@gambi97/keel-cli 0.2.0 → 0.3.0

package/dist/prompts.js

@@ -1,5 +1,10 @@
 import * as p from '@clack/prompts';
-import { ConfigError, DEFAULT_ENV_PRESET, DEFAULT_INFISICAL_HOST, DEFAULT_REGION, ENV_PRESETS, envDefaultScale, REGIONS, validateProjectName, validateScale, } from './config.js';
+import { createContext, GitHubError, inspectRepo, assertRepoUsable } from './bootstrap/github.js';
+import { InfisicalError, validateInfisical } from './bootstrap/infisical.js';
+import { ScalewayError, validateScalewayCredentials } from './bootstrap/scaleway.js';
+import { ConfigError, DEFAULT_ENV_PRESET, DEFAULT_INFISICAL_HOST, DEFAULT_REGION, ENV_PRESETS, envDefaultScale, REGIONS, validateProjectName, validateScale, validateUrl, } from './config.js';
+import { isDone, loadState } from './state.js';
+import { log } from './ui.js';
 function bail() {
     p.cancel('Cancelled. Nothing was created.');
     process.exit(1);
@@ -21,80 +26,58 @@ function validate(fn) {
         }
     };
 }
-/** Interactively fill everything still missing from flags/env/config file. */
+const secret = (message) => ask(p.password({ message }));
+const text = (message, placeholder) => ask(p.text({
+    message,
+    ...(placeholder ? { placeholder } : {}),
+    validate: (v) => (v.trim() ? undefined : 'Required.'),
+}));
+/**
+ * Interactively fill everything still missing from flags/env/config file.
+ *
+ * The project name comes first (it seeds the repo/bucket/project defaults),
+ * then the three provider blocks (GitHub, Infisical, Scaleway) — each closed
+ * by a read-only validation call that reports bad input immediately and
+ * re-asks only the offending value — and finally the configuration you want
+ * (region, environments, storage, scaling). Nothing is created here; creation
+ * starts only after the final confirmation.
+ */
 export async function fillMissing(partial, options) {
     const out = structuredClone(partial);
-    if (!out.projectName) {
-        out.projectName = await ask(p.text({
-            message: 'Project name (dns-safe, used for repo, bucket and resources)',
-            placeholder: 'my-app',
-            validate: validate(validateProjectName),
-        }));
-    }
-    if (!out.region) {
-        out.region = await ask(p.select({
-            message: 'Scaleway region',
-            initialValue: DEFAULT_REGION,
-            options: REGIONS.map((r) => ({ value: r, label: r })),
-        }));
+    await askProjectName(out);
+    // Each block opens with a "┌ <Provider>" section corner and closes with a
+    // "└ <Provider> connected — …" line, so every question flows inside its own
+    // section and the next one opens only when the previous is verified.
+    if (!options.dryRun) {
+        await askGitHub(out);
+        await askInfisical(out);
+        await askScaleway(out);
     }
-    const secret = (message) => ask(p.password({ message }));
-    const text = (message, placeholder) => ask(p.text({
-        message,
-        ...(placeholder ? { placeholder } : {}),
-        validate: (v) => (v.trim() ? undefined : 'Required.'),
+    // Configuration comes last: with the accounts verified, these are the only
+    // real choices left. In a dry run it is all that is asked after the name.
+    await askConfiguration(out, options);
+    return out;
+}
+async function askProjectName(out) {
+    if (out.projectName)
+        return;
+    out.projectName = await ask(p.text({
+        message: 'Project name (dns-safe, used for repo, bucket and resources)',
+        placeholder: 'my-app',
+        validate: validate(validateProjectName),
     }));
-    if (!out.scaleway.accessKey)
-        out.scaleway.accessKey = await text('Scaleway access key');
-    if (!out.scaleway.secretKey)
-        out.scaleway.secretKey = await secret('Scaleway secret key');
-    if (!out.scaleway.projectId)
-        out.scaleway.projectId = await text('Scaleway project ID');
-    if (!out.scaleway.organizationId)
-        out.scaleway.organizationId = await text('Scaleway organization ID');
-    if (!out.infisical.host) {
-        out.infisical.host = await ask(p.text({ message: 'Infisical host', initialValue: DEFAULT_INFISICAL_HOST }));
-    }
-    if (!out.infisical.clientId)
-        out.infisical.clientId = await text('Infisical machine identity client ID');
-    if (!out.infisical.clientSecret)
-        out.infisical.clientSecret = await secret('Infisical machine identity client secret');
-    if (!out.infisical.projectName) {
-        out.infisical.projectName = await ask(p.text({
-            message: 'Infisical project name (existing project is reused, otherwise created)',
-            initialValue: out.projectName,
-        }));
-    }
-    if (!out.github.token)
-        out.github.token = await secret('GitHub token (scopes: repo, workflow)');
-    if (!out.github.repoName) {
-        out.github.repoName = await ask(p.text({
-            message: 'GitHub repository name',
-            initialValue: out.projectName,
-            validate: validate(validateProjectName),
-        }));
-    }
-    if (out.github.repoPrivate === undefined) {
