@fishawack/lab-env 5.6.1 → 5.7.0-beta.2

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 ## Changelog
 
+### 5.7.0-beta.2 (2026-06-11)
+
+#### Features
+
+* ability to add opensearch to laravel fullstack provisions ([6218c78](https://bitbucket.org/fishawackdigital/lab-env/commits/6218c7835124941fd63ef8056c462a8775f6d7ae))
+* added ssm permission to ec2 role ([7b0195b](https://bitbucket.org/fishawackdigital/lab-env/commits/7b0195b98c59dd4fdcc8ca6848847dddda9ffb61))
+* auto configuration of the acm cert and port 443 listener if cert found ([878ce17](https://bitbucket.org/fishawackdigital/lab-env/commits/878ce175b6031a7ee6cd9f84420c8ace4d858093))
+* ec2 instances always in private and prompt for load balancer visibility + python now dynamic ([bd651cb](https://bitbucket.org/fishawackdigital/lab-env/commits/bd651cb78733d45bf1601e24dbd9c5a5ffc458e0))
+* ensure private subnets now a standard part of the prov command ([22f9876](https://bitbucket.org/fishawackdigital/lab-env/commits/22f9876e390689f7e94939be3839d0a2312f5f10))
+* rds now also creates in private subnet ([e7fb89d](https://bitbucket.org/fishawackdigital/lab-env/commits/e7fb89d9dfbb3fe62c34e8a07c6ba1c7fc732964))
+* use instance role and bucket policy for access now and move restore to after preflight checks ([c4bc090](https://bitbucket.org/fishawackdigital/lab-env/commits/c4bc090927a8dd9d43a52b93f06926e7167003b2))
+
+#### Bug Fixes
+
+* fullstack provision now indempotent and search enforces search role ([ca374ca](https://bitbucket.org/fishawackdigital/lab-env/commits/ca374caf5c1efa0fa216f62db776591de228e8d5))
+
+### 5.7.0-beta.1 (2026-06-08)
+
+#### Features
+
+* added a sync secrets command ([c98c66d](https://bitbucket.org/fishawackdigital/lab-env/commits/c98c66dc0d92bdac9dd79ae544362e60bae4ac88))
+* added the ability to restore from snapshot ([c0f3c6c](https://bitbucket.org/fishawackdigital/lab-env/commits/c0f3c6c5ee841121e78bc38047e40336c5880ef0))
+* elasticbeanstlak now fully utilizes secrets manager and has options to persist after delete ([bbb252c](https://bitbucket.org/fishawackdigital/lab-env/commits/bbb252cf5e2f07551c63df6fcebd574c1a84d9ab))
+* elb instance profile and managed update profile now include reading secretmanager permissions ([9059b01](https://bitbucket.org/fishawackdigital/lab-env/commits/9059b010ce781e07f3630aba5bb0b88556bed929))
+* encryption in transit for db connections by default for laravel applications and enforcement ([cac6590](https://bitbucket.org/fishawackdigital/lab-env/commits/cac659083dfef46eb047b943451be854d4daf94f))
+* rds and s3 no fully decoupled from fullstack and can be reattached to recreated elb instances ([72d3361](https://bitbucket.org/fishawackdigital/lab-env/commits/72d3361441e37d70f8b78dc98850828a92ea48a1))
+* setvars now utilizes secret manager secrets instead of plain text ([462ef90](https://bitbucket.org/fishawackdigital/lab-env/commits/462ef9077dad31b420355038c3264abf471164b9))
+
+#### Bug Fixes
+
+* added secret manager permission to fullstack deploy permissions ([6432d2d](https://bitbucket.org/fishawackdigital/lab-env/commits/6432d2d756e19e96c62d8c29dd79828811ecf1ac))
+* disable public access to RDS instances ([d4759e8](https://bitbucket.org/fishawackdigital/lab-env/commits/d4759e8ac11ecfbb22b0c3c80c96d5781ae8bda9))
+* session driver now uses database by default ([d745615](https://bitbucket.org/fishawackdigital/lab-env/commits/d7456154920ab380e2c01424e065c9aca6edf750))
+* use correct spinner class for logging ([592d7d5](https://bitbucket.org/fishawackdigital/lab-env/commits/592d7d56cf83ebfd62ce9d025450a8717222e8e0))
+
 ### 5.6.1 (2026-06-03)
 
