@ossy/deployment-tools 3.0.8 → 3.1.0

package/src/infrastructure/storage-static-stack.js

@@ -9,13 +9,12 @@ const { S3BucketOrigin } = require('aws-cdk-lib/aws-cloudfront-origins')
  * StorageStaticStack provisions the S3 bucket used for static assets and media,
  * a CloudFront CDN distribution serving the /media prefix, and a daily backup plan.
  *
- * This stack is intentionally kept separate from the deployment-target stack so that
- * the long-lived storage resources are never touched when the EC2 instance is updated
- * or replaced, avoiding CloudFormation cross-stack export conflicts.
+ * Kept separate from compute stacks so media storage is not replaced when ECS/edge
+ * stacks change (avoids CloudFormation cross-stack export conflicts).
  *
- * Exports (consumed by deployment-target-stack via cross-stack reference):
+ * Exports (consumed by platform-ecs via cross-stack reference):
  *   - `bucket`          — the S3 Bucket construct
- *   - `cdnDomainName`   — the CloudFront distribution domain name
+ *   - `cdnDomainName`   — the CloudFront distribution domain name (media CDN)
  */
 class StorageStaticStack extends Stack {
   constructor(scope, id, props) {

package/src/secrets/platform-secret-services.js

@@ -0,0 +1,32 @@
+/**
+ * Platform secret service targets for Secrets Manager.
+ *
+ * Naming and service set come from shared `platform-services` (#557 review).
+ */
+
+const { listPlatformServices } = require('../services/platform-services')
+
+/**
+ * @typedef {Object} PlatformSecretService
+ * @property {string} key - short key used in the secret name (after platform prefix)
+ * @property {string} secretName - full Secrets Manager name `{platform}/{key}`
+ * @property {string} source - origin label for docs/logs (`platform-runtime` or `services[].name`)
+ */
+
+/**
+ * List of platform services that should have a Secrets Manager secret.
+ *
+ * @param {{ platformName: string, services?: Array<{ name: string, type?: string }> }} config
+ * @returns {PlatformSecretService[]}
+ */
+function listPlatformSecretServices(config) {
+  return listPlatformServices(config).map(({ key, secretName, source }) => ({
+    key,
+    secretName,
+    source,
+  }))
+}
+
+module.exports = {
+  listPlatformSecretServices,
+}

package/src/secrets/platform-secret-services.spec.js

@@ -0,0 +1,40 @@
+const { describe, expect, it } = require('@jest/globals')
+const { listPlatformSecretServices } = require('./platform-secret-services')
+
+describe('listPlatformSecretServices', () => {
+  it('includes runtime and HTTP services, skips tcp and ossy-api', () => {
+    const services = listPlatformSecretServices({
+      platformName: 'ossybot',
+      services: [
+        {
+          name: 'ossy-website-ossy',
+          domain: 'ossy.se',
+          image: 'ghcr.io/ossy-se/website-ossy:latest',
+        },
+        {
+          name: 'ossy-api',
+          domain: 'api.ossy.se',
+          image: 'ghcr.io/ossy-se/ossy-api:latest',
+        },
+        {
+          name: 'minecraft',
+          type: 'tcp',
+          image: 'itzg/minecraft-server',
+          ports: [25565],
+        },
+      ],
+    })
+
+    expect(services.map(s => s.secretName)).toEqual([
+      'ossybot/runtime',
+      'ossybot/website-ossy',
+    ])
+    expect(services.find(s => s.key === 'runtime').source).toBe('platform-runtime')
+    expect(services.find(s => s.key === 'website-ossy').source).toBe('ossy-website-ossy')
+    expect(services.some(s => s.key === 'api' || s.secretName.endsWith('/api'))).toBe(false)
+  })
+
+  it('requires platformName', () => {
+    expect(() => listPlatformSecretServices({})).toThrow(/platformName is required/)
+  })
+})

