@ossy/deployment-tools 3.0.8 → 3.1.0

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.1.0](https://github.com/ossy-se/ossy/compare/v3.0.9...v3.1.0) (2026-08-12)
+
+### Features
+
+* **deployment-tools:** add CloudFront WAF and ACM edge in front of ALB ([#574](https://github.com/ossy-se/ossy/issues/574)) ([2dd1a69](https://github.com/ossy-se/ossy/commit/2dd1a69f4facfcbcc0e30c931915e6d58c916ad7))
+* **deployment-tools:** add ECS Fargate and ALB for platform services ([#573](https://github.com/ossy-se/ossy/issues/573)) ([42ef998](https://github.com/ossy-se/ossy/commit/42ef9986a1f96b422f0351b311e906dadd4db26b)), closes [#557](https://github.com/ossy-se/ossy/issues/557) [#572](https://github.com/ossy-se/ossy/issues/572) [#560](https://github.com/ossy-se/ossy/issues/560)
+* **deployment-tools:** add per-service Secrets Manager secrets ([#572](https://github.com/ossy-se/ossy/issues/572)) ([021ad55](https://github.com/ossy-se/ossy/commit/021ad5535d20722c819c154f41239bf8e583b9c3)), closes [#555](https://github.com/ossy-se/ossy/issues/555)
+* **deployment-tools:** cut over DNS to CloudFront and retire EC2/Caddy ([#570](https://github.com/ossy-se/ossy/issues/570)) ([99c4323](https://github.com/ossy-se/ossy/commit/99c43236adfee4ea68534f3245d2d9d420c51ce4)), closes [#560](https://github.com/ossy-se/ossy/issues/560) [#560](https://github.com/ossy-se/ossy/issues/560)
+
+
+## 3.0.9 (2026-08-11)
+
+**Note:** Version bump only for package @ossy/deployment-tools
+
+
+
+
+
 ## 3.0.8 (2026-08-07)
 
 **Note:** Version bump only for package @ossy/deployment-tools

package/README.md

@@ -1,34 +1,39 @@
 # @ossy/deployment-tools
 
-Infrastructure and CDK tooling for the Ossy platform EC2 host.
+Infrastructure and CDK tooling for the Ossy platform.
 
-The host runs Caddy as a reverse proxy plus several Docker containers managed by systemd. Apps are deployed by running `ossy app publish`.
+**Architecture** (epic #553): **CloudFront → WAF → ALB → ECS Fargate**, with per-service Secrets Manager and GitHub Actions rollouts via OIDC. EC2 + Caddy + EIP are **removed from CDK** (#560).
 
 ## Architecture
 
 ```
-Internet → Caddy (:443)
-             ├── api.ossy.se          → ossy-api (:3001)
-             ├── ossy.se              → ossy-website-ossy (:3002)  ← temporary
-             ├── www.plexus-sanitas.com → ossy-website-plexus-sanitas (:3003)  ← temporary
-             └── *.* (on-demand TLS)  → ossy-platform (:3000)
-                                           └── loads build from CMS on first request
+Internet → CloudFront (ACM TLS, us-east-1) → WAF → ALB (:80)
+             ├── host rules from platforms.json `services[].hosts|domain`
+             │     e.g. ossy.se, api.ossy.se → website-ossy Fargate service
+             ├── other known hosts / *.ossy.se → platform-runtime Fargate service
+             └── default action → platform-runtime
 ```
 
-Caddy uses **on-demand TLS**: before issuing a certificate for any domain, it calls `GET http://localhost:3001/api/v0/apps/ask?domain=<domain>`. If the domain is registered (i.e. `ossy app publish` has been run for it), Caddy issues the cert and proxies to the platform runtime.
+- Website images include the API — **no** separate `ossy-api` service.
+- Task definitions inject env from Secrets Manager (`{platform}/{serviceKey}`) and pull images from GHCR using `{platform}/ghcr-pull`.
+- Health checks use `GET /health` on each target group.
+- App CloudFront is **separate** from the `/media` CloudFront in `storage-static`.
+- Viewer `Host` is forwarded to the ALB (`OriginRequestPolicy.ALL_VIEWER`) so host rules match.
+- ACM terminates TLS at CloudFront; Caddy is not part of this path.
+- Route53 for known domains aliases to CloudFront (A + AAAA), not an Elastic IP.
 
