@ossy/deployment-tools 3.0.9 → 3.4.0

package/src/ecs/platform-ecs-services.js

@@ -0,0 +1,209 @@
+/**
+ * ECS/Fargate service targets derived from platforms.json.
+ *
+ * Service set and naming come from shared `platform-services`. No separate
+ * `ossy-api` — API lives in website images. TCP/UDP entries are skipped (not
+ * part of the ECS path after #560).
+ */
+
+const {
+  listHttpServiceEntries,
+  listPlatformServices,
+} = require('../services/platform-services')
+
+const RUNTIME_IMAGE = 'ghcr.io/ossy-se/platform:latest'
+const CONTAINER_PORT = 3000
+/** Shared with `@ossy/platform` `HEALTH_PATH` and ALB target-group checks. */
+const HEALTH_PATH = '/health'
+/**
+ * Abort hung Node `fetch` probes under the usual 5s ECS/Docker check timeout.
+ * Keep in sync with website-ossy `docker-healthcheck.js` when that lands.
+ */
+const HEALTHCHECK_FETCH_TIMEOUT_MS = 4000
+
+/**
+ * Plain task-definition `environment` keys set by PlatformEcsStack.
+ * Must not also be injected from Secrets Manager (ECS rejects duplicate keys).
+ */
+const CONTAINER_ENVIRONMENT_KEYS = Object.freeze([
+  'NODE_ENV',
+  'PORT',
+  'OSSY_SERVICE_NAME',
+  'MEDIA_REPOSITORY',
+  'MEDIA_CDN_DOMAIN_NAME',
+])
+
+/**
+ * @typedef {Object} PlatformEcsService
+ * @property {string} key - short key (`runtime`, `website-ossy`, …) — matches Secrets Manager
+ * @property {string} secretName - `{platform}/{key}`
+ * @property {string} source - origin label (`platform-runtime` or `services[].name`)
+ * @property {string} image - container image (GHCR)
+ * @property {string[]} hosts - ALB host-header values for this service (empty = default/catch-all)
+ * @property {boolean} isDefault - when true, ALB default action forwards here (runtime)
+ * @property {number} containerPort - container listen port
+ */
+
+/**
+ * Env keys from `platforms.json` that may be injected as ECS secrets.
+ * Drops keys already set as plain container environment.
+ *
+ * @param {string[]} envKeys
+ * @returns {string[]}
+ */
+function secretEnvKeysForEcsContainer(envKeys = []) {
+  if (!Array.isArray(envKeys)) {
+    throw new Error('[platform-ecs-services] envKeys must be an array')
+  }
+  const reserved = new Set(CONTAINER_ENVIRONMENT_KEYS)
+  return envKeys.filter((key) => typeof key === 'string' && key && !reserved.has(key))
+}
+
+/**
+ * Plain task-definition `environment` for an ECS HTTP container.
+ *
+ * Keys must stay aligned with `CONTAINER_ENVIRONMENT_KEYS` so Secrets Manager
+ * injection cannot collide with these values.
+ *
+ * @param {{
+ *   serviceKey: string,
+ *   containerPort?: number,
+ *   mediaRepository: string,
+ *   mediaCdnDomainName: string,
+ * }} options
+ * @returns {Record<string, string>}
+ */
+function containerEnvironment({
+  serviceKey,
+  containerPort = CONTAINER_PORT,
+  mediaRepository,
+  mediaCdnDomainName,
+}) {
+  if (!serviceKey) {
+    throw new Error('[platform-ecs-services] serviceKey is required')
+  }
+  if (!mediaRepository || !mediaCdnDomainName) {
+    throw new Error('[platform-ecs-services] mediaRepository and mediaCdnDomainName are required')
+  }
+  return {
+    NODE_ENV: 'production',
+    PORT: String(containerPort),
+    OSSY_SERVICE_NAME: serviceKey,
+    MEDIA_REPOSITORY: mediaRepository,
+    MEDIA_CDN_DOMAIN_NAME: mediaCdnDomainName,
+  }
+}
+
+/**
+ * ECS container health-check command for Ossy HTTP images.
+ *
+ * Uses Node `fetch` against `HEALTH_PATH` (honors runtime `PORT`) so probes
+ * work on `node:*-slim` without curl/wget and without requiring a WORKDIR
