@fishawack/lab-env 5.7.0-beta.1 → 5.7.0-beta.3

package/commands/create/libs/vars.js

@@ -126,10 +126,6 @@ module.exports.templates = [
         name: "boilerplate-laravel",
         type: "boilerplate",
     },
-    {
-        name: "boilerplate-laravel-vue",
-        type: "boilerplate",
-    },
     {
         name: "boilerplate-drupal",
         type: "boilerplate",
@@ -178,6 +174,15 @@ module.exports.templates = [
     },
 ];
 
+module.exports.secretGroups = [
+    "app",
+    "storage",
+    "database",
+    "opensearch",
+    "cache",
+    "mail",
+];
+
 module.exports.frameworks = [
     {
         name: "wordpress",
@@ -206,61 +211,12 @@ module.exports.eb = {
     environments: {
         python: {
             shared: [],
-            low: [],
-            high: [
-                {
-                    OptionName: "ELBScheme",
-                    Value: "internal",
-                    Namespace: "aws:ec2:vpc",
-                },
-                () => {
-                    const regions = {
-                        "us-east-1": {
-                            VPCId: "vpc-d30bcca8",
-                            Subnets:
-                                "subnet-00bf5eda896fdd5c5,subnet-0aa7e40d4701683ae",
-                        },
-                        "eu-west-1": {
-                            VPCId: "vpc-cc0d9aa9",
-                            Subnets:
-                                "subnet-0e357f06e047e1c10,subnet-0956ffb043535455d",
-                        },
-                    };
-
-                    return [
-                        {
-                            OptionName: "VPCId",
-                            Value: regions[process.env.AWS_REGION].VPCId,
-                            Namespace: "aws:ec2:vpc",
-                        },
-                        {
-                            OptionName: "Subnets",
-                            Value: regions[process.env.AWS_REGION].Subnets,
-                            Namespace: "aws:ec2:vpc",
-                        },
-                        {
-                            OptionName: "ELBSubnets",
-                            Value: regions[process.env.AWS_REGION].Subnets,
-                            Namespace: "aws:ec2:vpc",
-                        },
-                    ];
-                },
-                {
-                    OptionName: "AssociatePublicIpAddress",
-                    Value: "false",
-                    Namespace: "aws:ec2:vpc",
-                },
-            ],
         },
         php: {
             shared: [],
-            low: [],
-            high: [],
         },
         nginx: {
             shared: [],
-            low: [],
-            high: [],
         },
         httpd: {
             shared: [
@@ -270,33 +226,21 @@ module.exports.eb = {
                     Namespace: "aws:elasticbeanstalk:environment:proxy",
                 },
             ],
-            low: [],
-            high: [],
         },
         default: {
             shared: [],
-            low: [],
-            high: [],
         },
         wordpress: {
             shared: [],
-            low: [],
-            high: [],
         },
         laravel: {
             shared: [],
-            low: [],
-            high: [],
         },
         adonis: {
             shared: [],
-            low: [],
-            high: [],
         },
         drupal: {
             shared: [],
-            low: [],
-            high: [],
         },
         shared: [
             {
@@ -304,18 +248,16 @@ module.exports.eb = {
                 Value: "lab-env-aws-elasticbeanstalk-service-role",
                 Namespace: "aws:elasticbeanstalk:environment",
             },
-            {
+            ({ instanceProfileName }) => ({
                 OptionName: "IamInstanceProfile",
-                Value: "aws-elasticbeanstalk-ec2-role",
+                Value: instanceProfileName || "aws-elasticbeanstalk-ec2-role",
                 Namespace: "aws:autoscaling:launchconfiguration",
-            },
-        ],
-        low: [
-            {
-                OptionName: "EnvironmentType",
-                Value: "SingleInstance",
-                Namespace: "aws:elasticbeanstalk:environment",
-            },
+            }),
+            ({ instanceType }) => ({
+                OptionName: "InstanceType",
+                Value: instanceType || "t3.small",
+                Namespace: "aws:autoscaling:launchconfiguration",
+            }),
         ],
         high: [
             {
@@ -358,6 +300,59 @@ module.exports.eb = {
                 Value: "application",
                 Namespace: "aws:elasticbeanstalk:environment",
             },
+            ({ vpcId, privateSubnetIds, publicSubnetIds, elbScheme }) => {
+                const settings = [
+                    {
+                        OptionName: "VPCId",
+                        Value: vpcId,
+                        Namespace: "aws:ec2:vpc",
+                    },
+                    {
+                        OptionName: "Subnets",
+                        Value: privateSubnetIds,
+                        Namespace: "aws:ec2:vpc",
+                    },
+                    {
+                        OptionName: "ELBSubnets",
+                        Value:
