@hasna/uptime 0.1.8 → 0.1.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +25 -3
- package/README.md +4 -4
- package/SECURITY.md +4 -2
- package/dist/api.js +104 -47
- package/dist/checks.d.ts +2 -1
- package/dist/checks.d.ts.map +1 -1
- package/dist/checks.js +2 -1
- package/dist/cli/index.js +125 -68
- package/dist/cloud-plan.d.ts +6 -6
- package/dist/cloud-plan.d.ts.map +1 -1
- package/dist/cloud-plan.js +17 -17
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +121 -64
- package/dist/mcp/index.js +92 -37
- package/dist/service.d.ts +33 -9
- package/dist/service.d.ts.map +1 -1
- package/dist/service.js +92 -37
- package/dist/store.d.ts +13 -3
- package/dist/store.d.ts.map +1 -1
- package/dist/store.js +78 -25
- package/dist/types.d.ts +3 -0
- package/dist/types.d.ts.map +1 -1
- package/docs/aws-deployment-runbook.md +229 -14
- package/infra/aws/README.md +12 -1
- package/infra/aws/main.tf +44 -5
- package/infra/aws/terraform.tfvars.example +9 -1
- package/infra/aws/variables.tf +48 -1
- package/package.json +1 -1
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,cAAc,CAAC;AAC1D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,KAAK,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,QAAQ,CAAC;AACjE,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,MAAM,CAAC;AACxC,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE/C,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAC5E,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG;IAC3E,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,GAAG;IACrF,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;AAEhG,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,UAAU,CAAC;AAC1D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,QAAQ,CAAC;AACnD,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE7D,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;IAC3C,GAAG,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IACvC,IAAI,CAAC,EAAE,OAAO,GAAG,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,MAAM,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAE3E,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEhD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,oBAAoB,EAAE,CAAC;IACvC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,EAAE,UAAU,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,QAAQ,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB"}
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,cAAc,CAAC;AAC1D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,KAAK,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,QAAQ,CAAC;AACjE,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,MAAM,CAAC;AACxC,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE/C,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAqB,SAAQ,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAC5E,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG;IAC3E,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,GAAG;IACrF,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;AAEhG,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,UAAU,CAAC;AAC1D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,QAAQ,CAAC;AACnD,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE7D,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAC;IAC3C,GAAG,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IACvC,IAAI,CAAC,EAAE,OAAO,GAAG,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,MAAM,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAE3E,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEhD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,oBAAoB,EAAE,CAAC;IACvC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,EAAE,UAAU,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,QAAQ,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB"}
|
|
@@ -8,7 +8,7 @@ call AWS or mutate infrastructure.
|
|
|
8
8
|
|
|
9
9
|
```bash
|
|
10
10
|
uptime cloud plan --json > open-uptime-aws-plan.json
|
|
11
|
-
uptime cloud
|
|
11
|
+
uptime cloud private-probe-config --probe-id prb_private_01 --machine-id private-probe-01 --env > private-probe-01-uptime.env
|
|
12
12
|
```
|
|
13
13
|
|
|
14
14
|
Public package defaults are placeholders:
|
|
@@ -25,7 +25,7 @@ Override these with CLI flags or private deployment evidence for the real
|
|
|
25
25
|
account, hostname, workspace id, VPC id, secret refs, and repository names.
|
|
26
26
|
|
|
27
27
|
The generated AWS plan currently returns `status: "blocked"` and
|
|
28
|
-
`canApply: false`. The generated
|
|
28
|
+
`canApply: false`. The generated private-probe config returns `status: "blocked"` and
|
|
29
29
|
`canStart: false`. Treat both as review/preflight artifacts until the blockers
|
|
30
30
|
and required evidence in the JSON output are resolved.
|
|
31
31
|
|
|
@@ -33,7 +33,7 @@ The app repo includes a hosted runtime `Dockerfile` and Terraform/OpenTofu
|
|
|
33
33
|
starter files in `infra/aws`. The plan output points to these files and keeps
|
|
34
34
|
`applyAllowed: false`.
|
|
35
35
|
|
|
36
|
-
`uptime cloud
|
|
36
|
+
`uptime cloud private-probe-config --env` requires a real `--probe-id`; it will not
|
|
37
37
|
write a sourceable env file with a placeholder probe identity.
|
|
38
38
|
|
|
39
39
|
## Preflight
|
|
@@ -53,6 +53,9 @@ write a sourceable env file with a placeholder probe identity.
