@gambi97/keel-cli 0.1.1 → 0.2.0

package/templates/modules/app_stack/outputs.tf

@@ -21,3 +21,21 @@ output "database_url" {
 output "container_namespace_id" {
   value = scaleway_container_namespace.this.id
 }
+
+output "object_bucket_name" {
+  value = var.enable_object_storage ? scaleway_object_bucket.files[0].name : null
+}
+
+output "object_bucket_endpoint" {
+  value = var.enable_object_storage ? "https://s3.${var.region}.scw.cloud" : null
+}
+
+output "object_storage_access_key" {
+  value     = var.enable_object_storage ? scaleway_iam_api_key.storage[0].access_key : null
+  sensitive = true
+}
+
+output "object_storage_secret_key" {
+  value     = var.enable_object_storage ? scaleway_iam_api_key.storage[0].secret_key : null
+  sensitive = true
+}

package/templates/modules/app_stack/variables.tf

@@ -47,6 +47,11 @@ variable "enable_basic_auth" {
   type = bool
 }
 
+variable "enable_object_storage" {
+  type    = bool
+  default = false
+}
+
 variable "secret_environment_variables" {
   description = "Secrets injected into the container, sourced from Infisical."
   type        = map(string)

package/templates/outputs.tf

@@ -18,3 +18,25 @@ output "container_namespace_id" {
   description = "Scaleway Containers namespace ID."
   value       = module.app_stack.container_namespace_id
 }
+
+output "object_bucket_name" {
+  description = "Object Storage bucket for application files (null unless enabled)."
+  value       = module.app_stack.object_bucket_name
+}
+
+# The complete set of secrets the pipeline pushes to Infisical after each apply:
+# always DATABASE_URL, plus the S3_* coordinates when Object Storage is enabled.
+output "infisical_secrets" {
+  description = "Secrets synced to Infisical after each apply."
+  sensitive   = true
+  value = merge(
+    { DATABASE_URL = module.app_stack.database_url },
+    var.enable_object_storage ? {
+      S3_BUCKET     = module.app_stack.object_bucket_name
+      S3_ENDPOINT   = module.app_stack.object_bucket_endpoint
+      S3_REGION     = var.region
+      S3_ACCESS_KEY = module.app_stack.object_storage_access_key
+      S3_SECRET_KEY = module.app_stack.object_storage_secret_key
+    } : {}
+  )
+}

package/templates/variables.tf

@@ -13,8 +13,8 @@ variable "environment" {
   type        = string
 
   validation {
-    condition     = contains(["staging", "prod"], var.environment)
-    error_message = "environment must be either \"staging\" or \"prod\"."
+    condition     = contains(__ENV_SLUGS_TF__, var.environment)
+    error_message = "environment must be one of the configured environments."
   }
 }
 
@@ -72,6 +72,12 @@ variable "enable_basic_auth" {
   default     = false
 }
 
+variable "enable_object_storage" {
+  description = "When true, provision an Object Storage bucket for the app plus a dedicated least-privilege credential; its coordinates are synced to Infisical as S3_*."
+  type        = bool
+  default     = false
+}
+
 variable "infisical_host" {
   description = "Infisical instance URL."
   type        = string

package/templates/.github/scripts/sync-database-url.sh

@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-# Pushes the ready-to-use database connection string (dedicated IAM
-# credential included) to Infisical as DATABASE_URL.
-# Usage: sync-database-url.sh <staging|prod>
-# Expects: INFISICAL_HOST, INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET,
-#          INFISICAL_PROJECT_ID in the environment; terraform init already run.
-set -euo pipefail
-
-ENVIRONMENT="${1:?usage: sync-database-url.sh <staging|prod>}"
-
-DB_URL="$(terraform output -raw database_url)"
-if [ -z "$DB_URL" ]; then
-  echo "No database_url in outputs, skipping Infisical sync."
-  exit 0
-fi
-echo "::add-mask::$DB_URL"
-
-ACCESS_TOKEN="$(curl -sS --fail-with-body -X POST \
-  "$INFISICAL_HOST/api/v1/auth/universal-auth/login" \
-  -H "Content-Type: application/json" \
-  -d "{\"clientId\":\"$INFISICAL_CLIENT_ID\",\"clientSecret\":\"$INFISICAL_CLIENT_SECRET\"}" \
-  | jq -r .accessToken)"
-echo "::add-mask::$ACCESS_TOKEN"
-
-payload="$(jq -n \
-  --arg workspaceId "$INFISICAL_PROJECT_ID" \
-  --arg environment "$ENVIRONMENT" \
-  --arg value "$DB_URL" \
-  '{workspaceId: $workspaceId, environment: $environment, secretPath: "/", secretValue: $value, type: "shared"}')"
-
-# Update the placeholder seeded at bootstrap; create the secret if missing.
-status="$(curl -sS -o /dev/null -w "%{http_code}" -X PATCH \
-  "$INFISICAL_HOST/api/v3/secrets/raw/DATABASE_URL" \
-  -H "Authorization: Bearer $ACCESS_TOKEN" \
-  -H "Content-Type: application/json" \
-  -d "$payload")"
-
-if [ "$status" = "404" ]; then
-  curl -sS --fail-with-body -o /dev/null -X POST \
-    "$INFISICAL_HOST/api/v3/secrets/raw/DATABASE_URL" \
-    -H "Authorization: Bearer $ACCESS_TOKEN" \
-    -H "Content-Type: application/json" \
-    -d "$payload"
-elif [ "$status" -ge 300 ]; then
-  echo "Failed to update DATABASE_URL in Infisical (HTTP $status)" >&2
-  exit 1
-fi
-
-echo "DATABASE_URL synced to Infisical ($ENVIRONMENT)."