+                            elbScheme === "internal"
+                                ? privateSubnetIds
+                                : publicSubnetIds,
+                        Namespace: "aws:ec2:vpc",
+                    },
+                    {
+                        OptionName: "AssociatePublicIpAddress",
+                        Value: "false",
+                        Namespace: "aws:ec2:vpc",
+                    },
+                ];
+
+                if (elbScheme === "internal") {
+                    settings.push({
+                        OptionName: "ELBScheme",
+                        Value: "internal",
+                        Namespace: "aws:ec2:vpc",
+                    });
+                }
+
+                return settings;
+            },
+            {
+                OptionName: "ConfigDocument",
+                Value: JSON.stringify({
+                    Version: 1,
+                    CloudWatchMetrics: { Instance: {}, Environment: {} },
+                    Rules: {
+                        Environment: {
+                            Application: {
+                                ApplicationRequests4xx: { Enabled: false },
+                            },
+                            ELB: { ELBRequests4xx: { Enabled: false } },
+                        },
+                    },
+                }),
+                Namespace: "aws:elasticbeanstalk:healthreporting:system",
+            },
         ],
     },
     secretPayloads: {
@@ -372,13 +367,7 @@ module.exports.eb = {
                     MYSQL_ATTR_SSL_CA: "/opt/rds-certs/global-bundle.pem",
                 },
         },
-        low: {
-            app: {
-                DOMAIN_LINK: "<%= DOMAIN_LINK %>",
-                EMAIL_LINK: "mike.mellor@fishawack.com",
-            },
-        },
-        high: {},
+
         wordpress: {
             shared: {
                 app: {
@@ -435,20 +424,43 @@ module.exports.eb = {
         laravel: {
             shared: {
                 app: {
+                    APP_NAME: "<%= APP_NAME %>",
                     APP_ENV: "production",
                     APP_KEY: `base64:${Buffer.from(generator.generate({ length: 32, numbers: true, symbols: true })).toString("base64")}`,
                     APP_DEBUG: "false",
-                    APP_URL: "https://<%= DOMAIN_LINK %>",
+                    APP_URL: "https://<%= APP_DOMAIN %>",
+                    SESSION_DOMAIN: "<%= SESSION_DOMAIN %>",
+                    AWS_DEFAULT_REGION: "<%= AWS_REGION %>",
                 },
                 storage: ({ storage }) =>
                     storage && {
                         AWS_BUCKET: "<%= s3Slug %>",
-                        AWS_DEFAULT_REGION: "<%= AWS_REGION %>",
-                        AWS_ACCESS_KEY_ID: "<%= AccessKeyId %>",
-                        AWS_SECRET_ACCESS_KEY: "<%= SecretAccessKey %>",
+                        AWS_ACL_VISIBILITY: "private",
                         FILESYSTEM_DISK: "s3",
                         FILESYSTEM_DISK_PUBLIC: "s3-public",
                     },
+                opensearch: ({ opensearch }) =>
+                    opensearch && {
+                        SEARCH_HOST: "<%= SEARCH_HOST %>",
+                    },
+                cache: ({ cache }) =>
+                    cache && {
+                        REDIS_SCHEME: "tls",
+                        REDIS_HOST: "<%= REDIS_HOST %>",
+                        REDIS_PORT: "<%= REDIS_PORT %>",
+                        REDIS_PASSWORD: "<%= REDIS_PASSWORD %>",
+                        CACHE_STORE: "redis",
+                    },
+                mail: ({ mail }) =>
+                    mail && {
+                        MAIL_FROM_ADDRESS: "<%= MAIL_FROM_ADDRESS %>",
+                        MAIL_FROM_NAME: "<%= MAIL_FROM_NAME %>",
+                        MAIL_HOST: "email-smtp.us-east-1.amazonaws.com",
+                        MAIL_MAILER: "smtp",
+                        MAIL_PASSWORD: "<%= MAIL_PASSWORD %>",
+                        MAIL_PORT: "587",
+                        MAIL_USERNAME: "<%= MAIL_USERNAME %>",
+                    },
             },
             high: {
                 app: {
@@ -466,11 +478,11 @@ module.exports.eb = {
                     SESSION_DRIVER: "cookie",
                     PORT: "3333",
                     LOG_LEVEL: "info",
+                    AWS_DEFAULT_REGION: "<%= AWS_REGION %>",
                 },
                 storage: ({ storage }) =>
                     storage && {
                         AWS_BUCKET: "<%= s3Slug %>",
-                        AWS_DEFAULT_REGION: "<%= AWS_REGION %>",
                         AWS_ACCESS_KEY_ID: "<%= AccessKeyId %>",
                         AWS_SECRET_ACCESS_KEY: "<%= SecretAccessKey %>",
                         FILESYSTEM_DISK: "s3",
@@ -487,23 +499,22 @@ module.exports.eb = {
         },
     },
     buildSecretPayloads(config, data = {}) {
-        const { framework, availability = "low", platform, language } = config;
-        const result = { app: {}, storage: {}, database: {} };
+        const { framework, platform, language } = config;
+        const result = Object.fromEntries(
+            module.exports.secretGroups.map((g) => [g, {}]),
+        );
 
