putpaws 0.1.4 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d38b16d5a4fc24915b8bde117f9fda98d0fb6418989eebf98385e86ad724dd32
-  data.tar.gz: c3ee3c20989376d82da51e970aa23ab2995af32c39b0e37524c7fa915cf9a8f9
+  metadata.gz: d6d053460a5c78abad1e20f800e26aae412b0768b47a182380c9e876ebb616f9
+  data.tar.gz: bbb6cd4158d334b4029b17cb6141cf52e6e490317f9d438d2af0d43856876728
 SHA512:
-  metadata.gz: e2d00b74e706f5c9192a455bd7919845c4afeb06d2c3db9cd17c2030689cdc2858cc439efb6dd360cc8b9d4eb3fe6fceb6e9a62fb361de1ff0b8d30be4be10c2
-  data.tar.gz: 49fbf55b6659a02a563792d4ab406bbe1f583e84abf82eee10c5c52b12bbcb3da42d539fb1346dc10dd4a4a6ba70df427b8ddc5f1b5edf7c07e775c4b314fb72
+  metadata.gz: bdf0ff9f7a76d786532fe1b4a13991bd0542d2d584c9a1158996ff84f0479913062cc8b5ce9856a27fe3b7d83978e3c6d9e8816753733ac0a43db9e20ea9986b
+  data.tar.gz: b3714483e120918f2c777b1dd8f0b010efc4f26268a283a9f1d1a426f0ea0e1b214c033b2fb0e19d2c5b77a498a22f373a994c8ad16620a792993b528e6faa37

data/README.md

@@ -49,12 +49,40 @@ Presets are searched in this order: project local (`.putpaws/provisioning/preset
 user global (directories in `PUTPAWS_PRESETS_PATH`, then `~/.putpaws/presets/`), and the ones bundled in the gem.
 Whichever you pick on `ready` is copied into the project so the project owns its snapshot.
 
+Bundled presets (ECS Fargate, `awsvpc`):
+
+- `rails` (default) ... one `app` container on port 8080. Assumes the Rails 8 default Dockerfile,
+  where [Thruster](https://github.com/basecamp/thruster) fronts Puma and does what an nginx sidecar used to
+  (HTTP/2, asset caching / compression, X-Sendfile); TLS terminates at the ALB.
+  Thruster listens on port 80 by default, but the Rails Dockerfile runs as a non-root user and
+  Fargate does not let non-root processes bind ports below 1024 (unlike local Docker, which sets
+  `net.ipv4.ip_unprivileged_port_start=0`), so the preset sets `HTTP_PORT=8080` and
+  `container_port: 8080`; point the ALB target group at 8080. The Dockerfile needs no change
+  (`EXPOSE 80` is metadata only). Older Rails apps work too by adding the `thruster` gem and
+  starting with `bin/thrust bin/rails server`, or by setting `container_port` to the Puma port
+  and dropping `HTTP_PORT`.
+- `rails-nginx` ... same `app` task definition plus a `web` one with an nginx sidecar on port 80.
+  The sidecar is a stock nginx image with no proxy config, so point `nginx_image` at your own image
+  that proxies to `localhost:3000`. Keep this only when you need something Thruster does not do
+  (maintenance pages, custom rewrites, proxy-level auth).
+
+Need another task definition (Ex: a batch worker)? Add an entry to `task_definitions` of the
+copied preset with its own template; `up` creates it and writes an `application.json` entry for it.
+
 Security groups are either specified (one or more existing ones; putpaws never touches their rules)
 or a new one is created for the service when left empty on `ready`.
 
 When the service step completes, the new service is reflected into
 `.putpaws/application.json` and `.putpaws/infra.json` (diff is shown and confirmed),
 so `ecs:attach`, `ecs:shell`, `ecs:run` and `log:*` work immediately.
+One entry is written per task definition of the preset, keyed by the task definition
+family `{service_name}-{suffix}` (Ex: `awesome-api-staging-app` / `awesome-api-staging-web`),
+each pointing at the `infra.target` of the same name. Only the entry of the preset's
+`service_task_definition` carries `service` (for `ecs:deploy` / `ecs:attach`); the others have
+`service: null` and are meant for one-off tasks (`ecs:run` / `ecs:shell` / scheduler),
+so with `rails-nginx` `db:migrate` keeps running on the plain `app` task definition while the
+service runs `web` (nginx + app). `infra.network` is written once as `{service_name}`.
+Existing keys are never deleted; remove stale ones by hand.
 Secrets are handled by reference only: task definitions point to existing
 SSM parameters (Ex: `/{service_name}/RAILS_MASTER_KEY`) and putpaws never touches the values.
 
