@fishawack/lab-env 5.7.0-beta.1 → 5.7.0-beta.2

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 ## Changelog
 
+### 5.7.0-beta.2 (2026-06-11)
+
+#### Features
+
+* ability to add opensearch to laravel fullstack provisions ([6218c78](https://bitbucket.org/fishawackdigital/lab-env/commits/6218c7835124941fd63ef8056c462a8775f6d7ae))
+* added ssm permission to ec2 role ([7b0195b](https://bitbucket.org/fishawackdigital/lab-env/commits/7b0195b98c59dd4fdcc8ca6848847dddda9ffb61))
+* auto configuration of the acm cert and port 443 listener if cert found ([878ce17](https://bitbucket.org/fishawackdigital/lab-env/commits/878ce175b6031a7ee6cd9f84420c8ace4d858093))
+* ec2 instances always in private and prompt for load balancer visibility + python now dynamic ([bd651cb](https://bitbucket.org/fishawackdigital/lab-env/commits/bd651cb78733d45bf1601e24dbd9c5a5ffc458e0))
+* ensure private subnets now a standard part of the prov command ([22f9876](https://bitbucket.org/fishawackdigital/lab-env/commits/22f9876e390689f7e94939be3839d0a2312f5f10))
+* rds now also creates in private subnet ([e7fb89d](https://bitbucket.org/fishawackdigital/lab-env/commits/e7fb89d9dfbb3fe62c34e8a07c6ba1c7fc732964))
+* use instance role and bucket policy for access now and move restore to after preflight checks ([c4bc090](https://bitbucket.org/fishawackdigital/lab-env/commits/c4bc090927a8dd9d43a52b93f06926e7167003b2))
+
+#### Bug Fixes
+
+* fullstack provision now indempotent and search enforces search role ([ca374ca](https://bitbucket.org/fishawackdigital/lab-env/commits/ca374caf5c1efa0fa216f62db776591de228e8d5))
+
 ### 5.7.0-beta.1 (2026-06-08)
 
 #### Features

package/_Test/provision.js

@@ -66,7 +66,9 @@ describe("provision", () => {
         });
 
         after(async () => {
-            await aws.fullstackTerminate(repo, repo, branch);
+            await aws.fullstackTerminate(repo, repo, branch, {
+                deleteAppSecret: true,
+            });
 
             execSync(`rm -rf .elasticbeanstalk`, {
                 encoding: "utf8",

package/commands/create/cmds/deprovision.js

@@ -92,6 +92,12 @@ module.exports = [
                     message: "Delete the RDS database?",
                     default: false,
                 },
+                {
+                    type: "confirm",
+                    name: "deleteOpenSearch",
+                    message: "Delete the OpenSearch domain?",
+                    default: false,
+                },
                 {
                     type: "confirm",
                     name: "deleteAppSecret",
@@ -103,6 +109,7 @@ module.exports = [
             await aws.fullstackTerminate(slug, _.repoSafe, branch, {
                 deleteStorage: resourceAnswers.deleteStorage,
                 deleteDatabase: resourceAnswers.deleteDatabase,
+                deleteOpenSearch: resourceAnswers.deleteOpenSearch,
                 deleteAppSecret: resourceAnswers.deleteAppSecret,
             });
         } else {

package/commands/create/cmds/provision.js

@@ -228,6 +228,20 @@ module.exports = [
                     },
                 ])),
             };
+
+            if (answers.framework === "laravel") {
+                answers = {
+                    ...answers,
+                    ...(await inquirer.prompt([
+                        {
+                            type: "confirm",
+                            name: "opensearch",
+                            message: "Does this site need OpenSearch?",
+                            default: false,
+                        },
+                    ])),
+                };
+            }
         }
 
         answers = {
@@ -296,78 +310,60 @@ module.exports = [
         // Set AWS client defaults before any AWS operations
         setAWSClientDefaults(answers.client, answers.region);
 