         const sources = [
             this.secretPayloads.shared,
-            this.secretPayloads[availability],
             this.secretPayloads[platform]?.shared,
-            this.secretPayloads[platform]?.[availability],
             this.secretPayloads[language]?.shared,
-            this.secretPayloads[language]?.[availability],
             this.secretPayloads[framework]?.shared,
-            this.secretPayloads[framework]?.[availability],
+            this.secretPayloads[framework]?.high,
         ];
 
         for (const source of sources) {
             if (!source) continue;
-            for (const group of ["app", "storage", "database"]) {
+            for (const group of module.exports.secretGroups) {
                 let values = source[group];
                 if (typeof values === "function") {
                     values = values(config, data);
@@ -516,7 +527,7 @@ module.exports.eb = {
 
         // Apply lodash template interpolation
         const templateData = { ...process.env, ...data };
-        for (const group of ["app", "storage", "database"]) {
+        for (const group of module.exports.secretGroups) {
             if (Object.keys(result[group]).length) {
                 result[group] = JSON.parse(
                     template(JSON.stringify(result[group]))(templateData),
@@ -529,8 +540,6 @@ module.exports.eb = {
     configurations: {
         php: {
             shared: [".ebextensions/php/ini.config"],
-            low: [],
-            high: [],
         },
         nginx: {
             shared: [
@@ -538,14 +547,6 @@ module.exports.eb = {
                 ".platform/nginx/conf.d/upload_size.conf",
                 ".platform/nginx/conf.d/security_headers.conf",
                 ".platform/nginx/conf.d/elasticbeanstalk/www-to-nonwww-redirection.conf",
-            ],
-            low: [
-                ".platform/nginx/conf.d/elasticbeanstalk/http-https-redirection.conf",
-                ".platform/nginx/conf.d/ssl.conf",
-                ".ebextensions/nginx/auto-ssl.config",
-            ],
-            high: [
-                ".platform/nginx/conf.d/elasticbeanstalk/health.conf",
                 ".ebextensions/nginx/alb-health.config",
             ],
         },
@@ -553,14 +554,6 @@ module.exports.eb = {
             shared: [
                 ".platform/httpd/conf.d/virtualhost-80.conf",
                 ".platform/httpd/conf.d/elasticbeanstalk/80/www-to-nonwww-redirection.conf",
-            ],
-            low: [
-                ".platform/httpd/conf.d/elasticbeanstalk/80/http-https-redirection.conf",
-                ".platform/httpd/conf.d/virtualhost-443.conf",
-                ".platform/httpd/conf.d/elasticbeanstalk/443/ssl.conf",
-                ".ebextensions/httpd/auto-ssl.config",
-            ],
-            high: [
                 ".platform/httpd/conf.d/elasticbeanstalk/80/forward-https-proto.conf",
                 ".ebextensions/wordpress/alb-health.config",
             ],
@@ -569,8 +562,6 @@ module.exports.eb = {
             platform: "nginx",
             language: "php",
             shared: [],
-            low: [],
-            high: [],
         },
         wordpress: {
             platform: "httpd",
@@ -583,21 +574,21 @@ module.exports.eb = {
                 ".ebextensions/wordpress/environment.config",
                 ".ebextensions/wordpress/post-deploy.config",
                 ".ebextensions/wordpress/software.config",
+                ".platform/hooks/predeploy/deactivate-plugins.sh",
             ],
-            low: [".platform/hooks/predeploy/deactivate-plugins-single.sh"],
-            high: [".platform/hooks/predeploy/deactivate-plugins.sh"],
         },
         laravel: {
             platform: "nginx",
             language: "php",
             shared: [
                 ".platform/nginx/conf.d/elasticbeanstalk/laravel.conf",
+                ".ebextensions/laravel/cron.config",
                 ".ebextensions/laravel/post-deploy.config",
-                ".ebextensions/laravel/software.config",
+                ".ebextensions/laravel/queue-worker.config",
                 ".ebextensions/laravel/rds-ssl.config",
+                ".ebextensions/laravel/software.config",
+                ".platform/hooks/postdeploy/restart_queue.sh",
             ],
-            low: [],
-            high: [],
         },
         adonis: {
             platform: "nginx",
@@ -606,34 +597,27 @@ module.exports.eb = {
                 ".ebextensions/adonis/post-deploy.config",
                 ".ebextensions/adonis/software.config",
             ],
-            low: [],
-            high: [],
         },
         drupal: {
             platform: "httpd",
             language: "php",
             shared: [],
-            low: [],
-            high: [],
         },
         python: {
             platform: "nginx",
             language: "python",
             shared: [],
-            low: [],
-            high: [],
         },
-        shared: [".ebextensions/misc/setvars.config"],
-        low: [".ebextensions/misc/enable-https.config"],
-        high: [
+        shared: [
+            ".platform/hooks/prebuild/setvars.sh",
+            ".platform/confighooks/postdeploy/setvars.sh",
+            ".ebextensions/misc/asg-self-healing.config",
             ".ebextensions/misc/alb-http-to-https-redirection.config",
             ".ebextensions/misc/enable-https-lb.config",
-            ".ebextensions/misc/asg-self-healing.config",
-            ".ebextensions/misc/health-ignore-4xx.config",
         ],
     },
     merge(type, config, data = {}) {
-        const { framework, availability = "low", platform, language } = config;
+        const { framework, platform, language } = config;
 