package/templates/.github/workflows/terraform-apply.yml

@@ -1,103 +0,0 @@
-name: Terraform apply
-
-on:
-  push:
-    branches: [main]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: terraform-apply
-  cancel-in-progress: false
-
-env:
-  # The Scaleway keys double as S3 credentials for the state backend, so the
-  # same secret feeds both variables: one credential, one place to rotate.
-  AWS_ACCESS_KEY_ID: ${{ secrets.SCW_ACCESS_KEY }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.SCW_SECRET_KEY }}
-  SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
-  SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
-  SCW_DEFAULT_PROJECT_ID: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
-  SCW_DEFAULT_ORGANIZATION_ID: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
-  INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
-  INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
-  INFISICAL_PROJECT_ID: ${{ vars.INFISICAL_PROJECT_ID }}
-  INFISICAL_HOST: ${{ vars.INFISICAL_HOST }}
-  TF_VAR_infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
-  TF_VAR_infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
-  TF_VAR_infisical_project_id: ${{ vars.INFISICAL_PROJECT_ID }}
-  TF_VAR_infisical_host: ${{ vars.INFISICAL_HOST }}
-  TF_IN_AUTOMATION: "true"
-
-jobs:
-  apply-staging:
-    name: apply (staging)
-    runs-on: ubuntu-latest
-    environment: staging
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: hashicorp/setup-terraform@v3
-        with:
-          terraform_version: "~1.12"
-          terraform_wrapper: false
-
-      - name: Write backend config
-        run: |
-          cat > backend.hcl <<EOF
-          bucket = "${{ vars.TF_STATE_BUCKET }}"
-          region = "${{ vars.SCW_REGION }}"
-          endpoints = {
-            s3 = "https://s3.${{ vars.SCW_REGION }}.scw.cloud"
-          }
-          EOF
-
-      - name: Terraform init
-        run: terraform init -input=false -backend-config=backend.hcl
-
-      - name: Select workspace
-        run: terraform workspace select -or-create staging
-
-      - name: Terraform apply
-        run: terraform apply -input=false -auto-approve -var-file=staging.tfvars
-
-      - name: Sync DATABASE_URL to Infisical
-        run: ./.github/scripts/sync-database-url.sh staging
-
-  apply-prod:
-    name: apply (prod)
-    runs-on: ubuntu-latest
-    needs: apply-staging
-    # The "production" GitHub Environment carries a required-reviewer rule,
-    # so this job waits for manual approval.
-    environment: production
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: hashicorp/setup-terraform@v3
-        with:
-          terraform_version: "~1.12"
-          terraform_wrapper: false
-
-      - name: Write backend config
-        run: |
-          cat > backend.hcl <<EOF
-          bucket = "${{ vars.TF_STATE_BUCKET }}"
-          region = "${{ vars.SCW_REGION }}"
-          endpoints = {
-            s3 = "https://s3.${{ vars.SCW_REGION }}.scw.cloud"
-          }
-          EOF
-
-      - name: Terraform init
-        run: terraform init -input=false -backend-config=backend.hcl
-
-      - name: Select workspace
-        run: terraform workspace select -or-create prod
-
-      - name: Terraform apply
-        run: terraform apply -input=false -auto-approve -var-file=prod.tfvars
-
-      - name: Sync DATABASE_URL to Infisical
-        run: ./.github/scripts/sync-database-url.sh prod

package/templates/prod.tfvars

@@ -1,7 +0,0 @@
-# Non-sensitive production configuration. Safe to commit.
-project_name      = "__PROJECT_NAME__"
-region            = "__REGION__"
-environment       = "prod"
-enable_basic_auth = false
-min_scale         = __PROD_MIN_SCALE__
-max_scale         = __PROD_MAX_SCALE__

package/templates/staging.tfvars

@@ -1,7 +0,0 @@
-# Non-sensitive staging configuration. Safe to commit.
-project_name      = "__PROJECT_NAME__"
-region            = "__REGION__"
-environment       = "staging"
-enable_basic_auth = true
-min_scale         = __STAGING_MIN_SCALE__
-max_scale         = __STAGING_MAX_SCALE__