@ossy/deployment-tools 1.19.0 → 1.20.0

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 1.20.0 (2026-05-25)
+
+
+### Features
+
+* **deployment-tools:** Refactor container service management and update documentation ([8e2bc9c](https://github.com/ossy-se/ossy/commit/8e2bc9c186dbc9a16ae6127fad755baffc07d0be))
+
+
+
+
+
 # 1.19.0 (2026-05-25)
 
 

package/README.md

@@ -21,38 +21,111 @@ Caddy uses **on-demand TLS**: before issuing a certificate for any domain, it ca
 
 All services run as Docker containers managed by systemd. Service files are written to the EC2 host by CDK user data at instance creation.
 
-| Service | Unit file | Port | Auto-start | Image |
-|---|---|---|---|---|
-| Caddy | `caddy-route53.service` | 80, 443 | Yes | — |
-| Ossy API | `ossy-api.service` | 3001 | Yes | `ghcr.io/ossy-se/api:latest` |
-| Ossy Platform | `ossy-runtime.service` | 3000 | Yes | `ghcr.io/ossy-se/platform:latest` |
-| website-ossy | `ossy-website-ossy.service` | 3002 | Yes | `ghcr.io/ossy-se/website-ossy:latest` |
-| website-plexus-sanitas | `ossy-website-plexus-sanitas.service` | 3003 | Yes | `ghcr.io/ossy-se/website-plexus-sanitas:latest` |
+| Service | Unit file | Port | Image |
+|---|---|---|---|
+| Caddy | `caddy-route53.service` | 80, 443 | — |
+| Ossy API | `ossy-api.service` | 3001 | `ghcr.io/ossy-se/api:latest` |
+| Ossy Platform | `ossy-runtime.service` | 3000 | `ghcr.io/ossy-se/platform:latest` |
+| _configured via `services`_ | `<name>.service` | _per config_ | _per config_ |
 
-> **TODO (website-ossy, website-plexus-sanitas):** These are temporary services. Once `ossy app publish` is validated for each site, remove their service files and Caddy blocks so traffic flows through the platform runtime instead.
-
-> **TODO:** Pin `@ossy/platform` to a specific version at CDK deploy time (thread through `PlatformConfig`) rather than always pulling `@latest`.
+Additional services are generated automatically from the `services` array in `platforms.json` — see the Configuration section below.
 
 ## Configuration — `platforms.json`
 
-`packages/infrastructure/platforms.json` is the single source of truth for a platform. It contains:
+`packages/infrastructure/platforms.json` is the single source of truth for a platform. Each entry becomes a CDK `Stage` with its own set of stacks.
+
+| Field | Required | Description |
+|---|---|---|
+| `platformName` | Yes | Unique name, used as the CDK stage name and CloudFormation stack prefix |
+| `awsAccountId` | Yes | AWS account ID |
+| `awsKeyPairName` | Yes | EC2 key pair name for SSH access |
+| `awsInstanceClass` | No | EC2 instance class (e.g. `t3`, `t4g`, `m5`). Defaults to `t3` |
+| `awsInstanceSize` | No | EC2 instance size (e.g. `small`, `medium`, `large`). Defaults to `small` |
+| `sesDomains` | No | Domains to configure SES email identity for |
+| `domains` | No | Domains to create Route53 A records for, pointing to the EC2 Elastic IP. Supports wildcards (e.g. `*.ossy.se`). |
+| `services` | No | Per-platform container services (see below) |
+| `dnsRecords` | No | Additional DNS records by root domain (currently supports MX) |
+| `env` | No | Environment variables written to `/etc/environment` on the EC2 host at boot. **Never uploaded to S3.** |
+
+### `services` — container/domain mapping
+
+Each entry in `services` generates a systemd unit that pulls and runs a Docker image, and a Caddy block that routes a domain to it. All variables from `env` are forwarded to the container via `--env-file /etc/environment`.
+
+```json
+"services": [
+  {
+    "name": "ossy-website-ossy",
+    "domain": "ossy.se",
+    "image": "ghcr.io/ossy-se/website-ossy:latest"
+  }
+]
+```
+
+| Field | Description |
+|---|---|
+| `name` | Unique service name. Used as the Docker container name and systemd unit name (`<name>.service`). |
+| `domain` | Domain this service handles. Gets its own Caddy block with Route53 TLS. |
+| `image` | Docker image to pull and run. |
+
+Host ports are auto-assigned starting at `3002` based on the order in the array (`services[0]` → `3002`, `services[1]` → `3003`, etc.). Appending new entries is safe; avoid reordering existing ones.
+
+**Fixed built-in services** (always present, not configurable via `services`):
+- `ossy-api` — the Ossy API (`ghcr.io/ossy-se/api:latest`, port 3001)
+- `ossy-runtime` — the platform runtime serving all CMS-published apps (`ghcr.io/ossy-se/platform:latest`, port 3000, catch-all)
+
+**Custom domains**: For customer-owned domains (e.g. `woodhill.com`), the customer adds an A record pointing to the Elastic IP at their registrar. No infrastructure change needed — Caddy's on-demand TLS issues the cert automatically once the domain is registered via `ossy app publish`.
+
+**Wildcard subdomains**: Add `*.ossy.se` to `domains` for a Route53 wildcard A record. This covers any `*.ossy.se` subdomain without individual records.
 
-- **AWS config** — account ID, key pair, S3 bucket name, IAM role
-- **`domains`** — list of domains to create Route53 A records for, all pointing to the EC2 host IP
-- **`env`** — environment variables written to `/etc/environment` on the EC2 host at boot time. **These are never uploaded to S3.**
+`MEDIA_REPOSITORY` and `MEDIA_CDN_DOMAIN_NAME` are derived automatically from the provisioned S3 bucket and CloudFront distribution — do not set them in `env`.
 
-To add or change environment variables, update the `env` block in `platforms.json` and redeploy. To add a new domain, add it to `domains` and redeploy.
+To add a new platform, add an entry to `platforms.json`. No bucket name or CDN domain is needed; these are auto-generated by CloudFormation.
 
