@mp-lb/arcnet 0.0.0-stage → 0.1.0

package/src/validateConfig.ts

@@ -0,0 +1,22 @@
+import { fail } from "./fail.js";
+import { safePath } from "./safePath.js";
+import type { VercelConfig } from "./schemas.js";
+import { vercelConfigSchema } from "./schemas.js";
+
+export const validateConfig = (input: unknown, root: string): VercelConfig => {
+  const config = vercelConfigSchema.parse(input);
+  const identities = new Set<string>();
+
+  for (const site of Object.values(config.sites)) {
+    for (const id of [site.projectId, site.projectName].filter(
+      (id): id is string => Boolean(id),
+    )) {
+      if (identities.has(id)) fail("Duplicate Vercel project selection.");
+      identities.add(id);
+    }
+
+    safePath(root, site.output);
+  }
+
+  return config;
+};

package/templates/deploy-arc.yaml

@@ -0,0 +1,73 @@
+name: Deploy ArcNet project
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: arcnet-production
+  cancel-in-progress: false
+jobs:
+  configuration:
+    runs-on: ubuntu-latest
+    outputs:
+      approved: ${{ steps.config.outputs.approved }}
+      provider: ${{ steps.config.outputs.provider }}
+      account: ${{ steps.config.outputs.account }}
+      registry: ${{ steps.config.outputs.registry }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          package_json_file: package.json
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm exec arcnet check
+      - id: config
+        run: pnpm exec arcnet ci
+
+  deploy:
+    needs: configuration
+    if: needs.configuration.outputs.approved == 'true' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    environment: arcnet-production
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          package_json_file: package.json
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: pnpm install --frozen-lockfile
+      - uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ needs.configuration.outputs.provider }}
+          service_account: ${{ needs.configuration.outputs.account }}
+      - uses: google-github-actions/setup-gcloud@v2
+      - run: gcloud auth configure-docker "$REGISTRY" --quiet
+        env:
+          REGISTRY: ${{ needs.configuration.outputs.registry }}
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.15.6
+          terraform_wrapper: false
+      - name: Deploy selected services
+        run: pnpm exec arcnet deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          VERCEL_API_TOKEN: ${{ secrets.VERCEL_API_TOKEN }}
+          UPSTASH_EMAIL: ${{ secrets.UPSTASH_EMAIL }}
+          UPSTASH_API_KEY: ${{ secrets.UPSTASH_API_KEY }}
+          MONGODB_ATLAS_PUBLIC_KEY: ${{ secrets.MONGODB_ATLAS_PUBLIC_KEY }}
+          MONGODB_ATLAS_PRIVATE_KEY: ${{ secrets.MONGODB_ATLAS_PRIVATE_KEY }}
+          ARC_AWS_ACCESS_KEY_ID: ${{ secrets.ARC_AWS_ACCESS_KEY_ID }}
+          ARC_AWS_SECRET_ACCESS_KEY: ${{ secrets.ARC_AWS_SECRET_ACCESS_KEY }}
+          ARCNET_ENV_JSON: ${{ secrets.ARCNET_ENV_JSON }}

package/templates/deploy-vercel.yaml

@@ -0,0 +1,43 @@
+name: Deploy ArcNet static sites
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: arcnet-vercel-production
+  cancel-in-progress: false
+jobs:
+  configuration:
+    runs-on: ubuntu-latest
+    outputs:
+      approved: ${{ steps.config.outputs.approved }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - uses: pnpm/action-setup@v4
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm exec arcnet check
+      - id: config
+        run: pnpm exec arcnet ci
+
+  deploy:
+    needs: configuration
+    if: needs.configuration.outputs.approved == 'true' && github.ref == 'refs/heads/main'
+    environment: arcnet-production
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - uses: pnpm/action-setup@v4
+      - run: pnpm install --frozen-lockfile
+      - name: Deploy referenced static sites
+        run: pnpm exec arcnet deploy
+        env:
+          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}