-## Services
+Customer nameserver / custom-domain handoff at a registrar is **out of scope** (follow-up).
 
-All services run as Docker containers managed by systemd. Service files are written to the EC2 host by CDK user data at instance creation.
+## Health checks (ALB / ECS)
 
-| Service | Unit file | Port | Image |
-|---|---|---|---|
-| Caddy | `caddy-route53.service` | 80, 443 | — |
-| Ossy API | `ossy-api.service` | 3001 | `ghcr.io/ossy-se/api:latest` |
-| Ossy Platform | `ossy-runtime.service` | 3000 | `ghcr.io/ossy-se/platform:latest` |
-| _configured via `services`_ | `<name>.service` | _per config_ | _per config_ |
+Every deployable Ossy HTTP image exposes an unauthenticated liveness probe at **`GET /health`** (also accepts `HEAD`). It returns `200` when the Node process can accept traffic.
 
-Additional services are generated automatically from the `services` array in `platforms.json` — see the Configuration section below.
+| Image | How `/health` is provided |
+|---|---|
+| `ghcr.io/ossy-se/platform` (runtime) | Built into `@ossy/platform` `startRuntime` — does not load a CMS site |
+| Website / app images (`website-ossy`, other `services[]`) | Built into `@ossy/platform` `startServer` (and/or a local `health.api.js` until the platform package is bumped) |
+
+Use path `/health` for ALB target-group and ECS container health checks. Do not point probes at `/`, `/status`, or authenticated routes.
 
 ## Configuration — `platforms.json`
 
@@ -38,101 +43,179 @@ Additional services are generated automatically from the `services` array in `pl
 |---|---|---|
 | `platformName` | Yes | Unique name, used as the CDK stage name and CloudFormation stack prefix |
 | `awsAccountId` | Yes | AWS account ID |
-| `awsKeyPairName` | Yes | EC2 key pair name for SSH access |
-| `awsInstanceClass` | No | EC2 instance class (e.g. `t3`, `t4g`, `m5`). Defaults to `t3` |
-| `awsInstanceSize` | No | EC2 instance size (e.g. `small`, `medium`, `large`). Defaults to `small` |
+| `awsRegion` | No | Defaults to `eu-north-1` |
 | `sesDomains` | No | Domains to configure SES email identity for |
-| `domains` | No | Domains to create Route53 A records for, pointing to the EC2 Elastic IP. Supports wildcards (e.g. `*.ossy.se`). |
-| `services` | No | Per-platform container services (see below) |
+| `domains` | No | Domains for Route53 aliases → CloudFront and ACM coverage. Supports wildcards (e.g. `*.ossy.se`). |
+| `services` | No | Per-platform HTTP container services (see below) |
 | `dnsRecords` | No | Additional DNS records by root domain (currently supports MX) |
-| `env` | No | Environment variables written to `/etc/environment` on the EC2 host at boot. **Never uploaded to S3.** |
-
-### `services` — container/domain mapping
+| `env` | No | Env vars upserted into per-service Secrets Manager secrets (`npm run sync-secrets`). **Never uploaded to S3.** Values remain in git for now. |
+| `githubDeployRepos` | Yes (for `platform-ci`) | `owner/repo` list trusted by the GitHub OIDC deploy role. Set in `platforms.json` (e.g. `ossy-se/ossy`, `ossy-se/website-ossy`). |
+| `awsKeyPairName` / `awsInstanceClass` / `awsInstanceSize` | No | **Unused** after EC2 decommission (#560). Harmless if left in JSON. |
 
-Services come in two flavours: **HTTP** (routed through Caddy) and **TCP/UDP** (raw socket, bypasses Caddy). Both generate a systemd unit that pulls the image on every restart and forwards `/etc/environment` to the container.
+### `services` — HTTP containers on ECS
 