-## Bootstrapping a new host
+## CDK Stacks
 
-CDK provisions the instance, writes all service files, writes `/etc/environment` from `platforms.json`, and starts all services automatically. No manual SSH steps required.
+Each platform is a CDK `Stage` containing five stacks:
+
+| Stack | Description |
+|---|---|
+| `storage-static` | S3 bucket (auto-named), daily backup plan, CloudFront CDN for `/media`. Kept separate from the EC2 stack so storage resources are never touched during instance updates. |
+| `deployment-target` | EC2 instance with Elastic IP. Imports the S3 bucket from `storage-static` via cross-stack reference. |
+| `dns` | Route53 A records for all domains in `platforms.json`, pointing to the Elastic IP. |
+| `ses` | SES email sending identity and DKIM records. |
+
+The Elastic IP ensures the EC2 instance can be replaced (instance type changes, user data updates) without breaking DNS or CloudFormation cross-stack exports.
+
+## Bootstrapping a new platform
 
 ```bash
 cd packages/deployment-tools
-npx cdk deploy ossybot-deployment-target --require-approval never
+npx cdk deploy 'ossybot/**' --profile ossybot --require-approval never
 ```
 
-> Note: EC2 user data only runs on **first boot**. To apply infrastructure changes to an existing instance you must terminate and recreate it, or SSH in and apply the changes manually.
+CDK provisions the instance, writes all service files, writes `/etc/environment` from `platforms.json`, and starts all services automatically. No manual SSH steps are required.
+
+> Note: EC2 user data only runs on **first boot**. To apply infrastructure changes to an existing instance you must terminate and recreate it, or SSH in and apply changes manually.
+
+## Deploying changes
+
+Target a single platform:
+```bash
+npx cdk deploy 'ossybot/**' --profile ossybot
+```
+
+Target all platforms:
+```bash
+npx cdk deploy '**' --profile ossybot
+```
+
+Preview changes without deploying:
+```bash
+npx cdk diff 'ossybot/**' --profile ossybot
+```
+
+List all stacks:
+```bash
+npx cdk list
+```
 
 ## Redeploying after a code change
 
@@ -74,15 +147,20 @@ sudo systemctl restart ossy-website-plexus-sanitas
 
 ## Environment variables
 
-All env vars are defined in the `env` block of `platforms.json` and written to `/etc/environment` at boot. Reference:
+Defined in the `env` block of `platforms.json`, written to `/etc/environment` at boot. The following variables are injected automatically by CDK and should **not** be set manually:
+
+| Variable | Source |
+|---|---|
+| `MEDIA_REPOSITORY` | S3 bucket name from `storage-static` stack |
+| `MEDIA_CDN_DOMAIN_NAME` | CloudFront domain from `storage-static` stack |
+
+All other env vars:
 
 | Variable | Used by | Description |
 |---|---|---|
 | `DB_URL` | API | Atlas MongoDB connection string |
 | `DB_NAME` | API | MongoDB database name |
 | `TOKEN_SECRET` | API | JWT signing secret |
-| `MEDIA_REPOSITORY` | API | S3 bucket name for media uploads |
-| `MEDIA_CDN_DOMAIN_NAME` | API | CloudFront domain for public media |
 | `AWS_ACCESS_KEY_ID` | API | AWS credentials for S3 |
 | `AWS_SECRET_ACCESS_KEY` | API | AWS credentials for S3 |
 | `OSSY_API_KEY` | Platform, websites | API JWT for CMS reads |
@@ -90,22 +168,11 @@ All env vars are defined in the `env` block of `platforms.json` and written to `
 | `OPENAI_API_KEY` | Worker | OpenAI API key |
 | `OPENAI_ORGANIZATION` | Worker | OpenAI organisation ID |
 
-## Infrastructure (CDK)
-
-CDK stacks are defined in `src/infrastructure/`. Run via `cdk deploy` from the `deployment-tools` package.
-
-| Stack | Description |
-|---|---|
-| `trust-ci` | IAM role for CI to deploy infrastructure |
-| `deployment-target` | EC2 host, S3 bucket, CloudFront CDN for media |
-| `dns` | Route53 A records for all domains in `platforms.json` |
-| `ses` | SES email sending |
-
 ## Useful commands
 
 **SSH into instance**
 ```bash
-ssh -i path/to/keys ubuntu@<ip>
+ssh -i path/to/keys ubuntu@<elastic-ip>
 ```
 
 **View service logs**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/deployment-tools",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "description": "Collection of scripts and tools to aid deployment of containers and static files to Amazon Web Services through GitHub Actions",
   "source": "./src/index.js",
   "main": "./src/index.js",
@@ -12,11 +12,7 @@
   },
   "author": "Ossy",
   "license": "ISC",
-  "bin": "./src/index.cli.js",
   "dependencies": {
-    "@actions/core": "^1.10.0",
-    "@aws-sdk/client-sts": "^3.245.0",
-    "arg": "^5.0.2",
     "aws-cdk": "^2.73.0",
     "aws-cdk-lib": "^2.73.0",
     "constructs": "^10.1.304",
@@ -26,5 +22,5 @@
   "devDependencies": {
     "jest": "^27.5.1"
   },
-  "gitHead": "a40e3b439ced37f52db9526f799189e6d0809349"
+  "gitHead": "50d7e273859b6b77606d8530913b971c7445a34a"
 }

package/src/config/platform-config.js

@@ -5,15 +5,16 @@
  * @property {string[]=} sesDomains - list of domains to configure AWS SES email identity and DKIM records for
  * @property {string[]=} domains - list of domains to create Route53 A records for, pointing to the EC2 host
  * @property {object} dnsRecords - map of dns records by root domain, only supports MX records so that we can add dns records for our email service
+ * @property {Array<{name: string, domain: string, image: string}>=} services - per-platform container services; each entry generates a systemd unit and a Caddy domain block. Host ports are auto-assigned starting at 3002.
  * @property {Record<string,string>=} env - environment variables written to /etc/environment on the EC2 host at boot time; never uploaded to S3
  *
  * @property {string} awsAccountId - Aws account id
- * @property {string=} awsRegion - ?
- * @property {string=} awsKeyPairName - ?
- * @property {string} awsRoleToAssume - ?
+ * @property {string=} awsRegion - AWS region, defaults to eu-north-1
+ * @property {string=} awsKeyPairName - EC2 key pair name for SSH access
+ * @property {string=} awsInstanceClass - EC2 instance class (e.g. t3, t4g, m5), defaults to t3
+ * @property {string=} awsInstanceSize - EC2 instance size (e.g. small, medium, large), defaults to small
  *
  * @property {string=} ciDockerNetworkName - ?
- * @property {string} ciGithubActionsRepo - organisation/repoName
  */
 
 const SupportedRegions = {

package/src/infrastructure/cli.js

@@ -1,10 +1,7 @@
 #!/usr/bin/env node
 /* eslint-disable no-new */
 const { App } = require('aws-cdk-lib')
-const { TrustCiStack } = require('./trust-ci-stack')
-const { DeploymentTargetStack } = require('./deployment-target-stack')
-const { DnsStack } = require('./dns-stack')
-const { SesStack } = require('./ses-stack')
+const { PlatformStage } = require('./platform-stage')
 const { PlatformTemplateService } = require('../template')
 const { PlatformConfigService } = require('../config')
 
