@ossy/deployment-tools 3.0.9 → 3.1.0

package/src/infrastructure/platform-ecs-stack.js

@@ -0,0 +1,326 @@
+/* eslint-disable no-new */
+const { CfnOutput, Duration, Stack } = require('aws-cdk-lib')
+const {
+  Peer,
+  Port,
+  SecurityGroup,
+  SubnetType,
+  Vpc,
+} = require('aws-cdk-lib/aws-ec2')
+const {
+  Cluster,
+  ContainerImage,
+  CpuArchitecture,
+  FargateService,
+  FargateTaskDefinition,
+  LogDrivers,
+  OperatingSystemFamily,
+  Protocol,
+  Secret: EcsSecret,
+} = require('aws-cdk-lib/aws-ecs')
+const {
+  ApplicationLoadBalancer,
+  ApplicationProtocol,
+  ApplicationTargetGroup,
+  ListenerCondition,
+  TargetType,
+} = require('aws-cdk-lib/aws-elasticloadbalancingv2')
+const {
+  ManagedPolicy,
+  Role,
+  ServicePrincipal,
+} = require('aws-cdk-lib/aws-iam')
+const { LogGroup, RetentionDays } = require('aws-cdk-lib/aws-logs')
+const { listPlatformEcsServices } = require('../ecs/platform-ecs-services')
+
+/**
+ * @typedef {Object} PlatformEcsStackProps
+ * @property {import('../config/platform-config').PlatformConfig} config
+ * @property {import('aws-cdk-lib/aws-s3').IBucket} bucket
+ * @property {string} cdnDomainName
+ * @property {Record<string, import('aws-cdk-lib/aws-secretsmanager').ISecret>} secrets
+ * @property {Record<string, import('aws-cdk-lib/aws-iam').IRole>} taskRoles
+ * @property {import('aws-cdk-lib/aws-secretsmanager').ISecret} ghcrPullSecret
+ */
+
+/**
+ * VPC + ECS Fargate + ALB for platform HTTP services (#557 / epic #553).
+ *
+ * - ALB in public subnets (HTTP :80; CloudFront origin in #558)
+ * - Fargate tasks in private subnets; env from Secrets Manager (#555)
+ * - Host-based listener rules; runtime is the default / catch-all target
+ * - No `ossy-api` service — website images include the API
+ *
+ * Production traffic reaches these services via CloudFront → ALB (#558 / #560).
+ */
+class PlatformEcsStack extends Stack {
+  /**
+   * @param {object} scope
+   * @param {string} id
+   * @param {PlatformEcsStackProps} props
+   */
+  constructor(scope, id, props) {
+    super(scope, id, props)
+
+    if (!props?.config) {
+      throw new Error('[PlatformEcsStack] No config provided')
+    }
+    if (!props.bucket || !props.cdnDomainName) {
+      throw new Error('[PlatformEcsStack] bucket and cdnDomainName are required')
+    }
+    if (!props.secrets || !props.taskRoles || !props.ghcrPullSecret) {
+      throw new Error('[PlatformEcsStack] secrets, taskRoles, and ghcrPullSecret are required')
+    }
+
+    const platformName = props.config.platformName
+    const services = listPlatformEcsServices(props.config)
+    const envKeys = Object.keys(props.config.env || {})
+
+    const vpc = new Vpc(this, 'Vpc', {
+      maxAzs: 2,
+      natGateways: 1,
+      subnetConfiguration: [
+        { name: 'public', subnetType: SubnetType.PUBLIC, cidrMask: 24 },
+        { name: 'private', subnetType: SubnetType.PRIVATE_WITH_EGRESS, cidrMask: 24 },
+      ],
+    })
+
+    const albSecurityGroup = new SecurityGroup(this, 'AlbSecurityGroup', {
+      vpc,
+      description: `${platformName} ALB ingress`,
+      allowAllOutbound: true,
+    })
+    albSecurityGroup.addIngressRule(
+      Peer.anyIpv4(),
+      Port.tcp(80),
+      'HTTP from Internet / CloudFront origin'
+    )
+
+    const serviceSecurityGroup = new SecurityGroup(this, 'ServiceSecurityGroup', {
+      vpc,
+      description: `${platformName} ECS tasks`,
+      allowAllOutbound: true,
+    })
+    serviceSecurityGroup.addIngressRule(
+      albSecurityGroup,