-        // Snapshot restore prompt — only if database requested, before preflight
-        let snapshot = null;
-
-        if (answers.database) {
-            const { restore } = await inquirer.prompt([
-                {
-                    type: "confirm",
-                    name: "restore",
-                    message: "Restore database from an existing snapshot?",
-                    default: false,
-                },
-            ]);
-
-            if (restore) {
-                const snapshots = await aws.rds.listManualSnapshots();
-
-                if (snapshots.length) {
-                    const { selected } = await inquirer.prompt([
-                        {
-                            type: "list",
-                            name: "selected",
-                            message: "Select a snapshot to restore from",
-                            choices: snapshots.map((s) => ({
-                                name: `${s.DBSnapshotIdentifier} (source: ${s.DBInstanceIdentifier}, created: ${new Date(s.SnapshotCreateTime).toLocaleDateString()})`,
-                                value: s.DBSnapshotIdentifier,
-                            })),
-                        },
-                    ]);
-
-                    snapshot = selected;
-                } else {
-                    new utilities.Spinner(
-                        "No manual snapshots found, creating a fresh database",
-                        true,
-                    ).ora.info();
-                }
-            }
-        }
-
         // Pre-flight check for existing resources
-        let existingSecrets = { app: null, storage: null, database: null };
+        let existingSecrets = {
+            app: null,
+            storage: null,
+            database: null,
+            opensearch: null,
+        };
+        let existingEnvironment = false;
+        let existingResources = {
+            storage: false,
+            database: false,
+            opensearch: false,
+        };
+        let snapshot = null;
 
         if (answers.stack === "fullstack") {
-            const { conflicts, existing } = await aws.fullstackPreflight(
+            const { existing } = await aws.fullstackPreflight(
                 slug,
                 _.repoSafe,
                 branch,
                 {
                     storage: answers.storage,
                     database: answers.database,
+                    opensearch: answers.opensearch,
                 },
             );
 
-            if (conflicts.length) {
-                conflicts.forEach((c) =>
-                    console.log(utilities.colorize(`\n  ✗ ${c}`, "error")),
-                );
+            if (
+                existing.environment &&
+                existing.environment.Status !== "Ready"
+            ) {
                 console.log(
                     utilities.colorize(
-                        "\nProvisioning aborted due to existing resources.\n",
+                        `\n  ✗ EB environment "${slug}" is currently ${existing.environment.Status}, cannot re-provision\n`,
                         "error",
                     ),
                 );
                 process.exit(1);
             }
 
+            if (existing.environment) {
+                new utilities.Spinner(
+                    "EB environment already exists, skipping creation",
+                    true,
+                ).ora.info();
+                existingEnvironment = existing.environment;
+            }
+
             if (existing.storage) {
                 new utilities.Spinner(
                     "S3 bucket already exists, skipping storage creation",
                     true,
                 ).ora.info();
-                answers.storage = false;
+                existingResources.storage = true;
             }
 
             if (existing.database) {
@@ -375,7 +371,52 @@ module.exports = [
                     "RDS instance already exists, skipping database creation",
                     true,
                 ).ora.info();
-                answers.database = false;
+                existingResources.database = true;
+            }
+
+            if (existing.opensearch) {
+                new utilities.Spinner(
+                    "OpenSearch domain already exists, skipping creation",
+                    true,
+                ).ora.info();
+                existingResources.opensearch = true;
+            }
+
+            // Snapshot restore prompt — only if database is needed and doesn't already exist
+            if (answers.database && !existing.database) {
+                const { restore } = await inquirer.prompt([
+                    {
+                        type: "confirm",
+                        name: "restore",
+                        message: "Restore database from an existing snapshot?",
+                        default: false,
+                    },
+                ]);
+
+                if (restore) {
+                    const snapshots = await aws.rds.listManualSnapshots();
+
+                    if (snapshots.length) {
+                        const { selected } = await inquirer.prompt([
+                            {
+                                type: "list",
+                                name: "selected",
+                                message: "Select a snapshot to restore from",
+                                choices: snapshots.map((s) => ({
+                                    name: `${s.DBSnapshotIdentifier} (source: ${s.DBInstanceIdentifier}, created: ${new Date(s.SnapshotCreateTime).toLocaleDateString()})`,
+                                    value: s.DBSnapshotIdentifier,
+                                })),
+                            },
+                        ]);
+
+                        snapshot = selected;
+                    } else {
+                        new utilities.Spinner(
+                            "No manual snapshots found, creating a fresh database",
+                            true,
+                        ).ora.info();
+                    }
+                }
             }
 
