@fishawack/lab-env 5.6.1 → 5.7.0-beta.2

package/commands/create/libs/vars.js

@@ -178,6 +178,8 @@ module.exports.templates = [
     },
 ];
 
+module.exports.secretGroups = ["app", "storage", "database", "opensearch"];
+
 module.exports.frameworks = [
     {
         name: "wordpress",
@@ -207,55 +209,7 @@ module.exports.eb = {
         python: {
             shared: [],
             low: [],
-            high: [
-                {
-                    OptionName: "ELBScheme",
-                    Value: "internal",
-                    Namespace: "aws:ec2:vpc",
-                },
-                () => {
-                    const regions = {
-                        "us-east-1": {
-                            VPCId: "vpc-d30bcca8",
-                            Subnets:
-                                "subnet-00bf5eda896fdd5c5,subnet-0aa7e40d4701683ae",
-                        },
-                        "eu-west-1": {
-                            VPCId: "vpc-cc0d9aa9",
-                            Subnets:
-                                "subnet-0e357f06e047e1c10,subnet-0956ffb043535455d",
-                        },
-                    };
-
-                    return [
-                        {
-                            OptionName: "VPCId",
-                            Value: regions[process.env.AWS_REGION].VPCId,
-                            Namespace: "aws:ec2:vpc",
-                        },
-                        {
-                            OptionName: "Subnets",
-                            Value: regions[process.env.AWS_REGION].Subnets,
-                            Namespace: "aws:ec2:vpc",
-                        },
-                        {
-                            OptionName: "ELBSubnets",
-                            Value: regions[process.env.AWS_REGION].Subnets,
-                            Namespace: "aws:ec2:vpc",
-                        },
-                    ];
-                },
-                {
-                    OptionName: "AssociatePublicIpAddress",
-                    Value: "false",
-                    Namespace: "aws:ec2:vpc",
-                },
-                {
-                    OptionName: "APP_ENV",
-                    Value: "production",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-            ],
+            high: [],
         },
         php: {
             shared: [],
@@ -284,233 +238,17 @@ module.exports.eb = {
             high: [],
         },
         wordpress: {
-            shared: [
-                {
-                    OptionName: "AUTH_KEY",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "SECURE_AUTH_KEY",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "LOGGED_IN_KEY",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "NONCE_KEY",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AUTH_SALT",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "SECURE_AUTH_SALT",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "LOGGED_IN_SALT",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "NONCE_SALT",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "S3_UPLOADS_BUCKET",
-                    Value: "<%= s3Slug %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "S3_UPLOADS_REGION",
-                    Value: "<%= AWS_REGION %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "S3_UPLOADS_KEY",
-                    Value: "<%= AccessKeyId %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "S3_UPLOADS_SECRET",
-                    Value: "<%= SecretAccessKey %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-            ],
+            shared: [],
             low: [],
             high: [],
         },
         laravel: {
-            shared: [
-                {
-                    OptionName: "APP_ENV",
-                    Value: "production",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "APP_KEY",
-                    Value: `base64:${Buffer.from(generator.generate({ length: 32, numbers: true, symbols: true })).toString("base64")}`,
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "APP_DEBUG",
-                    Value: "false",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "APP_URL",
-                    Value: "https://<%= DOMAIN_LINK %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_BUCKET",
-                    Value: "<%= s3Slug %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_DEFAULT_REGION",
-                    Value: "<%= AWS_REGION %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_ACCESS_KEY_ID",
-                    Value: "<%= AccessKeyId %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_SECRET_ACCESS_KEY",