+      Port.tcp(3000),
+      'ALB to Fargate containers'
+    )
+
+    const cluster = new Cluster(this, 'Cluster', {
+      clusterName: `${platformName}-platform`,
+      vpc,
+      containerInsights: true,
+    })
+
+    const loadBalancer = new ApplicationLoadBalancer(this, 'Alb', {
+      vpc,
+      internetFacing: true,
+      securityGroup: albSecurityGroup,
+      vpcSubnets: { subnetType: SubnetType.PUBLIC },
+      loadBalancerName: truncateAwsName(`${platformName}-alb`, 32),
+    })
+
+    /** @type {ApplicationTargetGroup|undefined} */
+    let defaultTargetGroup
+    /** @type {Array<{ idSuffix: string, host: string, targetGroup: ApplicationTargetGroup }>} */
+    const hostRules = []
+
+    this.services = {}
+
+    for (const service of services) {
+      const idSuffix = toConstructId(service.key)
+      const secret = props.secrets[service.key]
+      const taskRole = props.taskRoles[service.key]
+
+      if (!secret || !taskRole) {
+        throw new Error(
+          `[PlatformEcsStack] missing secret or task role for "${service.key}" — deploy platform-secrets first`
+        )
+      }
+
+      const executionRole = new Role(this, `ExecutionRole${idSuffix}`, {
+        roleName: truncateAwsName(`${platformName}-${service.key}-exec`, 64),
+        description: `ECS execution role for ${service.secretName}`,
+        assumedBy: new ServicePrincipal('ecs-tasks.amazonaws.com'),
+        managedPolicies: [
+          ManagedPolicy.fromAwsManagedPolicyName(
+            'service-role/AmazonECSTaskExecutionRolePolicy'
+          ),
+        ],
+      })
+      // Task-def secret injection + GHCR pull use the execution role
+      secret.grantRead(executionRole)
+      props.ghcrPullSecret.grantRead(executionRole)
+
+      const logGroup = new LogGroup(this, `Logs${idSuffix}`, {
+        retention: RetentionDays.ONE_MONTH,
+      })
+
+      const taskDefinition = new FargateTaskDefinition(this, `TaskDef${idSuffix}`, {
+        family: `${platformName}-${service.key}`,
+        cpu: 512,
+        memoryLimitMiB: 1024,
+        runtimePlatform: {
+          cpuArchitecture: CpuArchitecture.X86_64,
+          operatingSystemFamily: OperatingSystemFamily.LINUX,
+        },
+        taskRole,
+        executionRole,
+      })
+
+      const containerSecrets = Object.fromEntries(
+        envKeys.map(key => [key, EcsSecret.fromSecretsManager(secret, key)])
+      )
+
+      const container = taskDefinition.addContainer(`Container${idSuffix}`, {
+        containerName: service.key,
+        image: ContainerImage.fromRegistry(service.image, {
+          credentials: props.ghcrPullSecret,
+        }),
+        logging: LogDrivers.awsLogs({
+          streamPrefix: service.key,
+          logGroup,
+        }),
+        environment: {
+          NODE_ENV: 'production',
+          PORT: String(service.containerPort),
+          MEDIA_REPOSITORY: props.bucket.bucketName,
+          MEDIA_CDN_DOMAIN_NAME: `https://${props.cdnDomainName}`,
+        },
+        secrets: containerSecrets,
+      })
+
+      container.addPortMappings({
+        containerPort: service.containerPort,
+        protocol: Protocol.TCP,
+      })
+
+      const fargateService = new FargateService(this, `Service${idSuffix}`, {
+        serviceName: truncateAwsName(`${platformName}-${service.key}`, 255),
+        cluster,
+        taskDefinition,
+        desiredCount: 1,
+        assignPublicIp: false,
+        securityGroups: [serviceSecurityGroup],
+        vpcSubnets: { subnetType: SubnetType.PRIVATE_WITH_EGRESS },
