@ariestools/cli 0.1.16 → 0.1.17

package/dist/terraform/serverless-aws/ecs.tf

@@ -0,0 +1,199 @@
+resource "aws_ecs_cluster" "main" {
+  name = "${local.name_prefix}-cluster"
+
+  setting {
+    name  = "containerInsights"
+    value = "enabled"
+  }
+}
+
+resource "aws_cloudwatch_log_group" "control" {
+  name              = "/aws/ecs/${local.name_prefix}-control"
+  retention_in_days = 30
+}
+
+resource "aws_cloudwatch_log_group" "plane" {
+  name              = "/aws/ecs/${local.name_prefix}-plane"
+  retention_in_days = 30
+}
+
+locals {
+  # When ECR repos are created in-stack (legacy flow), fall back to a `:bootstrap`
+  # tag against the local repo URI if the caller didn't set var.control_image yet.
+  # When ECR repos are owned by `aries infra images` instead (new flow), the caller
+  # MUST set var.control_image / var.plane_image — empty falls through and Fargate
+  # will refuse to launch a task with no image.
+  control_image = (
+    length(var.control_image) > 0 ? var.control_image :
+    var.create_ecr_repos ? "${aws_ecr_repository.control[0].repository_url}:bootstrap" :
+    ""
+  )
+  plane_image = (
+    length(var.plane_image) > 0 ? var.plane_image :
+    var.create_ecr_repos ? "${aws_ecr_repository.plane[0].repository_url}:bootstrap" :
+    ""
+  )
+
+  control_origin_url = local.has_domain ? "https://${local.data_fqdn}" : "http://${aws_lb.main.dns_name}/plane"
+}
+
+resource "aws_ecs_task_definition" "control" {
+  family                   = "${local.name_prefix}-control"
+  cpu                      = var.control_task_cpu
+  memory                   = var.control_task_memory
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  execution_role_arn       = aws_iam_role.task_execution.arn
+  task_role_arn            = aws_iam_role.control_task.arn
+
+  runtime_platform {
+    operating_system_family = "LINUX"
+    cpu_architecture        = "ARM64"
+  }
+
+  container_definitions = jsonencode([{
+    name      = "control"
+    image     = local.control_image
+    essential = true
+
+    portMappings = [{
+      containerPort = 8787
+      protocol      = "tcp"
+    }]
+
+    environment = [
+      { name = "STORE", value = "postgres" },
+      { name = "PORT", value = "8787" },
+      { name = "HOST", value = "0.0.0.0" },
+      { name = "DATALAKE_ORIGIN_URL", value = local.control_origin_url },
+      { name = "LOG_LEVEL", value = "info" },
+      { name = "CONTROL_VERSION", value = "0.1.0" },
+    ]
+
+    secrets = [
+      { name = "DATABASE_URL", valueFrom = aws_secretsmanager_secret.database_url.arn },
+      { name = "TOKEN_SIGNING_SECRET", valueFrom = aws_secretsmanager_secret.token_signing.arn },
+    ]
+
+    logConfiguration = {
+      logDriver = "awslogs"
+      options = {
+        "awslogs-group"         = aws_cloudwatch_log_group.control.name
+        "awslogs-region"        = var.region
+        "awslogs-stream-prefix" = "control"
+      }
+    }
+  }])
+}
+
+resource "aws_ecs_task_definition" "plane" {
+  family                   = "${local.name_prefix}-plane"
+  cpu                      = var.plane_task_cpu
+  memory                   = var.plane_task_memory
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  execution_role_arn       = aws_iam_role.task_execution.arn
+  task_role_arn            = aws_iam_role.plane_task.arn
+
+  runtime_platform {
+    operating_system_family = "LINUX"
+    cpu_architecture        = "ARM64"
+  }
+
+  container_definitions = jsonencode([{
+    name      = "plane"
+    image     = local.plane_image
+    essential = true
+
+    portMappings = [{
+      containerPort = 8788
+      protocol      = "tcp"
+    }]
+
+    environment = [
+      { name = "CONTROL_STORE", value = "postgres" },
+      { name = "PAYLOAD_STORE", value = "postgres" },
+      { name = "PORT", value = "8788" },
+      { name = "HOST", value = "0.0.0.0" },
+      { name = "AWS_REGION", value = var.region },
+      { name = "PAYLOAD_S3_BUCKET", value = aws_s3_bucket.payloads.bucket },
+      { name = "DATALAKE_ROUTE_PREFIX", value = local.has_domain ? "" : "/plane" },
+      { name = "LOG_LEVEL", value = "info" },
+      { name = "PLANE_VERSION", value = "0.1.0" },
+    ]
+
+    secrets = [
+      { name = "DATABASE_URL", valueFrom = aws_secretsmanager_secret.database_url.arn },
+      { name = "TOKEN_SIGNING_SECRET", valueFrom = aws_secretsmanager_secret.token_signing.arn },
+    ]
+
+    logConfiguration = {
+      logDriver = "awslogs"
+      options = {
+        "awslogs-group"         = aws_cloudwatch_log_group.plane.name
+        "awslogs-region"        = var.region
+        "awslogs-stream-prefix" = "plane"
+      }
+    }
+  }])
+}
+
+resource "aws_ecs_service" "control" {
+  name            = "${local.name_prefix}-control"
+  cluster         = aws_ecs_cluster.main.id
+  task_definition = aws_ecs_task_definition.control.arn
+  desired_count   = var.control_desired_count
+  launch_type     = "FARGATE"
+  propagate_tags  = "SERVICE"
+
+  network_configuration {
+    subnets          = [for s in aws_subnet.private : s.id]
+    security_groups  = [aws_security_group.service.id]
+    assign_public_ip = false
+  }
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.control.arn
+    container_name   = "control"
+    container_port   = 8787
+  }
+
+  deployment_minimum_healthy_percent = 50
+  deployment_maximum_percent         = 200
+
+  lifecycle {
+    ignore_changes = [desired_count]
+  }
+
+  depends_on = [aws_lb_listener.http]
+}
+
+resource "aws_ecs_service" "plane" {
+  name            = "${local.name_prefix}-plane"
+  cluster         = aws_ecs_cluster.main.id
+  task_definition = aws_ecs_task_definition.plane.arn
+  desired_count   = var.plane_desired_count
+  launch_type     = "FARGATE"
+  propagate_tags  = "SERVICE"
+
+  network_configuration {
+    subnets          = [for s in aws_subnet.private : s.id]
+    security_groups  = [aws_security_group.service.id]
+    assign_public_ip = false
+  }
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.plane.arn
+    container_name   = "plane"
+    container_port   = 8788
+  }
+
+  deployment_minimum_healthy_percent = 50
+  deployment_maximum_percent         = 200
+
+  lifecycle {
+    ignore_changes = [desired_count]
+  }
+
+  depends_on = [aws_lb_listener.http]
+}