-        out.github.repoPrivate = await ask(p.select({
-            message: 'Repository visibility',
-            initialValue: false,
-            options: [
-                { value: false, label: 'Public', hint: 'the infra contains no secrets' },
-                { value: true, label: 'Private' },
-            ],
-        }));
-    }
+}
+/** Everything that shapes the infrastructure: region, environments, options. */
+async function askConfiguration(out, options) {
+    p.intro('Configuration — region, environments and options');
+    await askRegion(out);
     if (!out.environments || out.environments.length === 0) {
         const preset = await ask(p.select({
             message: 'Which environments do you want?',
             initialValue: DEFAULT_ENV_PRESET,
             options: [
                 { value: 'prod', label: 'Production only', hint: 'single environment' },
-                {
-                    value: 'staging+prod',
-                    label: 'Staging + Production',
-                    hint: 'recommended',
-                },
+                { value: 'staging+prod', label: 'Staging + Production', hint: 'recommended' },
                 { value: 'dev+staging+prod', label: 'Dev + Staging + Production' },
             ],
         }));
@@ -114,6 +97,17 @@ export async function fillMissing(partial, options) {
             initialValue: true,
         }));
     }
+    // Production is the one scaling knob worth surfacing at setup: everything
+    // scales to zero when idle, and this is the ceiling. Staging/dev stay 0-1;
+    // full per-environment control lives behind --advanced.
+    if (!options.advanced && slugs.includes('prod') && out.scaling.prod?.maxScale === undefined) {
+        const max = await ask(p.text({
+            message: 'Maximum production instances (idle scales to zero; raise later in prod.tfvars)',
+            initialValue: String(envDefaultScale('prod').maxScale),
+            validate: validate((v) => validateScale(v, 'prod max scale')),
+        }));
+        out.scaling.prod = { ...(out.scaling.prod ?? {}), maxScale: Number(max) };
+    }
     if (options.advanced) {
         const scale = async (message, initial) => Number(await ask(p.text({
             message,
@@ -128,7 +122,193 @@ export async function fillMissing(partial, options) {
             out.scaling[slug] = current;
         }
     }
-    return out;
+}
+/** GitHub block: repo + token, then verify token, scopes and repo state. */
+async function askGitHub(out) {
+    // When resuming a run that already pushed, the repo legitimately has
+    // commits: a non-empty repo must not block the resume.
+    const targetDir = out.targetDir?.trim() || out.projectName;
+    const alreadyPushed = isDone(loadState(targetDir, out.projectName), 'github-push');
+    p.intro('GitHub — repository, visibility and token');
+    for (;;) {
+        if (!out.github.repoName) {
+            out.github.repoName = await ask(p.text({
+                message: 'GitHub repository name (a new empty repository works best)',
+                initialValue: out.projectName,
+                validate: validate(validateProjectName),
+            }));
+        }
+        if (out.github.repoPrivate === undefined) {
+            out.github.repoPrivate = await ask(p.select({
+                message: 'Repository visibility',
+                initialValue: false,
+                options: [
+                    { value: false, label: 'Public', hint: 'the infra contains no secrets' },
+                    { value: true, label: 'Private' },
+                ],
+            }));
+        }
+        if (!out.github.token) {
+            out.github.token = await secret('GitHub token (scopes: repo, workflow)');
+        }
+        try {
+            const ctx = await createContext({
+                token: out.github.token,
+                repoName: out.github.repoName,
+                repoPrivate: out.github.repoPrivate ?? false,
+            });
+            const { state } = await inspectRepo(ctx);
+            if (!(state === 'non-empty' && alreadyPushed)) {
+                assertRepoUsable(ctx, state);
+            }
+            const repo = `${ctx.owner}/${out.github.repoName}`;
+            p.outro(state === 'not-found'
+                ? `GitHub connected — ${repo} will be created after confirmation.`
+                : state === 'non-empty'
+                    ? `GitHub connected — resuming, ${repo} was already pushed.`
+                    : `GitHub connected — existing empty repository ${repo} will be reused.`);
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof GitHubError))
+                throw error;
+            log.error(error.message);
+            if (error.field === 'repo') {
+                out.github.repoName = undefined;
+            }
+            else {
+                out.github.token = undefined;
+            }
+        }
+    }
+}
+/** Infisical block: host + machine identity, then verify login and project. */
+async function askInfisical(out) {
+    p.intro('Infisical — secret-manager project and machine identity');
