@ossy/deployment-tools 3.0.9 → 3.1.0

package/src/ecs/platform-ecs-services.spec.js

@@ -0,0 +1,77 @@
+const { describe, expect, it } = require('@jest/globals')
+const {
+  RUNTIME_IMAGE,
+  hostsFromServiceEntry,
+  listPlatformEcsServices,
+} = require('./platform-ecs-services')
+
+describe('hostsFromServiceEntry', () => {
+  it('uses hosts when provided', () => {
+    expect(hostsFromServiceEntry({
+      domain: 'ossy.se',
+      hosts: ['ossy.se', 'api.ossy.se'],
+    })).toEqual(['ossy.se', 'api.ossy.se'])
+  })
+
+  it('falls back to domain', () => {
+    expect(hostsFromServiceEntry({ domain: 'ossy.se' })).toEqual(['ossy.se'])
+  })
+})
+
+describe('listPlatformEcsServices', () => {
+  it('includes runtime (default) and HTTP services; skips tcp and ossy-api', () => {
+    const services = listPlatformEcsServices({
+      platformName: 'ossybot',
+      domains: [
+        'api.ossy.se',
+        'ossy.se',
+        '*.ossy.se',
+        'www.plexus-sanitas.com',
+        'worker.ossy.se',
+      ],
+      services: [
+        {
+          name: 'ossy-website-ossy',
+          domain: 'ossy.se',
+          hosts: ['ossy.se', 'api.ossy.se'],
+          image: 'ghcr.io/ossy-se/website-ossy:latest',
+        },
+        {
+          name: 'ossy-website-plexus-sanitas',
+          domain: 'www.plexus-sanitas.com',
+          image: 'ghcr.io/ossy-se/website-plexus-sanitas:latest',
+        },
+        {
+          name: 'minecraft',
+          type: 'tcp',
+          image: 'itzg/minecraft-server',
+          ports: [25565],
+        },
+      ],
+    })
+
+    expect(services.map(s => s.key)).toEqual([
+      'runtime',
+      'website-ossy',
+      'website-plexus-sanitas',
+    ])
+
+    const runtime = services.find(s => s.key === 'runtime')
+    expect(runtime.isDefault).toBe(true)
+    expect(runtime.image).toBe(RUNTIME_IMAGE)
+    expect(runtime.hosts).toEqual(['*.ossy.se', 'worker.ossy.se'])
+    expect(runtime.containerPort).toBe(3000)
+
+    const website = services.find(s => s.key === 'website-ossy')
+    expect(website.isDefault).toBe(false)
+    expect(website.hosts).toEqual(['ossy.se', 'api.ossy.se'])
+    expect(website.image).toBe('ghcr.io/ossy-se/website-ossy:latest')
+    expect(website.secretName).toBe('ossybot/website-ossy')
+
+    expect(services.some(s => s.key.includes('api'))).toBe(false)
+  })
+
+  it('requires platformName', () => {
+    expect(() => listPlatformEcsServices({})).toThrow(/platformName is required/)
+  })
+})