-#### HTTP service (default)
-
-Generates a Caddy reverse-proxy block with Route53 TLS. The container must listen on port 3000.
+HTTP services (default) become Fargate services with ALB host rules. The container must listen on port 3000.
 
 ```json
 "services": [
   {
     "name": "ossy-website-ossy",
     "domain": "ossy.se",
-    "image": "ghcr.io/ossy-se/website-ossy:latest"
+    "image": "ghcr.io/ossy-se/website-ossy:latest",
+    "hosts": ["ossy.se", "api.ossy.se"]
   }
 ]
 ```
 
 | Field | Description |
 |---|---|
-| `name` | Unique service name — Docker container name and systemd unit (`<name>.service`). |
-| `domain` | Hostname routed by Caddy to this container (Route53 TLS via `dns route53`). |
-| `image` | Docker image to pull and run. |
+| `name` | Unique service name — Secrets Manager / ECS key strips a leading `ossy-` (`website-ossy`). |
+| `domain` | Primary hostname (default ALB host when `hosts` is omitted). |
+| `hosts` | Optional ALB host-header list. Example: `["ossy.se","api.ossy.se"]` so the website image serves apex and API host. Defaults to `[domain]`. |
+| `image` | Docker image to pull and run (GHCR). |
 
-Host ports are auto-assigned starting at `3002`, counting only HTTP services (TCP entries are skipped). Appending new HTTP entries is safe; avoid reordering existing ones.
+**Built-in (always present):**
+- `runtime` — platform runtime (`ghcr.io/ossy-se/platform:latest`) serving CMS-published apps; ALB default + unclaimed `domains`.
 
-#### TCP/UDP service
+**Not deployed:** separate `ossy-api` container; TCP/UDP `services[]` entries (ignored by the ECS path).
 
-No Caddy block. Ports are mapped directly (`HOST:CONTAINER`) and opened in the EC2 security group. Use this for game servers or any other raw socket protocol.
+**Wildcard subdomains:** Add `*.ossy.se` to `domains` for a Route53 wildcard alias to CloudFront.
 