 #### Bug Fixes

package/_Test/provision.js

@@ -66,7 +66,9 @@ describe("provision", () => {
         });
 
         after(async () => {
-            await aws.fullstackTerminate(repo, repo, branch);
+            await aws.fullstackTerminate(repo, repo, branch, {
+                deleteAppSecret: true,
+            });
 
             execSync(`rm -rf .elasticbeanstalk`, {
                 encoding: "utf8",

package/cli.js

@@ -171,6 +171,7 @@ const args = hideBin(process.argv);
                 "key",
                 "dekey",
                 "prune",
+                "sync-secrets",
             ].forEach((d) =>
                 cli.command(...require(`./commands/create/cmds/${d}.js`)),
             );

package/commands/create/cmds/deprovision.js

@@ -78,11 +78,42 @@ module.exports = [
         // Set AWS client defaults before any AWS operations
         setAWSClientDefaults(answers.client, answers.region);
 
-        await aws[`${answers.stack}Terminate`](
-            slug,
-            _.repoSafe,
-            branch,
-            answers.id,
-        );
+        if (answers.stack === "fullstack") {
+            const resourceAnswers = await inquirer.prompt([
+                {
+                    type: "confirm",
+                    name: "deleteStorage",
+                    message: "Delete the S3 storage bucket?",
+                    default: false,
+                },
+                {
+                    type: "confirm",
+                    name: "deleteDatabase",
+                    message: "Delete the RDS database?",
+                    default: false,
+                },
+                {
+                    type: "confirm",
+                    name: "deleteOpenSearch",
+                    message: "Delete the OpenSearch domain?",
+                    default: false,
+                },
+                {
+                    type: "confirm",
+                    name: "deleteAppSecret",
+                    message: "Delete the app secret (APP_KEY, salts, etc.)?",
+                    default: false,
+                },
+            ]);
+
+            await aws.fullstackTerminate(slug, _.repoSafe, branch, {
+                deleteStorage: resourceAnswers.deleteStorage,
+                deleteDatabase: resourceAnswers.deleteDatabase,
+                deleteOpenSearch: resourceAnswers.deleteOpenSearch,
+                deleteAppSecret: resourceAnswers.deleteAppSecret,
+            });
+        } else {
+            await aws.staticTerminate(slug, _.repoSafe, branch, answers.id);
+        }
     },
 ];

package/commands/create/cmds/provision.js

@@ -213,15 +213,35 @@ module.exports = [
                         message: "What availability is required?",
                         choices: ["low", "high"],
                     },
+                    region,
                     {
                         type: "confirm",
                         name: "database",
                         message: "Does this site need a database?",
                         default: true,
                     },
-                    region,
+                    {
+                        type: "confirm",
+                        name: "storage",
+                        message: "Does this site need S3 storage?",
+                        default: true,
+                    },
                 ])),
             };
+
+            if (answers.framework === "laravel") {
+                answers = {
+                    ...answers,
+                    ...(await inquirer.prompt([
+                        {
+                            type: "confirm",
+                            name: "opensearch",
+                            message: "Does this site need OpenSearch?",
+                            default: false,
+                        },
+                    ])),
+                };
+            }
         }
 
         answers = {
@@ -290,6 +310,225 @@ module.exports = [
         // Set AWS client defaults before any AWS operations
         setAWSClientDefaults(answers.client, answers.region);
 