package/src/edge/platform-edge-domains.js

@@ -0,0 +1,101 @@
+/**
+ * Derive CloudFront aliases + ACM certificate coverage from platforms.json.
+ *
+ * Part of #558: ACM certs for CloudFront must live in us-east-1 and cover every
+ * known platform hostname (apex + wildcards). Customer domains pointed at the
+ * EIP from a registrar (not in Route53) stay out of scope.
+ */
+
+/**
+ * @typedef {Object} EdgeDomainPlan
+ * @property {string[]} aliases - CloudFront alternate domain names (viewer Host values)
+ * @property {string} primaryDomain - certificate primary domainName
+ * @property {string[]} subjectAlternativeNames - certificate SANs (excludes primary)
+ * @property {Map<string, string>} validationDomainToRoot - hostname → root domain for DNS validation zones
+ */
+
+/**
+ * Root domain for Route53 hosted-zone lookup (last two labels).
+ * @param {string} domain
+ * @returns {string}
+ */
+function rootDomainOf(domain) {
+  const bare = domain.replace(/^\*\./, '')
+  const parts = bare.split('.')
+  if (parts.length < 2) {
+    throw new Error(`[platform-edge-domains] cannot derive root domain from "${domain}"`)
+  }
+  return parts.slice(-2).join('.')
+}
+
+/**
+ * Unique, stable sorted list of CloudFront aliases from `domains` + HTTP service hosts.
+ *
+ * @param {{
+ *   domains?: string[],
+ *   services?: Array<{ type?: string, domain?: string, hosts?: string[] }>
+ * }} config
+ * @returns {string[]}
+ */
+function listEdgeAliases(config) {
+  const fromDomains = (config.domains || []).filter(Boolean)
+  const fromServices = (config.services || [])
+    .filter(entry => (entry.type || 'http') === 'http')
+    .flatMap(entry => {
+      if (Array.isArray(entry.hosts)) return entry.hosts.filter(Boolean)
+      return entry.domain ? [entry.domain] : []
+    })
+
+  return [...new Set([...fromDomains, ...fromServices])].sort((a, b) =>
+    a.localeCompare(b)
+  )
+}
+
+/**
+ * Build ACM + CloudFront domain plan for a platform.
+ *
+ * Primary cert domain prefers an apex (no wildcard, not a subdomain) when present,
+ * otherwise the first alias. SANs cover the rest. Validation maps each name to its
+ * root hosted zone (wildcards validate on the parent zone).
+ *
+ * @param {{
+ *   platformName?: string,
+ *   domains?: string[],
+ *   services?: Array<{ type?: string, domain?: string, hosts?: string[] }>
+ * }} config
+ * @returns {EdgeDomainPlan}
+ */
+function planEdgeDomains(config) {
+  if (!config?.platformName) {
+    throw new Error('[platform-edge-domains] platformName is required')
+  }
+
+  const aliases = listEdgeAliases(config)
+  if (aliases.length === 0) {
+    throw new Error(
+      `[platform-edge-domains] platform "${config.platformName}" has no domains for CloudFront`
+    )
+  }
+
+  const apex = aliases.find(d => !d.includes('*') && d.split('.').length === 2)
+  const primaryDomain = apex || aliases[0]
+  const subjectAlternativeNames = aliases.filter(d => d !== primaryDomain)
+
+  /** @type {Map<string, string>} */
+  const validationDomainToRoot = new Map(
+    aliases.map(alias => [alias, rootDomainOf(alias)])
+  )
+
+  return {
+    aliases,
+    primaryDomain,
+    subjectAlternativeNames,
+    validationDomainToRoot,
+  }
+}
+
+module.exports = {
+  rootDomainOf,
+  listEdgeAliases,
+  planEdgeDomains,
+}

package/src/edge/platform-edge-domains.spec.js

@@ -0,0 +1,87 @@
+const { describe, expect, it } = require('@jest/globals')
+const {
+  rootDomainOf,
+  listEdgeAliases,
+  planEdgeDomains,
+} = require('./platform-edge-domains')
+
+describe('rootDomainOf', () => {
+  it('strips wildcards and returns the apex', () => {
+    expect(rootDomainOf('*.ossy.se')).toBe('ossy.se')
+    expect(rootDomainOf('api.ossy.se')).toBe('ossy.se')
+    expect(rootDomainOf('www.plexus-sanitas.com')).toBe('plexus-sanitas.com')
+  })
+})
+
+describe('listEdgeAliases', () => {
+  it('unions domains and HTTP service hosts; skips tcp', () => {
+    expect(listEdgeAliases({
+      domains: ['ossy.se', '*.ossy.se', 'worker.ossy.se'],
+      services: [
+        {
+          name: 'ossy-website-ossy',
+          domain: 'ossy.se',
+          hosts: ['ossy.se', 'api.ossy.se'],
+        },
+        {
+          name: 'minecraft',
+          type: 'tcp',
+          image: 'itzg/minecraft-server',
+          ports: [25565],
+        },
+      ],
+    })).toEqual(['*.ossy.se', 'api.ossy.se', 'ossy.se', 'worker.ossy.se'])
+  })
+})
+
+describe('planEdgeDomains', () => {
+  it('picks apex as primary and maps validation zones', () => {
+    const plan = planEdgeDomains({
+      platformName: 'ossybot',
+      domains: [
+        'api.ossy.se',
+        'ossy.se',
+        '*.ossy.se',
+        'www.plexus-sanitas.com',
+        'worker.ossy.se',
+      ],
+      services: [
+        {
+          name: 'ossy-website-ossy',
+          domain: 'ossy.se',
+          hosts: ['ossy.se', 'api.ossy.se'],
+        },
+        {
+          name: 'ossy-website-plexus-sanitas',
+          domain: 'www.plexus-sanitas.com',
+        },
+      ],
+    })
+
+    expect(plan.primaryDomain).toBe('ossy.se')
+    expect(plan.aliases).toEqual([
+      '*.ossy.se',
+      'api.ossy.se',
+      'ossy.se',
+      'worker.ossy.se',
+      'www.plexus-sanitas.com',
+    ])
+    expect(plan.subjectAlternativeNames).toEqual([
+      '*.ossy.se',
+      'api.ossy.se',
+      'worker.ossy.se',
+      'www.plexus-sanitas.com',
+    ])
+    expect(plan.validationDomainToRoot.get('*.ossy.se')).toBe('ossy.se')
+    expect(plan.validationDomainToRoot.get('www.plexus-sanitas.com')).toBe(
+      'plexus-sanitas.com'
+    )
+  })
+
+  it('requires platformName and at least one alias', () => {
+    expect(() => planEdgeDomains({})).toThrow(/platformName is required/)
+    expect(() => planEdgeDomains({ platformName: 'x', domains: [] })).toThrow(
+      /no domains for CloudFront/
+    )
+  })
+})