+ * `docker-healthcheck.js` in every image. Abort after
+ * `HEALTHCHECK_FETCH_TIMEOUT_MS` so hung sockets fail under the 5s timeout.
+ *
+ * @param {{ containerPort?: number }} [options]
+ * @returns {string[]} Docker/ECS exec-form health check command
+ */
+function ecsContainerHealthCheckCommand({ containerPort = CONTAINER_PORT } = {}) {
+  const portFallback = Number(containerPort) > 0 ? Number(containerPort) : CONTAINER_PORT
+  // Single expression — ECS passes each CMD arg without a shell.
+  const probe = [
+    `const port=Number.parseInt(String(process.env.PORT||''),10);`,
+    `const p=Number.isFinite(port)&&port>0?port:${portFallback};`,
+    `fetch('http://127.0.0.1:'+p+'${HEALTH_PATH}',{signal:AbortSignal.timeout(${HEALTHCHECK_FETCH_TIMEOUT_MS})})`,
+    `.then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))`,
+  ].join('')
+  return ['CMD', 'node', '-e', probe]
+}
+
+/**
+ * Host headers for an HTTP `services[]` entry.
+ * Uses optional `hosts` when set; otherwise `[domain]`.
+ *
+ * @param {{ domain?: string, hosts?: string[] }} entry
+ * @returns {string[]}
+ */
+function hostsFromServiceEntry(entry) {
+  if (Array.isArray(entry.hosts) && entry.hosts.length > 0) {
+    return entry.hosts.filter(Boolean)
+  }
+  if (entry.domain) return [entry.domain]
+  return []
+}
+
+/**
+ * Hosts routed explicitly to runtime (platform domains not claimed by an HTTP service).
+ * Wildcards like `*.ossy.se` are included so CMS apps keep working behind the ALB.
+ *
+ * @param {{ domains?: string[] }} config
+ * @param {Array<{ domain?: string, hosts?: string[] }>} httpEntries
+ * @returns {string[]}
+ */
+function runtimeHosts(config, httpEntries) {
+  const claimed = new Set(httpEntries.flatMap(hostsFromServiceEntry))
+  return (config.domains || []).filter(domain => !claimed.has(domain))
+}
+
+/**
+ * List Fargate services for a platform (runtime + HTTP services[]).
+ *
+ * @param {{
+ *   platformName: string,
+ *   domains?: string[],
+ *   services?: Array<{ name: string, type?: string, domain?: string, hosts?: string[], image?: string }>
+ * }} config
+ * @returns {PlatformEcsService[]}
+ */
+function listPlatformEcsServices(config) {
+  if (!config?.platformName) {
+    throw new Error('[platform-ecs-services] platformName is required')
+  }
+
+  const httpEntries = listHttpServiceEntries(config)
+  const runtimeHostList = runtimeHosts(config, httpEntries)
+
+  return listPlatformServices(config).map(service => {
+    if (service.key === 'runtime') {
+      return {
+        key: service.key,
+        secretName: service.secretName,
+        source: service.source,
+        image: RUNTIME_IMAGE,
+        hosts: runtimeHostList,
+        isDefault: true,
+        containerPort: CONTAINER_PORT,
+      }
+    }
+
+    if (!service.entry?.image) {
+      throw new Error(
+        `[platform-ecs-services] HTTP service "${service.key}" is missing image`
+      )
+    }
+
+    return {
+      key: service.key,
+      secretName: service.secretName,
+      source: service.source,
+      image: service.entry.image,
+      hosts: hostsFromServiceEntry(service.entry),
+      isDefault: false,
+      containerPort: CONTAINER_PORT,
+    }
+  })
+}
+
+module.exports = {
+  RUNTIME_IMAGE,
+  CONTAINER_PORT,
+  HEALTH_PATH,
+  HEALTHCHECK_FETCH_TIMEOUT_MS,
+  CONTAINER_ENVIRONMENT_KEYS,
+  secretEnvKeysForEcsContainer,
+  containerEnvironment,
+  ecsContainerHealthCheckCommand,
+  hostsFromServiceEntry,
+  listPlatformEcsServices,
+  runtimeHosts,
+}