package/dist/terraform/serverless-aws/encryption.tofu.example

@@ -0,0 +1,38 @@
+# OpenTofu state encryption — opt-in.
+#
+# Encrypts both `terraform.tfstate` and any saved plan files at rest using
+# AES-GCM with a key derived from `var.tfstate_passphrase` via PBKDF2.
+#
+# To enable:
+#   1. cp encryption.tofu.example encryption.tofu     (in the working dir)
+#   2. export TF_VAR_tfstate_passphrase='at-least-16-characters'
+#   3. tofu init -reconfigure
+#
+# Notes:
+#   - This file uses the `.tofu` extension so Terraform does NOT load it.
+#     Only OpenTofu engages encryption. Terraform users skip this block.
+#   - If you lose the passphrase, the state is unrecoverable — keep it in
+#     a password manager / Secrets Manager / etc.
+#   - To rotate the passphrase: add a second `key_provider` block with
+#     the old passphrase, set it as `fallback`, then `tofu apply` to
+#     re-encrypt with the new key. Drop the fallback once migrated.
+
+terraform {
+  encryption {
+    key_provider "pbkdf2" "default" {
+      passphrase = var.tfstate_passphrase
+    }
+
+    method "aes_gcm" "default" {
+      keys = key_provider.pbkdf2.default
+    }
+
+    state {
+      method = method.aes_gcm.default
+    }
+
+    plan {
+      method = method.aes_gcm.default
+    }
+  }
+}

