@gambi97/keel-cli 0.1.1

package/templates/.github/workflows/terraform-apply.yml

@@ -0,0 +1,103 @@
+name: Terraform apply
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: terraform-apply
+  cancel-in-progress: false
+
+env:
+  # The Scaleway keys double as S3 credentials for the state backend, so the
+  # same secret feeds both variables: one credential, one place to rotate.
+  AWS_ACCESS_KEY_ID: ${{ secrets.SCW_ACCESS_KEY }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.SCW_SECRET_KEY }}
+  SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
+  SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
+  SCW_DEFAULT_PROJECT_ID: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
+  SCW_DEFAULT_ORGANIZATION_ID: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
+  INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
+  INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
+  INFISICAL_PROJECT_ID: ${{ vars.INFISICAL_PROJECT_ID }}
+  INFISICAL_HOST: ${{ vars.INFISICAL_HOST }}
+  TF_VAR_infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
+  TF_VAR_infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
+  TF_VAR_infisical_project_id: ${{ vars.INFISICAL_PROJECT_ID }}
+  TF_VAR_infisical_host: ${{ vars.INFISICAL_HOST }}
+  TF_IN_AUTOMATION: "true"
+
+jobs:
+  apply-staging:
+    name: apply (staging)
+    runs-on: ubuntu-latest
+    environment: staging
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~1.12"
+          terraform_wrapper: false
+
+      - name: Write backend config
+        run: |
+          cat > backend.hcl <<EOF
+          bucket = "${{ vars.TF_STATE_BUCKET }}"
+          region = "${{ vars.SCW_REGION }}"
+          endpoints = {
+            s3 = "https://s3.${{ vars.SCW_REGION }}.scw.cloud"
+          }
+          EOF
+
+      - name: Terraform init
+        run: terraform init -input=false -backend-config=backend.hcl
+
+      - name: Select workspace
+        run: terraform workspace select -or-create staging
+
+      - name: Terraform apply
+        run: terraform apply -input=false -auto-approve -var-file=staging.tfvars
+
+      - name: Sync DATABASE_URL to Infisical
+        run: ./.github/scripts/sync-database-url.sh staging
+
+  apply-prod:
+    name: apply (prod)
+    runs-on: ubuntu-latest
+    needs: apply-staging
+    # The "production" GitHub Environment carries a required-reviewer rule,
+    # so this job waits for manual approval.
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~1.12"
+          terraform_wrapper: false
+
+      - name: Write backend config
+        run: |
+          cat > backend.hcl <<EOF
+          bucket = "${{ vars.TF_STATE_BUCKET }}"
+          region = "${{ vars.SCW_REGION }}"
+          endpoints = {
+            s3 = "https://s3.${{ vars.SCW_REGION }}.scw.cloud"
+          }
+          EOF
+
+      - name: Terraform init
+        run: terraform init -input=false -backend-config=backend.hcl
+
+      - name: Select workspace
+        run: terraform workspace select -or-create prod
+
+      - name: Terraform apply
+        run: terraform apply -input=false -auto-approve -var-file=prod.tfvars
+
+      - name: Sync DATABASE_URL to Infisical
+        run: ./.github/scripts/sync-database-url.sh prod