package/src/ecs/platform-ecs-services.spec.js

@@ -0,0 +1,163 @@
+const { describe, expect, it } = require('@jest/globals')
+const fs = require('node:fs')
+const path = require('node:path')
+const {
+  CONTAINER_ENVIRONMENT_KEYS,
+  CONTAINER_PORT,
+  HEALTH_PATH,
+  HEALTHCHECK_FETCH_TIMEOUT_MS,
+  RUNTIME_IMAGE,
+  containerEnvironment,
+  ecsContainerHealthCheckCommand,
+  hostsFromServiceEntry,
+  listPlatformEcsServices,
+  secretEnvKeysForEcsContainer,
+} = require('./platform-ecs-services')
+
+describe('shared health constants', () => {
+  it('stay aligned with @ossy/platform health.js (ALB + ECS probes)', () => {
+    const healthSrc = fs.readFileSync(
+      path.join(__dirname, '../../../platform/src/health.js'),
+      'utf8'
+    )
+    expect(healthSrc).toContain(`export const HEALTH_PATH = '${HEALTH_PATH}'`)
+    expect(HEALTH_PATH).toBe('/health')
+    expect(HEALTHCHECK_FETCH_TIMEOUT_MS).toBe(4000)
+    expect(CONTAINER_PORT).toBe(3000)
+  })
+})
+
+describe('ecsContainerHealthCheckCommand', () => {
+  it('probes HEALTH_PATH with Node fetch and abort timeout', () => {
+    const command = ecsContainerHealthCheckCommand()
+    expect(command[0]).toBe('CMD')
+    expect(command[1]).toBe('node')
+    expect(command[2]).toBe('-e')
+    expect(command[3]).toContain(`'${HEALTH_PATH}'`)
+    expect(command[3]).toContain(`AbortSignal.timeout(${HEALTHCHECK_FETCH_TIMEOUT_MS})`)
+    expect(command[3]).toContain(String(CONTAINER_PORT))
+    expect(command[3]).toContain('process.env.PORT')
+  })
+
+  it('honors an explicit containerPort fallback', () => {
+    const command = ecsContainerHealthCheckCommand({ containerPort: 3002 })
+    expect(command[3]).toContain('3002')
+  })
+})
+
+describe('containerEnvironment', () => {
+  it('uses exactly CONTAINER_ENVIRONMENT_KEYS (reserved for secret filtering)', () => {
+    const env = containerEnvironment({
+      serviceKey: 'website-ossy',
+      containerPort: 3000,
+      mediaRepository: 'media-bucket',
+      mediaCdnDomainName: 'https://cdn.example',
+    })
+    expect(Object.keys(env).sort()).toEqual([...CONTAINER_ENVIRONMENT_KEYS].sort())
+    expect(env).toEqual({
+      NODE_ENV: 'production',
+      PORT: '3000',
+      OSSY_SERVICE_NAME: 'website-ossy',
+      MEDIA_REPOSITORY: 'media-bucket',
+      MEDIA_CDN_DOMAIN_NAME: 'https://cdn.example',
+    })
+  })
+
+  it('requires serviceKey and media fields', () => {
+    expect(() => containerEnvironment({
+      mediaRepository: 'b',
+      mediaCdnDomainName: 'https://cdn.example',
+    })).toThrow(/serviceKey is required/)
+    expect(() => containerEnvironment({ serviceKey: 'runtime' })).toThrow(
+      /mediaRepository and mediaCdnDomainName are required/