-```json
-"services": [
-  {
-    "name": "minecraft",
-    "type": "tcp",
-    "image": "itzg/minecraft-server",
-    "ports": [25565],
-    "protocol": "tcp"
-  }
-]
+`MEDIA_REPOSITORY` and `MEDIA_CDN_DOMAIN_NAME` are derived from the provisioned S3 bucket and media CloudFront — do not set them in `env`.
+
+To add a new platform, add an entry to `platforms.json`. No bucket name or CDN domain is needed; these are auto-generated by CloudFormation.
+
+## Platform secrets (Secrets Manager)
+
+Each platform service gets **one** Secrets Manager secret (JSON object of env keys). Values still live in `platforms.json` for now; CDK owns the secret resources and IAM, and deploy upserts values.
+
+| Secret name | Source |
+|---|---|
+| `{platform}/runtime` | Built-in platform-runtime |
+| `{platform}/website-ossy` | HTTP entry in `services[]` named `ossy-website-ossy` (leading `ossy-` stripped) |
+| `{platform}/…` | Other HTTP `services[]` entries |
+
+**Not created:** `ossy-api`. TCP/UDP `services[]` entries are skipped.
+
+Each secret has a matching IAM role `{platform}-{key}-task` assumed by `ecs-tasks.amazonaws.com` with read access to that secret only.
+
+Also created: `{platform}/ghcr-pull` — Docker Hub-style credentials JSON (`username` + `password` PAT with `read:packages`) for private GHCR pulls. **Not** filled by `sync-secrets`; set manually once after the secrets stack deploys.
+
+### Sync values after CDK deploy
+
+```bash
+cd packages/deployment-tools
+
+# Create / update secret resources + IAM (part of the stage)
+npx cdk deploy 'ossybot/platform-secrets' --profile ossybot
+
+# Upsert secret *values* from platforms.json (never prints secret contents)
+npm run sync-secrets -- --profile ossybot
+
+# Optional: one platform, or dry-run
+npm run sync-secrets -- --profile ossybot --platform ossybot
+npm run sync-secrets -- --dry-run
 ```
 
-| Field | Description |
+Do **not** remove secrets from `platforms.json` yet.
+
+## ECS Fargate + ALB
+
+```bash
+cd packages/deployment-tools
+
+# Secrets + IAM first, then sync values + set ghcr-pull
+npx cdk deploy 'ossybot/platform-secrets' --profile ossybot
+npm run sync-secrets -- --profile ossybot
+# then put GHCR credentials into ossybot/ghcr-pull
+
+# VPC, cluster, Fargate services, ALB host rules
+npx cdk deploy 'ossybot/platform-ecs' --profile ossybot
+```
+
+| Resource | Notes |
 |---|---|
-| `name` | Unique service name — Docker container name and systemd unit. |
-| `type` | Must be `"tcp"` to enable this mode. |
-| `image` | Docker image to pull and run. |
-| `ports` | Array of port numbers to expose on the host and open in the security group. |
-| `protocol` | `"tcp"` (default), `"udp"`, or `"both"`. |
+| VPC | Public + private subnets, 1 NAT gateway |
+| ECS cluster | `{platform}-platform` |
+| Fargate services | `runtime` (`ghcr.io/ossy-se/platform:latest`) + each HTTP `services[]` entry |
+| ALB | Internet-facing HTTP :80; host rules; default → runtime; health check `/health` |
+| Task env | Secrets Manager JSON keys from `platforms.json` `env`; `MEDIA_*` from storage stack |
 
-**Fixed built-in services** (always present, not configurable via `services`):
-- `ossy-api` — the Ossy API (`ghcr.io/ossy-se/api:latest`, port 3001)
-- `ossy-runtime` — the platform runtime serving all CMS-published apps (`ghcr.io/ossy-se/platform:latest`, port 3000, catch-all)
+## CloudFront + WAF + ACM
 
-**Custom domains**: For customer-owned domains (e.g. `woodhill.com`), the customer adds an A record pointing to the Elastic IP at their registrar. No infrastructure change needed — Caddy's on-demand TLS issues the cert automatically once the domain is registered via `ossy app publish`.
+App traffic uses its own CloudFront distribution (do **not** overload the `/media` CDN). The edge stack is deployed in **`us-east-1`** because CloudFront viewer certificates and `CLOUDFRONT`-scope WAFv2 web ACLs must live there.
 
-**Wildcard subdomains**: Add `*.ossy.se` to `domains` for a Route53 wildcard A record. This covers any `*.ossy.se` subdomain without individual records.
+```bash
+# After platform-ecs exists (ALB DNS used as origin)
+npx cdk deploy 'ossybot/platform-edge' --profile ossybot
 