+        // Pre-flight check for existing resources
+        let existingSecrets = {
+            app: null,
+            storage: null,
+            database: null,
+            opensearch: null,
+        };
+        let existingEnvironment = false;
+        let existingResources = {
+            storage: false,
+            database: false,
+            opensearch: false,
+        };
+        let snapshot = null;
+
+        if (answers.stack === "fullstack") {
+            const { existing } = await aws.fullstackPreflight(
+                slug,
+                _.repoSafe,
+                branch,
+                {
+                    storage: answers.storage,
+                    database: answers.database,
+                    opensearch: answers.opensearch,
+                },
+            );
+
+            if (
+                existing.environment &&
+                existing.environment.Status !== "Ready"
+            ) {
+                console.log(
+                    utilities.colorize(
+                        `\n  ✗ EB environment "${slug}" is currently ${existing.environment.Status}, cannot re-provision\n`,
+                        "error",
+                    ),
+                );
+                process.exit(1);
+            }
+
+            if (existing.environment) {
+                new utilities.Spinner(
+                    "EB environment already exists, skipping creation",
+                    true,
+                ).ora.info();
+                existingEnvironment = existing.environment;
+            }
+
+            if (existing.storage) {
+                new utilities.Spinner(
+                    "S3 bucket already exists, skipping storage creation",
+                    true,
+                ).ora.info();
+                existingResources.storage = true;
+            }
+
+            if (existing.database) {
+                new utilities.Spinner(
+                    "RDS instance already exists, skipping database creation",
+                    true,
+                ).ora.info();
+                existingResources.database = true;
+            }
+
+            if (existing.opensearch) {
+                new utilities.Spinner(
+                    "OpenSearch domain already exists, skipping creation",
+                    true,
+                ).ora.info();
+                existingResources.opensearch = true;
+            }
+
+            // Snapshot restore prompt — only if database is needed and doesn't already exist
+            if (answers.database && !existing.database) {
+                const { restore } = await inquirer.prompt([
+                    {
+                        type: "confirm",
+                        name: "restore",
+                        message: "Restore database from an existing snapshot?",
+                        default: false,
+                    },
+                ]);
+
+                if (restore) {
+                    const snapshots = await aws.rds.listManualSnapshots();
+
+                    if (snapshots.length) {
+                        const { selected } = await inquirer.prompt([
+                            {
+                                type: "list",
+                                name: "selected",
+                                message: "Select a snapshot to restore from",
+                                choices: snapshots.map((s) => ({
+                                    name: `${s.DBSnapshotIdentifier} (source: ${s.DBInstanceIdentifier}, created: ${new Date(s.SnapshotCreateTime).toLocaleDateString()})`,
+                                    value: s.DBSnapshotIdentifier,
+                                })),
+                            },
+                        ]);
+
+                        snapshot = selected;
+                    } else {
+                        new utilities.Spinner(
+                            "No manual snapshots found, creating a fresh database",
+                            true,
+                        ).ora.info();
+                    }
+                }
+            }
+
+            existingSecrets = existing.secrets;
+
+            if (existingSecrets.app) {
+                new utilities.Spinner(
+                    "App secret already exists, reusing existing values",
+                    true,
+                ).ora.info();
+            }
+
+            if (existingSecrets.storage) {
+                new utilities.Spinner(
+                    "Storage secret already exists, reusing existing values",
+                    true,
+                ).ora.info();
+            }
+
+            if (existingSecrets.database) {
+                new utilities.Spinner(