+    )
+  })
+})
+
+describe('secretEnvKeysForEcsContainer', () => {
+  it('drops reserved container environment keys', () => {
+    expect(secretEnvKeysForEcsContainer([
+      'PORT',
+      'OSSY_SERVICE_NAME',
+      'TOKEN_SECRET',
+      'NODE_ENV',
+      'MEDIA_REPOSITORY',
+      'DB_URL',
+    ])).toEqual(['TOKEN_SECRET', 'DB_URL'])
+  })
+
+  it('requires an array', () => {
+    expect(() => secretEnvKeysForEcsContainer(null)).toThrow(/envKeys must be an array/)
+  })
+})
+
+describe('hostsFromServiceEntry', () => {
+  it('uses hosts when provided', () => {
+    expect(hostsFromServiceEntry({
+      domain: 'ossy.se',
+      hosts: ['ossy.se', 'api.ossy.se'],
+    })).toEqual(['ossy.se', 'api.ossy.se'])
+  })
+
+  it('falls back to domain', () => {
+    expect(hostsFromServiceEntry({ domain: 'ossy.se' })).toEqual(['ossy.se'])
+  })
+})
+
+describe('listPlatformEcsServices', () => {
+  it('includes runtime (default) and HTTP services; skips tcp and ossy-api', () => {
+    const services = listPlatformEcsServices({
+      platformName: 'ossybot',
+      domains: [
+        'api.ossy.se',
+        'ossy.se',
+        '*.ossy.se',
+        'www.plexus-sanitas.com',
+        'worker.ossy.se',
+      ],
+      services: [
+        {
+          name: 'ossy-website-ossy',
+          domain: 'ossy.se',
+          hosts: ['ossy.se', 'api.ossy.se'],
+          image: 'ghcr.io/ossy-se/website-ossy:latest',
+        },
+        {
+          name: 'ossy-website-plexus-sanitas',
+          domain: 'www.plexus-sanitas.com',
+          image: 'ghcr.io/ossy-se/website-plexus-sanitas:latest',
+        },
+        {
+          name: 'minecraft',
+          type: 'tcp',
+          image: 'itzg/minecraft-server',
+          ports: [25565],
+        },
+      ],
+    })
+
+    expect(services.map(s => s.key)).toEqual([
+      'runtime',
+      'website-ossy',
+      'website-plexus-sanitas',
+    ])
+
+    const runtime = services.find(s => s.key === 'runtime')
+    expect(runtime.isDefault).toBe(true)
+    expect(runtime.image).toBe(RUNTIME_IMAGE)
+    expect(runtime.hosts).toEqual(['*.ossy.se', 'worker.ossy.se'])
+    expect(runtime.containerPort).toBe(3000)
+
+    const website = services.find(s => s.key === 'website-ossy')
+    expect(website.isDefault).toBe(false)
+    expect(website.hosts).toEqual(['ossy.se', 'api.ossy.se'])
+    expect(website.image).toBe('ghcr.io/ossy-se/website-ossy:latest')
+    expect(website.secretName).toBe('ossybot/website-ossy')
+
+    expect(services.some(s => s.key.includes('api'))).toBe(false)
+  })
+
+  it('requires platformName', () => {
+    expect(() => listPlatformEcsServices({})).toThrow(/platformName is required/)
+  })
+})