package/src/index.js

@@ -1,5 +1,37 @@
 const { PlatformTemplateService } = require('./template')
+const {
+  listPlatformServices,
+  listHttpServiceEntries,
+  serviceKeyFromName,
+  secretNameFor,
+} = require('./services/platform-services')
+const { listPlatformSecretServices } = require('./secrets/platform-secret-services')
+const { syncPlatformSecrets } = require('./secrets/sync-platform-secrets')
+const {
+  listPlatformEcsServices,
+  hostsFromServiceEntry,
+  RUNTIME_IMAGE,
+  CONTAINER_PORT,
+} = require('./ecs/platform-ecs-services')
+const {
+  rootDomainOf,
+  listEdgeAliases,
+  planEdgeDomains,
+} = require('./edge/platform-edge-domains')
 
 module.exports = {
-  PlatformTemplateService
+  PlatformTemplateService,
+  listPlatformServices,
+  listHttpServiceEntries,
+  serviceKeyFromName,
+  secretNameFor,
+  listPlatformSecretServices,
+  syncPlatformSecrets,
+  listPlatformEcsServices,
+  hostsFromServiceEntry,
+  RUNTIME_IMAGE,
+  CONTAINER_PORT,
+  rootDomainOf,
+  listEdgeAliases,
+  planEdgeDomains,
 }

package/src/infrastructure/dns-stack.js

@@ -2,16 +2,44 @@ const { Stack, Duration } = require('aws-cdk-lib')
 const {
   HostedZone,
   ARecord,
+  AaaaRecord,
   MxRecord,
   RecordTarget
 } = require('aws-cdk-lib/aws-route53')
 
+/** Global Route53 hosted zone id for CloudFront alias records. */
+const CLOUDFRONT_HOSTED_ZONE_ID = 'Z2FDTNDATAQYW2'
+
+/**
+ * Alias target for a CloudFront distribution domain name (cross-region safe).
+ * Avoids requiring the Distribution construct in the platform-region DnsStack.
+ */
+class CloudFrontDomainTarget {
+  /**
+   * @param {string} domainName - e.g. d111111abcdef8.cloudfront.net
+   */
+  constructor(domainName) {
+    this.domainName = domainName
+  }
+
+  /**
+   * @returns {import('aws-cdk-lib/aws-route53').AliasRecordTargetConfig}
+   */
+  bind() {
+    // IAliasRecordTarget shape (not the raw CloudFormation AliasTargetProperty).
+    return {
+      hostedZoneId: CLOUDFRONT_HOSTED_ZONE_ID,
+      dnsName: this.domainName,
+    }
+  }
+}
+
 /**
  * DnsStackProps
  * @namespace DnsStack
  * @typedef {Object} DnsStackProps
  * @property {PlatformConfig} config - platform config
- * @property {string} containerDeploymentTargetPublicIp - public ip address of ec2 instance
+ * @property {string} cloudFrontDomainName - CloudFront app distribution domain (#558 / #560)
  */
 
