@ossy/deployment-tools 3.0.9 → 3.4.0

package/src/infrastructure/dns-stack.spec.js

@@ -0,0 +1,15 @@
+const { describe, expect, it } = require('@jest/globals')
+const {
+  CLOUDFRONT_HOSTED_ZONE_ID,
+  CloudFrontDomainTarget,
+} = require('./dns-stack')
+
+describe('CloudFrontDomainTarget', () => {
+  it('binds a flat AliasRecordTargetConfig for CloudFront', () => {
+    const target = new CloudFrontDomainTarget('d111111abcdef8.cloudfront.net')
+    expect(target.bind()).toEqual({
+      hostedZoneId: CLOUDFRONT_HOSTED_ZONE_ID,
+      dnsName: 'd111111abcdef8.cloudfront.net',
+    })
+  })
+})

package/src/infrastructure/platform-ci-stack.js

@@ -0,0 +1,151 @@
+/* eslint-disable no-new */
+const { CfnOutput, Stack, Duration } = require('aws-cdk-lib')
+const {
+  Effect,
+  OpenIdConnectProvider,
+  PolicyStatement,
+  Role,
+  WebIdentityPrincipal,
+} = require('aws-cdk-lib/aws-iam')
+
+/**
+ * @typedef {Object} PlatformCiStackProps
+ * @property {import('../config/platform-config').PlatformConfig} config
+ */
+
+/**
+ * GitHub Actions → AWS OIDC deploy role for ECS rollouts (#559).
+ *
+ * Creates an OIDC provider for `token.actions.githubusercontent.com` and a
+ * platform-scoped role that can register task definitions and update Fargate
+ * services. No long-lived access keys in GitHub.
+ *
+ * Trust is limited to `ref:refs/heads/main` for `config.githubDeployRepos`
+ * (set in platforms.json — add a repo there to allow it to assume this role).
+ *
+ * Note: AWS allows only one OIDC provider per URL per account. This stack is
+ * intended for the primary platform stage until a shared account bootstrap exists.
+ */
+class PlatformCiStack extends Stack {
+  /**
+   * @param {object} scope
+   * @param {string} id
+   * @param {PlatformCiStackProps} props
+   */
+  constructor(scope, id, props) {
+    super(scope, id, props)
+
+    if (!props?.config?.platformName) {
+      throw new Error('[PlatformCiStack] config.platformName is required')
+    }
+
+    const platformName = props.config.platformName
+    const account = props.env?.account ?? props.config.awsAccountId
+    const region = props.env?.region ?? props.config.awsRegion
+    const clusterName = `${platformName}-platform`
+    const roleName = `${platformName}-github-deploy`.slice(0, 64)
+    const githubDeployRepos = props.config.githubDeployRepos
+
+    if (!Array.isArray(githubDeployRepos) || githubDeployRepos.length === 0) {
+      throw new Error(
+        '[PlatformCiStack] config.githubDeployRepos must be a non-empty array in platforms.json'
+      )
+    }
+
+    const oidcSubjects = githubDeployRepos.map(repo => {
+      if (!repo || typeof repo !== 'string' || !repo.includes('/')) {
+        throw new Error(
+          `[PlatformCiStack] invalid githubDeployRepos entry "${repo}" (expected owner/repo)`
+        )
+      }
+      return `repo:${repo}:ref:refs/heads/main`
+    })
+
+    const provider = new OpenIdConnectProvider(this, 'GithubOidcProvider', {
+      url: 'https://token.actions.githubusercontent.com',
+      clientIds: ['sts.amazonaws.com'],
+    })
+
+    const deployRole = new Role(this, 'GithubDeployRole', {
+      roleName,
+      description: `GitHub Actions OIDC deploy role for ${platformName} ECS (#559)`,
+      maxSessionDuration: Duration.hours(1),
+      assumedBy: new WebIdentityPrincipal(
+        provider.openIdConnectProviderArn,
+        {
+          StringEquals: {
+            'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
+          },
+          StringLike: {
+            'token.actions.githubusercontent.com:sub': oidcSubjects,
+          },
+        }
+      ),
+    })
+
+    const clusterArn = `arn:aws:ecs:${region}:${account}:cluster/${clusterName}`
+    const serviceArn = `arn:aws:ecs:${region}:${account}:service/${clusterName}/*`
+    const taskArn = `arn:aws:ecs:${region}:${account}:task/${clusterName}/*`
+
+    deployRole.addToPolicy(new PolicyStatement({
+      sid: 'EcsDeployRead',
+      effect: Effect.ALLOW,
+      actions: [
+        'ecs:DescribeClusters',
+        'ecs:DescribeServices',
+        'ecs:DescribeTasks',
+        'ecs:ListTasks',
+      ],
+      resources: [clusterArn, serviceArn, taskArn],
+    }))
+
+    // Task-definition APIs are not cluster-scoped in IAM the same way services are.