|
|
|
53
53
|
require Route53/edge ownership and an ACM certificate.
|
|
54
54
|
5. Confirm the deployment role uses short-lived credentials or OIDC, not copied
|
|
55
55
|
access keys.
|
|
56
|
+
6. Create a private evidence directory outside the public repository. Store
|
|
57
|
+
command output, plan summaries, screenshots, and incident notes there. Do
|
|
58
|
+
not store tokens, database URLs, probe private keys, or secret values.
|
|
56
59
|
|
|
57
60
|
## Required Resources
|
|
58
61
|
|
|
@@ -89,12 +92,170 @@ terraform -chdir=infra/aws plan -out open-uptime.tfplan
|
|
|
89
92
|
|
|
90
93
|
Use Terraform/OpenTofu 1.9 or newer for this starter.
|
|
91
94
|
|
|
92
|
-
##
|
|
95
|
+
## Zero-Count Apply
|
|
93
96
|
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
97
|
+
The first reviewed apply must create infrastructure with every ECS service at
|
|
98
|
+
desired count `0`.
|
|
99
|
+
|
|
100
|
+
1. Confirm the plan has no deletes or replacements and that all ECS services are
|
|
101
|
+
dormant:
|
|
102
|
+
|
|
103
|
+
```bash
|
|
104
|
+
terraform show -json open-uptime.tfplan \
|
|
105
|
+
| jq -r '.resource_changes[] | select(.type=="aws_ecs_service") | [.address, .change.after.desired_count] | @tsv'
|
|
106
|
+
```
|
|
107
|
+
|
|
108
|
+
2. Confirm Terraform is not managing secret values:
|
|
109
|
+
|
|
110
|
+
```bash
|
|
111
|
+
terraform show -json open-uptime.tfplan \
|
|
112
|
+
| jq -r '.resource_changes[] | select(.type | test("secret_version|random_password|random_string")) | .address'
|
|
113
|
+
```
|
|
114
|
+
|
|
115
|
+
This command must print nothing.
|
|
116
|
+
|
|
117
|
+
3. Apply only the reviewed zero-count plan:
|
|
118
|
+
|
|
119
|
+
```bash
|
|
120
|
+
terraform apply open-uptime.tfplan
|
|
121
|
+
```
|
|
122
|
+
|
|
123
|
+
4. Capture outputs, the source commit, the package version, the plan summary,
|
|
124
|
+
and the caller identity in private deployment evidence.
|
|
125
|
+
|
|
126
|
+
## Image And Secrets
|
|
127
|
+
|
|
128
|
+
After the zero-count apply, build the image through the approved deploy pipeline
|
|
129
|
+
or the declared image builder. Record only the immutable digest, not build logs
|
|
130
|
+
that contain environment values:
|
|
131
|
+
|
|
132
|
+
```bash
|
|
133
|
+
aws codebuild start-build \
|
|
134
|
+
--profile <aws-profile> \
|
|
135
|
+
--region <region> \
|
|
136
|
+
--project-name <image-builder-project>
|
|
137
|
+
```
|
|
138
|
+
|
|
139
|
+
Update the approved infra root so `container_image` is the immutable ECR digest,
|
|
140
|
+
then re-plan with all services still at `0`.
|
|
141
|
+
|
|
142
|
+
Populate Secrets Manager values out of band. Verify metadata only:
|
|
143
|
+
|
|
144
|
+
```bash
|
|
145
|
+
aws secretsmanager describe-secret --profile <aws-profile> --region <region> --secret-id <secret-name>
|
|
146
|
+
aws secretsmanager list-secret-version-ids --profile <aws-profile> --region <region> --secret-id <secret-name>
|
|
147
|
+
```
|
|
148
|
+
|
|
149
|
+
Each required secret must have an `AWSCURRENT` version before any task is
|
|
150
|
+
started. Never run `get-secret-value` in shared logs or public evidence.