@@ -64,7 +92,7 @@ so `scheduler:deploy` works any time by just writing `.putpaws/schedule.json`.
 The CPU architecture is declared once as `cpu_architecture` (`ARM64` / `X86_64`) in the preset
 defaults (overridable per service via `overrides`), and applied consistently to both
 task definitions (`runtimePlatform`) and CodeBuild (environment type and image).
-The bundled preset defaults to `ARM64`; projects whose copied preset predates this setting
+The bundled presets default to `ARM64`; projects whose copied preset predates this setting
 fall back to `X86_64` so nothing changes silently. When switching an existing service to ARM,
 run the CI build right after `up` so an ARM image exists before tasks roll
 (`devops.environment_type` / `environment_image` can override the derivation for staged migration).
@@ -225,19 +253,35 @@ gem 'putpaws'
 
 `.putpaws/application.json`
 
+Keys are free-form names you pass to the CLI. The ones written by `putpaws up` follow
+`{service_name}-{suffix}`: `-app` for one-off tasks (`service: null`), `-web` for the
+long-running service.
+
 ```
 {
-  "awesome-api-staging": {
+  "awesome-api-staging-app": {
     "region": "ap-northeast-1",
     "cluster": "cluster-staging",
     "service": null,
-    "task_name_prefix": "awesome-api",
-    "log_group_prefix": "/ecs/awesome/awesome-api-staging",
+    "task_name_prefix": "awesome-api-staging-app",
+    "log_group_prefix": "/ecs/awesome-api-staging",
+    "log_region": null,
+    "build_log_group_prefix": "/aws/codebuild/awesome-api-staging",
+    "build_project_name_prefix": "awesome-api-staging",
+    "network": "awesome-api-staging",
+    "target": "awesome-api-staging-app"
+  },
+  "awesome-api-staging-web": {
+    "region": "ap-northeast-1",
+    "cluster": "cluster-staging",
+    "service": "awesome-api-staging",
+    "task_name_prefix": "awesome-api-staging-web",
+    "log_group_prefix": "/ecs/awesome-api-staging",
     "log_region": null,
     "build_log_group_prefix": "/aws/codebuild/awesome-api-staging",
     "build_project_name_prefix": "awesome-api-staging",
-    "network": "awesome-private-staging",
-    "target": "awesome-staging"
+    "network": "awesome-api-staging",
+    "target": "awesome-api-staging-web"
   },
   "awesome-api-production": {
     "region": "ap-northeast-1",

data/lib/putpaws/provision/config_writer.rb

@@ -8,6 +8,15 @@ module Putpaws
     # Reflects provisioned resources into .putpaws/application.json and
     # .putpaws/infra.json. Only the keys of the target service are touched.
     # Shows a diff and asks for confirmation before writing.
+    #
+    # One application entry and one infra.target entry are written per task
+    # definition of the preset, keyed by the task definition family
+    # (`<service_name>-<suffix>`). The entry whose suffix is the preset's
+    # `service_task_definition` carries `service` so that ecs:deploy /
+    # ecs:attach address the long-running service; the others are for
+    # one-off tasks (ecs:run / ecs:shell / scheduler) and have `service: null`.
+    # infra.network is written once per service as it does not depend on the
+    # task definition.
     class ConfigWriter
       attr_reader :config, :state, :prompt, :io
       def initialize(config:, state:, prompt:, io: $stdout)
@@ -17,17 +26,18 @@ module Putpaws
         @io = io
       end
 
-      def application_entry
+      def application_entry(entry)
+        family = config.task_definition_family(entry[:suffix])
         {
           region: config.region,
           cluster: config.cluster_name,
-          service: config.service_name,
-          task_name_prefix: config.service_name,
+          service: service_entry?(entry) ? config.service_name : nil,
+          task_name_prefix: family,
           log_group_prefix: config.log_group,
           build_log_group_prefix: config.build_log_group,
           build_project_name_prefix: config.build_project_name,
           network: config.service_name,
-          target: config.service_name,
+          target: family,
         }
       end
 
@@ -39,25 +49,32 @@ module Putpaws
         }
       end
 
-      def target_entry
+      def target_entry(entry)
         {
           # Used by EventBridge Scheduler (scheduler:deploy).
           scheduler_role: config.roles[:scheduler_role_arn],
           cluster: state.resources[:cluster_arn],
           # Revision-less on purpose: always run the latest ACTIVE revision.
-          task_definition: config.service_task_definition_family,
-          container_name: config.service_container_name,
+          task_definition: config.task_definition_family(entry[:suffix]),
+          container_name: entry[:container_name] || 'app',
         }
       end
 
       def apply!
-        write_key(path('application.json'), [config.service_name.to_sym], application_entry)
