGET_DB
-                          Value: !Ref DbName
-                        - Name: PROTECTED_DATABASES
-                          Value: #{JSON.generate(settings.protected_databases.join(' '))}
-              #{indent(DB_INIT_SECRETS, 8)}
-            YAML
+            TextTemplate.render(
+              "preview/db_init_task.tmpl",
+              prefix: settings.prefix, image: settings.db_init_image, script: indent(db_init_script.chomp, 12),
+              protected: JSON.generate(settings.protected_databases.join(" ")), secrets: indent(db_init_secrets, 8)
+            ).chomp
           end
 
           def task_definition(settings)
-            <<~YAML.chomp
-              TaskDefinition:
-                Type: AWS::ECS::TaskDefinition
-                Properties:
-                  Family: !Sub "#{settings.prefix}-${EnvName}"
-                  RequiresCompatibilities: [FARGATE]
-                  NetworkMode: awsvpc
-                  Cpu: "#{settings.cpu}"
-                  Memory: "#{settings.memory}"
-                  RuntimePlatform:
-                    CpuArchitecture: ARM64
-                    OperatingSystemFamily: LINUX
-                  ExecutionRoleArn: !GetAtt ExecutionRole.Arn
-                  TaskRoleArn: !GetAtt TaskRole.Arn
-                  ContainerDefinitions:
-              #{indent(settings.containers.map { |c| container_definition(settings, c) }.join("\n"), 6)}
-            YAML
+            containers = settings.containers.map { |c| container_definition(settings, c) }.join("\n")
+            TextTemplate.render("preview/task_definition.tmpl", prefix: settings.prefix, cpu: settings.cpu,
+                                                                memory: settings.memory,
+                                                                containers: indent(containers, 6)).chomp
           end
 
           def container_definition(settings, container)
@@ -127,13 +53,7 @@ module Hecks
           end
 
           def log_options(container)
-            <<~YAML
-              LogDriver: awslogs
-              Options:
-                awslogs-group: !Ref LogGroup
-                awslogs-region: !Ref AWS::Region
-                awslogs-stream-prefix: #{container.name}
-            YAML
+            TextTemplate.render("preview/log_options.tmpl", container: container.name)
           end
 
           def environment_yaml(settings, container)
@@ -147,20 +67,36 @@ module Hecks
             pairs = { "PORT" => scalar(container.port.to_s) }
             pairs.merge!(host_environment(settings)) if container.host
             pairs.merge!(database_environment) if container.host || container.database
-            container.secrets.each { |name| pairs[name] = "!Ref #{secret_id(container, name)}" }
-            container.environment.each { |name, value| pairs[name] = scalar(value) }
-            pairs.to_a
+            pairs.merge(own_environment(container)).to_a
+          end
+
+          def own_environment(container)
+            secrets = container.secrets.to_h { |name| [name, "!Ref #{secret_id(container, name)}"] }
+            secrets.merge(container.environment.transform_values { |value| scalar(value) })
           end
 
           def host_environment(settings)
             main = settings.main
-            pairs = {
+            host_serving(settings, main).merge(host_artifacts(main)).merge(host_optional(settings, main))
+          end
+
+          def host_serving(settings, main)
+            {
               "HECKS_DOMAIN" => scalar(main.fetch(:domain)), "HECKS_ERA" => scalar("1"),
               "PORT" => scalar(settings.host.port.to_s), "BIND" => scalar("0.0.0.0"),
-              "HECKS_SERVE_MODE" => scalar("1"), "HECKS_WEB" => scalar(main.fetch(:web)),
+              "HECKS_SERVE_MODE" => scalar("1"), "HECKS_WEB" => scalar(main.fetch(:web))
+            }
+          end
+
+          def host_artifacts(main)
+            {
               "HECKS_WASM_PATH" => scalar(main.fetch(:wasm_path)), "HECKS_IR_PATH" => scalar(main.fetch(:ir_path)),
               "SESSION_SECRET_ARN" => "!Ref SessionSecret", "HECKS_CHECKOUT_DOMAIN" => scalar(main.fetch(:domain))
             }
+          end
+
+          def host_optional(settings, main)
+            pairs = {}
             pairs["HECKS_SCHEMA"] = scalar(main[:schema]) if main[:schema]
             pairs["HECKS_SESSION_COOKIE"] = scalar(settings.session_cookie) if settings.session_cookie
             pairs