package/dist/terraform/serverless-aws/iam.tf

@@ -0,0 +1,68 @@
+data "aws_iam_policy_document" "ecs_task_assume" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "task_execution" {
+  name               = "${local.name_prefix}-task-execution"
+  assume_role_policy = data.aws_iam_policy_document.ecs_task_assume.json
+}
+
+resource "aws_iam_role_policy_attachment" "task_execution_basic" {
+  role       = aws_iam_role.task_execution.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+}
+
+data "aws_iam_policy_document" "task_execution_secrets" {
+  statement {
+    actions = ["secretsmanager:GetSecretValue"]
+    resources = [
+      aws_secretsmanager_secret.database_url.arn,
+      aws_secretsmanager_secret.token_signing.arn,
+    ]
+  }
+}
+
+resource "aws_iam_role_policy" "task_execution_secrets" {
+  name   = "${local.name_prefix}-task-execution-secrets"
+  role   = aws_iam_role.task_execution.id
+  policy = data.aws_iam_policy_document.task_execution_secrets.json
+}
+
+# Task role: scoped to the service's runtime needs. Plane needs S3 rw on the
+# payloads bucket; control plane currently needs nothing beyond logs.
+resource "aws_iam_role" "control_task" {
+  name               = "${local.name_prefix}-control-task"
+  assume_role_policy = data.aws_iam_policy_document.ecs_task_assume.json
+}
+
+resource "aws_iam_role" "plane_task" {
+  name               = "${local.name_prefix}-plane-task"
+  assume_role_policy = data.aws_iam_policy_document.ecs_task_assume.json
+}
+
+data "aws_iam_policy_document" "plane_s3" {
+  statement {
+    actions = [
+      "s3:GetObject",
+      "s3:PutObject",
+      "s3:DeleteObject",
+      "s3:ListBucket",
+    ]
+    resources = [
+      aws_s3_bucket.payloads.arn,
+      "${aws_s3_bucket.payloads.arn}/*",
+    ]
+  }
+}
+
+resource "aws_iam_role_policy" "plane_s3" {
+  name   = "${local.name_prefix}-plane-s3"
+  role   = aws_iam_role.plane_task.id
+  policy = data.aws_iam_policy_document.plane_s3.json
+}