-`MEDIA_REPOSITORY` and `MEDIA_CDN_DOMAIN_NAME` are derived automatically from the provisioned S3 bucket and CloudFront distribution — do not set them in `env`.
+# DNS aliases for known domains → CloudFront
+npx cdk deploy 'ossybot/dns' --profile ossybot
+```
 
-To add a new platform, add an entry to `platforms.json`. No bucket name or CDN domain is needed; these are auto-generated by CloudFormation.
+| Piece | Detail |
+|---|---|
+| Origin | ALB DNS name from `platform-ecs` (`LoadBalancerDnsName`), HTTP :80 |
+| Certificate | ACM in `us-east-1`, DNS-validated; covers `domains` + HTTP service hosts (apex + `*.ossy.se` etc.) |
+| WAF | WAFv2 web ACL (`AWSManagedRulesCommonRuleSet` + `KnownBadInputs`) associated via `webAclId` |
+| Cache | `CACHING_DISABLED` + `ALL_VIEWER` origin request policy (forwards `Host`) |
+| DNS | Route53 alias A/AAAA for known domains → CloudFront |
+
+## Release to ECS from GitHub Actions
+
+Images stay on **GHCR**. After a push to `main`, Publish workflows tag the image with the git SHA (and `:latest`), assume the platform deploy role via **GitHub OIDC** (no long-lived AWS keys), register a new task definition revision with the SHA tag, and update the ECS service.
+
+```bash
+# After platform-ecs exists — creates OIDC provider + deploy role
+npx cdk deploy 'ossybot/platform-ci' --profile ossybot
+```
+
+| Piece | Detail |
+|---|---|
+| Role | `{platform}-github-deploy` (e.g. `ossybot-github-deploy`) |
+| Trust | OIDC `token.actions.githubusercontent.com`, `sub` = `repo:<owner>/<repo>:ref:refs/heads/main` for each entry in `platforms.json` → `githubDeployRepos` |
+| Cluster / services | `{platform}-platform` / `{platform}-{serviceKey}` (e.g. `ossybot-runtime`, `ossybot-website-ossy`) |
+| Image tags | `ghcr.io/ossy-se/<image>:latest` and `:<git-sha>` |
+| Workflows | each trusted repo’s Publish workflow rolls its ECS service |
+
+Add another deploy source by appending `owner/repo` to `githubDeployRepos` and redeploying `platform-ci`. Deploy that stack once before the first Actions rollout. Workflows wait for ECS service stability after update.
 
 ## CDK Stacks
 
-Each platform is a CDK `Stage` containing five stacks:
+Each platform is a CDK `Stage` containing these stacks:
 
 | Stack | Description |
 |---|---|
-| `storage-static` | S3 bucket (auto-named), daily backup plan, CloudFront CDN for `/media`. Kept separate from the EC2 stack so storage resources are never touched during instance updates. |
-| `deployment-target` | EC2 instance with Elastic IP. Imports the S3 bucket from `storage-static` via cross-stack reference. |
-| `dns` | Route53 A records for all domains in `platforms.json`, pointing to the Elastic IP. |
+| `storage-static` | S3 bucket (auto-named), daily backup plan, CloudFront CDN for `/media`. |
+| `platform-secrets` | Secrets Manager secrets per service + ECS task roles (read IAM) + `ghcr-pull`. Values synced from `platforms.json` via `npm run sync-secrets`. |
+| `platform-ecs` | VPC, ECS Fargate services, ALB with host-based routing. |
+| `platform-ci` | GitHub OIDC provider + `{platform}-github-deploy` IAM role for ECS rollouts from Actions. |
+| `platform-edge` | CloudFront + WAF + ACM in `us-east-1` in front of the ALB. |
+| `dns` | Route53 alias records for known domains → CloudFront app distribution. |
 | `ses` | SES email sending identity and DKIM records. |
 
-The Elastic IP ensures the EC2 instance can be replaced (instance type changes, user data updates) without breaking DNS or CloudFormation cross-stack exports.
+### Cutover / decommission EC2 (#560)
+
+CDK no longer synthesizes `deployment-target` (EC2 + EIP + Caddy + systemd units). After `platform-edge` and `dns` are live and traffic is healthy:
+
+```bash
+# Destroy the leftover CloudFormation stack (name may be stage-prefixed)
+npx cdk destroy 'ossybot/deployment-target' --profile ossybot
+# or, if the stack still exists outside the app:
+# aws cloudformation delete-stack --stack-name ossybot-deployment-target --profile ossybot
+```
+
+Downtime during cutover is acceptable. Confirm known domains resolve to CloudFront before destroying EC2.
 
 ## Bootstrapping a new platform
 
