@hasna/uptime 0.1.4 → 0.1.6

package/docs/aws-deployment-runbook.md

@@ -0,0 +1,107 @@
+# AWS Deployment Runbook
+
+This runbook is for the `hasna-xyz-infra` AWS account target. It is intentionally
+dry-run first: the local generator produces a plan and command list, but it does
+not call AWS or mutate infrastructure.
+
+## Generate The Plan
+
+```bash
+uptime cloud plan --json > open-uptime-aws-plan.json
+uptime cloud spark01-config --probe-id prb_spark01 --env > spark01-uptime.env
+```
+
+Defaults come from the current design inventory:
+
+- account/profile label: `hasna-xyz-infra`
+- region: `us-east-1`
+- VPC: `vpc-04c7f7abc1d3c3f56`
+- RDS instance: `hasna-xyz-infra-apps-prod-postgres`
+- hostname: `uptime.hasna.xyz`
+- workspace id: `wks_2tyysw05cwap`
+
+Override these with CLI flags if the infra owner chooses a different value.
+
+The generated AWS plan currently returns `status: "blocked"` and
+`canApply: false`. The generated Spark01 config returns `status: "blocked"` and
+`canStart: false`. Treat both as review/preflight artifacts until the blockers
+and required evidence in the JSON output are resolved.
+
+The app repo includes a hosted runtime `Dockerfile` and Terraform/OpenTofu
+starter files in `infra/aws`. The plan output points to these files and keeps
+`applyAllowed: false`.
+
+`uptime cloud spark01-config --env` requires a real `--probe-id`; it will not
+write a sourceable env file with a placeholder probe identity.
+
+## Preflight
+
+1. Locate the real `hasna-xyz-infra` infrastructure repository or create the
+   change in the approved owner repository.
+2. Confirm the AWS caller identity:
+
+   ```bash
+   aws sts get-caller-identity --profile hasna-xyz-infra
+   ```
+
+3. Confirm the target VPC and RDS instance still match the plan.
+4. Confirm Route53/edge ownership for the chosen hostname.
+5. Confirm the deployment role uses short-lived credentials or OIDC, not copied
+   access keys.
+
+## Required Resources
+
+The plan expects:
+
+- ECR repository for the Open Uptime image.
+- ECS/Fargate cluster with separate services for web, scheduler, public probe,
+  reporter, and one-off migrations.
+- ALB, TLS certificate, target group, and security groups.
+- Existing private Postgres instance with dedicated Uptime roles or database.
+- S3 bucket for redacted browser evidence and generated report artifacts.
+- Secrets Manager or SSM refs for database, app env, probe config, and
+  reporting channel refs.
+- CloudWatch log groups for every component plus initial web 5xx/unhealthy
+  alarms. Scheduler-stall, stale-probe, and report-delivery alarms remain
+  blocked until those workers emit cloud metrics.
+
+Provision these through the approved infrastructure repository and reviewed
+plan/apply flow. The local `uptime cloud plan` output intentionally avoids
+copy-pastable AWS mutation commands.
+
+Plan the included Terraform/OpenTofu starter without a backend:
+
+```bash
+terraform -chdir=infra/aws fmt -check
+terraform -chdir=infra/aws init -backend=false
+terraform -chdir=infra/aws validate
+terraform -chdir=infra/aws plan -out open-uptime.tfplan
+```
+
+## Spark01
+
+Spark01 should be a private probe/operator machine, not the hosted source of
+truth. The generated env file points Spark01 at hosted `/api/v1` state and
+references a local private-key file path. It does not include private key or
+token contents.
+
+The private probe service should not be enabled until hosted probe claim/submit
+routes are backed by cloud check jobs and cloud audit rows.
+
+## Safety Rules
+
+- Do not deploy hosted mode with `HASNA_UPTIME_ALLOW_HOSTED_LOCAL_STORE=1`.
+- Do not inline AWS keys, hosted tokens, Mailery keys, Open Logs tokens, database
+  URLs, or probe private keys in task definitions. Use ECS `secrets.valueFrom`
+  refs such as `HASNA_UPTIME_DATABASE_URL` and `HASNA_UPTIME_HOSTED_TOKEN`.
+- Do not run public probe workers against private targets.
+- Do not expose dashboard/API routes without hosted auth and workspace checks.
+- Do not treat local SQLite, local project DBs, or Spark01 local state as cloud
+  authority after cutover.
+
+## Rollback
+
+Before each service update, record the previous task definition ARN. Roll back
+by disabling scheduler/reporter work first, then restoring the previous web or
+worker task definition. RDS snapshot restore requires separate operator approval
+and an audit event.