package/templates/.github/workflows/terraform-drift.yml

@@ -0,0 +1,91 @@
+name: Drift detection
+
+# Runs a read-only plan on a schedule and opens (or updates) an issue when the
+# real infrastructure no longer matches the code, e.g. after a change made in
+# the Scaleway console.
+
+on:
+  schedule:
+    - cron: "0 6 * * 1" # every Monday, 06:00 UTC
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  issues: write
+
+env:
+  # The Scaleway keys double as S3 credentials for the state backend, so the
+  # same secret feeds both variables: one credential, one place to rotate.
+  AWS_ACCESS_KEY_ID: ${{ secrets.SCW_ACCESS_KEY }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.SCW_SECRET_KEY }}
+  SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
+  SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
+  SCW_DEFAULT_PROJECT_ID: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
+  SCW_DEFAULT_ORGANIZATION_ID: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
+  TF_VAR_infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
+  TF_VAR_infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
+  TF_VAR_infisical_project_id: ${{ vars.INFISICAL_PROJECT_ID }}
+  TF_VAR_infisical_host: ${{ vars.INFISICAL_HOST }}
+  TF_IN_AUTOMATION: "true"
+
+jobs:
+  drift:
+    name: drift (${{ matrix.environment }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        environment: [staging, prod]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~1.12"
+          terraform_wrapper: false
+
+      - name: Write backend config
+        run: |
+          cat > backend.hcl <<EOF
+          bucket = "${{ vars.TF_STATE_BUCKET }}"
+          region = "${{ vars.SCW_REGION }}"
+          endpoints = {
+            s3 = "https://s3.${{ vars.SCW_REGION }}.scw.cloud"
+          }
+          EOF
+
+      - name: Terraform init
+        run: terraform init -input=false -backend-config=backend.hcl
+
+      - name: Select workspace
+        run: terraform workspace select -or-create ${{ matrix.environment }}
+
+      - name: Terraform plan (drift check)
+        id: plan
+        # -lock=false: read-only check, must never contend with a real apply.
+        run: |
+          set +e
+          terraform plan -input=false -lock=false -detailed-exitcode \
+            -var-file=${{ matrix.environment }}.tfvars -no-color > plan.txt 2>&1
+          code=$?
+          set -e
+          echo "exitcode=$code" >> "$GITHUB_OUTPUT"
+          tail -50 plan.txt
+          if [ "$code" = "1" ]; then exit 1; fi
+
+      - name: Report drift
+        if: steps.plan.outputs.exitcode == '2'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ENVIRONMENT: ${{ matrix.environment }}
+        run: |
+          title="Infrastructure drift detected (${ENVIRONMENT})"
+          body="Scheduled \`terraform plan\` for **${ENVIRONMENT}** found differences between the code and the real infrastructure.
+
+          Review the [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) and either revert the manual change or align the code with a PR."
+          existing=$(gh issue list --state open --search "in:title \"$title\"" --json number --jq '.[0].number')
+          if [ -n "$existing" ]; then
+            gh issue comment "$existing" --body "Drift still present on $(date -u +%F). See ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          else
+            gh issue create --title "$title" --body "$body"
+          fi

package/templates/.github/workflows/terraform-plan.yml

@@ -0,0 +1,63 @@
+name: Terraform plan
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+env:
+  # The Scaleway keys double as S3 credentials for the state backend, so the
+  # same secret feeds both variables: one credential, one place to rotate.
+  AWS_ACCESS_KEY_ID: ${{ secrets.SCW_ACCESS_KEY }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.SCW_SECRET_KEY }}
+  SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
+  SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
+  SCW_DEFAULT_PROJECT_ID: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
+  SCW_DEFAULT_ORGANIZATION_ID: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
+  TF_VAR_infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
+  TF_VAR_infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
+  TF_VAR_infisical_project_id: ${{ vars.INFISICAL_PROJECT_ID }}
+  TF_VAR_infisical_host: ${{ vars.INFISICAL_HOST }}
+  TF_IN_AUTOMATION: "true"
+
+jobs:
+  plan:
+    name: plan (${{ matrix.environment }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        environment: [staging, prod]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~1.12"
+
+      - name: Terraform fmt
+        run: terraform fmt -check -recursive
+
+      - name: Write backend config
+        run: |
+          cat > backend.hcl <<EOF
+          bucket = "${{ vars.TF_STATE_BUCKET }}"
+          region = "${{ vars.SCW_REGION }}"
+          endpoints = {
+            s3 = "https://s3.${{ vars.SCW_REGION }}.scw.cloud"
+          }
+          EOF
+
+      - name: Terraform init
+        run: terraform init -input=false -backend-config=backend.hcl
+
+      - name: Select workspace
+        run: terraform workspace select -or-create ${{ matrix.environment }}
+
+      - name: Terraform validate
+        run: terraform validate
+
+      - name: Terraform plan
+        run: terraform plan -input=false -var-file=${{ matrix.environment }}.tfvars

package/templates/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 __PROJECT_NAME__ contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/templates/README.md

