@intentius/chant-lexicon-aws 0.1.13 → 0.1.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/codegen/versions.ts

@@ -2,6 +2,8 @@
  * Pinned dependency versions for reproducible generation.
  */
 
+import { fetchWithRetry } from "@intentius/chant/codegen/fetch";
+
 export const PINNED_VERSIONS = {
   cfnLint: "v1.32.4",
 } as const;
@@ -22,15 +24,17 @@ export async function checkForUpdates(): Promise<{ cfnLint: { current: string; l
   let latest: string = current;
 
   try {
-    const resp = await fetch("https://api.github.com/repos/aws-cloudformation/cfn-lint/releases/latest", {
-      headers: { Accept: "application/vnd.github.v3+json" },
-    });
-    if (resp.ok) {
-      const data = await resp.json() as { tag_name: string };
-      latest = data.tag_name;
-    }
+    const resp = await fetchWithRetry(
+      "https://api.github.com/repos/aws-cloudformation/cfn-lint/releases/latest",
+      undefined,
+      undefined,
+      { headers: { Accept: "application/vnd.github.v3+json" } },
+    );
+    const data = await resp.json() as { tag_name: string };
+    latest = data.tag_name;
   } catch {
-    // Network failure — return current as latest
+    // Transient failures are retried inside fetchWithRetry; a permanent
+    // failure (or exhausted retries) lands here — return current as latest.
   }
 
   return { cfnLint: { current, latest } };

package/src/composites/fargate-alb.ts

@@ -14,6 +14,8 @@ import {
   TargetGroup,
   Listener,
   Listener_Action,
+  Listener_Certificate,
+  Listener_RedirectConfig,
   SecurityGroup,
   SecurityGroup_Ingress,
   LogGroup,
@@ -27,6 +29,20 @@ import { ecsTrustPolicy } from "./ecs-trust-policy";
 
 export interface FargateAlbProps {
   image: string;
+  /**
+   * Secrets Manager ARN holding private-registry pull credentials
+   * (`{"username","password"}`). Sets the container's `RepositoryCredentials`
+   * and grants the execution role `secretsmanager:GetSecretValue` on it — needed
+   * to pull from a private registry such as GHCR. Omit for public images / ECR.
+   */
+  repositoryCredentials?: string;
+  /**
+   * ACM certificate ARN. When set, the ALB serves HTTPS on 443 with this cert
+   * and the port-80 listener redirects to HTTPS (301). When omitted, the ALB
+   * serves plain HTTP on `listenerPort` (default 80). The cert + any DNS records
+   * are managed outside this composite (region must match the ALB).
+   */
+  certificateArn?: string;
   containerPort?: number;
   cpu?: string;
   memory?: string;
@@ -79,6 +95,14 @@ export const FargateAlb = Composite<FargateAlbProps>((props) => {
         Action: LogsActions.Write,
         Resource: "*",
       },
+      // Allow pulling private-registry credentials when configured.
+      ...(props.repositoryCredentials
+        ? [{
+            Effect: "Allow",
+            Action: ["secretsmanager:GetSecretValue"],
+            Resource: props.repositoryCredentials,
+          }]
+        : []),
     ],
   };
 
@@ -136,6 +160,9 @@ export const FargateAlb = Composite<FargateAlbProps>((props) => {
     LogConfiguration: logConfiguration,
     Environment: environmentVars.length > 0 ? environmentVars : undefined,
     Command: props.command,
+    RepositoryCredentials: props.repositoryCredentials
+      ? { CredentialsParameter: props.repositoryCredentials }
+      : undefined,
   });
 
   // Task definition
@@ -149,18 +176,22 @@ export const FargateAlb = Composite<FargateAlbProps>((props) => {
     ContainerDefinitions: [container],
   }, defs?.taskDef));
 
-  // ALB security group — ingress on listener port from anywhere
-  const albIngress = new SecurityGroup_Ingress({
-    IpProtocol: "tcp",
-    FromPort: listenerPort,
-    ToPort: listenerPort,
-    CidrIp: "0.0.0.0/0",
-  });
+  // ALB security group — ingress on the served port(s) from anywhere. With a
+  // cert that's 443 (HTTPS) + 80 (redirect); otherwise the plain listener port.
+  const ingressPorts = props.certificateArn ? [443, 80] : [listenerPort];
+  const albIngress = ingressPorts.map((port) =>
+    new SecurityGroup_Ingress({
+      IpProtocol: "tcp",
+      FromPort: port,
+      ToPort: port,
+      CidrIp: "0.0.0.0/0",
+    }),
+  );
 
   const albSg = new SecurityGroup({
     GroupDescription: "ALB security group",
     VpcId: props.vpcId,
-    SecurityGroupIngress: [albIngress],
+    SecurityGroupIngress: albIngress,
   });
 
   // Task security group — ingress on container port from ALB SG
@@ -194,18 +225,47 @@ export const FargateAlb = Composite<FargateAlbProps>((props) => {
     HealthCheckPath: healthCheckPath,
   }, defs?.targetGroup));
 
-  // Listener
-  const defaultAction = new Listener_Action({
+  // Listener(s). With a cert: HTTPS:443 forwards to the target group and HTTP:80
+  // redirects to HTTPS. Without: a single HTTP listener on `listenerPort`.
+  const forwardAction = new Listener_Action({
     Type: "forward",
     TargetGroupArn: targetGroup.TargetGroupArn,
   });
 
-  const listener = new Listener({
-    LoadBalancerArn: alb.LoadBalancerArn,
-    Port: listenerPort,
-    Protocol: "HTTP",
-    DefaultActions: [defaultAction],
-  });
+  let listener: InstanceType<typeof Listener>;
+  let redirectListener: InstanceType<typeof Listener> | undefined;
+
+  if (props.certificateArn) {
+    listener = new Listener({
+      LoadBalancerArn: alb.LoadBalancerArn,
+      Port: 443,
+      Protocol: "HTTPS",
+      Certificates: [new Listener_Certificate({ CertificateArn: props.certificateArn })],
+      DefaultActions: [forwardAction],
+    });
+    redirectListener = new Listener({
+      LoadBalancerArn: alb.LoadBalancerArn,
+      Port: 80,
+      Protocol: "HTTP",
+      DefaultActions: [
+        new Listener_Action({
+          Type: "redirect",
+          RedirectConfig: new Listener_RedirectConfig({
+            Protocol: "HTTPS",
+            Port: "443",
+            StatusCode: "HTTP_301",
+          }),
+        }),
+      ],
+    });
+  } else {
+    listener = new Listener({
+      LoadBalancerArn: alb.LoadBalancerArn,
+      Port: listenerPort,
+      Protocol: "HTTP",
+      DefaultActions: [forwardAction],
+    });
+  }
 
   // ECS Service
   const serviceLoadBalancer = new EcsService_LoadBalancer({
@@ -248,6 +308,7 @@ export const FargateAlb = Composite<FargateAlbProps>((props) => {
     alb,
     targetGroup,
     listener,
+    ...(redirectListener ? { redirectListener } : {}),
     service,
   };
 }, "FargateAlb");