package/templates/network.yaml

@@ -0,0 +1,105 @@
+# Shared network template. Private identifiers are placeholders; operator credentials remain outside Git.
+name: mp-lb
+
+# Template vars. gcp-project encodes our convention: one GCP project per code
+# project, mp-lb-<slug> — the per-project inventory, drift and teardown unit.
+region: asia-southeast1
+# AWS region for aws-s3 buckets — matches the legacy manual bucket's region.
+aws-region: ap-southeast-1
+gcp-project: arcnet-{slug}
+network-project: mp-lb-arcnet
+billing-account: REPLACE_BILLING_ACCOUNT
+
+dns:
+  zone: mp-lb.dev
+
+env:
+  resolver: dx decrypt --file docs/secrets.json.enc
+  public-file: .env.production
+
+backend:
+  gcs:
+    bucket: mp-lb-arcnet-terraform-state
+    prefix: terraform/state/{slug}
+
+# Image template; arc appends /<service>:<tag>.
+registry: "{region}-docker.pkg.dev/{gcp-project}/{slug}"
+
+providers:
+  google:
+    source: hashicorp/google
+    version: "~> 5.0"
+    config:
+      project: "{gcp-project}"
+      region: "{region}"
+      # Stamped on every label-supporting resource — the cross-check on top
+      # of the per-project boundary.
+      default_labels:
+        source: arcnet
+        project: "{slug}"
+      # Send the project as quota project on API requests — required by some
+      # APIs (e.g. billingbudgets) when authenticating with user ADC.
+      user_project_override: true
+      # Quota project must always exist — the per-project one doesn't yet
+      # during its own creation. The network project is the stable home.
+      billing_project: "{network-project}"
+  cloudflare:
+    source: cloudflare/cloudflare
+    version: "~> 4.0"
+    config:
+      api_token: "{{cred.CLOUDFLARE_API_TOKEN}}"
+  vercel:
+    source: vercel/vercel
+    version: "~> 1.0"
+    config:
+      api_token: "{{cred.VERCEL_API_TOKEN}}"
+  upstash:
+    source: upstash/upstash
+    version: "~> 1.0"
+    config:
+      email: "{{cred.UPSTASH_EMAIL}}"
+      api_key: "{{cred.UPSTASH_API_KEY}}"
+  mongodbatlas:
+    source: mongodb/mongodbatlas
+    version: "~> 1.0"
+    config:
+      public_key: "{{cred.MONGODB_ATLAS_PUBLIC_KEY}}"
+      private_key: "{{cred.MONGODB_ATLAS_PRIVATE_KEY}}"
+  aws:
+    source: hashicorp/aws
+    version: "~> 5.0"
+    config:
+      region: "{aws-region}"
+      default_tags:
+        tags:
+          source: arcnet
+          project: "{slug}"
+      # Optional static operator keys; unset renders empty and the provider
+      # falls back to ambient AWS config (profile/SSO).
+      access_key: "{{cred.ARC_AWS_ACCESS_KEY_ID}}"
+      secret_key: "{{cred.ARC_AWS_SECRET_ACCESS_KEY}}"
+
+# Network facts each module needs; merged under the deploy block's params.
+module-defaults:
+  github-ci:
+    gcp-project-id: "{gcp-project}"
+    state-bucket: mp-lb-arcnet-terraform-state
+    network-project: "{network-project}"
+    billing-account: "{billing-account}"
+  gcp-project:
+    project-id: "{gcp-project}"
+    billing-account: "{billing-account}"
+  gcp-budget:
+    billing-account: "{billing-account}"
+    gcp-project: "{gcp-project}"
+    currency: AUD # the billing account's currency
+  project-base:
+    region: "{region}"
+  cloud-run-web:
+    gcp-project-id: "{gcp-project}"
+    region: "{region}"
+  gce-worker:
+    region: "{region}"
+  shared-mongo-atlas:
+    atlas-project-id: "REPLACE_ATLAS_PROJECT_ID"
+    cluster-host: REPLACE_ATLAS_CLUSTER_HOST

package/templates/vercel-static/main.tf

@@ -0,0 +1,128 @@
+# A Vercel-hosted static frontend with a custom domain + Cloudflare DNS.
+# The actual upload (vercel deploy of the built output) is this module's
+# post-apply hook (see module.yaml), using the project id output.
+
+terraform {
+  required_providers {
+    vercel = {
+      source  = "vercel/vercel"
+      version = "~> 1.0"
+    }
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 4.0"
+    }
+  }
+}
+
+variable "name" {
+  type = string
+}
+
+variable "domain" {
+  type = string
+}
+
+# Cloudflare zone name (passed by arc alongside domain); the module does its
+# own zone lookup and apex detection.
+variable "dns_zone" {
+  type = string
+}
+
+variable "www_redirect" {
+  description = "Also register www.<domain> redirecting to <domain>; default: only for the zone apex"
+  type        = bool
+  default     = null
+  nullable    = true
+}
+
+variable "framework" {
+  description = "Vercel framework preset (e.g. nextjs); null = static upload"
+  type        = string
+  default     = null
+}
+
+# The service's resolved deploy env (arc passes it because module.yaml sets
+# service-env). Set on the project so server-side (request-time) code gets it;
+# the build still gets it separately via the upload hook's ARC_SERVICE_ENV.
+variable "env" {
+  type      = map(string)
+  default   = {}
+  sensitive = true
+}
+
+variable "root_directory" {
+  description = "Monorepo subdirectory Vercel builds from (framework projects)"
+  type        = string
+  default     = null
+}
+
+data "cloudflare_zone" "main" {
+  name = var.dns_zone
+}
+
+locals {
+  is_apex      = var.domain == var.dns_zone
+  www_redirect = coalesce(var.www_redirect, local.is_apex)
+}
+
+resource "vercel_project" "main" {
+  name             = var.name
+  framework        = var.framework
+  root_directory   = var.root_directory
+  build_command    = null
+  output_directory = null
+}
+
+# One resource per var keeps plans readable and diffs per-var. Keys aren't
+# secret — unwrap them for for_each (resource-level for_each can't iterate a
+# sensitive value); the values stay sensitive.
+resource "vercel_project_environment_variable" "env" {
+  for_each   = nonsensitive(toset(keys(var.env)))
+  project_id = vercel_project.main.id
+  key        = each.key
+  value      = var.env[each.key]
+  target     = ["production"]
+  sensitive  = true
+}
+
+resource "vercel_project_domain" "main" {
+  project_id = vercel_project.main.id
+  domain     = var.domain
+}
+
+resource "vercel_project_domain" "www" {
+  count                = local.www_redirect ? 1 : 0
+  project_id           = vercel_project.main.id
+  domain               = "www.${var.domain}"
+  redirect             = var.domain
+  redirect_status_code = 308
+
+  depends_on = [vercel_project_domain.main]
+}
+
+# Apex domains can't CNAME; Vercel publishes a stable A record for them.
+resource "cloudflare_record" "main" {
+  allow_overwrite = true
+  zone_id = data.cloudflare_zone.main.id
+  name    = var.domain
+  content = local.is_apex ? "76.76.21.21" : "cname.vercel-dns.com"
+  type    = local.is_apex ? "A" : "CNAME"
+  proxied = false
+  ttl     = 1
+}
+
+resource "cloudflare_record" "www" {
+  allow_overwrite = true
+  count   = local.www_redirect ? 1 : 0
+  zone_id = data.cloudflare_zone.main.id
+  name    = "www.${var.domain}"
+  content = "cname.vercel-dns.com"
+  type    = "CNAME"
+  proxied = false
+  ttl     = 1
+}
+
+output "project_id" {
+  value = vercel_project.main.id
+}