+    deployRole.addToPolicy(new PolicyStatement({
+      sid: 'EcsTaskDefinitions',
+      effect: Effect.ALLOW,
+      actions: [
+        'ecs:DescribeTaskDefinition',
+        'ecs:RegisterTaskDefinition',
+      ],
+      resources: ['*'],
+    }))
+
+    deployRole.addToPolicy(new PolicyStatement({
+      sid: 'EcsUpdateService',
+      effect: Effect.ALLOW,
+      actions: ['ecs:UpdateService'],
+      resources: [serviceArn],
+    }))
+
+    deployRole.addToPolicy(new PolicyStatement({
+      sid: 'PassEcsRoles',
+      effect: Effect.ALLOW,
+      actions: ['iam:PassRole'],
+      resources: [`arn:aws:iam::${account}:role/${platformName}-*`],
+      conditions: {
+        StringEquals: {
+          'iam:PassedToService': 'ecs-tasks.amazonaws.com',
+        },
+      },
+    }))
+
+    this.deployRole = deployRole
+    this.provider = provider
+
+    new CfnOutput(this, 'GithubDeployRoleArn', {
+      value: deployRole.roleArn,
+      description: 'IAM role ARN for GitHub Actions OIDC ECS deploys (#559)',
+      exportName: `${platformName}-GithubDeployRoleArn`,
+    })
+
+    new CfnOutput(this, 'GithubDeployRoleName', {
+      value: roleName,
+      description: 'IAM role name for GitHub Actions OIDC ECS deploys',
+      exportName: `${platformName}-GithubDeployRoleName`,
+    })
+  }
+}
+
+module.exports = {
+  PlatformCiStack,
+}

package/src/infrastructure/platform-ecs-stack.js

@@ -0,0 +1,349 @@
+/* eslint-disable no-new */
+const { CfnOutput, Duration, Stack } = require('aws-cdk-lib')
+const {
+  Peer,
+  Port,
+  SecurityGroup,
+  SubnetType,
+  Vpc,
+} = require('aws-cdk-lib/aws-ec2')
+const {
+  Cluster,
+  ContainerImage,
+  CpuArchitecture,
+  FargateService,
+  FargateTaskDefinition,
+  LogDrivers,
+  OperatingSystemFamily,
+  Protocol,
+  Secret: EcsSecret,
+} = require('aws-cdk-lib/aws-ecs')
+const {
+  ApplicationLoadBalancer,
+  ApplicationProtocol,
+  ApplicationTargetGroup,
+  ListenerCondition,
+  TargetType,
+} = require('aws-cdk-lib/aws-elasticloadbalancingv2')
+const {
+  ManagedPolicy,
+  Role,
+  ServicePrincipal,
+} = require('aws-cdk-lib/aws-iam')
+const { LogGroup, RetentionDays } = require('aws-cdk-lib/aws-logs')
+const {
+  CONTAINER_PORT,
+  HEALTH_PATH,
+  containerEnvironment,
+  ecsContainerHealthCheckCommand,
+  listPlatformEcsServices,
+  secretEnvKeysForEcsContainer,
+} = require('../ecs/platform-ecs-services')
+
+/**
+ * @typedef {Object} PlatformEcsStackProps
+ * @property {import('../config/platform-config').PlatformConfig} config
+ * @property {import('aws-cdk-lib/aws-s3').IBucket} bucket
+ * @property {string} cdnDomainName
+ * @property {Record<string, import('aws-cdk-lib/aws-secretsmanager').ISecret>} secrets
+ * @property {Record<string, import('aws-cdk-lib/aws-iam').IRole>} taskRoles
+ * @property {import('aws-cdk-lib/aws-secretsmanager').ISecret} ghcrPullSecret
+ */
+
+/**
+ * VPC + ECS Fargate + ALB for platform HTTP services (#557 / epic #553).
+ *
+ * - ALB in public subnets (HTTP :80; CloudFront origin in #558)
+ * - Fargate tasks in private subnets; env from Secrets Manager (#555)
+ * - Host-based listener rules; runtime is the default / catch-all target
+ * - No `ossy-api` service — website images include the API
+ *
+ * Production traffic reaches these services via CloudFront → ALB (#558 / #560).