@@ -0,0 +1,164 @@
+# __PROJECT_NAME__
+
+Serverless infrastructure on [Scaleway](https://www.scaleway.com), managed
+with Terraform, deployed by GitHub Actions, with application secrets in
+[Infisical](https://infisical.com). Generated by
+[keel](https://github.com/Gambi97/keel).
+
+This repository contains **infrastructure only**. The application itself
+lives elsewhere: it is any Docker image pushed to the registry provisioned
+here.
+
+## What this repo manages
+
+| Resource | Purpose |
+|---|---|
+| Registry namespace | Private container registry for the app images |
+| Container namespace + Serverless Container | Runs the app, scales to zero when idle |
+| Serverless SQL Database (Postgres) | One independent database per environment |
+| IAM application + API key | Dedicated least-privilege database credential for the app |
+
+Two environments, **staging** and **prod**, isolated via Terraform
+workspaces: same code, two separate states, differences confined to
+`staging.tfvars` / `prod.tfvars`. Staging expects the app to enforce Basic
+Auth (see below). State lives in the `__PROJECT_NAME__-tfstate` bucket on
+Scaleway Object Storage.
+
+**There are no secrets in this repository**, and none should ever be added.
+Credentials live in GitHub Actions encrypted secrets (CI) and in Infisical
+(application).
+
+> Naming heads-up: `backend.tf` configures the Terraform **state backend**,
+> the bucket where Terraform records what it has created. It has nothing to
+> do with your application's backend, which is just the Docker image you
+> deploy.
+
+## How deploys work
+
+```
+PR to main        -> terraform fmt + validate + plan (staging & prod), shown as PR checks
+merge/push main   -> apply staging -> manual approval (production gate) -> apply prod
+```
+
+- `main` is protected: PRs need a green plan, force pushes are blocked.
+- The prod apply waits for approval on the `production` GitHub Environment.
+- After each apply, the pipeline writes a ready-to-use Postgres connection
+  string to Infisical as `DATABASE_URL` for that environment. The credential
+  inside it is a dedicated IAM application that can only read/write the
+  database (least privilege), not your main API key.
+- State is locked during applies (S3-native locking, `use_lockfile`), so
+  concurrent runs cannot corrupt it.
+- A scheduled **drift detection** workflow (Monday 06:00 UTC, or manual via
+  the Actions tab) runs a read-only plan and opens an issue if the real
+  infrastructure diverged from the code.
+
+## First deploy
+
+1. **Merge or push to `main`.** The first pipeline run creates registry and
+   databases. The Serverless Container is intentionally skipped until an
+   image exists (`container_image` is empty), so the first apply is green.
+
+2. **Build and push the app image** (any Dockerfile, listening on port 8080
+   by default):
+
+   ```sh
+   docker login rg.__REGION__.scw.cloud/__PROJECT_NAME__-staging -u nologin --password-stdin <<< "$SCW_SECRET_KEY"
+   docker build -t rg.__REGION__.scw.cloud/__PROJECT_NAME__-staging/app:latest .
+   docker push rg.__REGION__.scw.cloud/__PROJECT_NAME__-staging/app:latest
+   ```
+
+3. **Point the container at the image**: set `container_image` in
+   `staging.tfvars` (and later in `prod.tfvars`, using the prod registry),
+   open a PR, review the plan, merge. The apply creates the container and
+   prints its URL (`terraform output container_url`).
+
+4. **Fill in the real secrets in Infisical.** The bootstrap seeded
+   placeholders; replace them with production values. The app reads
+   everything from its environment:
+
+   | Variable | Environment | Notes |
+   |---|---|---|
+   | `DATABASE_URL` | staging + prod | Complete connection string, auto-updated by the pipeline after each apply. No action needed |
+   | `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` | staging | The app must enforce these when `BASIC_AUTH_ENABLED=true` |
+
+   Every secret in the Infisical environment is injected into the container