+    if (!out.infisical.host) {
+        const choice = await ask(p.select({
+            message: 'Infisical host',
+            initialValue: 'us',
+            options: [
+                { value: 'us', label: 'US — app.infisical.com', hint: 'default' },
+                { value: 'eu', label: 'EU — eu.infisical.com' },
+                { value: 'other', label: 'Other (self-hosted)' },
+            ],
+        }));
+        if (choice === 'us')
+            out.infisical.host = DEFAULT_INFISICAL_HOST;
+        else if (choice === 'eu')
+            out.infisical.host = 'https://eu.infisical.com';
+        else {
+            out.infisical.host = await ask(p.text({
+                message: 'Infisical host URL',
+                placeholder: 'https://infisical.example.com',
+                validate: validate((v) => validateUrl(v, 'Infisical host')),
+            }));
+        }
+    }
+    for (;;) {
+        if (!out.infisical.clientId) {
+            out.infisical.clientId = await text('Infisical machine identity client ID');
+        }
+        if (!out.infisical.clientSecret) {
+            out.infisical.clientSecret = await secret('Infisical machine identity client secret');
+        }
+        if (!out.infisical.projectId && !out.infisical.projectName) {
+            const id = await ask(p.text({
+                message: `Infisical project ID to reuse (leave empty to create "${out.projectName}")`,
+                placeholder: 'empty: create a new project',
+                defaultValue: '',
+            }));
+            if (id.trim())
+                out.infisical.projectId = id.trim();
+            else
+                out.infisical.projectName = out.projectName;
+        }
+        try {
+            const { projectName } = await validateInfisical({
+                host: out.infisical.host,
+                clientId: out.infisical.clientId,
+                clientSecret: out.infisical.clientSecret,
+                projectId: out.infisical.projectId,
+            });
+            if (projectName)
+                out.infisical.projectName = projectName;
+            p.outro(out.infisical.projectId
+                ? `Infisical connected — existing project "${projectName}" (${out.infisical.projectId}) will be reused.`
+                : `Infisical connected — project "${out.infisical.projectName}" will be created after confirmation.`);
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof InfisicalError))
+                throw error;
+            log.error(error.message);
+            if (error.field === 'project') {
+                out.infisical.projectId = undefined;
+                out.infisical.projectName = undefined;
+            }
+            else {
+                out.infisical.clientId = undefined;
+                out.infisical.clientSecret = undefined;
+            }
+        }
+    }
+}
+async function askRegion(out) {
+    if (out.region)
+        return;
+    out.region = await ask(p.select({
+        message: 'Scaleway region',
+        initialValue: DEFAULT_REGION,
+        options: REGIONS.map((r) => ({ value: r, label: r })),
+    }));
+}
+/** Scaleway block: keys + IDs, then verify with a read-only API call. */
+async function askScaleway(out) {
+    p.intro('Scaleway — account keys and project');
+    for (;;) {
+        if (!out.scaleway.accessKey)
+            out.scaleway.accessKey = await text('Scaleway access key');
+        if (!out.scaleway.secretKey)
+            out.scaleway.secretKey = await secret('Scaleway secret key');
+        if (!out.scaleway.projectId)
+            out.scaleway.projectId = await text('Scaleway project ID');
+        if (!out.scaleway.organizationId) {
+            out.scaleway.organizationId = await text('Scaleway organization ID');
+        }
+        try {
+            await validateScalewayCredentials({
+                secretKey: out.scaleway.secretKey,
+                projectId: out.scaleway.projectId,
+                organizationId: out.scaleway.organizationId,
+            });
+            p.outro('Scaleway connected — credentials valid and project reachable.');
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof ScalewayError))
+                throw error;
+            log.error(error.message);
+            switch (error.code) {
+                case 'auth':
+                    out.scaleway.accessKey = undefined;
+                    out.scaleway.secretKey = undefined;
+                    break;
+                case 'project':
+                    out.scaleway.projectId = undefined;
+                    break;
+                case 'organization':
+                    out.scaleway.organizationId = undefined;
+                    break;
+                default: {
+                    // Transient API error: nothing to correct, offer a plain retry.
+                    const retry = await ask(p.confirm({ message: 'Scaleway API error. Retry?' }));
+                    if (!retry)
+                        bail();
+                }
+            }
+        }
+    }
 }
 export async function confirmSummary(summary) {
     p.note(summary, 'About to create');