@@ -15,25 +12,12 @@ PlatformTemplateService
     const app = new App()
 
     configs.forEach(config => {
-
-      const stackProps = {
+      new PlatformStage(app, config.platformName, {
         config,
         env: {
           account: config.awsAccountId,
           region: config.awsRegion
         }
-      }
-
-      new TrustCiStack(app, `${config.platformName}-trust-ci`, stackProps)
-
-      const deploymentTarget = new DeploymentTargetStack(app, `${config.platformName}-deployment-target`, stackProps)
-
-      new DnsStack(app, `${config.platformName}-dns`, {
-        ...stackProps,
-        containerDeploymentTargetPublicIp: deploymentTarget.containerDeploymentTargetPublicIp
       })
-
-      new SesStack(app, `${config.platformName}-ses`, stackProps)
-
     })
   })

package/src/infrastructure/container-deployment-target/caddy.service.js

@@ -1,4 +1,16 @@
-const caddyfile = `
+/**
+ * Builds the full Caddyfile content.
+ * - Global block: on-demand TLS pointing at the API ask endpoint
+ * - API block: explicit Route53 TLS for api.ossy.se
+ * - One block per ContainerService (from platforms.json `services`)
+ * - Catch-all :443 block: on-demand TLS, routes to the platform runtime
+ *
+ * @param {import('./container-service').ContainerService[]} services
+ */
+const buildCaddyfile = (services) => {
+  const serviceBlocks = services.map(s => s.caddyBlock).join('\n')
+
+  return `
 {
   on_demand_tls {
     ask http://localhost:3001/api/v0/apps/ask
@@ -14,32 +26,7 @@ api.ossy.se {
   }
   reverse_proxy localhost:3001
 }
-
-# TODO: remove this block once ossy.se traffic flows through the platform runtime.
-# Once ossy app publish is validated for ossy.se, delete this block and the
-# ossy-website-ossy.service so the catch-all below serves it via the platform.
-ossy.se {
-  tls {
-    dns route53 {
-      max_retries 10
-      profile ci-client
-    }
-  }
-  reverse_proxy localhost:3002
-}
-
-# TODO: remove this block once www.plexus-sanitas.com traffic flows through the platform runtime.
-# Once ossy app publish is validated for plexus-sanitas, delete this block and the
-# ossy-website-plexus-sanitas.service so the catch-all below serves it via the platform.
-www.plexus-sanitas.com {
-  tls {
-    dns route53 {
-      max_retries 10
-      profile ci-client
-    }
-  }
-  reverse_proxy localhost:3003
-}
+${serviceBlocks}
 
 :443 {
   tls {
@@ -52,6 +39,7 @@ www.plexus-sanitas.com {
   reverse_proxy localhost:3000
 }
 `
+}
 
 const systemdServiceFile = `
 # caddy-route53.service — Caddy with Route53 DNS plugin for on-demand TLS.
@@ -84,7 +72,11 @@ WantedBy=multi-user.target cloud-init.target
 */
 class CaddyService {
 
-  static install() {
+  /**
+   * @param {import('./container-service').ContainerService[]} services
+   */
+  static install(services = []) {
+    const caddyfile = buildCaddyfile(services)
     return [
       // Write Caddyfile
       'sudo mkdir -p /etc/caddy',

package/src/infrastructure/container-deployment-target/container-deployment-target.js

@@ -11,7 +11,9 @@ const {
   Port,
   UserData,
   KeyPair,
-  BlockDeviceVolume
+  BlockDeviceVolume,
+  CfnEIP,
+  CfnEIPAssociation
 } = require('aws-cdk-lib/aws-ec2')
 const { Role, ServicePrincipal, Policy, PolicyStatement, Effect } = require('aws-cdk-lib/aws-iam')
 const { Source, BucketDeployment } = require('aws-cdk-lib/aws-s3-deployment')
@@ -19,8 +21,7 @@ const { getInstallNodeJs, getInstallNpm, getInstallDocker } = require('./user-da
 const { CaddyService } = require('./caddy.service')
 const { OssyRuntimeService } = require('./ossy-runtime.service')
 const { OssyApiService } = require('./ossy-api.service')
-const { OssyWebsiteOssyService } = require('./ossy-website-ossy.service')
-const { OssyWebsitePlexusSanitasService } = require('./ossy-website-plexus-sanitas.service')
+const { ContainerService } = require('./container-service')
 const { AwsProfile } = require('./aws-profile')
 const { SupportedRegions } = require('../../config')
 
@@ -71,7 +72,7 @@ class ContainerDeploymentTarget extends Construct {
     )
 
     const platformConfigDeployment = new BucketDeployment(this, 'PlatformConfigDeployment', {
-      sources: [Source.jsonData('platform-config.json', { ...props.config, awsRoleToAssume: undefined, env: undefined })],
+      sources: [Source.jsonData('platform-config.json', { ...props.config, env: undefined })],
       destinationBucket: props.bucket,
       // Default prune:true would delete every other object (e.g. media/*) on each infra deploy.
       prune: false
@@ -111,6 +112,9 @@ class ContainerDeploymentTarget extends Construct {
     // Write platform env vars to /etc/environment so all systemd services pick them up.
     const envLines = Object.entries(props.config.env ?? {}).map(([k, v]) => `${k}=${v}`)
 