package/dist/terraform/serverless-aws/network.tf

@@ -0,0 +1,190 @@
+data "aws_availability_zones" "available" {
+  state = "available"
+}
+
+locals {
+  azs = slice(data.aws_availability_zones.available.names, 0, var.availability_zone_count)
+
+  public_subnet_cidrs  = [for i, _ in local.azs : cidrsubnet(var.vpc_cidr, 8, i)]
+  private_subnet_cidrs = [for i, _ in local.azs : cidrsubnet(var.vpc_cidr, 8, i + 16)]
+}
+
+resource "aws_vpc" "main" {
+  cidr_block           = var.vpc_cidr
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+
+  tags = { Name = "${local.name_prefix}-vpc" }
+}
+
+resource "aws_internet_gateway" "main" {
+  vpc_id = aws_vpc.main.id
+  tags   = { Name = "${local.name_prefix}-igw" }
+}
+
+resource "aws_subnet" "public" {
+  for_each = { for i, az in local.azs : az => i }
+
+  vpc_id                  = aws_vpc.main.id
+  availability_zone       = each.key
+  cidr_block              = local.public_subnet_cidrs[each.value]
+  map_public_ip_on_launch = true
+
+  tags = {
+    Name = "${local.name_prefix}-public-${each.key}"
+    Tier = "public"
+  }
+}
+
+resource "aws_subnet" "private" {
+  for_each = { for i, az in local.azs : az => i }
+
+  vpc_id            = aws_vpc.main.id
+  availability_zone = each.key
+  cidr_block        = local.private_subnet_cidrs[each.value]
+
+  tags = {
+    Name = "${local.name_prefix}-private-${each.key}"
+    Tier = "private"
+  }
+}
+
+resource "aws_eip" "nat" {
+  domain = "vpc"
+  tags   = { Name = "${local.name_prefix}-nat" }
+}
+
+resource "aws_nat_gateway" "main" {
+  allocation_id = aws_eip.nat.id
+  subnet_id     = aws_subnet.public[local.azs[0]].id
+
+  tags       = { Name = "${local.name_prefix}-nat" }
+  depends_on = [aws_internet_gateway.main]
+}
+
+resource "aws_route_table" "public" {
+  vpc_id = aws_vpc.main.id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.main.id
+  }
+
+  tags = { Name = "${local.name_prefix}-public-rt" }
+}
+
+resource "aws_route_table" "private" {
+  vpc_id = aws_vpc.main.id
+
+  route {
+    cidr_block     = "0.0.0.0/0"
+    nat_gateway_id = aws_nat_gateway.main.id
+  }
+
+  tags = { Name = "${local.name_prefix}-private-rt" }
+}
+
+resource "aws_route_table_association" "public" {
+  for_each       = aws_subnet.public
+  subnet_id      = each.value.id
+  route_table_id = aws_route_table.public.id
+}
+
+resource "aws_route_table_association" "private" {
+  for_each       = aws_subnet.private
+  subnet_id      = each.value.id
+  route_table_id = aws_route_table.private.id
+}
+
+# --- security groups -------------------------------------------------------
+
+resource "aws_security_group" "alb" {
+  name        = "${local.name_prefix}-alb"
+  description = "Internet-facing ingress for the ALB"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    description = "HTTPS from anywhere"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "HTTP from anywhere (redirected to HTTPS at the listener)"
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    description = "Outbound to anywhere (ALB to Fargate tasks)"
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = { Name = "${local.name_prefix}-alb-sg" }
+}
+
+resource "aws_security_group" "service" {
+  name        = "${local.name_prefix}-service"
+  description = "Fargate tasks; only accepts traffic from the ALB"
+  vpc_id      = aws_vpc.main.id
+
+  egress {
+    description = "Egress to the internet via NAT (ECR pulls, third-party APIs)"
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = { Name = "${local.name_prefix}-service-sg" }
+}
+
+resource "aws_security_group_rule" "service_from_alb_8787" {
+  type                     = "ingress"
+  from_port                = 8787
+  to_port                  = 8787
+  protocol                 = "tcp"
+  source_security_group_id = aws_security_group.alb.id
+  security_group_id        = aws_security_group.service.id
+  description              = "Control plane from ALB"
+}
+
+resource "aws_security_group_rule" "service_from_alb_8788" {
+  type                     = "ingress"
+  from_port                = 8788
+  to_port                  = 8788
+  protocol                 = "tcp"
+  source_security_group_id = aws_security_group.alb.id
+  security_group_id        = aws_security_group.service.id
+  description              = "Data plane from ALB"
+}
+
+resource "aws_security_group" "database" {
+  name        = "${local.name_prefix}-db"
+  description = "RDS Postgres; only accepts traffic from the Fargate service SG"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    description     = "Postgres from Fargate tasks"
+    from_port       = 5432
+    to_port         = 5432
+    protocol        = "tcp"
+    security_groups = [aws_security_group.service.id]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = { Name = "${local.name_prefix}-db-sg" }
+}