 /**
@@ -27,9 +55,13 @@ class DnsStack extends Stack {
   constructor(scope, id, props) {
     super(scope, id, props)
 
+    if (!props.cloudFrontDomainName) {
+      throw new Error('[DnsStack] cloudFrontDomainName is required')
+    }
+
     // Group domains by root domain so we can look up each hosted zone once.
     const domainsByRoot = (props.config.domains ?? []).reduce((map, domain) => {
-      const parts = domain.split('.')
+      const parts = domain.replace(/^\*\./, '').split('.')
       const rootDomain = parts.slice(-2).join('.')
       map.has(rootDomain)
         ? map.set(rootDomain, [...map.get(rootDomain), domain])
@@ -41,10 +73,20 @@ class DnsStack extends Stack {
       const zone = HostedZone.fromLookup(this, `${rootDomain}-zone`, { domainName: rootDomain })
 
       domains.forEach(domain => {
+        // Known platform domains → CloudFront (not EIP). Alias A + AAAA.
+        const cloudFrontTarget = RecordTarget.fromAlias(
+          new CloudFrontDomainTarget(props.cloudFrontDomainName)
+        )
         new ARecord(this, `${domain}-record`, {
           zone,
           recordName: domain,
-          target: RecordTarget.fromIpAddresses(props.containerDeploymentTargetPublicIp),
+          target: cloudFrontTarget,
+          ttl: Duration.seconds(60)
+        })
+        new AaaaRecord(this, `${domain}-aaaa-record`, {
+          zone,
+          recordName: domain,
+          target: cloudFrontTarget,
           ttl: Duration.seconds(60)
         })
       })
@@ -73,5 +115,7 @@ class DnsStack extends Stack {
 }
 
 module.exports = {
+  CLOUDFRONT_HOSTED_ZONE_ID,
+  CloudFrontDomainTarget,
   DnsStack
 }

package/src/infrastructure/dns-stack.spec.js

@@ -0,0 +1,15 @@
+const { describe, expect, it } = require('@jest/globals')
+const {
+  CLOUDFRONT_HOSTED_ZONE_ID,
+  CloudFrontDomainTarget,
+} = require('./dns-stack')
+
+describe('CloudFrontDomainTarget', () => {
+  it('binds a flat AliasRecordTargetConfig for CloudFront', () => {
+    const target = new CloudFrontDomainTarget('d111111abcdef8.cloudfront.net')
+    expect(target.bind()).toEqual({
+      hostedZoneId: CLOUDFRONT_HOSTED_ZONE_ID,
+      dnsName: 'd111111abcdef8.cloudfront.net',
+    })
+  })
+})