package/templates/vercel-static/module.yaml

@@ -0,0 +1,51 @@
+# From @mp-lb/zapper 0.21.0; only change: pin Vercel CLI 63.1.2.
+# vercel-static: Terraform owns the Vercel project + DNS; the upload itself
+# is a post-apply hook. Reserved service params it reads: build (optional
+# local build command, run with the service's deploy env), deploy-path (what
+# to upload), local-config (vercel.json path), remote-build (framework
+# projects: build via Vercel's CLI and upload only the build output —
+# uploading the whole monorepo for a remote build overwhelms Vercel's
+# files API).
+defaults:
+  name: "{slug}-{service}-arc"
+# Receive the service's resolved deploy env as the `env` Terraform variable
+# (set as Vercel project env vars for request-time code).
+service-env: true
+credentials:
+  - name: VERCEL_API_TOKEN
+    why: create the Vercel project and upload deploys
+  - name: CLOUDFLARE_API_TOKEN
+    why: DNS record for the frontend domain
+hooks:
+  post-apply:
+    - name: vercel upload
+      env:
+        VERCEL_PROJECT_ID: "{{output.project_id}}"
+        ARC_VERCEL_BUILD: "{{params.build}}"
+        ARC_VERCEL_DEPLOY_PATH: "{{params.deploy-path}}"
+        ARC_VERCEL_LOCAL_CONFIG: "{{params.local-config}}"
+        ARC_VERCEL_REMOTE_BUILD: "{{params.remote-build}}"
+      run: |
+        set -euo pipefail
+        VERCEL_ORG_ID="$(curl -fsS -H "Authorization: Bearer ${VERCEL_API_TOKEN}" https://api.vercel.com/v2/user \
+          | node -e 'let d="";process.stdin.on("data",c=>d+=c);process.stdin.on("end",()=>console.log(JSON.parse(d).user.id))')"
+        export VERCEL_ORG_ID
+        if [ -n "${ARC_VERCEL_BUILD}" ]; then
+          bash -c "${ARC_VERCEL_BUILD}"
+        fi
+        if [ "${ARC_VERCEL_REMOTE_BUILD}" = "true" ]; then
+          npx -y vercel@63.1.2 pull --yes --environment=production --token="${VERCEL_API_TOKEN}"
+          while IFS= read -r kv; do
+            if [ -n "${kv}" ]; then
+              export "${kv?}"
+            fi
+          done <<< "$(node -e 'const env=JSON.parse(process.env.ARC_SERVICE_ENV||"{}");for(const [k,v] of Object.entries(env))console.log(`${k}=${v}`)')"
+          npx -y vercel@63.1.2 build --prod --token="${VERCEL_API_TOKEN}"
+          npx -y vercel@63.1.2 deploy --prebuilt --prod --yes --token="${VERCEL_API_TOKEN}"
+          exit 0
+        fi
+        args=(--prod --yes --token="${VERCEL_API_TOKEN}")
+        if [ -n "${ARC_VERCEL_LOCAL_CONFIG}" ]; then
+          args+=(--local-config "${ARC_VERCEL_LOCAL_CONFIG}")
+        fi
+        npx -y vercel@63.1.2 deploy "${ARC_VERCEL_DEPLOY_PATH:-.}" "${args[@]}"