package/src/secrets/sync-platform-secrets.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+/**
+ * Upsert Secrets Manager secret *values* from platforms.json env blocks.
+ *
+ * CDK (`PlatformSecretsStack`) owns the secret resources and IAM. This script
+ * only writes values — it never prints secret contents.
+ *
+ * Usage:
+ *   npm run sync-secrets -- --profile ossybot
+ *   node src/secrets/sync-platform-secrets.js --platforms-path ../infrastructure/platforms.json --profile ossybot
+ */
+
+const { resolve } = require('path')
+const {
+  SecretsManagerClient,
+  PutSecretValueCommand,
+  DescribeSecretCommand,
+} = require('@aws-sdk/client-secrets-manager')
+const { PlatformTemplateService } = require('../template')
+const { PlatformConfigService } = require('../config')
+const { listPlatformSecretServices } = require('./platform-secret-services')
+const { logInfo, logError } = require('../log')
+
+function getArg(argv, name) {
+  const flag = `--${name}`
+  const index = argv.indexOf(flag)
+  if (index === -1) return undefined
+  return argv[index + 1]
+}
+
+function hasFlag(argv, name) {
+  return argv.includes(`--${name}`)
+}
+
+/**
+ * @param {object} options
+ * @param {string} options.platformsPath
+ * @param {string=} options.profile
+ * @param {string=} options.platformName - sync a single platform when set
+ * @param {boolean=} options.dryRun
+ */
+async function syncPlatformSecrets({
+  platformsPath,
+  profile,
+  platformName,
+  dryRun = false,
+}) {
+  if (profile) {
+    process.env.AWS_PROFILE = profile
+  }
+
+  const templates = await PlatformTemplateService.readFromFile(platformsPath)
+  const configs = templates.map(PlatformConfigService.from)
+    .filter(config => !platformName || config.platformName === platformName)
+
+  if (configs.length === 0) {
+    throw new Error(
+      platformName
+        ? `No platform named "${platformName}" in ${platformsPath}`
+        : `No platforms found in ${platformsPath}`
+    )
+  }
+
+  for (const config of configs) {
+    const region = config.awsRegion
+    const client = new SecretsManagerClient({ region })
+    const services = listPlatformSecretServices(config)
+    const env = config.env || {}
+    const keyCount = Object.keys(env).length
+
+    logInfo({
+      message: `[sync-platform-secrets] ${config.platformName}: upserting ${services.length} secret(s), ${keyCount} env key(s) each`,
+    })
+
+    for (const service of services) {
+      if (dryRun) {
+        logInfo({
+          message: `[sync-platform-secrets] dry-run: would put ${service.secretName} (${keyCount} keys)`,
+        })
+        continue
+      }
+
+      try {
+        await client.send(new DescribeSecretCommand({ SecretId: service.secretName }))
+      } catch (error) {
+        if (error.name === 'ResourceNotFoundException' || error.__type === 'ResourceNotFoundException') {
+          throw new Error(
+            `Secret "${service.secretName}" does not exist. Deploy the platform-secrets CDK stack first ` +
+              `(npx cdk deploy '${config.platformName}/platform-secrets'), then re-run sync-secrets.`
+          )
+        }
+        throw error
+      }
+
+      await client.send(new PutSecretValueCommand({
+        SecretId: service.secretName,
+        SecretString: JSON.stringify(env),
+      }))
+
+      logInfo({
+        message: `[sync-platform-secrets] upserted ${service.secretName} (${keyCount} keys)`,
+      })
+    }
+  }
+}
+
+async function main(argv = process.argv.slice(2)) {
+  const platformsPath = resolve(
+    getArg(argv, 'platforms-path') || '../infrastructure/platforms.json'
+  )
+  const profile = getArg(argv, 'profile')
+  const platformName = getArg(argv, 'platform')
+  const dryRun = hasFlag(argv, 'dry-run')
+
+  await syncPlatformSecrets({
+    platformsPath,
+    profile,
+    platformName,
+    dryRun,
+  })
+}
+
+if (require.main === module) {
+  main().catch(error => {
+    logError({
+      message: '[sync-platform-secrets] failed',
+      error: error?.message || error,
+    })
+    process.exitCode = 1
+  })
+}
+
+module.exports = {
+  syncPlatformSecrets,
+  main,
+}