|
|
151
|
+
|
|
152
|
+
## Protected Web Scale-Up
|
|
153
|
+
|
|
154
|
+
Before setting `desired_counts.web = 1`, verify:
|
|
155
|
+
|
|
156
|
+
- the image is an immutable digest, not a mutable tag or placeholder;
|
|
157
|
+
- required secrets have `AWSCURRENT` versions;
|
|
158
|
+
- `HASNA_UPTIME_ALLOWED_ORIGINS` matches the public HTTPS edge origin;
|
|
159
|
+
- CloudFront origin access is distribution-bound, not just narrowed to
|
|
160
|
+
CloudFront origin-facing ranges;
|
|
161
|
+
- web egress to ECR, Secrets Manager, CloudWatch Logs, S3, EFS, and any required
|
|
162
|
+
endpoints has been proven through NAT or VPC endpoints;
|
|
163
|
+
- scheduler, public-probe, reporter, and migration remain at `0`.
|
|
164
|
+
|
|
165
|
+
Scale only the web task, then capture the ECS deployment id and task definition
|
|
166
|
+
ARN:
|
|
167
|
+
|
|
168
|
+
```bash
|
|
169
|
+
aws ecs describe-services \
|
|
170
|
+
--profile <aws-profile> \
|
|
171
|
+
--region <region> \
|
|
172
|
+
--cluster <ecs-cluster> \
|
|
173
|
+
--services <web-service> \
|
|
174
|
+
--query 'services[0].{taskDefinition:taskDefinition,deployments:deployments[*].{id:id,status:status,desired:desiredCount,running:runningCount}}'
|
|
175
|
+
```
|
|
176
|
+
|
|
177
|
+
## Smoke Checks
|
|
178
|
+
|
|
179
|
+
Run these checks through the public edge URL and record status codes and request
|
|
180
|
+
ids. Use a scoped hosted token only from the operator secret store.
|
|
181
|
+
|
|
182
|
+
```bash
|
|
183
|
+
curl -fsS https://<edge-host>/health
|
|
184
|
+
curl -i https://<edge-host>/
|
|
185
|
+
curl -i https://<edge-host>/api/v1/summary
|
|
186
|
+
curl -i -H "Authorization: Bearer <token-from-secret-store>" https://<edge-host>/api/v1/summary
|
|
187
|
+
```
|
|
188
|
+
|
|
189
|
+
Expected results:
|
|
190
|
+
|
|
191
|
+
- `/health` returns `200` and no monitor data.
|
|
192
|
+
- Dashboard and API reads without auth return `401` or the approved identity
|
|
193
|
+
layer denial.
|
|
194
|
+
- Authenticated API reads return only the authorized workspace.
|
|
195
|
+
- Direct ALB origin access is denied unless it is the approved CloudFront origin
|
|
196
|
+
path.
|
|
197
|
+
|
|
198
|
+
## Logs And Alarms
|
|
199
|
+
|
|
200
|
+
Inspect recent web logs without printing secrets:
|
|
201
|
+
|
|
202
|
+
```bash
|
|
203
|
+
aws logs tail /ecs/<web-service> \
|
|
204
|
+
--profile <aws-profile> \
|
|
205
|
+
--region <region> \
|
|
206
|
+
--since 15m
|
|
207
|
+
```
|
|
208
|
+
|
|
209
|
+
Verify the initial web alarms exist and are not already alarming:
|
|
210
|
+
|
|
211
|
+
```bash
|
|
212
|
+
aws cloudwatch describe-alarms \
|
|
213
|
+
--profile <aws-profile> \
|
|
214
|
+
--region <region> \
|
|
215
|
+
--alarm-names <web-5xx-alarm> <web-unhealthy-alarm> \
|
|
216
|
+
--query 'MetricAlarms[*].{name:AlarmName,state:StateValue,reason:StateReason}'
|
|
217
|
+
```
|
|
218
|
+
|
|
219
|
+
Scheduler-stall, stale-probe, and report-delivery alarms stay blocked until
|
|
220
|
+
those workers are implemented, emit metrics, and are enabled.
|
|
221
|
+
|
|
222
|
+
## Backups And Restore Evidence
|
|
223
|
+
|
|
224
|
+
Verify EFS backup coverage after the first apply:
|
|
225
|
+
|
|
226
|
+
```bash
|
|
227
|
+
aws backup list-protected-resources \
|
|
228
|
+
--profile <aws-profile> \
|
|
229
|
+
--region <region> \
|
|
230
|
+
--query 'Results[?ResourceType==`EFS`].[ResourceArn,LastBackupTime]'
|
|
231
|
+
aws backup list-recovery-points-by-backup-vault \
|
|
232
|
+
--profile <aws-profile> \
|
|
233
|
+
--region <region> \
|
|
234
|
+
--backup-vault-name <backup-vault>
|
|
235
|
+
```
|
|
236
|
+
|
|
237
|
+
A restore drill must restore to a separate file system or staging target first.
