@digilogiclabs/create-saas-app 2.0.0 → 2.2.0

package/dist/templates/infrastructure/kubernetes/base/template/deployment.yaml

@@ -0,0 +1,123 @@
+# {{titleCaseName}} - Kubernetes Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+    app.kubernetes.io/component: web
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{projectName}}
+      app.kubernetes.io/component: web
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{projectName}}
+        app.kubernetes.io/component: web
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "3000"
+        prometheus.io/path: "/metrics"
+    spec:
+      serviceAccountName: {{projectName}}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      containers:
+        - name: app
+          image: {{projectName}}:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          env:
+            - name: NODE_ENV
+              value: "production"
+            - name: NEXT_PUBLIC_SUPABASE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{projectName}}-config
+                  key: SUPABASE_URL
+            - name: NEXT_PUBLIC_SUPABASE_ANON_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{projectName}}-secrets
+                  key: SUPABASE_ANON_KEY
+            - name: SUPABASE_SERVICE_ROLE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{projectName}}-secrets
+                  key: SUPABASE_SERVICE_ROLE_KEY
+            - name: NEXT_PUBLIC_APP_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{projectName}}-config
+                  key: APP_URL
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          startupProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            failureThreshold: 30
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: nextjs-cache
+              mountPath: /app/.next/cache
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: nextjs-cache
+          emptyDir: {}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: {{projectName}}
+                topologyKey: kubernetes.io/hostname
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: {{projectName}}

package/dist/templates/infrastructure/kubernetes/base/template/hpa.yaml

@@ -0,0 +1,45 @@
+# {{titleCaseName}} - Horizontal Pod Autoscaler
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{projectName}}
+  minReplicas: 2
+  maxReplicas: 10
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: 80
+  behavior:
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+        - type: Percent
+          value: 50
+          periodSeconds: 60
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 15
+        - type: Pods
+          value: 4
+          periodSeconds: 15
+      selectPolicy: Max

package/dist/templates/infrastructure/kubernetes/base/template/ingress.yaml

@@ -0,0 +1,31 @@
+# {{titleCaseName}} - Kubernetes Ingress
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
+spec:
+  tls:
+    - hosts:
+        - "{{projectName}}.example.com"
+      secretName: {{projectName}}-tls
+  rules:
+    - host: "{{projectName}}.example.com"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{projectName}}
+                port:
+                  name: http

package/dist/templates/infrastructure/kubernetes/base/template/kustomization.yaml

@@ -0,0 +1,25 @@
+# {{titleCaseName}} - Kustomize Base
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+metadata:
+  name: {{projectName}}-base
+
+namespace: {{projectName}}
+
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - configmap.yaml
+  - secret.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - hpa.yaml
+  - pdb.yaml
+  - networkpolicy.yaml
+
+commonLabels:
+  app.kubernetes.io/name: {{projectName}}
+  app.kubernetes.io/version: "1.0.0"
+  app.kubernetes.io/managed-by: kustomize

package/dist/templates/infrastructure/kubernetes/base/template/namespace.yaml

@@ -0,0 +1,8 @@
+# {{titleCaseName}} - Kubernetes Namespace
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+    app.kubernetes.io/managed-by: kustomize

package/dist/templates/infrastructure/kubernetes/base/template/networkpolicy.yaml

@@ -0,0 +1,48 @@
+# {{titleCaseName}} - Network Policy
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: {{projectName}}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow traffic from ingress controller
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: ingress-nginx
+      ports:
+        - protocol: TCP
+          port: 3000
+    # Allow traffic from monitoring
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: monitoring
+      ports:
+        - protocol: TCP
+          port: 3000
+  egress:
+    # Allow DNS
+    - to:
+        - namespaceSelector: {}
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    # Allow HTTPS (Supabase, external APIs)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - protocol: TCP
+          port: 443

package/dist/templates/infrastructure/kubernetes/base/template/pdb.yaml

@@ -0,0 +1,14 @@
+# {{titleCaseName}} - Pod Disruption Budget
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{projectName}}
+      app.kubernetes.io/component: web

