@deployfoundation/foundation-deploy 0.2.11 → 0.2.13

package/dist/bin/app.js

@@ -7,12 +7,12 @@ import {
   FoundationNetwork,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-sxvts8bf.js";
+} from "../chunk-ww9chzp9.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile
-} from "../chunk-n8qzcdq4.js";
+} from "../chunk-7qn00ny1.js";
 
 // bin/app.ts
 import { execFileSync } from "node:child_process";

package/dist/bin/foundation-deploy.js

@@ -29,7 +29,7 @@ import {
   stackExists,
   stackOutput,
   toolVersion
-} from "../chunk-2kqazxx6.js";
+} from "../chunk-e9vs85ah.js";
 import {
   BASE_SLACK_EVENTS,
   CAPABILITY_IDS,
@@ -45,7 +45,7 @@ import {
   requiredSlackScopes,
   skillsKey,
   slackCommandPrefix
-} from "../chunk-n8qzcdq4.js";
+} from "../chunk-7qn00ny1.js";
 
 // src/deploy/config-sync.ts
 import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";

package/dist/bin/release-account.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import {
   DEFAULT_RELEASE_BUCKET
-} from "../chunk-2kqazxx6.js";
-import"../chunk-n8qzcdq4.js";
+} from "../chunk-e9vs85ah.js";
+import"../chunk-7qn00ny1.js";
 
 // bin/release-account.ts
 import * as cdk2 from "aws-cdk-lib";

package/dist/{chunk-n8qzcdq4.js → chunk-7qn00ny1.js}

@@ -572,6 +572,14 @@ var RawProactive = z2.object({
   channels: z2.array(z2.string().regex(/^[CG][A-Z0-9]{8,}$/)).default([]),
   maxPerHour: z2.number().int().min(1).max(500).default(20)
 }).strict().default({ channels: [] });
+var RawRuntime = z2.object({
+  idleTimeoutMinutes: z2.number().int().min(5).max(480).default(15),
+  maxLifetimeHours: z2.number().int().min(1).max(8).default(8)
+}).strict().default({});
+var RawNetwork = z2.object({
+  natGateways: z2.union([z2.literal(1), z2.literal(2)]).default(1),
+  endpointAzs: z2.union([z2.literal(1), z2.literal(2)]).default(1)
+}).strict().default({});
 var RawNaming = z2.object({
   prefix: z2.string().min(1).max(32).regex(/^[A-Z][A-Za-z0-9]*$/),
   secretPrefix: z2.string().min(1).max(40).regex(/^[a-z][a-z0-9-]*$/),
@@ -711,6 +719,8 @@ var RawInstance = z2.object({
   license: RawLicense.optional(),
   config: z2.string().min(1),
   proactive: RawProactive,
+  runtime: RawRuntime,
+  network: RawNetwork,
   integrations: RawIntegrations,
   newsletter: RawNewsletter
 }).strict().superRefine((doc, ctx) => {

package/dist/{chunk-2kqazxx6.js → chunk-e9vs85ah.js}

@@ -6,7 +6,7 @@ import {
   manifestKey,
   releaseCacheDir,
   verifyManifest
-} from "./chunk-n8qzcdq4.js";
+} from "./chunk-7qn00ny1.js";
 
 // src/deploy/release.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";

package/dist/{chunk-sxvts8bf.js → chunk-ww9chzp9.js}

@@ -19,7 +19,7 @@ import {
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-n8qzcdq4.js";
+} from "./chunk-7qn00ny1.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -118,8 +118,8 @@ class FoundationAgent extends cdk.Stack {
           }
         ],
         LifecycleConfiguration: {
-          IdleRuntimeSessionTimeout: 3600,
-          MaxLifetime: 28800
+          IdleRuntimeSessionTimeout: props.instance.runtime.idleTimeoutMinutes * 60,
+          MaxLifetime: props.instance.runtime.maxLifetimeHours * 3600
         },
         RoleArn: this.executionRole.roleArn,
         EnvironmentVariables: {
@@ -2043,7 +2043,7 @@ class FoundationNetwork extends cdk5.Stack {
     } else {
       this.vpc = new ec2.Vpc(this, "FoundationVpc", {
         maxAzs: 2,
-        natGateways: 2,
+        natGateways: props.instance.network.natGateways,
         subnetConfiguration: [
           { name: "ingress", subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24 },
           { name: "egress", subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: 24 },
@@ -2088,7 +2088,12 @@ class FoundationNetwork extends cdk5.Stack {
     });
     endpointSg.addIngressRule(ec2.Peer.ipv4(this.vpc.vpcCidrBlock), ec2.Port.tcp(443), "HTTPS from VPC");
     this.endpointSecurityGroup = endpointSg;
-    const endpointSubnets = importedVpcId ? { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS } : { subnetGroupName: "app" };
+    const endpointSubnets = importedVpcId ? { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, onePerAz: true } : { subnetGroupName: "app", onePerAz: true };
+    if (props.instance.network.endpointAzs === 1) {
+      const zones = this.vpc.selectSubnets(endpointSubnets).availabilityZones;
+      if (zones.length > 1)
+        Object.assign(endpointSubnets, { availabilityZones: [zones[0]] });
+    }
     const gatewayEndpointSubnets = importedVpcId ? [{ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }] : [{ subnetGroupName: "app" }, { subnetGroupName: "egress" }];
     const sameAccountOnly = new iam6.PolicyStatement({
       effect: iam6.Effect.ALLOW,

