@ossy/deployment-tools 1.17.10 → 1.17.12

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## 1.17.12 (2026-05-25)
+
+**Note:** Version bump only for package @ossy/deployment-tools
+
+
+
+
+
+## 1.17.11 (2026-05-25)
+
+**Note:** Version bump only for package @ossy/deployment-tools
+
+
+
+
+
 ## 1.17.10 (2026-05-25)
 
 **Note:** Version bump only for package @ossy/deployment-tools

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/deployment-tools",
-  "version": "1.17.10",
+  "version": "1.17.12",
   "description": "Collection of scripts and tools to aid deployment of containers and static files to Amazon Web Services through GitHub Actions",
   "source": "./src/index.js",
   "main": "./src/index.js",
@@ -26,5 +26,5 @@
   "devDependencies": {
     "jest": "^27.5.1"
   },
-  "gitHead": "9c65b3f68767d269cb25810b3110798f1acc7a1d"
+  "gitHead": "c6eb8d3b9ffef1e426fc0e49099d5ea99aa5aa7f"
 }

package/src/config/platform-config.js

@@ -4,6 +4,7 @@
  * @property {string} platformName - Name of platform
  * @property {string[]=} sesDomains - list of domains to configure AWS SES email identity and DKIM records for
  * @property {object} dnsRecords - map of dns records by root domain, only supports MX records so that we can add dns records for our email service
+ * @property {Record<string,string>=} env - environment variables written to /etc/environment on the EC2 host at boot time; never uploaded to S3
  *
  * @property {string} awsAccountId - Aws account id
  * @property {string=} awsRegion - ?

package/src/infrastructure/container-deployment-target/caddy.service.js

@@ -15,6 +15,32 @@ api.ossy.se {
   reverse_proxy localhost:3001
 }
 
+# TODO: remove this block once ossy.se traffic flows through the platform runtime.
+# Once ossy app publish is validated for ossy.se, delete this block and the
+# ossy-website-ossy.service so the catch-all below serves it via the platform.
+ossy.se {
+  tls {
+    dns route53 {
+      max_retries 10
+      profile ci-client
+    }
+  }
+  reverse_proxy localhost:3002
+}
+
+# TODO: remove this block once www.plexus-sanitas.com traffic flows through the platform runtime.
+# Once ossy app publish is validated for plexus-sanitas, delete this block and the
+# ossy-website-plexus-sanitas.service so the catch-all below serves it via the platform.
+www.plexus-sanitas.com {
+  tls {
+    dns route53 {
+      max_retries 10
+      profile ci-client
+    }
+  }
+  reverse_proxy localhost:3003
+}
+
 :443 {
   tls {
     on_demand

package/src/infrastructure/container-deployment-target/container-deployment-target.js

@@ -19,6 +19,8 @@ const { getInstallNodeJs, getInstallNpm, getInstallDocker } = require('./user-da
 const { CaddyService } = require('./caddy.service')
 const { OssyRuntimeService } = require('./ossy-runtime.service')
 const { OssyApiService } = require('./ossy-api.service')
+const { OssyWebsiteOssyService } = require('./ossy-website-ossy.service')
+const { OssyWebsitePlexusSanitasService } = require('./ossy-website-plexus-sanitas.service')
 const { AwsProfile } = require('./aws-profile')
 const { SupportedRegions } = require('../../config')
 
@@ -69,7 +71,7 @@ class ContainerDeploymentTarget extends Construct {
     )
 
     const platformConfigDeployment = new BucketDeployment(this, 'PlatformConfigDeployment', {
-      sources: [Source.jsonData('platform-config.json', { ...props.config, awsRoleToAssume: undefined })],
+      sources: [Source.jsonData('platform-config.json', { ...props.config, awsRoleToAssume: undefined, env: undefined })],
       destinationBucket: props.bucket,
       // Default prune:true would delete every other object (e.g. media/*) on each infra deploy.
       prune: false
@@ -106,6 +108,9 @@ class ContainerDeploymentTarget extends Construct {
 
     const userData = UserData.forLinux()
 
+    // Write platform env vars to /etc/environment so all systemd services pick them up.
+    const envLines = Object.entries(props.config.env ?? {}).map(([k, v]) => `${k}=${v}`)
+
     userData.addCommands(
       'sudo groupadd docker',
       'sudo usermod -aG docker ubuntu',
@@ -116,11 +121,15 @@ class ContainerDeploymentTarget extends Construct {
       ...getInstallDocker(),
       'sudo apt-get install awscli --yes',
       ...AwsProfile.writeFile(role.roleArn, SupportedRegions.North),
+      // Write all platform env vars before starting any service
+      `sudo tee /etc/environment << 'ENVEOF'\n${envLines.join('\n')}\nENVEOF`,
       // Create shared Docker network for inter-container communication
       'docker network create ossy-network || true',
       ...CaddyService.install(),
       ...OssyRuntimeService.install(),
-      ...OssyApiService.install()
+      ...OssyApiService.install(),
+      ...OssyWebsiteOssyService.install(),
+      ...OssyWebsitePlexusSanitasService.install()
     )
 