+    // Build generic container services from config.services
+    const containerServices = ContainerService.fromConfig(props.config.services)
+
     userData.addCommands(
       'sudo groupadd docker',
       'sudo usermod -aG docker ubuntu',
@@ -125,11 +129,10 @@ class ContainerDeploymentTarget extends Construct {
       `sudo tee /etc/environment << 'ENVEOF'\n${envLines.join('\n')}\nENVEOF`,
       // Create shared Docker network for inter-container communication
       'docker network create ossy-network || true',
-      ...CaddyService.install(),
+      ...CaddyService.install(containerServices),
       ...OssyRuntimeService.install(),
       ...OssyApiService.install(),
-      ...OssyWebsiteOssyService.install(),
-      ...OssyWebsitePlexusSanitasService.install()
+      ...containerServices.flatMap(s => s.install())
     )
 
     userData.addS3DownloadCommand({
@@ -146,21 +149,42 @@ class ContainerDeploymentTarget extends Construct {
       ...OssyRuntimeService.start(),
       ...OssyApiService.enable(),
       ...OssyApiService.start(),
-      ...OssyWebsiteOssyService.enable(),
-      ...OssyWebsiteOssyService.start(),
-      ...OssyWebsitePlexusSanitasService.enable(),
-      ...OssyWebsitePlexusSanitasService.start()
+      ...containerServices.flatMap(s => [...s.enable(), ...s.start()])
     )
 
+    const instanceClassMap = {
+      t2: InstanceClass.T2,
+      t3: InstanceClass.T3,
+      t3a: InstanceClass.T3A,
+      t4g: InstanceClass.T4G,
+      m5: InstanceClass.M5,
+      m6i: InstanceClass.M6I,
+      c5: InstanceClass.C5,
+      c6i: InstanceClass.C6I,
+    }
+
+    const instanceSizeMap = {
+      nano: InstanceSize.NANO,
+      micro: InstanceSize.MICRO,
+      small: InstanceSize.SMALL,
+      medium: InstanceSize.MEDIUM,
+      large: InstanceSize.LARGE,
+      xlarge: InstanceSize.XLARGE,
+      '2xlarge': InstanceSize.XLARGE2,
+    }
+
+    const instanceClass = instanceClassMap[props.config.awsInstanceClass ?? 't3']
+    const instanceSize = instanceSizeMap[props.config.awsInstanceSize ?? 'small']
+
+    if (!instanceClass) throw new Error(`[ContainerDeploymentTarget] Unknown awsInstanceClass: ${props.config.awsInstanceClass}`)
+    if (!instanceSize) throw new Error(`[ContainerDeploymentTarget] Unknown awsInstanceSize: ${props.config.awsInstanceSize}`)
+
     const ec2Instance = new Instance(this, 'Ec2Instance', {
       vpc,
       securityGroup,
       userData,
       role,
-      instanceType: InstanceType.of(
-        InstanceClass.T3,
-        InstanceSize.SMALL
-      ),
+      instanceType: InstanceType.of(instanceClass, instanceSize),
       machineImage: new GenericLinuxImage({
         [SupportedRegions.North]: InstanceImages.UBUNTU
       }),
@@ -175,7 +199,15 @@ class ContainerDeploymentTarget extends Construct {
 
     props.bucket.grantRead(ec2Instance, '*')
 
-    this.instancePublicIp = ec2Instance.instancePublicIp
+    // Elastic IP gives the instance a stable public IP that survives instance replacements,
+    // preventing CloudFormation cross-stack export conflicts when the EC2 instance is updated.
+    const eip = new CfnEIP(this, 'ElasticIp', { domain: 'vpc' })
+    new CfnEIPAssociation(this, 'EipAssociation', {
+      instanceId: ec2Instance.instanceId,
+      allocationId: eip.attrAllocationId
+    })
+
+    this.instancePublicIp = eip.attrPublicIp
 
   }
 }

package/src/infrastructure/container-deployment-target/container-service.js

@@ -0,0 +1,101 @@
+/**
+ * ContainerServiceConfig
+ * @typedef {Object} ContainerServiceConfig
+ * @property {string} name   - Unique service name, used for the container name and systemd unit
+ * @property {string} domain - Domain this service is reachable on (used in Caddy block)
+ * @property {string} image  - Docker image to run (e.g. ghcr.io/ossy-se/website-ossy:latest)
+ */
+
+const BASE_PORT = 3002 // 3000 = platform runtime, 3001 = API
+
+/**
+ * ContainerService generates a systemd unit file and a Caddy reverse-proxy block
+ * for a domain → Docker container mapping defined in platforms.json `services`.
+ *
+ * Host ports are auto-assigned starting at 3002 based on the service's index in
+ * the array. All containers are expected to listen on port 3000 internally.
+ *
+ * All environment variables from /etc/environment are forwarded to the container
+ * via --env-file, so no per-service env wiring is needed.
+ */
+class ContainerService {
+
+  /**
+   * @param {ContainerServiceConfig} config
+   * @param {number} index - position in the services array, used to derive host port
+   */
+  constructor({ name, domain, image }, index) {
+    this.name = name
+    this.domain = domain
+    this.image = image
+    this.port = BASE_PORT + index
+  }
+
+  get systemdUnitFile() {
+    return `
+[Unit]
+Description=Container service: ${this.name} (${this.domain})
+After=network.target docker.service
+Requires=docker.service
+
+[Service]
+EnvironmentFile=/etc/environment
+ExecStartPre=-/usr/bin/docker rm -f ${this.name}
+ExecStartPre=/usr/bin/docker pull ${this.image}
+ExecStart=/usr/bin/docker run --name ${this.name} \\
+  --network ossy-network \\
+  -p ${this.port}:3000 \\
+  --env-file /etc/environment \\
+  ${this.image}
+ExecStop=/usr/bin/docker stop ${this.name}
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+`
+  }
+
+  get caddyBlock() {
+    return `
+${this.domain} {
+  tls {
+    dns route53 {
+      max_retries 10
+      profile ci-client
+    }
+  }
+  reverse_proxy localhost:${this.port}
+}`
+  }
+
+  get unitName() {
+    return `${this.name}.service`
+  }
+
+  install() {
+    return [`sudo tee /etc/systemd/system/${this.unitName} > /dev/null << 'EOF'\n${this.systemdUnitFile}\nEOF`]
+  }
+
+  enable() {
+    return [`sudo systemctl enable ${this.name}`]
+  }
+
+  start() {
+    return [`sudo systemctl start ${this.name}`]
+  }
+
+  /**
+   * Build ContainerService instances from the `services` array in platforms.json.
+   * @param {ContainerServiceConfig[]} services
+   * @returns {ContainerService[]}
+   */
+  static fromConfig(services = []) {
+    return services.map((s, index) => new ContainerService(s, index))
+  }
+
+}
+
+module.exports = {
+  ContainerService
+}

package/src/infrastructure/deployment-target-stack.js

@@ -1,97 +1,50 @@
 /* eslint-disable no-new */
-const { CfnOutput, Stack, RemovalPolicy } = require('aws-cdk-lib')
-const { BackupPlan, BackupVault, BackupResource } = require('aws-cdk-lib/aws-backup')
-const { Bucket, BlockPublicAccess } = require('aws-cdk-lib/aws-s3')
-const { Distribution, PriceClass, ResponseHeadersPolicy } = require('aws-cdk-lib/aws-cloudfront')
-const { S3BucketOrigin } = require('aws-cdk-lib/aws-cloudfront-origins')
+const { CfnOutput, Stack } = require('aws-cdk-lib')
 const { ContainerDeploymentTarget } = require('./container-deployment-target')
 