package/src/edge/platform-edge-domains.js

@@ -0,0 +1,101 @@
+/**
+ * Derive CloudFront aliases + ACM certificate coverage from platforms.json.
+ *
+ * Part of #558: ACM certs for CloudFront must live in us-east-1 and cover every
+ * known platform hostname (apex + wildcards). Customer domains pointed at the
+ * EIP from a registrar (not in Route53) stay out of scope.
+ */
+
+/**
+ * @typedef {Object} EdgeDomainPlan
+ * @property {string[]} aliases - CloudFront alternate domain names (viewer Host values)
+ * @property {string} primaryDomain - certificate primary domainName
+ * @property {string[]} subjectAlternativeNames - certificate SANs (excludes primary)
+ * @property {Map<string, string>} validationDomainToRoot - hostname → root domain for DNS validation zones
+ */
+
+/**
+ * Root domain for Route53 hosted-zone lookup (last two labels).
+ * @param {string} domain
+ * @returns {string}
+ */
+function rootDomainOf(domain) {
+  const bare = domain.replace(/^\*\./, '')
+  const parts = bare.split('.')
+  if (parts.length < 2) {
+    throw new Error(`[platform-edge-domains] cannot derive root domain from "${domain}"`)
+  }
+  return parts.slice(-2).join('.')
+}
+
+/**
+ * Unique, stable sorted list of CloudFront aliases from `domains` + HTTP service hosts.
+ *
+ * @param {{
+ *   domains?: string[],
+ *   services?: Array<{ type?: string, domain?: string, hosts?: string[] }>
+ * }} config
+ * @returns {string[]}
+ */
+function listEdgeAliases(config) {
+  const fromDomains = (config.domains || []).filter(Boolean)
+  const fromServices = (config.services || [])
+    .filter(entry => (entry.type || 'http') === 'http')
+    .flatMap(entry => {
+      if (Array.isArray(entry.hosts)) return entry.hosts.filter(Boolean)
+      return entry.domain ? [entry.domain] : []
+    })
+
+  return [...new Set([...fromDomains, ...fromServices])].sort((a, b) =>
+    a.localeCompare(b)
+  )
+}
+
+/**
+ * Build ACM + CloudFront domain plan for a platform.
+ *
+ * Primary cert domain prefers an apex (no wildcard, not a subdomain) when present,
+ * otherwise the first alias. SANs cover the rest. Validation maps each name to its
+ * root hosted zone (wildcards validate on the parent zone).
+ *
+ * @param {{
+ *   platformName?: string,
+ *   domains?: string[],
+ *   services?: Array<{ type?: string, domain?: string, hosts?: string[] }>
+ * }} config
+ * @returns {EdgeDomainPlan}
+ */
+function planEdgeDomains(config) {
+  if (!config?.platformName) {
+    throw new Error('[platform-edge-domains] platformName is required')
+  }
+
+  const aliases = listEdgeAliases(config)
+  if (aliases.length === 0) {
+    throw new Error(
+      `[platform-edge-domains] platform "${config.platformName}" has no domains for CloudFront`
+    )
+  }
+
+  const apex = aliases.find(d => !d.includes('*') && d.split('.').length === 2)
+  const primaryDomain = apex || aliases[0]
+  const subjectAlternativeNames = aliases.filter(d => d !== primaryDomain)
+
+  /** @type {Map<string, string>} */
+  const validationDomainToRoot = new Map(
+    aliases.map(alias => [alias, rootDomainOf(alias)])
+  )
+
+  return {
+    aliases,
+    primaryDomain,
+    subjectAlternativeNames,
+    validationDomainToRoot,
+  }
+}
+
+module.exports = {
+  rootDomainOf,
+  listEdgeAliases,
+  planEdgeDomains,
+}