package/dist/templates/infrastructure/kubernetes/base/template/secret.yaml

@@ -0,0 +1,17 @@
+# {{titleCaseName}} - Kubernetes Secret Template
+# NOTE: This is a template. In production, use sealed-secrets or external-secrets
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{projectName}}-secrets
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+type: Opaque
+stringData:
+  # Replace with actual values or use sealed-secrets/external-secrets
+  SUPABASE_ANON_KEY: "your-supabase-anon-key"
+  SUPABASE_SERVICE_ROLE_KEY: "your-supabase-service-role-key"
+  STRIPE_SECRET_KEY: "your-stripe-secret-key"
+  STRIPE_WEBHOOK_SECRET: "your-stripe-webhook-secret"
+  OPENAI_API_KEY: "your-openai-api-key"

package/dist/templates/infrastructure/kubernetes/base/template/service.yaml

@@ -0,0 +1,19 @@
+# {{titleCaseName}} - Kubernetes Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+    app.kubernetes.io/component: web
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: {{projectName}}
+    app.kubernetes.io/component: web

package/dist/templates/infrastructure/kubernetes/base/template/serviceaccount.yaml

@@ -0,0 +1,9 @@
+# {{titleCaseName}} - Kubernetes Service Account
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+automountServiceAccountToken: false

package/dist/templates/infrastructure/kubernetes/production/template/kustomization.yaml

@@ -0,0 +1,92 @@
+# {{titleCaseName}} - Production Overlay
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+metadata:
+  name: {{projectName}}-production
+
+namespace: {{projectName}}-production
+
+resources:
+  - ../../base/template
+
+nameSuffix: ""
+
+commonLabels:
+  app.kubernetes.io/environment: production
+
+# Production-specific image
+images:
+  - name: {{projectName}}
+    newName: ghcr.io/your-org/{{projectName}}
+    newTag: production
+
+# Production patches
+patches:
+  # Increase replicas
+  - target:
+      kind: Deployment
+      name: {{projectName}}
+    patch: |-
+      - op: replace
+        path: /spec/replicas
+        value: 3
+
+  # Increase resources
+  - target:
+      kind: Deployment
+      name: {{projectName}}
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/resources
+        value:
+          requests:
+            cpu: 250m
+            memory: 512Mi
+          limits:
+            cpu: 1000m
+            memory: 1Gi
+
+  # Update HPA for production
+  - target:
+      kind: HorizontalPodAutoscaler
+      name: {{projectName}}
+    patch: |-
+      - op: replace
+        path: /spec/minReplicas
+        value: 3
+      - op: replace
+        path: /spec/maxReplicas
+        value: 20
+
+  # Update PDB for production
+  - target:
+      kind: PodDisruptionBudget
+      name: {{projectName}}
+    patch: |-
+      - op: replace
+        path: /spec/minAvailable
+        value: 2
+
+  # Update ingress host for production
+  - target:
+      kind: Ingress
+      name: {{projectName}}
+    patch: |-
+      - op: replace
+        path: /spec/tls/0/hosts/0
+        value: "{{projectName}}.com"
+      - op: replace
+        path: /spec/tls/0/secretName
+        value: {{projectName}}-production-tls
+      - op: replace
+        path: /spec/rules/0/host
+        value: "{{projectName}}.com"
+
+# Production ConfigMap overrides
+configMapGenerator:
+  - name: {{projectName}}-config
+    behavior: merge
+    literals:
+      - APP_URL=https://{{projectName}}.com
+      - LOG_LEVEL=warn