|
|
238
|
+
Do not overwrite the production EFS file system during a drill. Record the
|
|
239
|
+
recovery point ARN, restore job id, target resource, validation result, and
|
|
240
|
+
cleanup action.
|
|
241
|
+
|
|
242
|
+
## Reports And Reporter Gate
|
|
243
|
+
|
|
244
|
+
Report preview can be tested locally or through authenticated read APIs. Hosted
|
|
245
|
+
delivery attempts through Mailery, Telephony, or Open Logs must stay disabled
|
|
246
|
+
until the reporter has cloud channel refs, idempotency storage, retry/backoff
|
|
247
|
+
state, audit rows, and delivery alarms.
|
|
248
|
+
|
|
249
|
+
Do not set `desired_counts.reporter = 1` until a reviewed runbook section exists
|
|
250
|
+
for report retry, duplicate suppression, provider failure handling, and delivery
|
|
251
|
+
audit export.
|
|
252
|
+
|
|
253
|
+
## Private Probe Operator
|
|
254
|
+
|
|
255
|
+
The operator machine should be a private probe/operator machine, not the hosted
|
|
256
|
+
source of truth. The generated env file points the machine at hosted `/api/v1`
|
|
257
|
+
state and references a local private-key file path. It does not include private
|
|
258
|
+
key or token contents.
|
|
98
259
|
|
|
99
260
|
The private probe service should not be enabled until hosted probe claim/submit
|
|
100
261
|
routes are backed by cloud check jobs and cloud audit rows.
|
|
@@ -117,13 +278,67 @@ routes are backed by cloud check jobs and cloud audit rows.
|
|
|
117
278
|
- Do not expose dashboard/API routes without hosted auth and workspace checks.
|
|
118
279
|
- Do not expose the ALB directly in CloudFront mode; ALB ingress must be limited
|
|
119
280
|
to CloudFront origin-facing ranges.
|
|
120
|
-
- Do not treat
|
|
281
|
+
- Do not treat CloudFront prefix-list ingress as distribution-bound origin
|
|
282
|
+
protection. Before enabling the web task, add CloudFront VPC origin/private
|
|
283
|
+
ALB routing or require a CloudFront-only origin header whose secret value is
|
|
284
|
+
not stored in Terraform state.
|
|
285
|
+
- Do not treat local SQLite, local project DBs, or private-probe local state as cloud
|
|
121
286
|
authority after cutover.
|
|
287
|
+
- Do configure owner/project/environment/service/cost-center tags and AWS
|
|
288
|
+
Budgets alert recipients in the approved infra root before live scale-out.
|
|
122
289
|
|
|
123
290
|
## Rollback
|
|
124
291
|
|
|
125
|
-
Before each service update, record the previous task definition ARN
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
292
|
+
Before each service update, record the previous task definition ARN and current
|
|
293
|
+
desired counts:
|
|
294
|
+
|
|
295
|
+
```bash
|
|
296
|
+
aws ecs describe-services \
|
|
297
|
+
--profile <aws-profile> \
|
|
298
|
+
--region <region> \
|
|
299
|
+
--cluster <ecs-cluster> \
|
|
300
|
+
--services <service-name> \
|
|
301
|
+
--query 'services[0].{taskDefinition:taskDefinition,desired:desiredCount,running:runningCount}'
|
|
302
|
+
```
|
|
303
|
+
|
|
304
|
+
If web health fails after scale-up, first scale web back to `0`:
|
|
305
|
+
|
|
306
|
+
```bash
|
|
307
|
+
aws ecs update-service \
|
|
308
|
+
--profile <aws-profile> \
|
|
309
|
+
--region <region> \
|
|
310
|
+
--cluster <ecs-cluster> \
|
|
311
|
+
--service <web-service> \
|
|
312
|
+
--desired-count 0
|
|
313
|
+
```
|
|
314
|
+
|
|
315
|
+
If a later task definition is bad, restore the previous task definition and keep
|
|
316
|
+
workers disabled:
|
|
317
|
+
|
|
318
|
+
```bash
|
|
319
|
+
aws ecs update-service \
|
|
320
|
+
--profile <aws-profile> \
|
|
321
|
+
--region <region> \
|
|
322
|
+
--cluster <ecs-cluster> \
|
|
323
|
+
--service <web-service> \
|
|
324
|
+
--task-definition <previous-task-definition-arn> \
|
|
325
|
+
--desired-count 1
|
|
326
|
+
```
|
|
327
|
+
|
|
328
|
+
Disable scheduler/reporter/probe work before data rollback. EFS backup restore
|
|
329
|
+
requires separate operator approval, a selected recovery point, a replacement
|
|
330
|
+
mount target/access point cutover, validation in staging, and an audit event.