         return JSON.parse(
             template(
@@ -641,13 +625,10 @@ module.exports.eb = {
                     []
                         .concat(
                             this[type].shared,
-                            this[type][availability],
+                            this[type].high,
                             this[type][platform]?.shared,
-                            this[type][platform]?.[availability],
                             this[type][language]?.shared,
-                            this[type][language]?.[availability],
                             this[type][framework]?.shared,
-                            this[type][framework]?.[availability],
                         )
                         .map((d) =>
                             typeof d === "function" ? d(config, data) : d,
@@ -727,3 +708,6 @@ module.exports.cloudfront = (
         },
     },
 });
+
+// AWS SDK client defaults
+module.exports.awsClientConfig = { maxAttempts: 5, retryMode: "adaptive" };

package/commands/create/services/aws/acm.js

@@ -0,0 +1,61 @@
+const { ACMClient, ListCertificatesCommand } = require("@aws-sdk/client-acm");
+const { Spinner } = require("../../libs/utilities");
+const { awsClientConfig } = require("../../libs/vars");
+
+const getClient = () => new ACMClient(awsClientConfig);
+
+module.exports.listCertificates = async () => {
+    const certs = [];
+    let nextToken;
+
+    do {
+        const res = await getClient().send(
+            new ListCertificatesCommand({
+                CertificateStatuses: ["ISSUED"],
+                NextToken: nextToken,
+            }),
+        );
+        certs.push(...(res.CertificateSummaryList || []));
+        nextToken = res.NextToken;
+    } while (nextToken);
+
+    return certs;
+};
+
+module.exports.findCertificatesForDomain = async (domain) => {
+    const certs = await Spinner.prototype.simple(
+        `Looking up ACM certificates for ${domain}`,
+        () => module.exports.listCertificates(),
+    );
+
+    if (!certs.length) return [];
+
+    // Extract apex domain (e.g. "test.avh-det.com" → "avh-det.com")
+    const parts = domain.split(".");
+    const apex = parts.length > 2 ? parts.slice(-2).join(".") : domain;
+    const wildcard = `*.${apex}`;
+
+    // Check all cert domains (DomainName + SANs)
+    const getCertDomains = (cert) => {
+        const domains = [cert.DomainName];
+        if (cert.SubjectAlternativeNameSummaries) {
+            domains.push(...cert.SubjectAlternativeNameSummaries);
+        }
+        return domains;
+    };
+
+    const candidates = [domain, wildcard];
+    if (apex !== domain) candidates.push(apex);
+
+    const matches = certs.filter((c) =>
+        getCertDomains(c).some((d) => candidates.includes(d)),
+    );
+
+    // Deduplicate by ARN
+    const seen = new Set();
+    return matches.filter((c) => {
+        if (seen.has(c.CertificateArn)) return false;
+        seen.add(c.CertificateArn);
+        return true;
+    });
+};