 /**
-  * @class
-*/
+ * DeploymentTargetStackProps
+ * @typedef {Object} DeploymentTargetStackProps
+ * @property {PlatformConfig} config - platform config
+ * @property {import('aws-cdk-lib/aws-s3').IBucket} bucket - static assets bucket (from StorageStaticStack)
+ * @property {string} cdnDomainName - CloudFront domain name (from StorageStaticStack)
+ */
+
+/**
+ * DeploymentTargetStack provisions the EC2 instance (with Elastic IP) that runs the
+ * platform services. The S3 bucket lives in StorageStaticStack so that EC2 replacements
+ * never trigger CloudFormation cross-stack export conflicts on storage resources.
+ *
+ * MEDIA_REPOSITORY and MEDIA_CDN_DOMAIN_NAME are derived from the actual bucket and CDN
+ * resources rather than being hardcoded in platforms.json.
+ */
 class DeploymentTargetStack extends Stack {
   constructor(scope, id, props) {
     super(scope, id, props)
 
     if (!props?.config) {
-      throw ('[DeploymentTargetStack] No template provided')
+      throw ('[DeploymentTargetStack] No config provided')
     }
 
-    // TODO: Check if the bucket already exists and use it
-    // instead of having the whole deployment fail
-    const staticDeploymentTarget =
-      new Bucket(this, 'StaticDeploymentTarget', {
-        bucketName: props.config.awsStaticBucketName,
-        blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
-        removalPolicy: RemovalPolicy.RETAIN,
-        autoDeleteObjects: false,
-        versioned: true,
-        cors: [{
-          allowedHeaders: ['*'],
-          allowedMethods: ['GET', 'PUT', 'POST' ],
-          allowedOrigins: [ '*' ],
-          exposeHeaders: []
-        }]
-      })
-
-    const mediaBackupVault = new BackupVault(this, 'StaticMediaBackupVault', {
-      backupVaultName: `${props.config.platformName}-static-media`,
-      removalPolicy: RemovalPolicy.RETAIN
-    })
-
-    const mediaBackupPlan = BackupPlan.daily35DayRetention(this, 'StaticMediaBackupPlan', mediaBackupVault)
-
-    mediaBackupPlan.addSelection('StaticDeploymentTargetBucket', {
-      backupSelectionName: `${props.config.platformName}-s3-static-media`,
-      resources: [BackupResource.fromArn(staticDeploymentTarget.bucketArn)],
-      allowRestores: true
-    })
-
-    const mediaCDN = new Distribution(this, 'Media', {
-        defaultBehavior: {
-          origin: S3BucketOrigin.withOriginAccessControl(staticDeploymentTarget, { originPath: '/media' }),
-          // S3 bucket CORS does not add headers on viewer responses; without this, browser fetch()
-          // to the CDN is cross-origin and Chrome may block with net::ERR_BLOCKED_BY_ORB.
-          responseHeadersPolicy:
-            ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT
-        },
-        priceClass: PriceClass.PRICE_CLASS_100
-      })
-
-    const containerDeploymentTarget =
-      new ContainerDeploymentTarget(this, 'ContainerDeploymentTarget', {
-      config: props.config,
-      bucket: staticDeploymentTarget
+    const containerDeploymentTarget = new ContainerDeploymentTarget(this, 'ContainerDeploymentTarget', {
+      config: {
+        ...props.config,
+        env: {
+          ...props.config.env,
+          MEDIA_REPOSITORY: props.bucket.bucketName,
+          MEDIA_CDN_DOMAIN_NAME: `https://${props.cdnDomainName}`
+        }
+      },
+      bucket: props.bucket
     })
 
     this.containerDeploymentTargetPublicIp = containerDeploymentTarget.instancePublicIp
-    this.staticDeploymentTargetBucketName = staticDeploymentTarget.bucketName
-    this.staticDeploymentTargetBucketArn = staticDeploymentTarget.bucketArn
-
-    new CfnOutput(this, 'MediaCDNDomainName', {
-      value: mediaCDN.domainName,
-      description: 'Domain name of CDN distribution',
-      exportName: 'MediaCDNDomainName'
-    })
 
     new CfnOutput(this, 'ContainerDeploymentTargetPublicIp', {
       value: containerDeploymentTarget.instancePublicIp,
-      description: 'Public ip of the ec2 instance',
-      exportName: 'awsContainerDeploymentTargetPublicIp'
-    })
-
-    new CfnOutput(this, 'StaticDeploymentTargetBucketName', {
-      value: staticDeploymentTarget.bucketName,
-      description: 'Name of static deployment target bucket',
-      exportName: 'awsStaticDeploymentTargetBucketName'
-    })
-
-    new CfnOutput(this, 'StaticDeploymentTargetBucketArn', {
-      value: staticDeploymentTarget.bucketArn,
-      description: 'Name of static deployment target bucket',
-      exportName: 'awsStaticDeploymentTargetBucketArn'
+      description: 'Public IP of the EC2 instance (Elastic IP)',
+      exportName: `${props.config.platformName}-ContainerDeploymentTargetPublicIp`
     })
-
   }
 }
 