+        circuitBreaker: { rollback: true },
+      })
+
+      const targetGroup = new ApplicationTargetGroup(this, `TargetGroup${idSuffix}`, {
+        vpc,
+        port: service.containerPort,
+        protocol: ApplicationProtocol.HTTP,
+        targetType: TargetType.IP,
+        targetGroupName: truncateAwsName(`${platformName}-${service.key}`, 32),
+        healthCheck: {
+          path: '/health',
+          healthyHttpCodes: '200',
+          interval: Duration.seconds(30),
+          timeout: Duration.seconds(5),
+          healthyThresholdCount: 2,
+          unhealthyThresholdCount: 3,
+        },
+        deregistrationDelay: Duration.seconds(30),
+      })
+
+      fargateService.attachToApplicationTargetGroup(targetGroup)
+
+      if (service.isDefault) {
+        defaultTargetGroup = targetGroup
+      }
+
+      for (const host of service.hosts) {
+        hostRules.push({ idSuffix, host, targetGroup })
+      }
+
+      this.services[service.key] = {
+        service: fargateService,
+        targetGroup,
+      }
+
+      new CfnOutput(this, `ServiceName${idSuffix}`, {
+        value: fargateService.serviceName,
+        description: `ECS service name for ${service.secretName}`,
+        exportName: `${platformName}-EcsService-${service.key}`,
+      })
+    }
+
+    if (!defaultTargetGroup) {
+      throw new Error('[PlatformEcsStack] runtime default target group was not created')
+    }
+
+    const listener = loadBalancer.addListener('HttpListener', {
+      port: 80,
+      protocol: ApplicationProtocol.HTTP,
+      defaultTargetGroups: [defaultTargetGroup],
+    })
+
+    // Lower priority number = evaluated first. Specific hosts before wildcards
+    // so `api.ossy.se` is not swallowed by `*.ossy.se`.
+    const orderedHostRules = [...hostRules].sort((a, b) => {
+      const aWild = a.host.includes('*') ? 1 : 0
+      const bWild = b.host.includes('*') ? 1 : 0
+      return aWild - bWild
+    })
+
+    let rulePriority = 10
+    for (const rule of orderedHostRules) {
+      listener.addTargetGroups(
+        `Rule${rule.idSuffix}${toConstructId(rule.host)}`,
+        {
+          priority: rulePriority,
+          conditions: [ListenerCondition.hostHeaders([rule.host])],
+          targetGroups: [rule.targetGroup],
+        }
+      )
+      rulePriority += 1
+    }
+
+    this.vpc = vpc
+    this.cluster = cluster
+    this.loadBalancer = loadBalancer
+    this.listener = listener
+
+    new CfnOutput(this, 'LoadBalancerDnsName', {
+      value: loadBalancer.loadBalancerDnsName,
+      description: 'ALB DNS name (CloudFront origin for platform-edge)',
+      exportName: `${platformName}-AlbDnsName`,
+    })
+
+    new CfnOutput(this, 'LoadBalancerArn', {
+      value: loadBalancer.loadBalancerArn,
+      description: 'ALB ARN',
+      exportName: `${platformName}-AlbArn`,
+    })
+
+    new CfnOutput(this, 'ClusterName', {
+      value: cluster.clusterName,
+      description: 'ECS cluster name',
+      exportName: `${platformName}-EcsClusterName`,
+    })
+  }
+}
+
+/**
+ * CloudFormation-safe construct id fragment.
+ * @param {string} key
+ * @returns {string}
+ */
+function toConstructId(key) {
+  return key.replace(/[^A-Za-z0-9]/g, '')
+}
+
+/**
+ * AWS name length limits (ALB, IAM, ECS, target groups).
+ * @param {string} name
+ * @param {number} max
+ * @returns {string}
+ */
+function truncateAwsName(name, max) {
+  return name.length <= max ? name : name.slice(0, max)
+}
+
+module.exports = {
+  PlatformEcsStack,
+}