|
|
331
|
+
|
|
332
|
+
## Evidence Checklist
|
|
333
|
+
|
|
334
|
+
A deployment record is not complete until it contains:
|
|
335
|
+
|
|
336
|
+
- source commit, package version, published package integrity, and image digest;
|
|
337
|
+
- Terraform plan summary and zero-count desired-count proof;
|
|
338
|
+
- secret metadata proof showing `AWSCURRENT` without secret values;
|
|
339
|
+
- protected edge smoke results and direct-origin denial evidence;
|
|
340
|
+
- ECS service/task definition evidence;
|
|
341
|
+
- CloudWatch log tail and alarm-state readback;
|
|
342
|
+
- backup vault, protected-resource, recovery-point, and restore-drill evidence;
|
|
343
|
+
- rollback command transcript or dry-run notes;
|
|
344
|
+
- explicit list of remaining disabled workers and why they remain disabled.
|
package/infra/aws/README.md
CHANGED
|
@@ -41,12 +41,23 @@ The web task receives `HASNA_UPTIME_ALLOWED_ORIGINS` for the selected public
|
|
|
41
41
|
HTTPS origin so hosted mutation CSRF checks still work through the private HTTP
|
|
42
42
|
origin hop.
|
|
43
43
|
|
|
44
|
+
CloudFront prefix-list ingress is only a network narrowing control; it is not
|
|
45
|
+
bound to one distribution. Add CloudFront VPC origin/private ALB routing or an
|
|
46
|
+
ALB origin-header rule with the secret value managed outside Terraform state
|
|
47
|
+
before enabling the web task.
|
|
48
|
+
|
|
49
|
+
All module resources carry owner, project, environment, service, account, app
|
|
50
|
+
type, and cost-center tags. Set `monthly_budget_limit_usd` plus
|
|
51
|
+
`budget_alert_email_addresses` in the approved infra root to create AWS Budgets
|
|
52
|
+
forecasted and actual spend alerts. Leaving the email list empty skips budget
|
|
53
|
+
creation and is not sufficient for live scale-out approval.
|
|
54
|
+
|
|
44
55
|
## Current Blockers
|
|
45
56
|
|
|
46
57
|
- Hosted production auth/RBAC still needs scoped, revocable credentials.
|
|
47
58
|
- Public probe runtime still needs execution-time DNS/redirect/rebinding SSRF
|
|
48
59
|
enforcement.
|
|
49
|
-
-
|
|
60
|
+
- Hosted private-probe enrollment/heartbeat/revocation is still
|
|
50
61
|
fail-closed.