package/dist/ui.js

@@ -48,7 +48,9 @@ export function renderSummary(answers, dryRun) {
         '',
         'Infisical',
         `  host           ${answers.infisical.host}`,
-        `  project        ${answers.infisical.projectName} (created or reused)`,
+        `  project        ${answers.infisical.projectId
+            ? `${answers.infisical.projectName} (existing, ${answers.infisical.projectId})`
+            : `${answers.infisical.projectName} (will be created)`}`,
         `  environments   ${envSlugs} (+ placeholder secrets)`,
         '',
         `Object Storage   ${answers.objectStorage ? 'enabled (per-environment bucket + S3_* secrets)' : 'disabled'}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gambi97/keel-cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
   "keywords": [
     "keel",

package/templates/.github/scripts/sync-secrets.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Pushes the secrets Terraform produced to Infisical, so the application reads
-# them at runtime: always DATABASE_URL (dedicated IAM credential included), plus
-# the S3_* Object Storage coordinates when that feature is enabled.
+# them at runtime: always DATABASE_URL and APP_URL, plus the S3_* Object
+# Storage coordinates when that feature is enabled.
 # Usage: sync-secrets.sh <environment>
 # Expects: INFISICAL_HOST, INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET,
 #          INFISICAL_PROJECT_ID in the environment; terraform init already run.
@@ -9,8 +9,17 @@ set -euo pipefail
 
 ENVIRONMENT="${1:?usage: sync-secrets.sh <environment>}"
 
-SECRETS_JSON="$(terraform output -json infisical_secrets)"
-if [ -z "$SECRETS_JSON" ] || [ "$SECRETS_JSON" = "null" ] || [ "$SECRETS_JSON" = "{}" ]; then
+# Collect the base "infisical_secrets" output plus any module-contributed
+# "infisical_secrets_<name>" output, merged into one map. A module added to
+# this repo contributes secrets by exposing its own output under that prefix:
+# nothing here or in outputs.tf needs editing.
+SECRETS_JSON="$(terraform output -json | jq -c '
+  [to_entries[]
+    | select(.key | test("^infisical_secrets(_[a-z0-9_]+)?$"))
+    | select(.value.value | type == "object")
+    | .value.value]
+  | add // {}')"
+if [ "$SECRETS_JSON" = "{}" ] || [ "$SECRETS_JSON" = "null" ]; then
   echo "No secrets to sync."
   exit 0
 fi

package/templates/.github/workflows/terraform-drift.yml

@@ -29,13 +29,31 @@ env:
   TF_IN_AUTOMATION: "true"
 