+                    "Database secret already exists, reusing existing values",
+                    true,
+                ).ora.info();
+            }
+
+            if (existingSecrets.opensearch) {
+                new utilities.Spinner(
+                    "OpenSearch secret already exists, reusing existing values",
+                    true,
+                ).ora.info();
+            }
+
+            // EB-specific prompts — only for new environments
+            if (!existingEnvironment && answers.availability === "high") {
+                answers = {
+                    ...answers,
+                    ...(await inquirer.prompt([
+                        {
+                            type: "list",
+                            name: "elbScheme",
+                            message: "Load balancer visibility?",
+                            choices: ["public", "internal"],
+                        },
+                    ])),
+                };
+            }
+
+            // App name and domain prompts — only for new Laravel environments
+            if (!existingEnvironment && answers.framework === "laravel") {
+                answers = {
+                    ...answers,
+                    ...(await inquirer.prompt([
+                        {
+                            type: "input",
+                            name: "appName",
+                            message: "What is the app name?",
+                            default: _.repoSafe,
+                            validate: (v) =>
+                                /^[a-zA-Z0-9 ]+$/.test(v) ||
+                                "Alphanumeric characters and spaces only",
+                        },
+                        {
+                            type: "input",
+                            name: "appDomain",
+                            message:
+                                "What domain will this site be served at? (DNS must be configured manually)",
+                            filter: (v) =>
+                                v
+                                    .replace(/^https?:\/\//, "")
+                                    .replace(/\/+$/, ""),
+                            validate: (v) =>
+                                v.length > 0 || "Domain is required",
+                        },
+                    ])),
+                };
+
+                // ACM cert selection — only for high availability (ALB)
+                if (answers.availability === "high") {
+                    const matchingCerts =
+                        await aws.acm.findCertificatesForDomain(
+                            answers.appDomain,
+                        );
+
+                    if (matchingCerts.length) {
+                        answers = {
+                            ...answers,
+                            ...(await inquirer.prompt([
+                                {
+                                    type: "list",
+                                    name: "certArn",
+                                    message:
+                                        "Which ACM certificate should be used for HTTPS?",
+                                    choices: [
+                                        ...matchingCerts.map((c) => ({
+                                            name: c.DomainName,
+                                            value: c.CertificateArn,
+                                        })),
+                                        { name: "None", value: null },
+                                    ],
+                                },
+                            ])),
+                        };
+                    } else {
+                        new utilities.Spinner(
+                            `No ACM certificates match ${answers.appDomain}, HTTPS listener must be configured manually`,
+                            true,
+                        ).ora.info();
+                    }
+                }
+            }
+        }
+
         try {
             if (answers.stack === "static") {
                 infastructure = await aws.static(
@@ -319,6 +558,16 @@ module.exports = [
                     answers.framework,
                     answers.availability,
                     answers.database,
+                    answers.storage,
+                    answers.opensearch,
+                    existingSecrets,
+                    snapshot,
+                    answers.elbScheme || "public",
+                    existingEnvironment,
+                    existingResources,
+                    answers.appName,
+                    answers.appDomain,
+                    answers.certArn,
                 );
             }
         } catch (e) {