-                    Value: "<%= SecretAccessKey %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "FILESYSTEM_DISK",
-                    Value: "s3",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "FILESYSTEM_DISK_PUBLIC",
-                    Value: "s3-public",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-            ],
+            shared: [],
             low: [],
-            high: [
-                {
-                    OptionName: "SESSION_DRIVER",
-                    Value: "cookie",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "SESSION_SECURE_COOKIE",
-                    Value: "true",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-            ],
+            high: [],
         },
         adonis: {
-            shared: [
-                {
-                    OptionName: "NODE_ENV",
-                    Value: "production",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "APP_KEY",
-                    Value: `base64:${Buffer.from(generator.generate({ length: 32, numbers: true, symbols: true })).toString("base64")}`,
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "APP_URL",
-                    Value: "https://<%= DOMAIN_LINK %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "SESSION_DRIVER",
-                    Value: "cookie",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_BUCKET",
-                    Value: "<%= s3Slug %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_DEFAULT_REGION",
-                    Value: "<%= AWS_REGION %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_ACCESS_KEY_ID",
-                    Value: "<%= AccessKeyId %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_SECRET_ACCESS_KEY",
-                    Value: "<%= SecretAccessKey %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "FILESYSTEM_DISK",
-                    Value: "s3",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "FILESYSTEM_DISK_PUBLIC",
-                    Value: "s3-public",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "PORT",
-                    Value: "3333",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "LOG_LEVEL",
-                    Value: "info",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-            ],
+            shared: [],
             low: [],
             high: [],
         },
@@ -525,32 +263,11 @@ module.exports.eb = {
                 Value: "lab-env-aws-elasticbeanstalk-service-role",
                 Namespace: "aws:elasticbeanstalk:environment",
             },
-            {
+            ({ instanceProfileName }) => ({
                 OptionName: "IamInstanceProfile",
-                Value: "aws-elasticbeanstalk-ec2-role",
+                Value: instanceProfileName || "aws-elasticbeanstalk-ec2-role",
                 Namespace: "aws:autoscaling:launchconfiguration",
-            },
-            ({ database }) =>
-                database && [
-                    {
-                        OptionName: "HasCoupledDatabase",
-                        Value: "true",
-                        Namespace: "aws:rds:dbinstance",
-                    },
-                    {
-                        OptionName: "DBEngineVersion",
-                        Value: "8.0.43",
-                        Namespace: "aws:rds:dbinstance",
-                    },
-                    {
-                        OptionName: "DBPassword",
-                        Value: generator.generate({
-                            length: 10,
-                            numbers: true,
-                        }),
-                        Namespace: "aws:rds:dbinstance",
-                    },
-                ],
+            }),
         ],
         low: [
             {
@@ -558,16 +275,6 @@ module.exports.eb = {
                 Value: "SingleInstance",
                 Namespace: "aws:elasticbeanstalk:environment",
             },
-            {
-                OptionName: "DOMAIN_LINK",
-                Value: "<%= DOMAIN_LINK %>",
-                Namespace: "aws:elasticbeanstalk:application:environment",
-            },
-            {
-                OptionName: "EMAIL_LINK",
-                Value: "mike.mellor@fishawack.com",
-                Namespace: "aws:elasticbeanstalk:application:environment",
-            },
         ],
         high: [
             {
@@ -610,8 +317,215 @@ module.exports.eb = {
                 Value: "application",
                 Namespace: "aws:elasticbeanstalk:environment",
             },
+            ({ vpcId, privateSubnetIds, publicSubnetIds, elbScheme }) => {