package/src/infrastructure/platform-edge-stack.js

@@ -0,0 +1,213 @@
+/* eslint-disable no-new */
+const { CfnOutput, Stack, Duration } = require('aws-cdk-lib')
+const {
+  Certificate,
+  CertificateValidation,
+} = require('aws-cdk-lib/aws-certificatemanager')
+const {
+  AllowedMethods,
+  CachePolicy,
+  CachedMethods,
+  Distribution,
+  OriginProtocolPolicy,
+  OriginRequestPolicy,
+  PriceClass,
+  ViewerProtocolPolicy,
+} = require('aws-cdk-lib/aws-cloudfront')
+const { HttpOrigin } = require('aws-cdk-lib/aws-cloudfront-origins')
+const { HostedZone } = require('aws-cdk-lib/aws-route53')
+const { CfnWebACL } = require('aws-cdk-lib/aws-wafv2')
+const { planEdgeDomains } = require('../edge/platform-edge-domains')
+
+/** CloudFront ACM + WAFv2 CloudFront-scope resources must live in us-east-1. */
+const CLOUDFRONT_REGION = 'us-east-1'
+
+/**
+ * @typedef {Object} PlatformEdgeStackProps
+ * @property {import('../config/platform-config').PlatformConfig} config
+ * @property {string} albDnsName - DNS name of the platform ALB (CloudFront origin)
+ */
+
+/**
+ * CloudFront + WAF + ACM in front of the platform ALB (#558 / epic #553).
+ *
+ * - Separate distribution from the `/media` CDN in `storage-static`
+ * - Forwards viewer `Host` (and cookies/query) so ALB host rules keep working
+ * - ACM certificate in us-east-1 covering known platform domains
+ * - WAFv2 web ACL (CLOUDFRONT scope) associated with the distribution
+ *
+ * Deploy this stack with `env.region = us-east-1`. DNS alias cutover is wired
+ * from `DnsStack` using the distribution domain name output.
+ */
+class PlatformEdgeStack extends Stack {
+  /**
+   * @param {object} scope
+   * @param {string} id
+   * @param {PlatformEdgeStackProps} props
+   */
+  constructor(scope, id, props) {
+    super(scope, id, props)
+
+    if (!props?.config) {
+      throw new Error('[PlatformEdgeStack] No config provided')
+    }
+    if (!props.albDnsName) {
+      throw new Error('[PlatformEdgeStack] albDnsName is required')
+    }
+    if (Stack.of(this).region !== CLOUDFRONT_REGION) {
+      throw new Error(
+        `[PlatformEdgeStack] must be deployed in ${CLOUDFRONT_REGION} (got ${Stack.of(this).region})`
+      )
+    }
+
+    const platformName = props.config.platformName
+    const plan = planEdgeDomains(props.config)
+
+    /** @type {Map<string, import('aws-cdk-lib/aws-route53').IHostedZone>} */
+    const zonesByRoot = new Map(
+      [...new Set(plan.validationDomainToRoot.values())].map(rootDomain => [
+        rootDomain,
+        HostedZone.fromLookup(this, `${toConstructId(rootDomain)}Zone`, {
+          domainName: rootDomain,
+        }),
+      ])
+    )
+
+    /** @type {Record<string, import('aws-cdk-lib/aws-route53').IHostedZone>} */
+    const validationZones = Object.fromEntries(
+      [...plan.validationDomainToRoot.entries()].map(([domain, root]) => [
+        domain,
+        zonesByRoot.get(root),
+      ])
+    )
+
+    const certificate = new Certificate(this, 'ViewerCertificate', {
+      domainName: plan.primaryDomain,
+      subjectAlternativeNames: plan.subjectAlternativeNames,
+      validation: CertificateValidation.fromDnsMultiZone(validationZones),
+    })
+
+    const webAcl = new CfnWebACL(this, 'WebAcl', {
+      name: truncateName(`${platformName}-app-edge`, 128),
+      description: `WAF for ${platformName} CloudFront app distribution`,
+      scope: 'CLOUDFRONT',
+      defaultAction: { allow: {} },
+      visibilityConfig: {
+        cloudWatchMetricsEnabled: true,
+        metricName: truncateName(`${platformName}AppEdge`, 128),