package/commands/create/cmds/sync-secrets.js

@@ -0,0 +1,198 @@
+const _ = require("../../../globals.js");
+const inquirer = require("inquirer");
+const aws = require("../services/aws/index.js");
+const { setAWSClientDefaults } = require("../services/aws/misc.js");
+const utilities = require("../libs/utilities");
+const { client, region } = require("../libs/prompts.js");
+const { secretGroups } = require("../libs/vars.js");
+
+const SECRETS_NAMESPACE = "aws:elasticbeanstalk:application:environmentsecrets";
+
+module.exports = [
+    ["sync-secrets", "syncs"],
+    _.config.preset === "devops"
+        ? "Sync Secrets Manager keys with EB environment secrets"
+        : false,
+    (yargs) => {
+        yargs.option("branch", {
+            alias: "b",
+            describe: "Branch to configure",
+            type: "string",
+        });
+    },
+    async (argv) => {
+        let branch = argv.branch || _.branch;
+
+        let answer = await inquirer.prompt([
+            {
+                type: "confirm",
+                name: "check",
+                message: `Syncing secrets for the ${utilities.colorize(branch, "success")} branch, is this correct?`,
+                default: "Y",
+            },
+        ]);
+
+        if (!answer.check) {
+            process.exit(1);
+        }
+
+        let answers = await inquirer.prompt([client, region]);
+
+        const slug = aws.slug(_.repoSafe, answers.client, branch, "eb");
+
+        setAWSClientDefaults(answers.client, answers.region);
+
+        // Verify EB environment exists
+        let appName;
+
+        try {
+            const { Environments } =
+                await aws.elasticbeanstalk.describeEnvironment(slug);
+            const active = Environments.filter(
+                (e) => e.Status !== "Terminated",
+            );
+            if (!active.length) {
+                console.log(
+                    utilities.colorize(
+                        `\n  ✗ No active EB environment found for "${slug}"\n`,
+                        "error",
+                    ),
+                );
+                process.exit(1);
+            }
+            appName = active[0].ApplicationName;
+        } catch {
+            console.log(
+                utilities.colorize(
+                    `\n  ✗ No EB environment found for "${slug}"\n`,
+                    "error",
+                ),
+            );
+            process.exit(1);
+        }
+
+        // Build expected environmentsecrets from Secrets Manager
+        const expectedSettings = [];
+        const groups = secretGroups;
+
+        for (const group of groups) {
+            const secretName = `${slug}-${group}`;
+
+            try {
+                const secret =
+                    await aws.secretsmanager.describeSecret(secretName);
+                const secretValue =
+                    await aws.secretsmanager.getSecretValue(secretName);
+                const keys = Object.keys(secretValue);
+
+                for (const key of keys) {
+                    expectedSettings.push({
+                        OptionName: key,
+                        Value: `${secret.ARN}:${key}`,
+                        Namespace: SECRETS_NAMESPACE,
+                    });
+                }
+            } catch {
+                /* secret does not exist for this group */
+            }
+        }
+
+        // Get current EB configuration
+        const currentSettings =
+            await aws.elasticbeanstalk.describeConfigurationSettings(
+                appName,
+                slug,
+            );
+
+        const currentSecrets = currentSettings.filter(
+            (s) => s.Namespace === SECRETS_NAMESPACE,
+        );
+
+        // Diff: what to add and what to remove
+        const currentKeys = new Set(currentSecrets.map((s) => s.OptionName));
+        const expectedKeys = new Set(expectedSettings.map((s) => s.OptionName));
+
+        const toAdd = expectedSettings.filter(
+            (s) => !currentKeys.has(s.OptionName),
+        );
+        const toUpdate = expectedSettings.filter((s) => {
+            const current = currentSecrets.find(
+                (c) => c.OptionName === s.OptionName,
+            );
+            return current && current.Value !== s.Value;
+        });
+        const toRemove = currentSecrets
+            .filter((s) => !expectedKeys.has(s.OptionName))
+            .map((s) => ({
+                OptionName: s.OptionName,
+                Namespace: SECRETS_NAMESPACE,
+            }));
+
+        const optionSettings = [...toAdd, ...toUpdate];
+
+        if (!optionSettings.length && !toRemove.length) {
+            new utilities.Spinner(
+                "Environment secrets are in sync",
+                true,
+            ).ora.info();
+            return;
+        }
+
+        // Log summary
+        if (toAdd.length) {
+            console.log(
+                utilities.colorize(
+                    `\n  Adding ${toAdd.length} secret(s): ${toAdd.map((s) => s.OptionName).join(", ")}`,
+                    "success",
+                ),
+            );
+        }
+
+        if (toUpdate.length) {
+            console.log(
+                utilities.colorize(
+                    `\n  Updating ${toUpdate.length} secret(s): ${toUpdate.map((s) => s.OptionName).join(", ")}`,
+                    "info",
+                ),
+            );
+        }
+
+        if (toRemove.length) {
+            console.log(
+                utilities.colorize(
+                    `\n  Removing ${toRemove.length} secret(s): ${toRemove.map((s) => s.OptionName).join(", ")}`,
+                    "warning",
+                ),
+            );
+        }
+
+        console.log("");
+
+        answer = await inquirer.prompt([
+            {
+                type: "confirm",
+                name: "proceed",
+                message: "Apply these changes?",
+                default: true,
+            },
+        ]);
+
+        if (!answer.proceed) {
+            process.exit(0);
+        }
+
+        await aws.elasticbeanstalk.updateEnvironmentSettings(
+            slug,
+            optionSettings,
+            toRemove,
+        );
+
+        console.log(
+            // eslint-disable-next-line prettier/prettier
+            utilities.colorize(
+                "\n  ✔ Environment secrets synced\n",
+                "success",
+            ),
+        );
+    },
+];

package/commands/create/libs/utilities.js

@@ -122,6 +122,8 @@ module.exports.nameSafe = (name, service = "s3") => {
 
     if (service === "eb") {
         maxLength = 40;
+    } else if (service === "os") {
+        maxLength = 28;
     }
 
     safe = safe.substring(0, maxLength - suffix.length - prefix.length);