package/src/infrastructure/platform-stage.js

@@ -0,0 +1,40 @@
+/* eslint-disable no-new */
+const { Stage } = require('aws-cdk-lib')
+const { StorageStaticStack } = require('./storage-static-stack')
+const { DeploymentTargetStack } = require('./deployment-target-stack')
+const { DnsStack } = require('./dns-stack')
+const { SesStack } = require('./ses-stack')
+
+/**
+ * PlatformStage groups all stacks that make up a single platform deployment.
+ * Using a Stage lets you target one platform at a time:
+ *
+ *   cdk deploy 'ossybot/**' --profile ossybot
+ *
+ * Stack names within the stage are automatically prefixed with the platform name,
+ * e.g. ossybot/trust-ci, ossybot/storage-static, ossybot/deployment-target, etc.
+ */
+class PlatformStage extends Stage {
+  constructor(scope, id, props) {
+    super(scope, id, props)
+
+    const storageStatic = new StorageStaticStack(this, 'storage-static', props)
+
+    const deploymentTarget = new DeploymentTargetStack(this, 'deployment-target', {
+      ...props,
+      bucket: storageStatic.bucket,
+      cdnDomainName: storageStatic.cdnDomainName
+    })
+
+    new DnsStack(this, 'dns', {
+      ...props,
+      containerDeploymentTargetPublicIp: deploymentTarget.containerDeploymentTargetPublicIp
+    })
+
+    new SesStack(this, 'ses', props)
+  }
+}
+
+module.exports = {
+  PlatformStage
+}

package/src/infrastructure/storage-static-stack.js

@@ -0,0 +1,87 @@
+/* eslint-disable no-new */
+const { CfnOutput, Stack, RemovalPolicy } = require('aws-cdk-lib')
+const { BackupPlan, BackupVault, BackupResource } = require('aws-cdk-lib/aws-backup')
+const { Bucket, BlockPublicAccess } = require('aws-cdk-lib/aws-s3')
+const { Distribution, PriceClass, ResponseHeadersPolicy } = require('aws-cdk-lib/aws-cloudfront')
+const { S3BucketOrigin } = require('aws-cdk-lib/aws-cloudfront-origins')
+
+/**
+ * StorageStaticStack provisions the S3 bucket used for static assets and media,
+ * a CloudFront CDN distribution serving the /media prefix, and a daily backup plan.
+ *
+ * This stack is intentionally kept separate from the deployment-target stack so that
+ * the long-lived storage resources are never touched when the EC2 instance is updated
+ * or replaced, avoiding CloudFormation cross-stack export conflicts.
+ *
+ * Exports (consumed by deployment-target-stack via cross-stack reference):
+ *   - `bucket`          — the S3 Bucket construct
+ *   - `cdnDomainName`   — the CloudFront distribution domain name
+ */
+class StorageStaticStack extends Stack {
+  constructor(scope, id, props) {
+    super(scope, id, props)
+
+    if (!props?.config) {
+      throw ('[StorageStaticStack] No config provided')
+    }
+
+    const bucket = new Bucket(this, 'StaticDeploymentTarget', {
+      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+      removalPolicy: RemovalPolicy.RETAIN,
+      autoDeleteObjects: false,
+      versioned: true,
+      cors: [{
+        allowedHeaders: ['*'],
+        allowedMethods: ['GET', 'PUT', 'POST'],
+        allowedOrigins: ['*'],
+        exposeHeaders: []
+      }]
+    })
+
+    const backupVault = new BackupVault(this, 'StaticMediaBackupVault', {
+      removalPolicy: RemovalPolicy.RETAIN
+    })
+
+    const backupPlan = BackupPlan.daily35DayRetention(this, 'StaticMediaBackupPlan', backupVault)
+
+    backupPlan.addSelection('StaticDeploymentTargetBucket', {
+      resources: [BackupResource.fromArn(bucket.bucketArn)],
+      allowRestores: true
+    })
+
+    const mediaCDN = new Distribution(this, 'Media', {
+      defaultBehavior: {
+        origin: S3BucketOrigin.withOriginAccessControl(bucket, { originPath: '/media' }),
+        // S3 bucket CORS does not add headers on viewer responses; without this, browser fetch()
+        // to the CDN is cross-origin and Chrome may block with net::ERR_BLOCKED_BY_ORB.
+        responseHeadersPolicy: ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT
+      },
+      priceClass: PriceClass.PRICE_CLASS_100
+    })
+
+    this.bucket = bucket
+    this.cdnDomainName = mediaCDN.domainName
+
+    new CfnOutput(this, 'MediaCDNDomainName', {
+      value: mediaCDN.domainName,
+      description: 'Domain name of CDN distribution',
+      exportName: `${props.config.platformName}-MediaCDNDomainName`
+    })
+
+    new CfnOutput(this, 'StaticDeploymentTargetBucketName', {
+      value: bucket.bucketName,
+      description: 'Name of static deployment target bucket',
+      exportName: `${props.config.platformName}-StaticDeploymentTargetBucketName`
+    })
+
+    new CfnOutput(this, 'StaticDeploymentTargetBucketArn', {
+      value: bucket.bucketArn,
+      description: 'ARN of static deployment target bucket',
+      exportName: `${props.config.platformName}-StaticDeploymentTargetBucketArn`
+    })
+  }
+}
+
+module.exports = {
+  StorageStaticStack
+}

package/src/template/platform-template.js

@@ -10,10 +10,7 @@ const { logError, logInfo } = require('../log')
  * @property {string} awsAccountId - Aws account id
  * @property {string=} awsRegion - ?
  * @property {string=} awsKeyPairName - ?
- * @property {string} awsRoleToAssume - ?
  * @property {string=} awsDeploymentSqsArn - ?
- *
- * @property {string} ciGithubActionsRepo - organisation/repoName
  */
 