 ```bash
 cd packages/deployment-tools
 npx cdk deploy 'ossybot/**' --profile ossybot --require-approval never
+npm run sync-secrets -- --profile ossybot
+# set {platform}/ghcr-pull credentials once
 ```
 
-CDK provisions the instance, writes all service files, writes `/etc/environment` from `platforms.json`, and starts all services automatically. No manual SSH steps are required.
-
-> Note: EC2 user data only runs on **first boot**. To apply infrastructure changes to an existing instance you must terminate and recreate it, or SSH in and apply changes manually.
-
 ## Deploying changes
 
 Target a single platform:
@@ -157,32 +240,18 @@ npx cdk list
 
 ## Redeploying after a code change
 
-All services pull the latest image from GHCR on every restart — no manual build step needed.
-
-```bash
-# API — push to main triggers CI → ghcr.io/ossy-se/api:latest
-sudo systemctl restart ossy-api
-
-# Platform runtime — merge to main in ossy monorepo → ghcr.io/ossy-se/platform:latest
-sudo systemctl restart ossy-runtime
-
-# website-ossy — push to main in website-ossy repo → ghcr.io/ossy-se/website-ossy:latest
-sudo systemctl restart ossy-website-ossy
-
-# website-plexus-sanitas — push to main → ghcr.io/ossy-se/website-plexus-sanitas:latest
-sudo systemctl restart ossy-website-plexus-sanitas
-```
+Merge to `main` — Publish workflows push GHCR tags (`:latest` + `:<sha>`) and roll the matching ECS service. No SSH / `systemctl`.
 
 ## Environment variables
 
-Defined in the `env` block of `platforms.json`, written to `/etc/environment` at boot. The following variables are injected automatically by CDK and should **not** be set manually:
+Defined in the `env` block of `platforms.json`, synced into Secrets Manager. The following are injected automatically by the ECS stack and should **not** be set manually:
 
 | Variable | Source |
 |---|---|
 | `MEDIA_REPOSITORY` | S3 bucket name from `storage-static` stack |
 | `MEDIA_CDN_DOMAIN_NAME` | CloudFront domain from `storage-static` stack |
 
-All other env vars:
+Other common env vars:
 
 | Variable | Used by | Description |
 |---|---|---|
@@ -198,32 +267,10 @@ All other env vars:
 
 ## Useful commands
 
-**SSH into instance**
-```bash
-ssh -i path/to/keys ubuntu@<elastic-ip>
-```
-
-**View service logs**
-```bash
-journalctl -u ossy-runtime.service -n 200 -f
-journalctl -u ossy-api.service -n 200 -f
-journalctl -u ossy-website-ossy.service -n 200 -f
-journalctl -u caddy-route53.service -n 200 -f
-```
-
-**View running containers**
 ```bash
-docker ps
-```
-
-**View container logs**
-```bash
-docker logs ossy-runtime
-docker logs ossy-api
-docker logs ossy-website-ossy
-```
-
-**Reload Caddy config**
-```bash
-sudo systemctl reload caddy-route53.service
+cd packages/deployment-tools
+npm test
+npx cdk list
+npx cdk diff 'ossybot/**' --profile ossybot
+npm run sync-secrets -- --profile ossybot --dry-run
 ```

package/jest.config.js

@@ -0,0 +1,5 @@
+/** @type {import('jest').Config} */
+module.exports = {
+  testEnvironment: 'node',
+  testMatch: ['**/src/**/*.spec.js'],
+}

package/package.json

@@ -1,18 +1,20 @@
 {
   "name": "@ossy/deployment-tools",
-  "version": "3.0.8",
+  "version": "3.1.0",
   "description": "Collection of scripts and tools to aid deployment of containers and static files to Amazon Web Services through GitHub Actions",
   "source": "./src/index.js",
   "main": "./src/index.js",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 0",
+    "test": "NODE_OPTIONS=--experimental-vm-modules jest",
     "build": "echo \"The build step is not required when using JavaScript!\" && exit 0",
     "build:docs": "jsdoc -c jsdoc.config.js",
-    "cdk": "cdk"
+    "cdk": "cdk",
+    "sync-secrets": "node ./src/secrets/sync-platform-secrets.js"
   },
   "author": "Ossy",
   "license": "ISC",
   "dependencies": {
+    "@aws-sdk/client-secrets-manager": "^3.0.0",