package/dist/templates/infrastructure/terraform/aws/template/README.md

@@ -0,0 +1,156 @@
+# {{titleCaseName}} - AWS Infrastructure
+
+Terraform configuration for deploying {{titleCaseName}} to AWS with Vercel frontend.
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                         Internet                            │
+└─────────────────────────────────────────────────────────────┘
+                              │
+              ┌───────────────┼───────────────┐
+              ▼               ▼               ▼
+        ┌──────────┐   ┌───────────┐   ┌───────────┐
+        │  Vercel  │   │ CloudFront│   │  Supabase │
+        │ (App)    │   │ (CDN)     │   │ (Auth/DB) │
+        └──────────┘   └───────────┘   └───────────┘
+                              │
+                              ▼
+                       ┌───────────┐
+                       │    S3     │
+                       │ (Storage) │
+                       └───────────┘
+
+        ┌───────────┐   ┌───────────┐   ┌───────────┐
+        │    SQS    │   │  Secrets  │   │CloudWatch │
+        │ (Queue)   │   │ Manager   │   │ (Logs)    │
+        └───────────┘   └───────────┘   └───────────┘
+```
+
+## Prerequisites
+
+1. **AWS Account** with appropriate permissions
+2. **Vercel Account** with API token
+3. **Supabase Project** created
+4. **Terraform** >= 1.0 installed
+5. **AWS CLI** configured with credentials
+
+## Quick Start
+
+1. **Initialize Terraform:**
+   ```bash
+   terraform init
+   ```
+
+2. **Create variables file:**
+   ```bash
+   cp terraform.tfvars.example terraform.tfvars
+   ```
+
+3. **Update variables:**
+   Edit `terraform.tfvars` with your values.
+
+4. **Plan changes:**
+   ```bash
+   terraform plan
+   ```
+
+5. **Apply changes:**
+   ```bash
+   terraform apply
+   ```
+
+## Resources Created
+
+| Resource | Purpose |
+|----------|---------|
+| Vercel Project | Frontend hosting with automatic deployments |
+| S3 Bucket | File storage with versioning and encryption |
+| CloudFront Distribution | CDN for S3 content |
+| SQS Queues | Background job processing (main + DLQ) |
+| Secrets Manager | Secure storage for API keys |
+| IAM Role | Execution role for Lambda/ECS |
+| CloudWatch Log Group | Centralized logging |
+| SNS Topic | Alert notifications |
+
+## Environments
+
+### Staging
+```bash
+terraform workspace new staging
+terraform apply -var="environment=staging"
+```
+
+### Production
+```bash
+terraform workspace new production
+terraform apply -var="environment=production"
+```
+
+## Remote State (Recommended for Teams)
+
+1. Create S3 bucket and DynamoDB table:
+   ```bash
+   aws s3 mb s3://{{projectName}}-terraform-state
+   aws dynamodb create-table \
+     --table-name {{projectName}}-terraform-locks \
+     --attribute-definitions AttributeName=LockID,AttributeType=S \
+     --key-schema AttributeName=LockID,KeyType=HASH \
+     --billing-mode PAY_PER_REQUEST
+   ```
+
+2. Uncomment backend configuration in `main.tf`
+
+3. Re-initialize:
+   ```bash
+   terraform init -migrate-state
+   ```
+
+## Security Notes
+
+- All S3 buckets have public access blocked
+- Encryption enabled at rest (AES256)
+- Secrets stored in Secrets Manager
+- IAM follows least-privilege principle
+- CloudFront uses HTTPS only
+
+## Cost Estimation
+
+| Resource | Estimated Monthly Cost |
+|----------|----------------------|
+| Vercel | Free - $20 (Hobby/Pro) |
+| S3 | ~$5 (50GB storage) |
+| CloudFront | ~$10 (100GB transfer) |
+| SQS | ~$1 (1M requests) |
+| Secrets Manager | ~$1 (4 secrets) |
+| CloudWatch | ~$5 (10GB logs) |
+| **Total** | **~$22-42/month** |
+
+## Cleanup
+
+```bash
+terraform destroy
+```
+
+## Troubleshooting
+
+### Vercel API Token
+Generate at: https://vercel.com/account/tokens
+
+### AWS Credentials
+```bash
+aws configure
+# Or use environment variables:
+export AWS_ACCESS_KEY_ID="xxx"
+export AWS_SECRET_ACCESS_KEY="xxx"
+```
+
+### State Lock Issues
+```bash
+terraform force-unlock LOCK_ID
+```
+
+## License
+
+MIT - Built with DLL Platform