 jobs:
+  discover:
+    name: discover environments
+    runs-on: ubuntu-latest
+    outputs:
+      environments: ${{ steps.list.outputs.environments }}
+    steps:
+      - uses: actions/checkout@v4
+
+      # Every <env>.tfvars at the repo root is an environment: adding one to
+      # the drift matrix is just adding its tfvars file, no workflow edit.
+      - name: List environments from tfvars files
+        id: list
+        run: |
+          environments=$(ls *.tfvars | sed 's/\.tfvars$//' \
+            | jq --raw-input --slurp --compact-output 'split("\n") | map(select(length > 0))')
+          echo "environments=$environments" >> "$GITHUB_OUTPUT"
+
   drift:
     name: drift (${{ matrix.environment }})
+    needs: discover
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        environment: __ENV_MATRIX__
+        environment: ${{ fromJSON(needs.discover.outputs.environments) }}
     steps:
       - uses: actions/checkout@v4
 

package/templates/.github/workflows/terraform-plan.yml

@@ -23,13 +23,31 @@ env:
   TF_IN_AUTOMATION: "true"
 
 jobs:
+  discover:
+    name: discover environments
+    runs-on: ubuntu-latest
+    outputs:
+      environments: ${{ steps.list.outputs.environments }}
+    steps:
+      - uses: actions/checkout@v4
+
+      # Every <env>.tfvars at the repo root is an environment: adding one to
+      # the plan matrix is just adding its tfvars file, no workflow edit.
+      - name: List environments from tfvars files
+        id: list
+        run: |
+          environments=$(ls *.tfvars | sed 's/\.tfvars$//' \
+            | jq --raw-input --slurp --compact-output 'split("\n") | map(select(length > 0))')
+          echo "environments=$environments" >> "$GITHUB_OUTPUT"
+
   plan:
     name: plan (${{ matrix.environment }})
+    needs: discover
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        environment: __ENV_MATRIX__
+        environment: ${{ fromJSON(needs.discover.outputs.environments) }}
     steps:
       - uses: actions/checkout@v4
 

package/templates/README.md

@@ -49,8 +49,8 @@ merge/push main   -> apply each environment in order; any gated environment (pro
 - After each apply, the pipeline syncs the secrets Terraform produced to
   Infisical for that environment: a ready-to-use Postgres `DATABASE_URL`
   (whose credential is a dedicated IAM application that can only read/write
-  the database, not your main API key) and, when Object Storage is enabled,
-  the `S3_*` coordinates.
+  the database, not your main API key), the app's public `APP_URL` and, when
+  Object Storage is enabled, the `S3_*` coordinates.
 - State is locked during applies (S3-native locking, `use_lockfile`), so
   concurrent runs cannot corrupt it.
 - A scheduled **drift detection** workflow (Monday 06:00 UTC, or manual via
@@ -84,6 +84,7 @@ merge/push main   -> apply each environment in order; any gated environment (pro
    | Variable | Where | Notes |
    |---|---|---|
    | `DATABASE_URL` | every environment | Complete connection string, auto-updated by the pipeline after each apply. No action needed |
+   | `APP_URL` | every environment | Public URL of the app, auto-updated by the pipeline once a container exists. Useful for links, OAuth callbacks, webhooks |
    | `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` | non-production | The app must enforce these when `BASIC_AUTH_ENABLED=true` |
    | `S3_BUCKET` / `S3_ENDPOINT` / `S3_REGION` / `S3_ACCESS_KEY` / `S3_SECRET_KEY` | every environment (if Object Storage enabled) | Auto-updated by the pipeline after each apply |
 
@@ -114,14 +115,37 @@ environment enables it is the `enable_basic_auth` flag in its `<env>.tfvars`.
   secrets (repo Settings > Secrets and variables > Actions).
 - **Add a custom domain**: add a `scaleway_container_domain` resource in
   `modules/app_stack` pointing at the container, plus your DNS record.
-- **Add an environment**: add a `<env>.tfvars`, an Infisical environment with
-  the same slug, an entry in the plan/drift matrix and a job in
+- **Add an environment**: add a `<env>.tfvars` at the repo root (the plan and
+  drift workflows discover environments from the tfvars files automatically),
+  create an Infisical environment with the same slug, and add a job in
   `.github/workflows/terraform-apply.yml` (mirror an existing one and set its
-  `needs:` to chain after the previous environment).
+  `needs:` to chain after the previous environment). Note: the new `plan
+  (<env>)` check becomes required on `main` only after you add it in the
+  branch-protection settings.
 - **Pin provider versions**: after any local `terraform init`, commit the
   generated `.terraform.lock.hcl` so CI resolves the exact same provider
   builds on every run.
 