+   as a secret environment variable, so adding an app secret is: add it in
+   Infisical, re-run the apply (any merge to `main`).
+
+## Basic Auth on staging
+
+Scaleway Serverless Containers expose public endpoints with no built-in auth,
+so staging protection is enforced **by the application**: the container
+receives `BASIC_AUTH_ENABLED=true` plus the credentials from Infisical, and
+the app is expected to respond `401` without them (a few lines of middleware
+in any framework). Prod does not set `BASIC_AUTH_ENABLED`.
+
+## Day-2 operations
+
+- **Scale**: adjust `min_scale` / `max_scale` (instances) in the tfvars;
+  `cpu_limit`, `memory_limit`, `container_port`, `db_min_cpu` / `db_max_cpu`
+  are variables with sensible defaults you can override the same way.
+- **Rotate an app secret**: change it in Infisical, trigger an apply. No
+  commit needed.
+- **Rotate the database credential**: `terraform apply
+  -replace=module.app_stack.scaleway_iam_api_key.db` (or via a PR touching
+  it); the pipeline re-syncs `DATABASE_URL` automatically.
+- **Rotate Scaleway/Infisical credentials**: update the GitHub Actions
+  secrets (repo Settings > Secrets and variables > Actions).
+- **Add a custom domain**: add a `scaleway_container_domain` resource in
+  `modules/app_stack` pointing at the container, plus your DNS record.
+- **Add an environment**: add a workspace, an `<env>.tfvars`, an Infisical
+  environment with the same slug, and mirror one job in each workflow.
+- **Pin provider versions**: after any local `terraform init`, commit the
+  generated `.terraform.lock.hcl` so CI resolves the exact same provider
+  builds on every run.
+
+## Running Terraform locally (optional)
+
+CI is the source of truth, but plans can be run locally:
+
+```sh
+cp backend.hcl.example backend.hcl
+export AWS_ACCESS_KEY_ID=<scaleway-access-key>       # state backend
+export AWS_SECRET_ACCESS_KEY=<scaleway-secret-key>
+export SCW_ACCESS_KEY=<scaleway-access-key>          # provider
+export SCW_SECRET_KEY=<scaleway-secret-key>
+export SCW_DEFAULT_PROJECT_ID=<project-id>
+export SCW_DEFAULT_ORGANIZATION_ID=<organization-id>
+export TF_VAR_infisical_client_id=<machine-identity-client-id>
+export TF_VAR_infisical_client_secret=<machine-identity-client-secret>
+export TF_VAR_infisical_project_id=<infisical-project-id>
+export TF_VAR_infisical_host=https://app.infisical.com
+
+terraform init -backend-config=backend.hcl
+terraform workspace select -or-create staging
+terraform plan -var-file=staging.tfvars
+```
+
+Avoid local applies: they race against CI on the same state.
+
+## Configuration reference
+
+- **Committed tfvars** (`staging.tfvars`, `prod.tfvars`): non-sensitive knobs
+  only (name, region, scaling, image).
+- **GitHub Actions secrets**: `SCW_ACCESS_KEY`, `SCW_SECRET_KEY`,
+  `SCW_DEFAULT_PROJECT_ID`, `SCW_DEFAULT_ORGANIZATION_ID`,
+  `INFISICAL_CLIENT_ID`, `INFISICAL_CLIENT_SECRET`. The workflows reuse the
+  Scaleway keys as `AWS_*` for the state backend.
+- **GitHub Actions variables**: `TF_STATE_BUCKET`, `SCW_REGION`,
+  `INFISICAL_PROJECT_ID`, `INFISICAL_HOST`.
+- **Infisical**: one environment per workspace (`staging`, `prod`), all
+  application secrets.
+
+## Troubleshooting
+
+- **Plan fails with 403 on the state bucket**: the `SCW_*` secrets don't
+  match a Scaleway key with Object Storage access.
+- **Plan fails reading Infisical secrets**: check `INFISICAL_PROJECT_ID` and
+  that the machine identity has access to the project and both environments.
+- **Apply green but no container**: expected until `container_image` is set.
+- **App can't reach the database**: `DATABASE_URL` is only synced after an
+  apply; check the value in Infisical for that environment. It must contain
+  a username and password (the dedicated IAM credential), not placeholders.
+- **Apply fails creating IAM resources**: the CI Scaleway key needs IAM
+  permissions (IAMManager) to create the app's database credential.