+        sampledRequestsEnabled: true,
+      },
+      rules: [
+        {
+          name: 'AWSManagedRulesCommonRuleSet',
+          priority: 1,
+          overrideAction: { none: {} },
+          statement: {
+            managedRuleGroupStatement: {
+              vendorName: 'AWS',
+              name: 'AWSManagedRulesCommonRuleSet',
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: 'AWSManagedRulesCommonRuleSet',
+            sampledRequestsEnabled: true,
+          },
+        },
+        {
+          name: 'AWSManagedRulesKnownBadInputsRuleSet',
+          priority: 2,
+          overrideAction: { none: {} },
+          statement: {
+            managedRuleGroupStatement: {
+              vendorName: 'AWS',
+              name: 'AWSManagedRulesKnownBadInputsRuleSet',
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: 'AWSManagedRulesKnownBadInputsRuleSet',
+            sampledRequestsEnabled: true,
+          },
+        },
+      ],
+    })
+
+    const origin = new HttpOrigin(props.albDnsName, {
+      protocolPolicy: OriginProtocolPolicy.HTTP_ONLY,
+      readTimeout: Duration.seconds(60),
+      keepaliveTimeout: Duration.seconds(60),
+    })
+
+    // CloudFront associates WAF via webAclId (not CfnWebACLAssociation).
+    const distribution = new Distribution(this, 'AppDistribution', {
+      comment: `${platformName} app edge (ALB origin) — not the /media CDN`,
+      domainNames: plan.aliases,
+      certificate,
+      priceClass: PriceClass.PRICE_CLASS_100,
+      webAclId: webAcl.attrArn,
+      defaultBehavior: {
+        origin,
+        viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        allowedMethods: AllowedMethods.ALLOW_ALL,
+        cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
+        // Dynamic app traffic — do not cache at the edge by default.
+        cachePolicy: CachePolicy.CACHING_DISABLED,
+        // Forward Host so ALB listener host rules match viewer hostnames.
+        originRequestPolicy: OriginRequestPolicy.ALL_VIEWER,
+      },
+    })
+
+    this.distribution = distribution
+    this.certificate = certificate
+    this.domainName = distribution.distributionDomainName
+    this.distributionId = distribution.distributionId
+    this.aliases = plan.aliases
+
+    new CfnOutput(this, 'DistributionDomainName', {
+      value: distribution.distributionDomainName,
+      description: 'CloudFront domain for app traffic (Route53 alias target)',
+      exportName: `${platformName}-AppCloudFrontDomainName`,
+    })
+
+    new CfnOutput(this, 'DistributionId', {
+      value: distribution.distributionId,
+      description: 'CloudFront distribution id for app traffic',
+      exportName: `${platformName}-AppCloudFrontDistributionId`,
+    })
+
+    new CfnOutput(this, 'ViewerCertificateArn', {
+      value: certificate.certificateArn,
+      description: 'ACM certificate ARN (us-east-1) for CloudFront aliases',
+      exportName: `${platformName}-AppCloudFrontCertificateArn`,
+    })
+
+    new CfnOutput(this, 'WebAclArn', {
+      value: webAcl.attrArn,
+      description: 'WAFv2 web ACL ARN associated with the app distribution',
+      exportName: `${platformName}-AppCloudFrontWebAclArn`,
+    })
+  }
+}
+
+/**
+ * @param {string} key
+ * @returns {string}
+ */
+function toConstructId(key) {
+  return key.replace(/[^A-Za-z0-9]/g, '')
+}
+
+/**
+ * @param {string} name
+ * @param {number} max
+ * @returns {string}
+ */
+function truncateName(name, max) {
+  return name.length <= max ? name : name.slice(0, max)
+}
+
+module.exports = {
+  CLOUDFRONT_REGION,
+  PlatformEdgeStack,
+}