|
|
51
62
|
|
|
52
63
|
Keep `desired_count` at `0`, or at `1` for the protected web bridge only after
|
package/infra/aws/main.tf
CHANGED
|
@@ -53,10 +53,15 @@ locals {
|
|
|
53
53
|
}
|
|
54
54
|
}
|
|
55
55
|
tags = {
|
|
56
|
-
ManagedBy
|
|
57
|
-
Service
|
|
58
|
-
|
|
59
|
-
|
|
56
|
+
ManagedBy = "terraform"
|
|
57
|
+
Service = var.service_name
|
|
58
|
+
Project = var.project_name
|
|
59
|
+
Stage = var.stage
|
|
60
|
+
Environment = var.environment
|
|
61
|
+
Account = var.account_name
|
|
62
|
+
Owner = var.owner
|
|
63
|
+
AppType = var.app_type
|
|
64
|
+
CostCenter = var.cost_center
|
|
60
65
|
}
|
|
61
66
|
}
|
|
62
67
|
|
|
@@ -436,7 +441,7 @@ resource "aws_efs_access_point" "uptime" {
|
|
|
436
441
|
}
|
|
437
442
|
|
|
438
443
|
resource "aws_efs_mount_target" "data" {
|
|
439
|
-
for_each =
|
|
444
|
+
for_each = { for index, subnet_id in var.private_subnet_ids : tostring(index) => subnet_id }
|
|
440
445
|
file_system_id = aws_efs_file_system.data.id
|
|
441
446
|
subnet_id = each.value
|
|
442
447
|
security_groups = [aws_security_group.efs.id]
|
|
@@ -529,6 +534,7 @@ resource "aws_lb_listener" "https" {
|
|
|
529
534
|
port = 443
|
|
530
535
|
protocol = "HTTPS"
|
|
531
536
|
certificate_arn = var.certificate_arn
|
|
537
|
+
tags = local.tags
|
|
532
538
|
|
|
533
539
|
default_action {
|
|
534
540
|
type = "forward"
|
|
@@ -541,6 +547,7 @@ resource "aws_lb_listener" "http_cloudfront" {
|
|
|
541
547
|
load_balancer_arn = aws_lb.open_uptime.arn
|
|
542
548
|
port = 80
|
|
543
549
|
protocol = "HTTP"
|
|
550
|
+
tags = local.tags
|
|
544
551
|
|
|
545
552
|
default_action {
|
|
546
553
|
type = "forward"
|
|
@@ -882,3 +889,35 @@ resource "aws_cloudwatch_metric_alarm" "web_unhealthy" {
|
|
|
882
889
|
TargetGroup = aws_lb_target_group.web.arn_suffix
|
|
883
890
|
}
|
|
884
891
|
}
|
|
892
|
+
|
|
893
|
+
resource "aws_budgets_budget" "monthly" {
|
|
894
|
+
count = var.monthly_budget_limit_usd > 0 && length(var.budget_alert_email_addresses) > 0 ? 1 : 0
|
|
895
|
+
name = "${local.prefix}-monthly-budget"
|
|
896
|
+
budget_type = "COST"
|
|
897
|
+
limit_amount = format("%.2f", var.monthly_budget_limit_usd)
|
|
898
|
+
limit_unit = "USD"
|
|
899
|
+
time_unit = "MONTHLY"
|
|
900
|
+
|
|
901
|
+
cost_filter {
|
|
902
|
+
name = "TagKeyValue"
|
|
903
|
+
values = [format("user:Service$%s", var.service_name)]
|
|
904
|
+
}
|
|
905
|
+
|
|
906
|
+
notification {
|
|
907
|
+
comparison_operator = "GREATER_THAN"
|
|
908
|
+
notification_type = "FORECASTED"
|
|
909
|
+
threshold = 80
|
|
910
|
+
threshold_type = "PERCENTAGE"
|
|
911
|
+
subscriber_email_addresses = var.budget_alert_email_addresses
|
|
912
|
+
}
|
|
913
|
+
|
|
914
|
+
notification {
|
|
915
|
+
comparison_operator = "GREATER_THAN"
|
|
916
|
+
notification_type = "ACTUAL"
|
|
917
|
+
threshold = 100
|
|
918
|
+
threshold_type = "PERCENTAGE"
|
|
919
|
+
subscriber_email_addresses = var.budget_alert_email_addresses
|
|
920
|
+
}
|
|
921
|
+
|
|
922
|
+
tags = local.tags
|
|
923
|
+
}
|
|
@@ -1,6 +1,11 @@
|
|
|
1
1
|
region = "us-east-1"
|
|
2
2
|
stage = "prod"
|
|
3
3
|
service_name = "open-uptime"
|
|
4
|
+
project_name = "open-uptime"
|
|
5
|
+
owner = "hasna"
|
|
6
|
+
app_type = "opensource"
|
|
7
|
+
environment = "prod"
|
|
8
|
+
cost_center = "opensource"
|
|
4
9
|
hostname = "uptime.example.com"
|
|
5
10
|
workspace_id = "workspace-id"
|
|
6
11
|
vpc_id = "vpc-xxxxxxxx"
|
|
@@ -10,7 +15,7 @@ public_subnet_ids = ["subnet-replace-public-a", "subnet-replace-public-b"
|
|
|
10
15
|
alb_ingress_cidr_blocks = []
|
|
11
16
|
private_subnet_ids = ["subnet-replace-private-a", "subnet-replace-private-b"]
|
|
12
17
|
container_image = "123456789012.dkr.ecr.us-east-1.amazonaws.com/open-uptime@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
|
13
|
-
runtime_package_version = "0.1.