     "aws-cdk": "^2.73.0",
     "aws-cdk-lib": "^2.73.0",
     "constructs": "^10.1.304",
@@ -22,5 +24,5 @@
   "devDependencies": {
     "jest": "^30.4.2"
   },
-  "gitHead": "980b380c9dee0de78ef3ebabe86efcec1c223a9a"
+  "gitHead": "9b146fb6fd9769f800863806c5bd16016508b218"
 }

package/src/config/platform-config.js

@@ -3,31 +3,31 @@
  * @typedef {Object} PlatformConfig
  * @property {string} platformName - Name of platform
  * @property {string[]=} sesDomains - list of domains to configure AWS SES email identity and DKIM records for
- * @property {string[]=} domains - list of domains to create Route53 A records for, pointing to the EC2 host
+ * @property {string[]=} domains - list of domains for Route53 aliases (CloudFront app edge) and ACM coverage
  * @property {object} dnsRecords - map of dns records by root domain, only supports MX records so that we can add dns records for our email service
- * @property {Array<HttpServiceConfig|TcpServiceConfig>=} services - per-platform container services; each entry generates a systemd unit. HTTP services also get a Caddy reverse-proxy block. TCP/UDP services get direct port exposure and security group rules instead.
+ * @property {Array<HttpServiceConfig|TcpServiceConfig>=} services - per-platform container services. HTTP entries become ECS Fargate services + ALB host rules. TCP/UDP entries are ignored by the ECS path (not deployed).
+ * @property {Record<string,string>=} env - environment variables upserted into per-service Secrets Manager secrets via `npm run sync-secrets`. Never uploaded to S3. Values stay in git for now (#555).
+ * @property {string} awsAccountId - Aws account id
+ * @property {string=} awsRegion - AWS region, defaults to eu-north-1
+ * @property {string=} awsKeyPairName - unused after EC2 decommission (#560); ignored by CDK
+ * @property {string=} awsInstanceClass - unused after EC2 decommission (#560); ignored by CDK
+ * @property {string=} awsInstanceSize - unused after EC2 decommission (#560); ignored by CDK
+ * @property {string[]=} githubDeployRepos - `owner/repo` list trusted by the GitHub OIDC deploy role (#559); required for platform-ci, set in platforms.json
+ * @property {string=} ciDockerNetworkName - ?
  *
  * @typedef {Object} HttpServiceConfig
  * @property {'http'} [type]    - defaults to 'http' when omitted
- * @property {string} name      - unique service name (container + systemd unit)
- * @property {string} domain    - hostname routed by Caddy to this container
+ * @property {string} name      - unique service name (ECS service key derived by stripping leading `ossy-`)
+ * @property {string} domain    - primary hostname (default ALB host when `hosts` omitted)
+ * @property {string[]=} hosts  - ALB host-header values (#557); defaults to `[domain]`
  * @property {string} image     - Docker image (e.g. ghcr.io/ossy-se/website-ossy:latest)
  *
  * @typedef {Object} TcpServiceConfig
- * @property {'tcp'} type       - marks a raw socket service; bypasses Caddy entirely
- * @property {string} name      - unique service name (container + systemd unit)
+ * @property {'tcp'} type       - raw socket service; not deployed on the ECS path (#560)
+ * @property {string} name      - unique service name
  * @property {string} image     - Docker image (e.g. itzg/minecraft-server)
- * @property {number[]} ports   - ports to open on the host and in the EC2 security group
+ * @property {number[]} ports   - ports (unused by current CDK stacks)
  * @property {'tcp'|'udp'|'both'} [protocol] - defaults to 'tcp'
- * @property {Record<string,string>=} env - environment variables written to /etc/environment on the EC2 host at boot time; never uploaded to S3
- *
- * @property {string} awsAccountId - Aws account id
- * @property {string=} awsRegion - AWS region, defaults to eu-north-1
- * @property {string=} awsKeyPairName - EC2 key pair name for SSH access