package/templates/_gitignore

@@ -0,0 +1,28 @@
+# Terraform (.terraform.lock.hcl is intentionally NOT ignored: commit it
+# for reproducible provider versions)
+.terraform/
+*.tfstate
+*.tfstate.*
+crash.log
+crash.*.log
+*.tfplan
+
+# Local backend config (contains bucket coordinates, kept out of the repo)
+backend.hcl
+
+# Local overrides and secrets: never commit credentials
+*.auto.tfvars
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+.env
+.env.*
+
+# Bootstrap resume file
+.keel.json
+
+# Editors / OS
+.DS_Store
+.idea/
+.vscode/

package/templates/backend.hcl.example

@@ -0,0 +1,9 @@
+# Copy to backend.hcl (git-ignored) for local terraform runs:
+#   cp backend.hcl.example backend.hcl
+#   terraform init -backend-config=backend.hcl
+bucket = "__TF_STATE_BUCKET__"
+region = "__REGION__"
+
+endpoints = {
+  s3 = "https://s3.__REGION__.scw.cloud"
+}

package/templates/backend.tf

@@ -0,0 +1,19 @@
+# Remote state on Scaleway Object Storage (S3-compatible).
+# Bucket, region and endpoint are provided at init time:
+#   terraform init -backend-config=backend.hcl
+# Credentials come from AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY
+# (set them to your Scaleway access key / secret key).
+# Each workspace stores its state under env:/<workspace>/.
+# use_lockfile enables S3-native state locking (Terraform >= 1.10); Scaleway
+# Object Storage supports the conditional writes it relies on.
+terraform {
+  backend "s3" {
+    key                         = "terraform.tfstate"
+    use_lockfile                = true
+    skip_credentials_validation = true
+    skip_region_validation      = true
+    skip_requesting_account_id  = true
+    skip_metadata_api_check     = true
+    skip_s3_checksum            = true
+  }
+}

package/templates/main.tf

@@ -0,0 +1,28 @@
+# Application secrets live in Infisical, one environment per Terraform workspace.
+data "infisical_secrets" "app" {
+  env_slug     = var.environment
+  workspace_id = var.infisical_project_id
+  folder_path  = "/"
+}
+
+module "app_stack" {
+  source = "./modules/app_stack"
+
+  project_name    = var.project_name
+  environment     = var.environment
+  region          = var.region
+  container_image = var.container_image
+  container_port  = var.container_port
+  cpu_limit       = var.cpu_limit
+  memory_limit    = var.memory_limit
+  min_scale       = var.min_scale
+  max_scale       = var.max_scale
+  db_min_cpu      = var.db_min_cpu
+  db_max_cpu      = var.db_max_cpu
+
+  enable_basic_auth = var.enable_basic_auth
+
+  secret_environment_variables = {
+    for name, secret in data.infisical_secrets.app.secrets : name => secret.value
+  }
+}