package/src/infrastructure/platform-secrets-stack.js

@@ -0,0 +1,103 @@
+/* eslint-disable no-new */
+const { CfnOutput, RemovalPolicy, Stack } = require('aws-cdk-lib')
+const { Role, ServicePrincipal } = require('aws-cdk-lib/aws-iam')
+const { Secret } = require('aws-cdk-lib/aws-secretsmanager')
+const { listPlatformSecretServices } = require('../secrets/platform-secret-services')
+
+/**
+ * PlatformSecretsStackProps
+ * @typedef {Object} PlatformSecretsStackProps
+ * @property {import('../config/platform-config').PlatformConfig} config - platform config
+ */
+
+/**
+ * Creates one Secrets Manager secret per platform service (runtime + HTTP services[])
+ * and an ECS task role that can read that secret. Values are not set here — sync them
+ * from `platforms.json` with `npm run sync-secrets` after deploy (see #555).
+ *
+ * Also creates `{platform}/ghcr-pull` for private GHCR image pulls from ECS (#557).
+ * Put `{"username":"<github>","password":"<pat with read:packages>"}` into that secret
+ * before tasks can start (not synced from platforms.json).
+ *
+ * Long-lived secrets + task roles for ECS; independent of edge/DNS stack lifecycle.
+ */
+class PlatformSecretsStack extends Stack {
+  /**
+   * @param {object} scope
+   * @param {string} id
+   * @param {PlatformSecretsStackProps} props
+   */
+  constructor(scope, id, props) {
+    super(scope, id, props)
+
+    if (!props?.config) {
+      throw new Error('[PlatformSecretsStack] No config provided')
+    }
+
+    const platformName = props.config.platformName
+    /** @type {Record<string, import('aws-cdk-lib/aws-secretsmanager').ISecret>} */
+    this.secrets = {}
+    /** @type {Record<string, import('aws-cdk-lib/aws-iam').IRole>} */
+    this.taskRoles = {}
+
+    this.ghcrPullSecret = new Secret(this, 'GhcrPull', {
+      secretName: `${platformName}/ghcr-pull`,
+      description: `GHCR docker pull credentials for ${platformName} ECS (username + password)`,
+      removalPolicy: RemovalPolicy.RETAIN,
+    })
+
+    new CfnOutput(this, 'GhcrPullSecretArn', {
+      value: this.ghcrPullSecret.secretArn,
+      description: `Secrets Manager ARN for ${platformName}/ghcr-pull`,
+      exportName: `${platformName}-SecretArn-ghcr-pull`,
+    })
+
+    const services = listPlatformSecretServices(props.config)
+
+    for (const service of services) {
+      const idSuffix = toConstructId(service.key)
+
+      const secret = new Secret(this, `Secret${idSuffix}`, {
+        secretName: service.secretName,
+        description: `Platform secrets for ${service.source} (${platformName})`,
+        removalPolicy: RemovalPolicy.RETAIN,
+      })
+
+      // ECS Fargate task role (#557). Grant read only for this service secret.
+      const taskRole = new Role(this, `TaskRole${idSuffix}`, {
+        roleName: `${platformName}-${service.key}-task`,
+        description: `ECS task role for ${service.secretName} (read Secrets Manager)`,
+        assumedBy: new ServicePrincipal('ecs-tasks.amazonaws.com'),
+      })
+      secret.grantRead(taskRole)
+
+      this.secrets[service.key] = secret
+      this.taskRoles[service.key] = taskRole
+
+      new CfnOutput(this, `SecretArn${idSuffix}`, {
+        value: secret.secretArn,
+        description: `Secrets Manager ARN for ${service.secretName}`,
+        exportName: `${platformName}-SecretArn-${service.key}`,
+      })
+
+      new CfnOutput(this, `TaskRoleArn${idSuffix}`, {
+        value: taskRole.roleArn,
+        description: `ECS task role ARN for ${service.secretName}`,
+        exportName: `${platformName}-TaskRoleArn-${service.key}`,
+      })
+    }
+  }
+}
+
+/**
+ * CloudFormation-safe construct id fragment from a service key.
+ * @param {string} key
+ * @returns {string}
+ */
+function toConstructId(key) {
+  return key.replace(/[^A-Za-z0-9]/g, '')
+}
+
+module.exports = {
+  PlatformSecretsStack,
+}