package/dist/src/index.js

@@ -9,7 +9,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-sxvts8bf.js";
+} from "../chunk-ww9chzp9.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -42,7 +42,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-n8qzcdq4.js";
+} from "../chunk-7qn00ny1.js";
 export {
   BUILD_TIMEOUT,
   BUN_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.11",
+  "version": "0.2.13",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/stacks/agent-stack.ts

@@ -227,9 +227,11 @@ export class FoundationAgent extends cdk.Stack {
             },
           },
         ],
+        // Idle sessions are billed for their memory: see `runtime` in the
+        // instance schema for why the default is 15 minutes, not 60.
         LifecycleConfiguration: {
-          IdleRuntimeSessionTimeout: 3600,
-          MaxLifetime: 28800,
+          IdleRuntimeSessionTimeout: props.instance.runtime.idleTimeoutMinutes * 60,
+          MaxLifetime: props.instance.runtime.maxLifetimeHours * 3600,
         },
         RoleArn: this.executionRole.roleArn,
         EnvironmentVariables: {

package/src/stacks/network-stack.ts

@@ -70,9 +70,9 @@ export class FoundationNetwork extends cdk.Stack {
     } else {
       this.vpc = new ec2.Vpc(this, "FoundationVpc", {
         maxAzs: 2,
-        // One NAT per AZ: the Slack ack / chat.update path must survive a
-        // single-AZ failure.
-        natGateways: 2,
+        // One NAT by default: a second (AZ-failure tolerance for egress) is
+        // about $33/month, opted into with `network.natGateways: 2`.
+        natGateways: props.instance.network.natGateways,
         subnetConfiguration: [
           { name: "ingress", subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24 },
           { name: "egress", subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, cidrMask: 24 },
@@ -82,7 +82,7 @@ export class FoundationNetwork extends cdk.Stack {
       this.egressSubnets = { subnetGroupName: "egress" };
       // The addresses everything in the VPC leaves through, so a third party
       // (an Atlas IP allowlist, say) can name this instance and no other.
-      // One per AZ, matching `natGateways: 2` above.
+      // One per NAT gateway (`network.natGateways`).
       new cdk.CfnOutput(this, "NatEgressIp", {
         value: cdk.Fn.join(
           ",",
@@ -191,9 +191,16 @@ export class FoundationNetwork extends cdk.Stack {
     // Interface endpoints sit in the isolated app tier when we created the
     // VPC; on an imported VPC they land in its private subnets. Private DNS
     // makes them authoritative for the whole VPC either way.
+    // One AZ by default (`network.endpointAzs`): the other AZ reaches the
+    // same endpoint through private DNS, for a little cross-AZ traffic
+    // instead of a second set of endpoint-hours.
     const endpointSubnets: ec2.SubnetSelection = importedVpcId
-      ? { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }
-      : { subnetGroupName: "app" };
+      ? { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS, onePerAz: true }
+      : { subnetGroupName: "app", onePerAz: true };
+    if (props.instance.network.endpointAzs === 1) {
+      const zones = this.vpc.selectSubnets(endpointSubnets).availabilityZones;
+      if (zones.length > 1) Object.assign(endpointSubnets, { availabilityZones: [zones[0]] });
+    }
     // Gateway endpoints attach to every private route table (app + egress) so
     // S3/DynamoDB traffic from the NAT tier also stays on AWS's network.
     const gatewayEndpointSubnets: ec2.SubnetSelection[] = importedVpcId