package/src/services/platform-services.js

@@ -0,0 +1,94 @@
+/**
+ * Shared platform service naming and listing from platforms.json.
+ *
+ * Used by Secrets Manager and ECS so neither domain depends on the other.
+ * Built-in `ossy-api` is omitted — API lives in website images; only
+ * platform-runtime + configured HTTP `services[]` are included.
+ */
+
+/**
+ * @typedef {Object} PlatformService
+ * @property {string} key - short key (`runtime`, `website-ossy`, …)
+ * @property {string} secretName - `{platform}/{key}`
+ * @property {string} source - origin label (`platform-runtime` or systemd/service name)
+ * @property {object=} entry - original HTTP `services[]` entry when applicable
+ */
+
+/**
+ * Derive the canonical service key from a platforms.json HTTP service name.
+ * Strips a leading `ossy-` prefix so `ossy-website-ossy` → `website-ossy`.
+ *
+ * @param {string} serviceName
+ * @returns {string}
+ */
+function serviceKeyFromName(serviceName) {
+  if (!serviceName || typeof serviceName !== 'string') {
+    throw new Error('[platform-services] service name is required')
+  }
+  return serviceName.replace(/^ossy-/, '')
+}
+
+/**
+ * Secrets Manager / shared resource name for a service key.
+ *
+ * @param {string} platformName
+ * @param {string} key
+ * @returns {string}
+ */
+function secretNameFor(platformName, key) {
+  return `${platformName}/${key}`
+}
+
+/**
+ * HTTP `services[]` entries (skips tcp/udp and nameless rows).
+ *
+ * @param {{ services?: Array<{ name?: string, type?: string }> }} config
+ * @returns {Array<{ name: string, type?: string, domain?: string, hosts?: string[], image?: string }>}
+ */
+function listHttpServiceEntries(config) {
+  return (config.services || []).filter(
+    entry => (entry.type || 'http') === 'http' && entry.name
+  )
+}
+
+/**
+ * Platform services that get secrets / ECS targets: runtime + HTTP services[].
+ * Skips legacy `ossy-api` (key `api`).
+ *
+ * @param {{ platformName: string, services?: Array<{ name: string, type?: string }> }} config
+ * @returns {PlatformService[]}
+ */
+function listPlatformServices(config) {
+  if (!config?.platformName) {
+    throw new Error('[platform-services] platformName is required')
+  }
+
+  const { platformName } = config
+  const runtime = {
+    key: 'runtime',
+    secretName: secretNameFor(platformName, 'runtime'),
+    source: 'platform-runtime',
+  }
+
+  const httpServices = listHttpServiceEntries(config)
+    .map(entry => {
+      const key = serviceKeyFromName(entry.name)
+      return { key, entry }
+    })
+    .filter(({ key }) => key !== 'api')
+    .map(({ key, entry }) => ({
+      key,
+      secretName: secretNameFor(platformName, key),
+      source: entry.name,
+      entry,
+    }))
+
+  return [runtime, ...httpServices]
+}
+
+module.exports = {
+  serviceKeyFromName,
+  secretNameFor,
+  listHttpServiceEntries,
+  listPlatformServices,
+}