     userData.addS3DownloadCommand({
@@ -136,7 +145,11 @@ class ContainerDeploymentTarget extends Construct {
       ...OssyRuntimeService.enable(),
       ...OssyRuntimeService.start(),
       ...OssyApiService.enable(),
-      ...OssyApiService.start()
+      ...OssyApiService.start(),
+      ...OssyWebsiteOssyService.enable(),
+      ...OssyWebsiteOssyService.start(),
+      ...OssyWebsitePlexusSanitasService.enable(),
+      ...OssyWebsitePlexusSanitasService.start()
     )
 
     const ec2Instance = new Instance(this, 'Ec2Instance', {

package/src/infrastructure/container-deployment-target/ossy-website-ossy.service.js

@@ -0,0 +1,52 @@
+// TODO: remove this service once ossy.se traffic flows through the platform runtime.
+// The platform runtime (ghcr.io/ossy-se/platform) is the long-term host for all
+// tenant sites including ossy.se. This service is a stopgap while the CMS-based
+// publish flow is validated in production.
+
+const systemdServiceFile = `
+[Unit]
+Description=Ossy Website (ossy.se)
+After=network.target docker.service
+Requires=docker.service
+
+[Service]
+EnvironmentFile=/etc/environment
+ExecStartPre=-/usr/bin/docker rm -f ossy-website-ossy
+ExecStartPre=/usr/bin/docker pull ghcr.io/ossy-se/website-ossy:latest
+ExecStart=/usr/bin/docker run --name ossy-website-ossy \\
+  --network ossy-network \\
+  -p 3002:3000 \\
+  -e PORT=3000 \\
+  -e OSSY_API_URL=http://ossy-api:3001 \\
+  -e OSSY_COOKIE_SECRET=\${OSSY_COOKIE_SECRET} \\
+  ghcr.io/ossy-se/website-ossy:latest
+ExecStop=/usr/bin/docker stop ossy-website-ossy
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+`
+
+/**
+  * @class
+*/
+class OssyWebsiteOssyService {
+
+  static install() {
+    return [`sudo tee /etc/systemd/system/ossy-website-ossy.service > /dev/null << 'EOF'\n${systemdServiceFile}\nEOF`]
+  }
+
+  static enable() {
+    return ['sudo systemctl enable ossy-website-ossy']
+  }
+
+  static start() {
+    return ['sudo systemctl start ossy-website-ossy']
+  }
+
+}
+
+module.exports = {
+  OssyWebsiteOssyService
+}

package/src/infrastructure/container-deployment-target/ossy-website-plexus-sanitas.service.js

@@ -0,0 +1,52 @@
+// TODO: remove this service once www.plexus-sanitas.com traffic flows through the platform runtime.
+// The platform runtime (ghcr.io/ossy-se/platform) is the long-term host for all
+// tenant sites including plexus-sanitas. This service is a stopgap while the CMS-based
+// publish flow is validated in production.
+
+const systemdServiceFile = `
+[Unit]
+Description=Ossy Website (www.plexus-sanitas.com)
+After=network.target docker.service
+Requires=docker.service
+
+[Service]
+EnvironmentFile=/etc/environment
+ExecStartPre=-/usr/bin/docker rm -f ossy-website-plexus-sanitas
+ExecStartPre=/usr/bin/docker pull ghcr.io/ossy-se/website-plexus-sanitas:latest
+ExecStart=/usr/bin/docker run --name ossy-website-plexus-sanitas \\
+  --network ossy-network \\
+  -p 3003:3000 \\
+  -e PORT=3000 \\
+  -e OSSY_API_URL=http://ossy-api:3001 \\
+  -e OSSY_COOKIE_SECRET=\${OSSY_COOKIE_SECRET} \\
+  ghcr.io/ossy-se/website-plexus-sanitas:latest
+ExecStop=/usr/bin/docker stop ossy-website-plexus-sanitas
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+`
+
+/**
+  * @class
+*/
+class OssyWebsitePlexusSanitasService {
+
+  static install() {
+    return [`sudo tee /etc/systemd/system/ossy-website-plexus-sanitas.service > /dev/null << 'EOF'\n${systemdServiceFile}\nEOF`]
+  }
+
+  static enable() {
+    return ['sudo systemctl enable ossy-website-plexus-sanitas']
+  }
+
+  static start() {
+    return ['sudo systemctl start ossy-website-plexus-sanitas']
+  }
+
+}
+
+module.exports = {
+  OssyWebsitePlexusSanitasService
+}