             existingSecrets = existing.secrets;
@@ -400,6 +441,92 @@ module.exports = [
                     true,
                 ).ora.info();
             }
+
+            if (existingSecrets.opensearch) {
+                new utilities.Spinner(
+                    "OpenSearch secret already exists, reusing existing values",
+                    true,
+                ).ora.info();
+            }
+
+            // EB-specific prompts — only for new environments
+            if (!existingEnvironment && answers.availability === "high") {
+                answers = {
+                    ...answers,
+                    ...(await inquirer.prompt([
+                        {
+                            type: "list",
+                            name: "elbScheme",
+                            message: "Load balancer visibility?",
+                            choices: ["public", "internal"],
+                        },
+                    ])),
+                };
+            }
+
+            // App name and domain prompts — only for new Laravel environments
+            if (!existingEnvironment && answers.framework === "laravel") {
+                answers = {
+                    ...answers,
+                    ...(await inquirer.prompt([
+                        {
+                            type: "input",
+                            name: "appName",
+                            message: "What is the app name?",
+                            default: _.repoSafe,
+                            validate: (v) =>
+                                /^[a-zA-Z0-9 ]+$/.test(v) ||
+                                "Alphanumeric characters and spaces only",
+                        },
+                        {
+                            type: "input",
+                            name: "appDomain",
+                            message:
+                                "What domain will this site be served at? (DNS must be configured manually)",
+                            filter: (v) =>
+                                v
+                                    .replace(/^https?:\/\//, "")
+                                    .replace(/\/+$/, ""),
+                            validate: (v) =>
+                                v.length > 0 || "Domain is required",
+                        },
+                    ])),
+                };
+
+                // ACM cert selection — only for high availability (ALB)
+                if (answers.availability === "high") {
+                    const matchingCerts =
+                        await aws.acm.findCertificatesForDomain(
+                            answers.appDomain,
+                        );
+
+                    if (matchingCerts.length) {
+                        answers = {
+                            ...answers,
+                            ...(await inquirer.prompt([
+                                {
+                                    type: "list",
+                                    name: "certArn",
+                                    message:
+                                        "Which ACM certificate should be used for HTTPS?",
+                                    choices: [
+                                        ...matchingCerts.map((c) => ({
+                                            name: c.DomainName,
+                                            value: c.CertificateArn,
+                                        })),
+                                        { name: "None", value: null },
+                                    ],
+                                },
+                            ])),
+                        };
+                    } else {
+                        new utilities.Spinner(
+                            `No ACM certificates match ${answers.appDomain}, HTTPS listener must be configured manually`,
+                            true,
+                        ).ora.info();
+                    }
+                }
+            }
         }
 
         try {
@@ -432,8 +559,15 @@ module.exports = [
                     answers.availability,
                     answers.database,
                     answers.storage,
+                    answers.opensearch,
                     existingSecrets,
                     snapshot,
+                    answers.elbScheme || "public",
+                    existingEnvironment,
+                    existingResources,
+                    answers.appName,
+                    answers.appDomain,
+                    answers.certArn,
                 );
             }
         } catch (e) {

package/commands/create/cmds/sync-secrets.js

@@ -4,6 +4,7 @@ const aws = require("../services/aws/index.js");
 const { setAWSClientDefaults } = require("../services/aws/misc.js");
 const utilities = require("../libs/utilities");
 const { client, region } = require("../libs/prompts.js");
+const { secretGroups } = require("../libs/vars.js");
 
 const SECRETS_NAMESPACE = "aws:elasticbeanstalk:application:environmentsecrets";
 
@@ -72,7 +73,7 @@ module.exports = [
 
         // Build expected environmentsecrets from Secrets Manager
         const expectedSettings = [];
-        const groups = ["app", "storage", "database"];
+        const groups = secretGroups;
 
         for (const group of groups) {
             const secretName = `${slug}-${group}`;

package/commands/create/libs/utilities.js

@@ -122,6 +122,8 @@ module.exports.nameSafe = (name, service = "s3") => {
 
     if (service === "eb") {
         maxLength = 40;
+    } else if (service === "os") {
+        maxLength = 28;
     }
 
     safe = safe.substring(0, maxLength - suffix.length - prefix.length);

package/commands/create/libs/vars.js

@@ -178,6 +178,8 @@ module.exports.templates = [
     },
 ];
 