|
|
18
|
+
runtime_package_version = "0.1.10"
|
|
14
19
|
certificate_arn = null
|
|
15
20
|
hosted_zone_id = null
|
|
16
21
|
app_env_secret_arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:open-uptime/prod/app/env"
|
|
@@ -19,6 +24,7 @@ public_probe_secret_arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret
|
|
|
19
24
|
reporting_secret_arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:open-uptime/prod/reporting"
|
|
20
25
|
kms_key_arn = "arn:aws:kms:us-east-1:123456789012:key/00000000-0000-0000-0000-000000000000"
|
|
21
26
|
alarm_actions = []
|
|
27
|
+
monthly_budget_limit_usd = 0
|
|
22
28
|
|
|
23
29
|
desired_counts = {
|
|
24
30
|
web = 0
|
|
@@ -27,3 +33,5 @@ desired_counts = {
|
|
|
27
33
|
reporter = 0
|
|
28
34
|
migration = 0
|
|
29
35
|
}
|
|
36
|
+
|
|
37
|
+
budget_alert_email_addresses = []
|
package/infra/aws/variables.tf
CHANGED
|
@@ -22,6 +22,36 @@ variable "service_name" {
|
|
|
22
22
|
default = "open-uptime"
|
|
23
23
|
}
|
|
24
24
|
|
|
25
|
+
variable "project_name" {
|
|
26
|
+
description = "Project tag value for cost allocation."
|
|
27
|
+
type = string
|
|
28
|
+
default = "open-uptime"
|
|
29
|
+
}
|
|
30
|
+
|
|
31
|
+
variable "owner" {
|
|
32
|
+
description = "Owner tag value for cost allocation and operations."
|
|
33
|
+
type = string
|
|
34
|
+
default = "hasna"
|
|
35
|
+
}
|
|
36
|
+
|
|
37
|
+
variable "app_type" {
|
|
38
|
+
description = "AppType tag value."
|
|
39
|
+
type = string
|
|
40
|
+
default = "opensource"
|
|
41
|
+
}
|
|
42
|
+
|
|
43
|
+
variable "environment" {
|
|
44
|
+
description = "Environment tag value."
|
|
45
|
+
type = string
|
|
46
|
+
default = "prod"
|
|
47
|
+
}
|
|
48
|
+
|
|
49
|
+
variable "cost_center" {
|
|
50
|
+
description = "CostCenter tag value."
|
|
51
|
+
type = string
|
|
52
|
+
default = "opensource"
|
|
53
|
+
}
|
|
54
|
+
|
|
25
55
|
variable "hostname" {
|
|
26
56
|
description = "Public/internal hostname for Open Uptime."
|
|
27
57
|
type = string
|
|
@@ -86,7 +116,7 @@ variable "container_image" {
|
|
|
86
116
|
variable "runtime_package_version" {
|
|
87
117
|
description = "Published @hasna/uptime package version that CodeBuild should build into the ECR image."
|
|
88
118
|
type = string
|
|
89
|
-
default = "0.1.
|
|
119
|
+
default = "0.1.10"
|
|
90
120
|
|
|
91
121
|
validation {
|
|
92
122
|
condition = can(regex("^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$", var.runtime_package_version))
|
|
@@ -190,3 +220,20 @@ variable "alarm_actions" {
|
|
|
190
220
|
type = list(string)
|
|
191
221
|
default = []
|
|
192
222
|
}
|
|
223
|
+
|
|
224
|
+
variable "monthly_budget_limit_usd" {
|
|
225
|
+
description = "Optional monthly AWS Budgets limit in USD. Set with budget_alert_email_addresses to create a budget alert."
|
|
226
|
+
type = number
|
|
227
|
+
default = 0
|
|
228
|
+
|
|
229
|
+
validation {
|
|
230
|
+
condition = var.monthly_budget_limit_usd >= 0
|
|
231
|
+
error_message = "monthly_budget_limit_usd must be non-negative."
|
|
232
|
+
}
|
|
233
|
+
}
|
|
234
|
+
|
|
235
|
+
variable "budget_alert_email_addresses" {
|
|
236
|
+
description = "Email recipients for AWS Budgets forecasted and actual alerts. Leave empty to skip budget creation."
|
|
237
|
+
type = list(string)
|
|
238
|
+
default = []
|
|
239
|
+
}
|
package/package.json
CHANGED