         write_key(path('infra.json'), [:network, config.service_name.to_sym], network_entry)
-        write_key(path('infra.json'), [:target, config.service_name.to_sym], target_entry)
+        config.preset.task_definitions.each do |entry|
+          key = config.task_definition_family(entry[:suffix]).to_sym
+          write_key(path('application.json'), [key], application_entry(entry))
+          write_key(path('infra.json'), [:target, key], target_entry(entry))
+        end
       end
 
       private
 
+      def service_entry?(entry)
+        entry[:suffix] == config.preset.service_task_definition
+      end
+
       def path(basename)
         Pathname.new(config.path_prefix).join(basename)
       end

data/lib/putpaws/provision/preset.rb

@@ -6,6 +6,8 @@ module Putpaws
   module Provision
     class Preset
       BUILTIN_DIR = File.expand_path('presets', __dir__)
+      # Preselected on `ready`: Rails 8 with Thruster, app container only.
+      DEFAULT = 'rails'
 
       def self.local_dir(path_prefix: '.putpaws')
         Pathname.new(path_prefix).join('provisioning', 'presets')

data/lib/putpaws/provision/presets/rails/preset.json

@@ -0,0 +1,35 @@
+{
+  "defaults": {
+    "cpu_architecture": "ARM64",
+    "cpu": "256",
+    "memory": "512",
+    "desired_count": 1,
+    "container_port": 8080,
+    "log_retention_days": 30,
+    "image_tag": "latest",
+    "assign_public_ip": "DISABLED",
+    "env": {
+      "RAILS_ENV": "production",
+      "RACK_ENV": "production",
+      "RAILS_LOG_TO_STDOUT": "1",
+      "HTTP_PORT": "8080"
+    },
+    "secrets": {
+      "RAILS_MASTER_KEY": "{ssm_parameter_prefix}/RAILS_MASTER_KEY"
+    }
+  },
+  "task_definitions": [
+    { "suffix": "app", "template": "taskdef-app.json.erb", "container_name": "app" }
+  ],
+  "service_task_definition": "app",
+  "devops_defaults": {
+    "source_type": "GITHUB",
+    "environment_images": {
+      "ARM64": "aws/codebuild/amazonlinux-aarch64-standard:3.0",
+      "X86_64": "aws/codebuild/standard:7.0"
+    },
+    "compute_type": "BUILD_GENERAL1_SMALL",
+    "privileged_mode": true,
+    "buildspec": "buildspec.yml"
+  }
+}

data/lib/putpaws/provision/presets/rails/templates/taskdef-app.json.erb

@@ -0,0 +1,33 @@
+{
+  "family": "<%= service_name %>-app",
+  "requiresCompatibilities": ["FARGATE"],
+  "networkMode": "awsvpc",
+  "runtimePlatform": {
+    "cpuArchitecture": "<%= cpu_architecture %>",
+    "operatingSystemFamily": "LINUX"
+  },
+  "cpu": "<%= cpu %>",
+  "memory": "<%= memory %>",
+  "executionRoleArn": "<%= execution_role_arn %>",
+  "taskRoleArn": "<%= task_role_arn %>",
+  "containerDefinitions": [
+    {
+      "name": "app",
+      "image": "<%= image %>",
+      "essential": true,
+      "portMappings": [
+        { "containerPort": <%= container_port %>, "protocol": "tcp" }
+      ],
+      "environment": <%= env_json %>,
+      "secrets": <%= secrets_json %>,
+      "logConfiguration": {
+        "logDriver": "awslogs",
+        "options": {
+          "awslogs-group": "<%= log_group %>",
+          "awslogs-region": "<%= region %>",
+          "awslogs-stream-prefix": "app"
+        }
+      }
+    }
+  ]
+}

data/lib/putpaws/provision/tasks/provision.rake

@@ -22,8 +22,10 @@ namespace :provision do
     end
 
     region = prompt.ask("Region:", default: 'ap-northeast-1')
-    preset_choices = Putpaws::Provision::Preset.catalog.map{|e| ["#{e[:name]} (#{e[:source]})", e[:name]]}.to_h
-    preset_name = prompt.select("Preset:", preset_choices)
+    preset_catalog = Putpaws::Provision::Preset.catalog
+    preset_choices = preset_catalog.map{|e| ["#{e[:name]} (#{e[:source]})", e[:name]]}.to_h
+    preset_default = (preset_catalog.index{|e| e[:name] == Putpaws::Provision::Preset::DEFAULT} || 0) + 1
+    preset_name = prompt.select("Preset:", preset_choices, default: preset_default)
 
     puts "--- Basic infra (existing resources; used to generate IAM policies) ---"
     vpc_id = prompt.ask("VPC ID:"){|q| q.required(true)}

data/lib/putpaws/version.rb

@@ -1,3 +1,3 @@
 module Putpaws
-  VERSION = "0.1.4"
+  VERSION = "0.1.6"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: putpaws
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.1.6
 platform: ruby
 authors:
 - metheglin
@@ -182,6 +182,8 @@ files:
 - lib/putpaws/provision/presets/rails-nginx/preset.json
 - lib/putpaws/provision/presets/rails-nginx/templates/taskdef-app.json.erb
 - lib/putpaws/provision/presets/rails-nginx/templates/taskdef-web.json.erb
+- lib/putpaws/provision/presets/rails/preset.json
+- lib/putpaws/provision/presets/rails/templates/taskdef-app.json.erb
 - lib/putpaws/provision/provision_config.rb
 - lib/putpaws/provision/provision_task.rb
 - lib/putpaws/provision/resources/base.rb