+module.exports.secretGroups = ["app", "storage", "database", "opensearch"];
+
 module.exports.frameworks = [
     {
         name: "wordpress",
@@ -207,50 +209,7 @@ module.exports.eb = {
         python: {
             shared: [],
             low: [],
-            high: [
-                {
-                    OptionName: "ELBScheme",
-                    Value: "internal",
-                    Namespace: "aws:ec2:vpc",
-                },
-                () => {
-                    const regions = {
-                        "us-east-1": {
-                            VPCId: "vpc-d30bcca8",
-                            Subnets:
-                                "subnet-00bf5eda896fdd5c5,subnet-0aa7e40d4701683ae",
-                        },
-                        "eu-west-1": {
-                            VPCId: "vpc-cc0d9aa9",
-                            Subnets:
-                                "subnet-0e357f06e047e1c10,subnet-0956ffb043535455d",
-                        },
-                    };
-
-                    return [
-                        {
-                            OptionName: "VPCId",
-                            Value: regions[process.env.AWS_REGION].VPCId,
-                            Namespace: "aws:ec2:vpc",
-                        },
-                        {
-                            OptionName: "Subnets",
-                            Value: regions[process.env.AWS_REGION].Subnets,
-                            Namespace: "aws:ec2:vpc",
-                        },
-                        {
-                            OptionName: "ELBSubnets",
-                            Value: regions[process.env.AWS_REGION].Subnets,
-                            Namespace: "aws:ec2:vpc",
-                        },
-                    ];
-                },
-                {
-                    OptionName: "AssociatePublicIpAddress",
-                    Value: "false",
-                    Namespace: "aws:ec2:vpc",
-                },
-            ],
+            high: [],
         },
         php: {
             shared: [],
@@ -304,11 +263,11 @@ module.exports.eb = {
                 Value: "lab-env-aws-elasticbeanstalk-service-role",
                 Namespace: "aws:elasticbeanstalk:environment",
             },
-            {
+            ({ instanceProfileName }) => ({
                 OptionName: "IamInstanceProfile",
-                Value: "aws-elasticbeanstalk-ec2-role",
+                Value: instanceProfileName || "aws-elasticbeanstalk-ec2-role",
                 Namespace: "aws:autoscaling:launchconfiguration",
-            },
+            }),
         ],
         low: [
             {
@@ -358,6 +317,43 @@ module.exports.eb = {
                 Value: "application",
                 Namespace: "aws:elasticbeanstalk:environment",
             },
+            ({ vpcId, privateSubnetIds, publicSubnetIds, elbScheme }) => {
+                const settings = [
+                    {
+                        OptionName: "VPCId",
+                        Value: vpcId,
+                        Namespace: "aws:ec2:vpc",
+                    },
+                    {
+                        OptionName: "Subnets",
+                        Value: privateSubnetIds,
+                        Namespace: "aws:ec2:vpc",
+                    },
+                    {
+                        OptionName: "ELBSubnets",
+                        Value:
+                            elbScheme === "internal"
+                                ? privateSubnetIds
+                                : publicSubnetIds,
+                        Namespace: "aws:ec2:vpc",
+                    },
+                    {
+                        OptionName: "AssociatePublicIpAddress",
+                        Value: "false",
+                        Namespace: "aws:ec2:vpc",
+                    },
+                ];
+
+                if (elbScheme === "internal") {
+                    settings.push({
+                        OptionName: "ELBScheme",
+                        Value: "internal",
+                        Namespace: "aws:ec2:vpc",
+                    });
+                }
+
+                return settings;
+            },
         ],
     },
     secretPayloads: {
@@ -435,20 +431,24 @@ module.exports.eb = {
         laravel: {
             shared: {
                 app: {
+                    APP_NAME: "<%= APP_NAME %>",
                     APP_ENV: "production",
                     APP_KEY: `base64:${Buffer.from(generator.generate({ length: 32, numbers: true, symbols: true })).toString("base64")}`,
                     APP_DEBUG: "false",
-                    APP_URL: "https://<%= DOMAIN_LINK %>",
+                    APP_URL: "https://<%= APP_DOMAIN %>",
                 },
                 storage: ({ storage }) =>
                     storage && {
                         AWS_BUCKET: "<%= s3Slug %>",
                         AWS_DEFAULT_REGION: "<%= AWS_REGION %>",
-                        AWS_ACCESS_KEY_ID: "<%= AccessKeyId %>",
-                        AWS_SECRET_ACCESS_KEY: "<%= SecretAccessKey %>",
+                        AWS_ACL_VISIBILITY: "private",
                         FILESYSTEM_DISK: "s3",
                         FILESYSTEM_DISK_PUBLIC: "s3-public",
                     },
+                opensearch: ({ opensearch }) =>
+                    opensearch && {
+                        SEARCH_HOST: "<%= SEARCH_HOST %>",
+                    },
             },
             high: {
                 app: {
@@ -488,7 +488,7 @@ module.exports.eb = {
     },
     buildSecretPayloads(config, data = {}) {
         const { framework, availability = "low", platform, language } = config;
-        const result = { app: {}, storage: {}, database: {} };
+        const result = { app: {}, storage: {}, database: {}, opensearch: {} };
 