package/templates/modules/app_stack/main.tf

@@ -0,0 +1,70 @@
+locals {
+  name = "${var.project_name}-${var.environment}"
+}
+
+resource "scaleway_registry_namespace" "this" {
+  name      = local.name
+  region    = var.region
+  is_public = false
+}
+
+resource "scaleway_container_namespace" "this" {
+  name   = local.name
+  region = var.region
+}
+
+resource "scaleway_sdb_sql_database" "this" {
+  name    = local.name
+  region  = var.region
+  min_cpu = var.db_min_cpu
+  max_cpu = var.db_max_cpu
+}
+
+# Dedicated least-privilege credential for the application: it can reach the
+# database and nothing else. Serverless SQL authenticates with IAM: username
+# is the application ID, password its API secret key.
+resource "scaleway_iam_application" "db" {
+  name        = "${local.name}-db"
+  description = "Database access for ${local.name} (managed by Terraform)"
+}
+
+resource "scaleway_iam_policy" "db_access" {
+  name           = "${local.name}-db-access"
+  description    = "Read/write access to the ${local.name} Serverless SQL database"
+  application_id = scaleway_iam_application.db.id
+
+  rule {
+    project_ids          = [scaleway_sdb_sql_database.this.project_id]
+    permission_set_names = ["ServerlessSQLDatabaseReadWrite"]
+  }
+}
+
+resource "scaleway_iam_api_key" "db" {
+  application_id = scaleway_iam_application.db.id
+  description    = "Database credential for ${local.name} (managed by Terraform)"
+}
+
+# The container is gated on an image being available: registry and database
+# are provisioned first, the container appears once an image has been pushed
+# and container_image is set.
+resource "scaleway_container" "this" {
+  count = var.container_image == "" ? 0 : 1
+
+  name               = var.project_name
+  namespace_id       = scaleway_container_namespace.this.id
+  image              = var.container_image
+  port               = var.container_port
+  cpu_limit          = var.cpu_limit
+  memory_limit_bytes = var.memory_limit * 1024 * 1024
+  min_scale          = var.min_scale
+  max_scale          = var.max_scale
+  privacy            = "public"
+
+  environment_variables = var.enable_basic_auth ? {
+    BASIC_AUTH_ENABLED = "true"
+  } : {}
+
+  # BASIC_AUTH_USER / BASIC_AUTH_PASSWORD / DATABASE_URL arrive here from
+  # Infisical; the app is responsible for enforcing Basic Auth when enabled.
+  secret_environment_variables = var.secret_environment_variables
+}

package/templates/modules/app_stack/outputs.tf

@@ -0,0 +1,23 @@
+output "container_url" {
+  value = var.container_image == "" ? null : scaleway_container.this[0].public_endpoint
+}
+
+output "registry_endpoint" {
+  value = scaleway_registry_namespace.this.endpoint
+}
+
+output "database_url" {
+  # Ready-to-use connection string: dedicated IAM application as username,
+  # its API secret key as password (see the connect-to-a-database docs).
+  value = format(
+    "postgres://%s:%s@%s",
+    scaleway_iam_application.db.id,
+    scaleway_iam_api_key.db.secret_key,
+    trimprefix(scaleway_sdb_sql_database.this.endpoint, "postgres://"),
+  )
+  sensitive = true
+}
+
+output "container_namespace_id" {
+  value = scaleway_container_namespace.this.id
+}

package/templates/modules/app_stack/variables.tf

@@ -0,0 +1,55 @@
+variable "project_name" {
+  type = string
+}
+
+variable "environment" {
+  type = string
+}
+
+variable "region" {
+  type = string
+}
+
+variable "container_image" {
+  type    = string
+  default = ""
+}
+
+variable "container_port" {
+  type = number
+}
+
+variable "cpu_limit" {
+  type = number
+}
+
+variable "memory_limit" {
+  type = number
+}
+
+variable "min_scale" {
+  type = number
+}
+
+variable "max_scale" {
+  type = number
+}
+
+variable "db_min_cpu" {
+  type = number
+}
+
+variable "db_max_cpu" {
+  type = number
+}
+
+variable "enable_basic_auth" {
+  type = bool
+}
+
+variable "secret_environment_variables" {
+  description = "Secrets injected into the container, sourced from Infisical."
+  type        = map(string)
+  sensitive   = true
+  default     = {}
+}