+## Extending this repo with your own module
+
+The layout is designed so additions never edit generated files:
+
+1. Put your Terraform in a **new file at the repo root** (e.g. `jobs.tf`,
+   optionally with a `modules/<name>/` directory) — Terraform merges all root
+   `.tf` files automatically. Reach the app stack only through its outputs,
+   never into its internals.
+2. Per-environment configuration goes into the existing `<env>.tfvars` files
+   (append new variables; declare them in your own `.tf` file).
+3. If your module produces secrets the app should read, expose them as an
+   output named `infisical_secrets_<name>` (a map of string, marked
+   `sensitive`). The pipeline collects every output matching that prefix and
+   syncs it to Infisical after each apply — no edit to `outputs.tf` or the
+   workflows required.
+
+`.keel/manifest.json` (committed) records the keel version, the contract
+version and the generation options this repo was created with, so tooling and
+future you know exactly what it is built on.
+
 ## Running Terraform locally (optional)
 
 CI is the source of truth, but plans can be run locally (replace `<env>` with

package/templates/_gitignore

@@ -19,7 +19,7 @@ override.tf.json
 .env
 .env.*
 
-# Bootstrap resume file
+# Bootstrap resume file (machine-local; .keel/manifest.json IS committed)
 .keel.json
 
 # Editors / OS

package/templates/main.tf

@@ -3,6 +3,16 @@ data "infisical_secrets" "app" {
   env_slug     = var.environment
   workspace_id = var.infisical_project_id
   folder_path  = "/"
+
+  lifecycle {
+    # Guards against applying one environment's tfvars into another
+    # environment's state (e.g. prod.tfvars while the staging workspace is
+    # selected), which would create prod-named resources in staging state.
+    precondition {
+      condition     = terraform.workspace == var.environment
+      error_message = "The selected Terraform workspace must match var.environment: run `terraform workspace select <env>` before plan/apply with <env>.tfvars."
+    }
+  }
 }
 
 module "app_stack" {

package/templates/modules/app_stack/main.tf

@@ -1,4 +1,7 @@
 locals {
+  # <project>-<env>: the naming convention every per-environment resource
+  # shares with the CLI (which builds registry hints from it) — do not change
+  # one side without the other; contracts.test.ts pins them together.
   name = "${var.project_name}-${var.environment}"
 }
 

package/templates/outputs.tf

@@ -24,13 +24,22 @@ output "object_bucket_name" {
   value       = module.app_stack.object_bucket_name
 }
 
-# The complete set of secrets the pipeline pushes to Infisical after each apply:
-# always DATABASE_URL, plus the S3_* coordinates when Object Storage is enabled.
+# The secrets the pipeline pushes to Infisical after each apply: always
+# DATABASE_URL and APP_URL, plus the S3_* coordinates when Object Storage is
+# enabled. A module added to this repo can contribute its own secrets by
+# exposing an output named "infisical_secrets_<name>" (a map of string): the
+# pipeline collects every output matching that prefix, so extending never
+# requires editing this file.
 output "infisical_secrets" {
   description = "Secrets synced to Infisical after each apply."
   sensitive   = true
   value = merge(
-    { DATABASE_URL = module.app_stack.database_url },
+    {
+      DATABASE_URL = module.app_stack.database_url
+      # Public URL of the app; null until a container image is deployed (the
+      # pipeline skips null values and syncs it on the first apply after).
+      APP_URL = module.app_stack.container_url
+    },
     var.enable_object_storage ? {
       S3_BUCKET     = module.app_stack.object_bucket_name
       S3_ENDPOINT   = module.app_stack.object_bucket_endpoint

package/templates/variables.tf

@@ -46,6 +46,11 @@ variable "min_scale" {
   description = "Minimum number of container instances."
   type        = number
   default     = 0
+
+  validation {
+    condition     = var.min_scale <= var.max_scale
+    error_message = "min_scale cannot exceed max_scale."
+  }
 }
 
 variable "max_scale" {