+                const settings = [
+                    {
+                        OptionName: "VPCId",
+                        Value: vpcId,
+                        Namespace: "aws:ec2:vpc",
+                    },
+                    {
+                        OptionName: "Subnets",
+                        Value: privateSubnetIds,
+                        Namespace: "aws:ec2:vpc",
+                    },
+                    {
+                        OptionName: "ELBSubnets",
+                        Value:
+                            elbScheme === "internal"
+                                ? privateSubnetIds
+                                : publicSubnetIds,
+                        Namespace: "aws:ec2:vpc",
+                    },
+                    {
+                        OptionName: "AssociatePublicIpAddress",
+                        Value: "false",
+                        Namespace: "aws:ec2:vpc",
+                    },
+                ];
+
+                if (elbScheme === "internal") {
+                    settings.push({
+                        OptionName: "ELBScheme",
+                        Value: "internal",
+                        Namespace: "aws:ec2:vpc",
+                    });
+                }
+
+                return settings;
+            },
         ],
     },
+    secretPayloads: {
+        shared: {
+            database: ({ database }) =>
+                database && {
+                    RDS_HOSTNAME: "<%= RDS_HOSTNAME %>",
+                    RDS_PORT: "<%= RDS_PORT %>",
+                    RDS_DB_NAME: "ebdb",
+                    RDS_USERNAME: "ebroot",
+                    RDS_PASSWORD: "<%= RDS_PASSWORD %>",
+                    MYSQL_ATTR_SSL_CA: "/opt/rds-certs/global-bundle.pem",
+                },
+        },
+        low: {
+            app: {
+                DOMAIN_LINK: "<%= DOMAIN_LINK %>",
+                EMAIL_LINK: "mike.mellor@fishawack.com",
+            },
+        },
+        high: {},
+        wordpress: {
+            shared: {
+                app: {
+                    AUTH_KEY: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    SECURE_AUTH_KEY: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    LOGGED_IN_KEY: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    NONCE_KEY: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    AUTH_SALT: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    SECURE_AUTH_SALT: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    LOGGED_IN_SALT: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    NONCE_SALT: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                },
+                storage: ({ storage }) =>
+                    storage && {
+                        S3_UPLOADS_BUCKET: "<%= s3Slug %>",
+                        S3_UPLOADS_REGION: "<%= AWS_REGION %>",
+                        S3_UPLOADS_KEY: "<%= AccessKeyId %>",
+                        S3_UPLOADS_SECRET: "<%= SecretAccessKey %>",
+                    },
+            },
+        },
+        laravel: {
+            shared: {
+                app: {
+                    APP_NAME: "<%= APP_NAME %>",
+                    APP_ENV: "production",
+                    APP_KEY: `base64:${Buffer.from(generator.generate({ length: 32, numbers: true, symbols: true })).toString("base64")}`,
+                    APP_DEBUG: "false",
+                    APP_URL: "https://<%= APP_DOMAIN %>",
+                },
+                storage: ({ storage }) =>
+                    storage && {
+                        AWS_BUCKET: "<%= s3Slug %>",
+                        AWS_DEFAULT_REGION: "<%= AWS_REGION %>",
+                        AWS_ACL_VISIBILITY: "private",
+                        FILESYSTEM_DISK: "s3",
+                        FILESYSTEM_DISK_PUBLIC: "s3-public",
+                    },
+                opensearch: ({ opensearch }) =>
+                    opensearch && {
+                        SEARCH_HOST: "<%= SEARCH_HOST %>",
+                    },
+            },
+            high: {
+                app: {
+                    SESSION_DRIVER: "database",
+                    SESSION_SECURE_COOKIE: "true",
+                },
+            },
+        },
+        adonis: {
+            shared: {
+                app: {
+                    NODE_ENV: "production",
+                    APP_KEY: `base64:${Buffer.from(generator.generate({ length: 32, numbers: true, symbols: true })).toString("base64")}`,
+                    APP_URL: "https://<%= DOMAIN_LINK %>",
+                    SESSION_DRIVER: "cookie",
+                    PORT: "3333",