+ */
+class PlatformEcsStack extends Stack {
+  /**
+   * @param {object} scope
+   * @param {string} id
+   * @param {PlatformEcsStackProps} props
+   */
+  constructor(scope, id, props) {
+    super(scope, id, props)
+
+    if (!props?.config) {
+      throw new Error('[PlatformEcsStack] No config provided')
+    }
+    if (!props.bucket || !props.cdnDomainName) {
+      throw new Error('[PlatformEcsStack] bucket and cdnDomainName are required')
+    }
+    if (!props.secrets || !props.taskRoles || !props.ghcrPullSecret) {
+      throw new Error('[PlatformEcsStack] secrets, taskRoles, and ghcrPullSecret are required')
+    }
+
+    const platformName = props.config.platformName
+    const services = listPlatformEcsServices(props.config)
+    const envKeys = Object.keys(props.config.env || {})
+
+    const vpc = new Vpc(this, 'Vpc', {
+      maxAzs: 2,
+      natGateways: 1,
+      subnetConfiguration: [
+        { name: 'public', subnetType: SubnetType.PUBLIC, cidrMask: 24 },
+        { name: 'private', subnetType: SubnetType.PRIVATE_WITH_EGRESS, cidrMask: 24 },
+      ],
+    })
+
+    const albSecurityGroup = new SecurityGroup(this, 'AlbSecurityGroup', {
+      vpc,
+      description: `${platformName} ALB ingress`,
+      allowAllOutbound: true,
+    })
+    albSecurityGroup.addIngressRule(
+      Peer.anyIpv4(),
+      Port.tcp(80),
+      'HTTP from Internet / CloudFront origin'
+    )
+
+    const serviceSecurityGroup = new SecurityGroup(this, 'ServiceSecurityGroup', {
+      vpc,
+      description: `${platformName} ECS tasks`,
+      allowAllOutbound: true,
+    })
+    serviceSecurityGroup.addIngressRule(
+      albSecurityGroup,
+      Port.tcp(CONTAINER_PORT),
+      'ALB to Fargate containers'
+    )
+
+    const cluster = new Cluster(this, 'Cluster', {
+      clusterName: `${platformName}-platform`,
+      vpc,
+      containerInsights: true,
+    })
+
+    const loadBalancer = new ApplicationLoadBalancer(this, 'Alb', {
+      vpc,
+      internetFacing: true,
+      securityGroup: albSecurityGroup,
+      vpcSubnets: { subnetType: SubnetType.PUBLIC },
+      loadBalancerName: truncateAwsName(`${platformName}-alb`, 32),
+    })
+
+    /** @type {ApplicationTargetGroup|undefined} */
+    let defaultTargetGroup
+    /** @type {Array<{ idSuffix: string, host: string, targetGroup: ApplicationTargetGroup }>} */
+    const hostRules = []
+
+    this.services = {}
+
+    for (const service of services) {
+      const idSuffix = toConstructId(service.key)
+      const secret = props.secrets[service.key]
+      const taskRole = props.taskRoles[service.key]
+
+      if (!secret || !taskRole) {
+        throw new Error(
+          `[PlatformEcsStack] missing secret or task role for "${service.key}" — deploy platform-secrets first`
+        )
+      }
+
+      const executionRole = new Role(this, `ExecutionRole${idSuffix}`, {
+        roleName: truncateAwsName(`${platformName}-${service.key}-exec`, 64),
+        description: `ECS execution role for ${service.secretName}`,
+        assumedBy: new ServicePrincipal('ecs-tasks.amazonaws.com'),
+        managedPolicies: [
+          ManagedPolicy.fromAwsManagedPolicyName(
+            'service-role/AmazonECSTaskExecutionRolePolicy'
+          ),
+        ],
+      })
+      // Task-def secret injection + GHCR pull use the execution role
+      secret.grantRead(executionRole)
+      props.ghcrPullSecret.grantRead(executionRole)
+
+      const logGroup = new LogGroup(this, `Logs${idSuffix}`, {
+        retention: RetentionDays.ONE_MONTH,
+      })
+
+      const taskDefinition = new FargateTaskDefinition(this, `TaskDef${idSuffix}`, {
+        family: `${platformName}-${service.key}`,
+        cpu: 512,
+        memoryLimitMiB: 1024,
+        runtimePlatform: {
+          cpuArchitecture: CpuArchitecture.X86_64,
+          operatingSystemFamily: OperatingSystemFamily.LINUX,
+        },
+        taskRole,
+        executionRole,
+      })
+
+      // Secrets must not redefine plain `environment` keys (PORT, OSSY_SERVICE_NAME, …).