package/src/services/platform-services.spec.js

@@ -0,0 +1,80 @@
+const { describe, expect, it } = require('@jest/globals')
+const {
+  serviceKeyFromName,
+  secretNameFor,
+  listHttpServiceEntries,
+  listPlatformServices,
+} = require('./platform-services')
+
+describe('serviceKeyFromName', () => {
+  it('strips leading ossy- prefix', () => {
+    expect(serviceKeyFromName('ossy-website-ossy')).toBe('website-ossy')
+  })
+
+  it('leaves names without ossy- prefix unchanged', () => {
+    expect(serviceKeyFromName('website-ossy')).toBe('website-ossy')
+  })
+
+  it('throws when name is missing', () => {
+    expect(() => serviceKeyFromName('')).toThrow(/service name is required/)
+  })
+})
+
+describe('secretNameFor', () => {
+  it('joins platform and key', () => {
+    expect(secretNameFor('ossybot', 'website-ossy')).toBe('ossybot/website-ossy')
+  })
+})
+
+describe('listHttpServiceEntries', () => {
+  it('keeps http entries and skips tcp', () => {
+    const entries = listHttpServiceEntries({
+      services: [
+        { name: 'ossy-website-ossy', domain: 'ossy.se' },
+        { name: 'minecraft', type: 'tcp', ports: [25565] },
+      ],
+    })
+    expect(entries.map(e => e.name)).toEqual(['ossy-website-ossy'])
+  })
+})
+
+describe('listPlatformServices', () => {
+  it('includes runtime and HTTP services, skips tcp and ossy-api', () => {
+    const services = listPlatformServices({
+      platformName: 'ossybot',
+      services: [
+        {
+          name: 'ossy-website-ossy',
+          domain: 'ossy.se',
+          image: 'ghcr.io/ossy-se/website-ossy:latest',
+        },
+        {
+          name: 'ossy-api',
+          domain: 'api.ossy.se',
+          image: 'ghcr.io/ossy-se/ossy-api:latest',
+        },
+        {
+          name: 'minecraft',
+          type: 'tcp',
+          image: 'itzg/minecraft-server',
+          ports: [25565],
+        },
+      ],
+    })
+
+    expect(services.map(s => s.secretName)).toEqual([
+      'ossybot/runtime',
+      'ossybot/website-ossy',
+    ])
+    expect(services.find(s => s.key === 'runtime').source).toBe('platform-runtime')
+    expect(services.find(s => s.key === 'website-ossy').source).toBe('ossy-website-ossy')
+    expect(services.find(s => s.key === 'website-ossy').entry.image).toBe(
+      'ghcr.io/ossy-se/website-ossy:latest'
+    )
+    expect(services.some(s => s.key === 'api' || s.secretName.endsWith('/api'))).toBe(false)
+  })
+
+  it('requires platformName', () => {
+    expect(() => listPlatformServices({})).toThrow(/platformName is required/)
+  })
+})

package/src/template/platform-template.js

@@ -3,14 +3,14 @@ const { readFileSync } = require('fs')
 const { logError, logInfo } = require('../log')
 
 /**
- * Platform template definition
+ * Platform template definition (raw entry from platforms.json before PlatformConfig defaults).
  * @typedef {Object} PlatformTemplate
  * @property {string} platformName - Name of platform
- *
  * @property {string} awsAccountId - Aws account id
- * @property {string=} awsRegion - ?
- * @property {string=} awsKeyPairName - ?
- * @property {string=} awsDeploymentSqsArn - ?
+ * @property {string=} awsRegion - AWS region (defaults applied in PlatformConfigService)
+ * @property {string[]=} githubDeployRepos - repos trusted by platform-ci OIDC (#559)
+ * @property {string[]=} domains - Route53 → CloudFront known domains (#560)
+ * @property {string=} awsKeyPairName - unused after EC2 decommission (#560)
  */
 
 /**

package/src/infrastructure/container-deployment-target/aws-profile.js

@@ -1,25 +0,0 @@
-/**
-  * @class
-*/
-class AwsProfile {
-
-  static writeFile(roleArn, region) {
-
-    const awsProfileFile = `
-[profile ci-client]
-role_arn = ${roleArn}
-credential_source = Ec2InstanceMetadata
-region = ${region}
-`
-    return [
-      'sudo mkdir /home/caddy',
-      'sudo mkdir /home/caddy/.aws',
-      `sudo echo "${awsProfileFile}" >> /home/caddy/.aws/credentials`
-    ]
-  }
-
-}
-
-module.exports = {
-  AwsProfile
-}