 /**

package/src/aws-credentials/aws-credentials.js

@@ -1,87 +0,0 @@
-const core = require('@actions/core')
-const { STSClient, AssumeRoleWithWebIdentityCommand } = require('@aws-sdk/client-sts')
-
-const { logInfo, logError } = require('../log')
-
-/**
-  * @class
-*/
-class AwsCredentialsService {
-
-  static resolveAwsCredentials(platformConfig) {
-    // If awsRoleToAssume is present, then we assume we run in a github workflow
-    // If awsRoleToAssume is not present, then we assume they are resolved localy by aws-sdk
-    if (!platformConfig.awsRoleToAssume) {
-      logInfo({ message: '[AwsCredentialsService] No aws role to assume was found, leaving auth logic to @aws-sdk package' })
-      return Promise.resolve(undefined)
-    }
-
-    const stsClient = new STSClient({ region: platformConfig.awsRegion })
-
-    logInfo({ message: '[AwsCredentialsService] Fetching GitHub ID token' })
-    return core.getIDToken('sts.amazonaws.com')
-      .then(webIdentityToken => {
-        logInfo({ message: `[AwsCredentialsService] Attempting to resolve aws credentials by assuming the role: ${platformConfig.awsRoleToAssume}` })
-        return stsClient.send(new AssumeRoleWithWebIdentityCommand({
-          RoleArn: `arn:aws:iam::${platformConfig.awsAccountId}:role/${platformConfig.awsRoleToAssume}`,
-          RoleSessionName: 'GitHubActions',
-          DurationSeconds: 15 * 60,
-          WebIdentityToken: webIdentityToken
-        }))
-      })
-      .then(responseData => ({
-        // Don't ask
-        AccessKeyId: responseData.Credentials.AccessKeyId,
-        SessionToken: responseData.Credentials.SessionToken,
-        SecretAccessKey: responseData.Credentials.SecretAccessKey,
-        accessKeyId: responseData.Credentials.AccessKeyId,
-        sessionToken: responseData.Credentials.SessionToken,
-        secretAccessKey: responseData.Credentials.SecretAccessKey
-      }))
-      .then(x => AwsCredentialsService.exportCredentialsToGithubWorkflow({ ...x, awsRegion: platformConfig.awsRegion }))
-      .catch(error => {
-        logError({ message: '[AwsCredentialsService] Could not resolve temporary credentials', error })
-        return undefined
-      })
-  }
-
-  static exportCredentialsToGithubWorkflow(params) {
-    // Configure the AWS CLI and AWS SDKs using environment variables and set them as secrets.
-    // Setting the credentials as secrets masks them in Github Actions logs
-    const { accessKeyId, secretAccessKey, sessionToken, awsRegion } = params
-
-    // AWS_ACCESS_KEY_ID:
-    // Specifies an AWS access key associated with an IAM user or role
-    core.setSecret(accessKeyId)
-    core.exportVariable('AWS_ACCESS_KEY_ID', accessKeyId)
-
-    // AWS_SECRET_ACCESS_KEY:
-    // Specifies the secret key associated with the access key. This is essentially the "password" for the access key.
-    core.setSecret(secretAccessKey)
-    core.exportVariable('AWS_SECRET_ACCESS_KEY', secretAccessKey)
-
-    // AWS_SESSION_TOKEN:
-    // Specifies the session token value that is required if you are using temporary security credentials.
-    if (sessionToken) {
-      core.setSecret(sessionToken)
-      core.exportVariable('AWS_SESSION_TOKEN', sessionToken)
-    } else if (process.env.AWS_SESSION_TOKEN) {
-      // clear session token from previous credentials action
-      core.exportVariable('AWS_SESSION_TOKEN', '')
-    }
-
-    if (awsRegion) {
-      core.exportVariable('AWS_REGION', awsRegion)
-    } else if (process.env.AWS_REGION) {
-      // clear AWS_REGION from previous credentials action
-      core.exportVariable('AWS_REGION', '')
-    }
-
-    return params
-  }
-
-}
-
-module.exports = {
-  AwsCredentialsService
-}

package/src/aws-credentials/cli.js

@@ -1,55 +0,0 @@
-const arg = require('arg')
-const { AwsCredentialsService } = require('./aws-credentials')
-const { PlatformTemplateService } = require('../template')
-const { PlatformConfigService } = require('../config')
-const { logInfo, logError } = require('../log')
-
-const resolveCredentials = options => {
-  logInfo({ message: 'resolve-credentials' })
-
-  const parsedArgs = arg({
-    '--access-key-id': String,
-    '--session-token': String,
-    '--secret-access-key': String
-  }, { argv: options })
-
-  AwsCredentialsService.exportCredentialsToGithubWorkflow({
-    accessKeyId: parsedArgs['--access-key-id'],
-    sessionToken: parsedArgs['--session-token'],
-    secretAccessKey: parsedArgs['--secret-access-key']
-  })
-}
-
-const assumeRole = options => {
-  logInfo({ message: 'assume-role' })
-
-  const parsedArgs = arg({
-    '--platforms': String,
-    '--target-platform': String
-  }, { argv: options })
-
-  const platformName = parsedArgs['--target-platform'] || ''
-
-  PlatformTemplateService.readFromFile(parsedArgs['--platforms'] || process.env.PLATFORMS)
-    .then(templates => templates.map(PlatformConfigService.from))
-    .then(configs => configs.find(x => x.platformName === platformName))
-    .then(targetConfig => {
-
-      if (!targetConfig) {
-        return logError({ message: 'No configuration found' })
-      }
-
-      AwsCredentialsService.resolveAwsCredentials(targetConfig)
-        .then(() => logInfo({ message: `Assumed role for ${targetConfig.platformName}` }))
-
-    })
-
-}
-
-module.exports = {
-  handler: ([command, ...options]) => {
-    !!command
-      ? { 'resolve-credentials': resolveCredentials, 'assume-role': assumeRole }[command](options)
-      : logError({ message: 'No command provided' })
-  }
-}

package/src/aws-credentials/index.js

@@ -1 +0,0 @@
-module.exports = require('./aws-credentials')

package/src/index.cli.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env node
-/* eslint-disable global-require, no-unused-vars */
-
-const [_, __, handlerName, ...restArgs] = process.argv
-
-const loadHandler = {
-  aws: () => require('./aws-credentials/cli.js'),
-  template: () => require('./template/cli.js'),
-}[handlerName]
-
-!!loadHandler && loadHandler().handler(restArgs)

package/src/infrastructure/container-deployment-target/ossy-website-ossy.service.js