package/infra/aws/.terraform.lock.hcl

@@ -0,0 +1,25 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "5.100.0"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:wOhTPz6apLBuF7/FYZuCoXRK/MLgrNprZ3vXmq83g5k=",
+    "zh:054b8dd49f0549c9a7cc27d159e45327b7b65cf404da5e5a20da154b90b8a644",
+    "zh:0b97bf8d5e03d15d83cc40b0530a1f84b459354939ba6f135a0086c20ebbe6b2",
+    "zh:1589a2266af699cbd5d80737a0fe02e54ec9cf2ca54e7e00ac51c7359056f274",
+    "zh:6330766f1d85f01ae6ea90d1b214b8b74cc8c1badc4696b165b36ddd4cc15f7b",
+    "zh:7c8c2e30d8e55291b86fcb64bdf6c25489d538688545eb48fd74ad622e5d3862",
+    "zh:99b1003bd9bd32ee323544da897148f46a527f622dc3971af63ea3e251596342",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:9f8b909d3ec50ade83c8062290378b1ec553edef6a447c56dadc01a99f4eaa93",
+    "zh:aaef921ff9aabaf8b1869a86d692ebd24fbd4e12c21205034bb679b9caf883a2",
+    "zh:ac882313207aba00dd5a76dbd572a0ddc818bb9cbf5c9d61b28fe30efaec951e",
+    "zh:bb64e8aff37becab373a1a0cc1080990785304141af42ed6aa3dd4913b000421",
+    "zh:dfe495f6621df5540d9c92ad40b8067376350b005c637ea6efac5dc15028add4",
+    "zh:f0ddf0eaf052766cfe09dea8200a946519f653c384ab4336e2a4a64fdd6310e9",
+    "zh:f1b7e684f4c7ae1eed272b6de7d2049bb87a0275cb04dbb7cda6636f600699c9",
+    "zh:ff461571e3f233699bf690db319dfe46aec75e58726636a0d97dd9ac6e32fb70",
+  ]
+}

package/infra/aws/README.md

@@ -0,0 +1,32 @@
+# Open Uptime AWS Infra
+
+This directory is a reviewable Terraform/OpenTofu starting point for deploying
+Open Uptime in the `hasna-xyz-infra` AWS account. It is intentionally
+plan-first. Do not apply it directly from this app repo unless the infrastructure
+owner has approved this directory as the source of truth or has copied it into
+the approved infra repository.
+
+## Expected Flow
+
+```bash
+terraform -chdir=infra/aws fmt -check
+terraform -chdir=infra/aws init -backend=false
+terraform -chdir=infra/aws validate
+terraform -chdir=infra/aws plan -out open-uptime.tfplan
+```
+
+Required inputs are declared in `variables.tf` and illustrated in
+`terraform.tfvars.example`. Secrets are passed as Secrets Manager/SSM ARNs only;
+never place plaintext tokens, database URLs, private keys, or channel
+credentials in `.tfvars` files.
+
+## Current Blockers
+
+- Hosted Postgres adapter and migrations are not implemented in the app yet.
+- Hosted production auth/RBAC still needs scoped, revocable credentials.
+- Public probe runtime still needs execution-time DNS/redirect/rebinding SSRF
+  enforcement.
+- Spark01 hosted private-probe enrollment/heartbeat/revocation is still
+  fail-closed.
+
+Keep `desired_count` at `0` or plan-only until those blockers are closed.