package/src/infrastructure/platform-stage.js

@@ -1,9 +1,15 @@
 /* eslint-disable no-new */
 const { Stage } = require('aws-cdk-lib')
 const { StorageStaticStack } = require('./storage-static-stack')
-const { DeploymentTargetStack } = require('./deployment-target-stack')
 const { DnsStack } = require('./dns-stack')
 const { SesStack } = require('./ses-stack')
+const { PlatformSecretsStack } = require('./platform-secrets-stack')
+const { PlatformEcsStack } = require('./platform-ecs-stack')
+const { PlatformCiStack } = require('./platform-ci-stack')
+const {
+  PlatformEdgeStack,
+  CLOUDFRONT_REGION,
+} = require('./platform-edge-stack')
 
 /**
  * PlatformStage groups all stacks that make up a single platform deployment.
@@ -12,7 +18,10 @@ const { SesStack } = require('./ses-stack')
  *   cdk deploy 'ossybot/**' --profile ossybot
  *
  * Stack names within the stage are automatically prefixed with the platform name,
- * e.g. ossybot/trust-ci, ossybot/storage-static, ossybot/deployment-target, etc.
+ * e.g. ossybot/storage-static, ossybot/platform-ecs, ossybot/platform-edge, etc.
+ *
+ * EC2 + Caddy (`deployment-target`) is removed from the stage (#560). Destroy any
+ * leftover CloudFormation stack of that name after edge + DNS are live.
  */
 class PlatformStage extends Stage {
   constructor(scope, id, props) {
@@ -20,15 +29,33 @@ class PlatformStage extends Stage {
 
     const storageStatic = new StorageStaticStack(this, 'storage-static', props)
 
-    const deploymentTarget = new DeploymentTargetStack(this, 'deployment-target', {
+    const platformSecrets = new PlatformSecretsStack(this, 'platform-secrets', props)
+
+    const platformEcs = new PlatformEcsStack(this, 'platform-ecs', {
       ...props,
       bucket: storageStatic.bucket,
-      cdnDomainName: storageStatic.cdnDomainName
+      cdnDomainName: storageStatic.cdnDomainName,
+      secrets: platformSecrets.secrets,
+      taskRoles: platformSecrets.taskRoles,
+      ghcrPullSecret: platformSecrets.ghcrPullSecret,
+    })
+
+    new PlatformCiStack(this, 'platform-ci', props)
+
+    // CloudFront + WAF + ACM (#558). Must be us-east-1 for viewer certs / CLOUDFRONT WAF.
+    const platformEdge = new PlatformEdgeStack(this, 'platform-edge', {
+      config: props.config,
+      albDnsName: platformEcs.loadBalancer.loadBalancerDnsName,
+      env: {
+        account: props.env?.account ?? props.config.awsAccountId,
+        region: CLOUDFRONT_REGION,
+      },
     })
 
+    // Known Route53 domains → CloudFront (#558 / #560). No EIP path.
     new DnsStack(this, 'dns', {
       ...props,
-      containerDeploymentTargetPublicIp: deploymentTarget.containerDeploymentTargetPublicIp
+      cloudFrontDomainName: platformEdge.domainName,
     })
 
     new SesStack(this, 'ses', props)