@@ -1,52 +0,0 @@
-// TODO: remove this service once ossy.se traffic flows through the platform runtime.
-// The platform runtime (ghcr.io/ossy-se/platform) is the long-term host for all
-// tenant sites including ossy.se. This service is a stopgap while the CMS-based
-// publish flow is validated in production.
-
-const systemdServiceFile = `
-[Unit]
-Description=Ossy Website (ossy.se)
-After=network.target docker.service
-Requires=docker.service
-
-[Service]
-EnvironmentFile=/etc/environment
-ExecStartPre=-/usr/bin/docker rm -f ossy-website-ossy
-ExecStartPre=/usr/bin/docker pull ghcr.io/ossy-se/website-ossy:latest
-ExecStart=/usr/bin/docker run --name ossy-website-ossy \\
-  --network ossy-network \\
-  -p 3002:3000 \\
-  -e PORT=3000 \\
-  -e OSSY_API_URL=http://ossy-api:3001 \\
-  -e OSSY_COOKIE_SECRET=\${OSSY_COOKIE_SECRET} \\
-  ghcr.io/ossy-se/website-ossy:latest
-ExecStop=/usr/bin/docker stop ossy-website-ossy
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-`
-
-/**
-  * @class
-*/
-class OssyWebsiteOssyService {
-
-  static install() {
-    return [`sudo tee /etc/systemd/system/ossy-website-ossy.service > /dev/null << 'EOF'\n${systemdServiceFile}\nEOF`]
-  }
-
-  static enable() {
-    return ['sudo systemctl enable ossy-website-ossy']
-  }
-
-  static start() {
-    return ['sudo systemctl start ossy-website-ossy']
-  }
-
-}
-
-module.exports = {
-  OssyWebsiteOssyService
-}

package/src/infrastructure/container-deployment-target/ossy-website-plexus-sanitas.service.js

@@ -1,52 +0,0 @@
-// TODO: remove this service once www.plexus-sanitas.com traffic flows through the platform runtime.
-// The platform runtime (ghcr.io/ossy-se/platform) is the long-term host for all
-// tenant sites including plexus-sanitas. This service is a stopgap while the CMS-based
-// publish flow is validated in production.
-
-const systemdServiceFile = `
-[Unit]
-Description=Ossy Website (www.plexus-sanitas.com)
-After=network.target docker.service
-Requires=docker.service
-
-[Service]
-EnvironmentFile=/etc/environment
-ExecStartPre=-/usr/bin/docker rm -f ossy-website-plexus-sanitas
-ExecStartPre=/usr/bin/docker pull ghcr.io/ossy-se/website-plexus-sanitas:latest
-ExecStart=/usr/bin/docker run --name ossy-website-plexus-sanitas \\
-  --network ossy-network \\
-  -p 3003:3000 \\
-  -e PORT=3000 \\
-  -e OSSY_API_URL=http://ossy-api:3001 \\
-  -e OSSY_COOKIE_SECRET=\${OSSY_COOKIE_SECRET} \\
-  ghcr.io/ossy-se/website-plexus-sanitas:latest
-ExecStop=/usr/bin/docker stop ossy-website-plexus-sanitas
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-`
-
-/**
-  * @class
-*/
-class OssyWebsitePlexusSanitasService {
-
-  static install() {
-    return [`sudo tee /etc/systemd/system/ossy-website-plexus-sanitas.service > /dev/null << 'EOF'\n${systemdServiceFile}\nEOF`]
-  }
-
-  static enable() {
-    return ['sudo systemctl enable ossy-website-plexus-sanitas']
-  }
-
-  static start() {
-    return ['sudo systemctl start ossy-website-plexus-sanitas']
-  }
-
-}
-
-module.exports = {
-  OssyWebsitePlexusSanitasService
-}

package/src/infrastructure/trust-ci-stack.js

@@ -1,76 +0,0 @@
-const { Stack, Duration, CfnOutput } = require('aws-cdk-lib')
-const {
-  OpenIdConnectProvider,
-  OpenIdConnectPrincipal,
-  Role,
-  Effect,
-  PolicyDocument,
-  PolicyStatement
-} = require('aws-cdk-lib/aws-iam')
-
-/**
-  * @class
-*/
-class TrustCiStack extends Stack {
-  /**
-   * Establishes trust between GithHub and Amazon Web Services.
-   * This is needed so that we can interact with Amazon Web Services through
-   * GitHub Actions without having to manually provide credentials every time we
-   * run a workflow
-   *
-   * @param {object} scope - scope
-   * @param {string} id - id
-   * @param {PlatformTemplate} props - PlatformTemplate
-   */
-  constructor(scope, id, props) {
-    super(scope, id, props)
-
-    const provider = new OpenIdConnectProvider(this, 'GitHubProvider', {
-      url: 'https://token.actions.githubusercontent.com',
-      clientIds: ['sts.amazonaws.com']
-    })
-
-    const GitHubPrincipal = new OpenIdConnectPrincipal(provider)
-      .withConditions({
-        StringLike: {
-          'token.actions.githubusercontent.com:sub': `repo:${props.config.ciGithubActionsRepo}:*`
-        },
-        StringEquals: {
-            'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com'
-        }
-      })
-
-    // eslint-disable-next-line no-new
-    const role = new Role(this, 'GitHubActionsRole', {
-      assumedBy: GitHubPrincipal,
-      description: 'Role assumed by GitHubPrincipal for deploying from CI using aws cdk',
-      maxSessionDuration: Duration.hours(1),
-      inlinePolicies: {
-        CdkDeploymentPolicy: new PolicyDocument({
-          assignSids: true,
-          statements: [
-            new PolicyStatement({
-              effect: Effect.ALLOW,
-              actions: ['sts:AssumeRole', 'sqs:SendMessage'],
-              resources: [
-                `arn:aws:iam::${props.config.awsAccountId}:role/cdk-*`,
-                `arn:aws:sqs:${props.config.awsRegion}:${props.config.awsAccountId}:*`
-              ]
-            })
-          ]
-        })
-      }
-    })
-
-    new CfnOutput(this, 'CiAwsRoleToAssume', {
-      value: role.roleName,
-      description: 'Name of role to be assumed in CI/CD pipelines on github',
-      exportName: 'awsRoleToAssume'
-    })
-
-  }
-}
-
-module.exports = {
-  TrustCiStack
-}

package/src/template/cli.js

@@ -1,24 +0,0 @@
-const arg = require('arg')
-const { PlatformTemplateService } = require('./platform-template')
-
-const { logInfo, logError } = require('../log')
-
-const validate = options => {
-  logInfo({ message: 'Running validate command' })
-
-  const parsedArgs = arg({
-    '--platforms': String,
-    '-p': '--platforms'
-  }, { argv: options })
-
-  PlatformTemplateService.readFromFile(parsedArgs['--platforms'])
-    .then(() => logInfo({ message: 'Template is valid' }))
-}
-
-module.exports = {
-  handler: ([command, ...options]) => {
-    !!command
-      ? { validate }[command](options)
-      : logError({ message: 'No command provided' })
-  }
-}