         const sources = [
             this.secretPayloads.shared,
@@ -503,7 +503,7 @@ module.exports.eb = {
 
         for (const source of sources) {
             if (!source) continue;
-            for (const group of ["app", "storage", "database"]) {
+            for (const group of module.exports.secretGroups) {
                 let values = source[group];
                 if (typeof values === "function") {
                     values = values(config, data);
@@ -516,7 +516,7 @@ module.exports.eb = {
 
         // Apply lodash template interpolation
         const templateData = { ...process.env, ...data };
-        for (const group of ["app", "storage", "database"]) {
+        for (const group of module.exports.secretGroups) {
             if (Object.keys(result[group]).length) {
                 result[group] = JSON.parse(
                     template(JSON.stringify(result[group]))(templateData),

package/commands/create/services/aws/acm.js

@@ -0,0 +1,59 @@
+const { ACMClient, ListCertificatesCommand } = require("@aws-sdk/client-acm");
+const { Spinner } = require("../../libs/utilities");
+
+module.exports.listCertificates = async () => {
+    const client = new ACMClient({});
+    const certs = [];
+    let nextToken;
+
+    do {
+        const res = await client.send(
+            new ListCertificatesCommand({
+                CertificateStatuses: ["ISSUED"],
+                NextToken: nextToken,
+            }),
+        );
+        certs.push(...(res.CertificateSummaryList || []));
+        nextToken = res.NextToken;
+    } while (nextToken);
+
+    return certs;
+};
+
+module.exports.findCertificatesForDomain = async (domain) => {
+    const certs = await Spinner.prototype.simple(
+        `Looking up ACM certificates for ${domain}`,
+        () => module.exports.listCertificates(),
+    );
+
+    if (!certs.length) return [];
+
+    // Extract apex domain (e.g. "test.avh-det.com" → "avh-det.com")
+    const parts = domain.split(".");
+    const apex = parts.length > 2 ? parts.slice(-2).join(".") : domain;
+    const wildcard = `*.${apex}`;
+
+    // Check all cert domains (DomainName + SANs)
+    const getCertDomains = (cert) => {
+        const domains = [cert.DomainName];
+        if (cert.SubjectAlternativeNameSummaries) {
+            domains.push(...cert.SubjectAlternativeNameSummaries);
+        }
+        return domains;
+    };
+
+    const candidates = [domain, wildcard];
+    if (apex !== domain) candidates.push(apex);
+
+    const matches = certs.filter((c) =>
+        getCertDomains(c).some((d) => candidates.includes(d)),
+    );
+
+    // Deduplicate by ARN
+    const seen = new Set();
+    return matches.filter((c) => {
+        if (seen.has(c.CertificateArn)) return false;
+        seen.add(c.CertificateArn);
+        return true;
+    });
+};