+                    LOG_LEVEL: "info",
+                },
+                storage: ({ storage }) =>
+                    storage && {
+                        AWS_BUCKET: "<%= s3Slug %>",
+                        AWS_DEFAULT_REGION: "<%= AWS_REGION %>",
+                        AWS_ACCESS_KEY_ID: "<%= AccessKeyId %>",
+                        AWS_SECRET_ACCESS_KEY: "<%= SecretAccessKey %>",
+                        FILESYSTEM_DISK: "s3",
+                        FILESYSTEM_DISK_PUBLIC: "s3-public",
+                    },
+            },
+        },
+        python: {
+            high: {
+                app: {
+                    APP_ENV: "production",
+                },
+            },
+        },
+    },
+    buildSecretPayloads(config, data = {}) {
+        const { framework, availability = "low", platform, language } = config;
+        const result = { app: {}, storage: {}, database: {}, opensearch: {} };
+
+        const sources = [
+            this.secretPayloads.shared,
+            this.secretPayloads[availability],
+            this.secretPayloads[platform]?.shared,
+            this.secretPayloads[platform]?.[availability],
+            this.secretPayloads[language]?.shared,
+            this.secretPayloads[language]?.[availability],
+            this.secretPayloads[framework]?.shared,
+            this.secretPayloads[framework]?.[availability],
+        ];
+
+        for (const source of sources) {
+            if (!source) continue;
+            for (const group of module.exports.secretGroups) {
+                let values = source[group];
+                if (typeof values === "function") {
+                    values = values(config, data);
+                }
+                if (values) {
+                    Object.assign(result[group], values);
+                }
+            }
+        }
+
+        // Apply lodash template interpolation
+        const templateData = { ...process.env, ...data };
+        for (const group of module.exports.secretGroups) {
+            if (Object.keys(result[group]).length) {
+                result[group] = JSON.parse(
+                    template(JSON.stringify(result[group]))(templateData),
+                );
+            }
+        }
+
+        return result;
+    },
     configurations: {
         php: {
             shared: [".ebextensions/php/ini.config"],
@@ -680,6 +594,7 @@ module.exports.eb = {
                 ".platform/nginx/conf.d/elasticbeanstalk/laravel.conf",
                 ".ebextensions/laravel/post-deploy.config",
                 ".ebextensions/laravel/software.config",
+                ".ebextensions/laravel/rds-ssl.config",
             ],
             low: [],
             high: [],

package/commands/create/services/aws/acm.js

@@ -0,0 +1,59 @@
+const { ACMClient, ListCertificatesCommand } = require("@aws-sdk/client-acm");
+const { Spinner } = require("../../libs/utilities");
+
+module.exports.listCertificates = async () => {
+    const client = new ACMClient({});
+    const certs = [];
+    let nextToken;
+
+    do {
+        const res = await client.send(
+            new ListCertificatesCommand({
+                CertificateStatuses: ["ISSUED"],
+                NextToken: nextToken,
+            }),
+        );
+        certs.push(...(res.CertificateSummaryList || []));
+        nextToken = res.NextToken;
+    } while (nextToken);
+
+    return certs;
+};
+
+module.exports.findCertificatesForDomain = async (domain) => {
+    const certs = await Spinner.prototype.simple(
+        `Looking up ACM certificates for ${domain}`,
+        () => module.exports.listCertificates(),
+    );
+
+    if (!certs.length) return [];
+
+    // Extract apex domain (e.g. "test.avh-det.com" → "avh-det.com")
+    const parts = domain.split(".");
+    const apex = parts.length > 2 ? parts.slice(-2).join(".") : domain;
+    const wildcard = `*.${apex}`;
+
+    // Check all cert domains (DomainName + SANs)
+    const getCertDomains = (cert) => {
+        const domains = [cert.DomainName];
+        if (cert.SubjectAlternativeNameSummaries) {
+            domains.push(...cert.SubjectAlternativeNameSummaries);
+        }
+        return domains;
+    };
+
+    const candidates = [domain, wildcard];
+    if (apex !== domain) candidates.push(apex);
+
+    const matches = certs.filter((c) =>
+        getCertDomains(c).some((d) => candidates.includes(d)),
+    );
+
+    // Deduplicate by ARN
+    const seen = new Set();
+    return matches.filter((c) => {
+        if (seen.has(c.CertificateArn)) return false;
+        seen.add(c.CertificateArn);
+        return true;
+    });
+};