package/src/edge/platform-edge-domains.spec.js

@@ -0,0 +1,87 @@
+const { describe, expect, it } = require('@jest/globals')
+const {
+  rootDomainOf,
+  listEdgeAliases,
+  planEdgeDomains,
+} = require('./platform-edge-domains')
+
+describe('rootDomainOf', () => {
+  it('strips wildcards and returns the apex', () => {
+    expect(rootDomainOf('*.ossy.se')).toBe('ossy.se')
+    expect(rootDomainOf('api.ossy.se')).toBe('ossy.se')
+    expect(rootDomainOf('www.plexus-sanitas.com')).toBe('plexus-sanitas.com')
+  })
+})
+
+describe('listEdgeAliases', () => {
+  it('unions domains and HTTP service hosts; skips tcp', () => {
+    expect(listEdgeAliases({
+      domains: ['ossy.se', '*.ossy.se', 'worker.ossy.se'],
+      services: [
+        {
+          name: 'ossy-website-ossy',
+          domain: 'ossy.se',
+          hosts: ['ossy.se', 'api.ossy.se'],
+        },
+        {
+          name: 'minecraft',
+          type: 'tcp',
+          image: 'itzg/minecraft-server',
+          ports: [25565],
+        },
+      ],
+    })).toEqual(['*.ossy.se', 'api.ossy.se', 'ossy.se', 'worker.ossy.se'])
+  })
+})
+
+describe('planEdgeDomains', () => {
+  it('picks apex as primary and maps validation zones', () => {
+    const plan = planEdgeDomains({
+      platformName: 'ossybot',
+      domains: [
+        'api.ossy.se',
+        'ossy.se',
+        '*.ossy.se',
+        'www.plexus-sanitas.com',
+        'worker.ossy.se',
+      ],
+      services: [
+        {
+          name: 'ossy-website-ossy',
+          domain: 'ossy.se',
+          hosts: ['ossy.se', 'api.ossy.se'],
+        },
+        {
+          name: 'ossy-website-plexus-sanitas',
+          domain: 'www.plexus-sanitas.com',
+        },
+      ],
+    })
+
+    expect(plan.primaryDomain).toBe('ossy.se')
+    expect(plan.aliases).toEqual([
+      '*.ossy.se',
+      'api.ossy.se',
+      'ossy.se',
+      'worker.ossy.se',
+      'www.plexus-sanitas.com',
+    ])
+    expect(plan.subjectAlternativeNames).toEqual([
+      '*.ossy.se',
+      'api.ossy.se',
+      'worker.ossy.se',
+      'www.plexus-sanitas.com',
+    ])
+    expect(plan.validationDomainToRoot.get('*.ossy.se')).toBe('ossy.se')
+    expect(plan.validationDomainToRoot.get('www.plexus-sanitas.com')).toBe(
+      'plexus-sanitas.com'
+    )
+  })
+
+  it('requires platformName and at least one alias', () => {
+    expect(() => planEdgeDomains({})).toThrow(/platformName is required/)
+    expect(() => planEdgeDomains({ platformName: 'x', domains: [] })).toThrow(
+      /no domains for CloudFront/
+    )
+  })
+})

package/src/index.js

@@ -1,5 +1,49 @@
 const { PlatformTemplateService } = require('./template')
+const {
+  listPlatformServices,
+  listHttpServiceEntries,
+  serviceKeyFromName,
+  secretNameFor,
+} = require('./services/platform-services')
+const { listPlatformSecretServices } = require('./secrets/platform-secret-services')
+const { syncPlatformSecrets } = require('./secrets/sync-platform-secrets')
+const {
+  listPlatformEcsServices,
+  hostsFromServiceEntry,
+  RUNTIME_IMAGE,
+  CONTAINER_PORT,
+  HEALTH_PATH,
+  HEALTHCHECK_FETCH_TIMEOUT_MS,
+  CONTAINER_ENVIRONMENT_KEYS,
+  secretEnvKeysForEcsContainer,
+  containerEnvironment,
+  ecsContainerHealthCheckCommand,
+} = require('./ecs/platform-ecs-services')
+const {
+  rootDomainOf,
+  listEdgeAliases,
+  planEdgeDomains,
+} = require('./edge/platform-edge-domains')
 