- * @property {string=} awsInstanceClass - EC2 instance class (e.g. t3, t4g, m5), defaults to t3
- * @property {string=} awsInstanceSize - EC2 instance size (e.g. small, medium, large), defaults to small
- *
- * @property {string=} ciDockerNetworkName - ?
  */
 
 const SupportedRegions = {

package/src/ecs/platform-ecs-services.js

@@ -0,0 +1,111 @@
+/**
+ * ECS/Fargate service targets derived from platforms.json.
+ *
+ * Service set and naming come from shared `platform-services`. No separate
+ * `ossy-api` — API lives in website images. TCP/UDP entries are skipped (not
+ * part of the ECS path after #560).
+ */
+
+const {
+  listHttpServiceEntries,
+  listPlatformServices,
+} = require('../services/platform-services')
+
+const RUNTIME_IMAGE = 'ghcr.io/ossy-se/platform:latest'
+const CONTAINER_PORT = 3000
+
+/**
+ * @typedef {Object} PlatformEcsService
+ * @property {string} key - short key (`runtime`, `website-ossy`, …) — matches Secrets Manager
+ * @property {string} secretName - `{platform}/{key}`
+ * @property {string} source - origin label (`platform-runtime` or `services[].name`)
+ * @property {string} image - container image (GHCR)
+ * @property {string[]} hosts - ALB host-header values for this service (empty = default/catch-all)
+ * @property {boolean} isDefault - when true, ALB default action forwards here (runtime)
+ * @property {number} containerPort - container listen port
+ */
+
+/**
+ * Host headers for an HTTP `services[]` entry.
+ * Uses optional `hosts` when set; otherwise `[domain]`.
+ *
+ * @param {{ domain?: string, hosts?: string[] }} entry
+ * @returns {string[]}
+ */
+function hostsFromServiceEntry(entry) {
+  if (Array.isArray(entry.hosts) && entry.hosts.length > 0) {
+    return entry.hosts.filter(Boolean)
+  }
+  if (entry.domain) return [entry.domain]
+  return []
+}
+
+/**
+ * Hosts routed explicitly to runtime (platform domains not claimed by an HTTP service).
+ * Wildcards like `*.ossy.se` are included so CMS apps keep working behind the ALB.
+ *
+ * @param {{ domains?: string[] }} config
+ * @param {Array<{ domain?: string, hosts?: string[] }>} httpEntries
+ * @returns {string[]}
+ */
+function runtimeHosts(config, httpEntries) {
+  const claimed = new Set(httpEntries.flatMap(hostsFromServiceEntry))
+  return (config.domains || []).filter(domain => !claimed.has(domain))
+}
+
+/**
+ * List Fargate services for a platform (runtime + HTTP services[]).
+ *
+ * @param {{
+ *   platformName: string,
+ *   domains?: string[],
+ *   services?: Array<{ name: string, type?: string, domain?: string, hosts?: string[], image?: string }>
+ * }} config
+ * @returns {PlatformEcsService[]}
+ */
+function listPlatformEcsServices(config) {
+  if (!config?.platformName) {
+    throw new Error('[platform-ecs-services] platformName is required')
+  }
+
+  const httpEntries = listHttpServiceEntries(config)
+  const runtimeHostList = runtimeHosts(config, httpEntries)
+
+  return listPlatformServices(config).map(service => {
+    if (service.key === 'runtime') {
+      return {
+        key: service.key,
+        secretName: service.secretName,
+        source: service.source,
+        image: RUNTIME_IMAGE,
+        hosts: runtimeHostList,
+        isDefault: true,
+        containerPort: CONTAINER_PORT,
+      }
+    }
+
+    if (!service.entry?.image) {
+      throw new Error(
+        `[platform-ecs-services] HTTP service "${service.key}" is missing image`
+      )
+    }
+
+    return {
+      key: service.key,
+      secretName: service.secretName,
+      source: service.source,
+      image: service.entry.image,
+      hosts: hostsFromServiceEntry(service.entry),
+      isDefault: false,
+      containerPort: CONTAINER_PORT,
+    }
+  })
+}
+
+module.exports = {
+  RUNTIME_IMAGE,
+  CONTAINER_PORT,
+  hostsFromServiceEntry,
+  listPlatformEcsServices,
+  runtimeHosts,
+}