package/src/infrastructure/container-deployment-target/caddy.service.js

@@ -1,117 +0,0 @@
-/**
- * Builds the full Caddyfile content.
- * - Global block: on-demand TLS pointing at the API ask endpoint
- * - API block: explicit Route53 TLS for api.ossy.se
- * - One block per ContainerService (from platforms.json `services`)
- * - Catch-all :443 block: on-demand TLS, routes to the platform runtime
- *
- * @param {import('./container-service').ContainerService[]} services
- */
-const buildCaddyfile = (services) => {
-  const serviceBlocks = services.map(s => s.caddyBlock).join('\n')
-
-  return `
-{
-  on_demand_tls {
-    ask http://localhost:3001/api/v0/apps/ask
-  }
-}
-
-api.ossy.se {
-  tls {
-    dns route53 {
-      max_retries 10
-    }
-  }
-  reverse_proxy localhost:3001
-}
-${serviceBlocks}
-
-:443 {
-  tls {
-    on_demand
-    dns route53 {
-      max_retries 10
-    }
-  }
-  reverse_proxy localhost:3000
-}
-`
-}
-
-const systemdServiceFile = `
-# caddy-route53.service — Caddy with Route53 DNS plugin for on-demand TLS.
-# Configured via /etc/caddy/Caddyfile.
-
-[Unit]
-Description=Caddy
-Documentation=https://caddyserver.com/docs/
-After=network.target network-online.target
-Requires=network-online.target
-
-[Service]
-Type=notify
-User=caddy
-Group=caddy
-ExecStart=/usr/bin/caddy.route53 run --config /etc/caddy/Caddyfile
-TimeoutStopSec=5s
-LimitNOFILE=1048576
-LimitNPROC=512
-PrivateTmp=true
-ProtectSystem=full
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-
-[Install]
-WantedBy=multi-user.target cloud-init.target
-`
-
-/**
-  * @class
-*/
-class CaddyService {
-
-  /**
-   * @param {import('./container-service').ContainerService[]} services
-   */
-  static install(services = []) {
-    const caddyfile = buildCaddyfile(services)
-    return [
-      // Write Caddyfile
-      'sudo mkdir -p /etc/caddy',
-      `sudo tee /etc/caddy/Caddyfile > /dev/null << 'CADDYEOF'\n${caddyfile}\nCADDYEOF`,
-      // Write systemd unit
-      `sudo tee /etc/systemd/system/caddy-route53.service > /dev/null << 'UNITEOF'\n${systemdServiceFile}\nUNITEOF`,
-      // Create caddy system user (apt install caddy may not run on all Ubuntu versions)
-      'sudo useradd --system --home /var/lib/caddy --shell /usr/sbin/nologin --create-home caddy || true',
-      'sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https',
-      'sudo curl -1sLf \'https://dl.cloudsmith.io/public/caddy/stable/gpg.key\' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg',
-      'sudo curl -1sLf \'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt\' | sudo tee /etc/apt/sources.list.d/caddy-stable.list',
-      'sudo curl -1sLf \'https://dl.cloudsmith.io/public/caddy/xcaddy/gpg.key\' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg',
-      'sudo curl -1sLf \'https://dl.cloudsmith.io/public/caddy/xcaddy/debian.deb.txt\' | sudo tee /etc/apt/sources.list.d/caddy-xcaddy.list',
-      'sudo add-apt-repository ppa:longsleep/golang-backports -y',
-      'sudo apt update',
-      'sudo apt install caddy xcaddy golang-go -y',
-      'sudo xcaddy build --with github.com/caddy-dns/route53',
-      'sudo mv ./caddy /usr/bin/caddy.route53'
-    ]
-  }
-
-  static enable() {
-    return [
-      'sudo systemctl disable caddy.service',
-      'sudo systemctl enable caddy-route53.service'
-    ]
-  }
-
-  static start() {
-    return [
-      'sudo systemctl stop caddy.service',
-      'sudo systemctl start caddy-route53.service'
-    ]
-  }
-
-}
-
-module.exports = {
-  CaddyService
-}