package/src/infrastructure/platform-ci-stack.js

@@ -0,0 +1,151 @@
+/* eslint-disable no-new */
+const { CfnOutput, Stack, Duration } = require('aws-cdk-lib')
+const {
+  Effect,
+  OpenIdConnectProvider,
+  PolicyStatement,
+  Role,
+  WebIdentityPrincipal,
+} = require('aws-cdk-lib/aws-iam')
+
+/**
+ * @typedef {Object} PlatformCiStackProps
+ * @property {import('../config/platform-config').PlatformConfig} config
+ */
+
+/**
+ * GitHub Actions → AWS OIDC deploy role for ECS rollouts (#559).
+ *
+ * Creates an OIDC provider for `token.actions.githubusercontent.com` and a
+ * platform-scoped role that can register task definitions and update Fargate
+ * services. No long-lived access keys in GitHub.
+ *
+ * Trust is limited to `ref:refs/heads/main` for `config.githubDeployRepos`
+ * (set in platforms.json — add a repo there to allow it to assume this role).
+ *
+ * Note: AWS allows only one OIDC provider per URL per account. This stack is
+ * intended for the primary platform stage until a shared account bootstrap exists.
+ */
+class PlatformCiStack extends Stack {
+  /**
+   * @param {object} scope
+   * @param {string} id
+   * @param {PlatformCiStackProps} props
+   */
+  constructor(scope, id, props) {
+    super(scope, id, props)
+
+    if (!props?.config?.platformName) {
+      throw new Error('[PlatformCiStack] config.platformName is required')
+    }
+
+    const platformName = props.config.platformName
+    const account = props.env?.account ?? props.config.awsAccountId
+    const region = props.env?.region ?? props.config.awsRegion
+    const clusterName = `${platformName}-platform`
+    const roleName = `${platformName}-github-deploy`.slice(0, 64)
+    const githubDeployRepos = props.config.githubDeployRepos
+
+    if (!Array.isArray(githubDeployRepos) || githubDeployRepos.length === 0) {
+      throw new Error(
+        '[PlatformCiStack] config.githubDeployRepos must be a non-empty array in platforms.json'
+      )
+    }
+
+    const oidcSubjects = githubDeployRepos.map(repo => {
+      if (!repo || typeof repo !== 'string' || !repo.includes('/')) {
+        throw new Error(
+          `[PlatformCiStack] invalid githubDeployRepos entry "${repo}" (expected owner/repo)`
+        )
+      }
+      return `repo:${repo}:ref:refs/heads/main`
+    })
+
+    const provider = new OpenIdConnectProvider(this, 'GithubOidcProvider', {
+      url: 'https://token.actions.githubusercontent.com',
+      clientIds: ['sts.amazonaws.com'],
+    })
+
+    const deployRole = new Role(this, 'GithubDeployRole', {
+      roleName,
+      description: `GitHub Actions OIDC deploy role for ${platformName} ECS (#559)`,
+      maxSessionDuration: Duration.hours(1),
+      assumedBy: new WebIdentityPrincipal(
+        provider.openIdConnectProviderArn,
+        {
+          StringEquals: {
+            'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
+          },
+          StringLike: {
+            'token.actions.githubusercontent.com:sub': oidcSubjects,
+          },
+        }
+      ),
+    })
+
+    const clusterArn = `arn:aws:ecs:${region}:${account}:cluster/${clusterName}`
+    const serviceArn = `arn:aws:ecs:${region}:${account}:service/${clusterName}/*`
+    const taskArn = `arn:aws:ecs:${region}:${account}:task/${clusterName}/*`
+
+    deployRole.addToPolicy(new PolicyStatement({
+      sid: 'EcsDeployRead',
+      effect: Effect.ALLOW,
+      actions: [
+        'ecs:DescribeClusters',
+        'ecs:DescribeServices',
+        'ecs:DescribeTasks',
+        'ecs:ListTasks',
+      ],
+      resources: [clusterArn, serviceArn, taskArn],
+    }))
+
+    // Task-definition APIs are not cluster-scoped in IAM the same way services are.
+    deployRole.addToPolicy(new PolicyStatement({
+      sid: 'EcsTaskDefinitions',
+      effect: Effect.ALLOW,
+      actions: [
+        'ecs:DescribeTaskDefinition',
+        'ecs:RegisterTaskDefinition',
+      ],
+      resources: ['*'],
+    }))
+
+    deployRole.addToPolicy(new PolicyStatement({
+      sid: 'EcsUpdateService',
+      effect: Effect.ALLOW,
+      actions: ['ecs:UpdateService'],
+      resources: [serviceArn],
+    }))
+
+    deployRole.addToPolicy(new PolicyStatement({
+      sid: 'PassEcsRoles',
+      effect: Effect.ALLOW,
+      actions: ['iam:PassRole'],
+      resources: [`arn:aws:iam::${account}:role/${platformName}-*`],
+      conditions: {
+        StringEquals: {
+          'iam:PassedToService': 'ecs-tasks.amazonaws.com',
+        },
+      },
+    }))
+
+    this.deployRole = deployRole
+    this.provider = provider
+
+    new CfnOutput(this, 'GithubDeployRoleArn', {
+      value: deployRole.roleArn,
+      description: 'IAM role ARN for GitHub Actions OIDC ECS deploys (#559)',
+      exportName: `${platformName}-GithubDeployRoleArn`,
+    })
+
+    new CfnOutput(this, 'GithubDeployRoleName', {
+      value: roleName,
+      description: 'IAM role name for GitHub Actions OIDC ECS deploys',
+      exportName: `${platformName}-GithubDeployRoleName`,
+    })
+  }
+}
+
+module.exports = {
+  PlatformCiStack,
+}