 module.exports = {
-  PlatformTemplateService
+  PlatformTemplateService,
+  listPlatformServices,
+  listHttpServiceEntries,
+  serviceKeyFromName,
+  secretNameFor,
+  listPlatformSecretServices,
+  syncPlatformSecrets,
+  listPlatformEcsServices,
+  hostsFromServiceEntry,
+  RUNTIME_IMAGE,
+  CONTAINER_PORT,
+  HEALTH_PATH,
+  HEALTHCHECK_FETCH_TIMEOUT_MS,
+  CONTAINER_ENVIRONMENT_KEYS,
+  secretEnvKeysForEcsContainer,
+  containerEnvironment,
+  ecsContainerHealthCheckCommand,
+  rootDomainOf,
+  listEdgeAliases,
+  planEdgeDomains,
 }

package/src/infrastructure/dns-stack.js

@@ -2,16 +2,44 @@ const { Stack, Duration } = require('aws-cdk-lib')
 const {
   HostedZone,
   ARecord,
+  AaaaRecord,
   MxRecord,
   RecordTarget
 } = require('aws-cdk-lib/aws-route53')
 
+/** Global Route53 hosted zone id for CloudFront alias records. */
+const CLOUDFRONT_HOSTED_ZONE_ID = 'Z2FDTNDATAQYW2'
+
+/**
+ * Alias target for a CloudFront distribution domain name (cross-region safe).
+ * Avoids requiring the Distribution construct in the platform-region DnsStack.
+ */
+class CloudFrontDomainTarget {
+  /**
+   * @param {string} domainName - e.g. d111111abcdef8.cloudfront.net
+   */
+  constructor(domainName) {
+    this.domainName = domainName
+  }
+
+  /**
+   * @returns {import('aws-cdk-lib/aws-route53').AliasRecordTargetConfig}
+   */
+  bind() {
+    // IAliasRecordTarget shape (not the raw CloudFormation AliasTargetProperty).
+    return {
+      hostedZoneId: CLOUDFRONT_HOSTED_ZONE_ID,
+      dnsName: this.domainName,
+    }
+  }
+}
+
 /**
  * DnsStackProps
  * @namespace DnsStack
  * @typedef {Object} DnsStackProps
  * @property {PlatformConfig} config - platform config
- * @property {string} containerDeploymentTargetPublicIp - public ip address of ec2 instance
+ * @property {string} cloudFrontDomainName - CloudFront app distribution domain (#558 / #560)
  */
 
 /**
@@ -27,9 +55,13 @@ class DnsStack extends Stack {
   constructor(scope, id, props) {
     super(scope, id, props)
 
+    if (!props.cloudFrontDomainName) {
+      throw new Error('[DnsStack] cloudFrontDomainName is required')
+    }
+
     // Group domains by root domain so we can look up each hosted zone once.
     const domainsByRoot = (props.config.domains ?? []).reduce((map, domain) => {
-      const parts = domain.split('.')
+      const parts = domain.replace(/^\*\./, '').split('.')
       const rootDomain = parts.slice(-2).join('.')
       map.has(rootDomain)
         ? map.set(rootDomain, [...map.get(rootDomain), domain])
@@ -41,10 +73,20 @@ class DnsStack extends Stack {
       const zone = HostedZone.fromLookup(this, `${rootDomain}-zone`, { domainName: rootDomain })
 
       domains.forEach(domain => {
+        // Known platform domains → CloudFront (not EIP). Alias A + AAAA.
+        const cloudFrontTarget = RecordTarget.fromAlias(
+          new CloudFrontDomainTarget(props.cloudFrontDomainName)
+        )
         new ARecord(this, `${domain}-record`, {
           zone,
           recordName: domain,
-          target: RecordTarget.fromIpAddresses(props.containerDeploymentTargetPublicIp),
+          target: cloudFrontTarget,
+          ttl: Duration.seconds(60)
+        })
+        new AaaaRecord(this, `${domain}-aaaa-record`, {
+          zone,
+          recordName: domain,
+          target: cloudFrontTarget,
           ttl: Duration.seconds(60)
         })
       })
@@ -73,5 +115,7 @@ class DnsStack extends Stack {
 }
 
 module.exports = {
+  CLOUDFRONT_HOSTED_ZONE_ID,
+  CloudFrontDomainTarget,
   DnsStack
 }