package/dist/terraform/serverless-aws/outputs.tf

@@ -0,0 +1,64 @@
+output "alb_dns_name" {
+  description = "Public DNS of the ALB. Use this when `domain_name` is empty."
+  value       = aws_lb.main.dns_name
+}
+
+output "api_url" {
+  description = "Control plane URL. When `domain_name` is set, https://api.<domain>; otherwise the ALB DNS over HTTP."
+  value       = local.has_domain ? "https://${local.api_fqdn}" : "http://${aws_lb.main.dns_name}"
+}
+
+output "data_url" {
+  description = "Data plane URL. When `domain_name` is set, https://data.<domain>; otherwise the ALB DNS with /plane path prefix."
+  value       = local.has_domain ? "https://${local.data_fqdn}" : "http://${aws_lb.main.dns_name}/plane"
+}
+
+output "ecr_control_repository" {
+  description = "ECR repository URI for the control plane image. Empty when the stack does not own its ECR (create_ecr_repos=false)."
+  value       = var.create_ecr_repos ? aws_ecr_repository.control[0].repository_url : ""
+}
+
+output "ecr_plane_repository" {
+  description = "ECR repository URI for the data plane image. Empty when the stack does not own its ECR (create_ecr_repos=false)."
+  value       = var.create_ecr_repos ? aws_ecr_repository.plane[0].repository_url : ""
+}
+
+output "rds_endpoint" {
+  description = "RDS Postgres host (internal to the VPC; not publicly reachable)."
+  value       = aws_db_instance.main.address
+}
+
+output "payloads_bucket" {
+  description = "S3 bucket holding archive-tier payloads."
+  value       = aws_s3_bucket.payloads.bucket
+}
+
+output "vpc_id" {
+  description = "Dedicated VPC id."
+  value       = aws_vpc.main.id
+}
+
+output "ecs_cluster_name" {
+  description = "ECS cluster name used for live status checks."
+  value       = aws_ecs_cluster.main.name
+}
+
+output "control_service_name" {
+  description = "Control-plane ECS service name used for live status checks."
+  value       = aws_ecs_service.control.name
+}
+
+output "plane_service_name" {
+  description = "Data-plane ECS service name used for live status checks."
+  value       = aws_ecs_service.plane.name
+}
+
+output "database_url_secret_arn" {
+  description = "Secrets Manager ARN containing the Postgres connection string."
+  value       = aws_secretsmanager_secret.database_url.arn
+}
+
+output "token_signing_secret_arn" {
+  description = "Secrets Manager ARN for the HMAC signing secret shared by both planes."
+  value       = aws_secretsmanager_secret.token_signing.arn
+}

package/dist/terraform/serverless-aws/providers.tf

@@ -0,0 +1,19 @@
+provider "aws" {
+  region = var.region
+
+  default_tags {
+    tags = local.common_tags
+  }
+}
+
+# us-east-1 is required for ACM certificates fronting CloudFront. We do not
+# use CloudFront in phase 1 but keep this aliased provider available so phase
+# 5 (multi-region + edge router) can attach without restructuring providers.
+provider "aws" {
+  alias  = "us_east_1"
+  region = "us-east-1"
+
+  default_tags {
+    tags = local.common_tags
+  }
+}

package/dist/terraform/serverless-aws/storage.tf

@@ -0,0 +1,51 @@
+resource "aws_s3_bucket" "payloads" {
+  bucket        = "${local.name_prefix}-payloads-${data.aws_caller_identity.current.account_id}-${var.region}"
+  force_destroy = var.environment != "prod"
+}
+
+resource "aws_s3_bucket_public_access_block" "payloads" {
+  bucket = aws_s3_bucket.payloads.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "payloads" {
+  bucket = aws_s3_bucket.payloads.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_s3_bucket_versioning" "payloads" {
+  bucket = aws_s3_bucket.payloads.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "payloads" {
+  bucket = aws_s3_bucket.payloads.id
+
+  rule {
+    id     = "expire-old-versions"
+    status = "Enabled"
+
+    filter {}
+
+    noncurrent_version_expiration {
+      noncurrent_days = 30
+    }
+
+    abort_incomplete_multipart_upload {
+      days_after_initiation = 7
+    }
+  }
+}
+
+data "aws_caller_identity" "current" {}

package/dist/terraform/serverless-aws/terraform.tfvars.example

@@ -0,0 +1,19 @@
+region      = "us-west-2"
+aws_profile = "xylabs-datalake"
+environment = "staging"
+project     = "aries-datalake"
+
+# A major-version prefix selects the latest matching version offered in the region.
+db_engine_version = "16"
+
+# Set this to your domain when you're ready to put real DNS in front of the
+# stack. Until then leave it empty and reach the ALB over its AWS DNS name.
+# domain_name         = "datalake.xylabs.com"
+# create_route53_zone = false   # set true if OpenTofu should create the zone
+
+# Set these after `docker push` runs against the ECR repos that this stack
+# creates. On the very first `terraform apply` leave them at their defaults;
+# OpenTofu will provision the repos with a placeholder image tag, and you
+# then push real images and re-apply to pick them up.
+# control_image = "123456789012.dkr.ecr.us-west-2.amazonaws.com/aries-datalake-staging-control:0.1.0"
+# plane_image   = "123456789012.dkr.ecr.us-west-2.amazonaws.com/aries-datalake-staging-plane:0.1.0"