+      const containerSecrets = Object.fromEntries(
+        secretEnvKeysForEcsContainer(envKeys).map(key => [
+          key,
+          EcsSecret.fromSecretsManager(secret, key),
+        ])
+      )
+
+      const container = taskDefinition.addContainer(`Container${idSuffix}`, {
+        containerName: service.key,
+        image: ContainerImage.fromRegistry(service.image, {
+          credentials: props.ghcrPullSecret,
+        }),
+        logging: LogDrivers.awsLogs({
+          streamPrefix: service.key,
+          logGroup,
+        }),
+        // Labels `/health` via OSSY_SERVICE_NAME; keys stay in CONTAINER_ENVIRONMENT_KEYS.
+        environment: containerEnvironment({
+          serviceKey: service.key,
+          containerPort: service.containerPort,
+          mediaRepository: props.bucket.bucketName,
+          mediaCdnDomainName: `https://${props.cdnDomainName}`,
+        }),
+        secrets: containerSecrets,
+        // Node fetch → GET /health (no curl in node:*-slim; no image-local script required).
+        healthCheck: {
+          command: ecsContainerHealthCheckCommand({
+            containerPort: service.containerPort,
+          }),
+          interval: Duration.seconds(30),
+          timeout: Duration.seconds(5),
+          retries: 3,
+          startPeriod: Duration.seconds(60),
+        },
+      })
+
+      container.addPortMappings({
+        containerPort: service.containerPort,
+        protocol: Protocol.TCP,
+      })
+
+      const fargateService = new FargateService(this, `Service${idSuffix}`, {
+        serviceName: truncateAwsName(`${platformName}-${service.key}`, 255),
+        cluster,
+        taskDefinition,
+        desiredCount: 1,
+        assignPublicIp: false,
+        securityGroups: [serviceSecurityGroup],
+        vpcSubnets: { subnetType: SubnetType.PRIVATE_WITH_EGRESS },
+        circuitBreaker: { rollback: true },
+        healthCheckGracePeriod: Duration.seconds(60),
+      })
+
+      const targetGroup = new ApplicationTargetGroup(this, `TargetGroup${idSuffix}`, {
+        vpc,
+        port: service.containerPort,
+        protocol: ApplicationProtocol.HTTP,
+        targetType: TargetType.IP,
+        targetGroupName: truncateAwsName(`${platformName}-${service.key}`, 32),
+        healthCheck: {
+          path: HEALTH_PATH,
+          healthyHttpCodes: '200',
+          interval: Duration.seconds(30),
+          timeout: Duration.seconds(5),
+          healthyThresholdCount: 2,
+          unhealthyThresholdCount: 3,
+        },
+        deregistrationDelay: Duration.seconds(30),
+      })
+
+      fargateService.attachToApplicationTargetGroup(targetGroup)
+
+      if (service.isDefault) {
+        defaultTargetGroup = targetGroup
+      }
+
+      for (const host of service.hosts) {
+        hostRules.push({ idSuffix, host, targetGroup })
+      }
+
+      this.services[service.key] = {
+        service: fargateService,
+        targetGroup,
+      }
+
+      new CfnOutput(this, `ServiceName${idSuffix}`, {
+        value: fargateService.serviceName,
+        description: `ECS service name for ${service.secretName}`,
+        exportName: `${platformName}-EcsService-${service.key}`,
+      })
+    }
+
+    if (!defaultTargetGroup) {
+      throw new Error('[PlatformEcsStack] runtime default target group was not created')
+    }
+
+    const listener = loadBalancer.addListener('HttpListener', {
+      port: 80,
+      protocol: ApplicationProtocol.HTTP,
+      defaultTargetGroups: [defaultTargetGroup],
+    })
+
+    // Lower priority number = evaluated first. Specific hosts before wildcards
+    // so `api.ossy.se` is not swallowed by `*.ossy.se`.
+    const orderedHostRules = [...hostRules].sort((a, b) => {
+      const aWild = a.host.includes('*') ? 1 : 0
+      const bWild = b.host.includes('*') ? 1 : 0
+      return aWild - bWild
+    })
+
+    let rulePriority = 10
+    for (const rule of orderedHostRules) {
+      listener.addTargetGroups(
+        `Rule${rule.idSuffix}${toConstructId(rule.host)}`,
+        {
+          priority: rulePriority,
+          conditions: [ListenerCondition.hostHeaders([rule.host])],
+          targetGroups: [rule.targetGroup],
+        }
+      )
+      rulePriority += 1
+    }
+
+    this.vpc = vpc
+    this.cluster = cluster
+    this.loadBalancer = loadBalancer
+    this.listener = listener
+
+    new CfnOutput(this, 'LoadBalancerDnsName', {
+      value: loadBalancer.loadBalancerDnsName,
+      description: 'ALB DNS name (CloudFront origin for platform-edge)',
+      exportName: `${platformName}-AlbDnsName`,
+    })
+
+    new CfnOutput(this, 'LoadBalancerArn', {
+      value: loadBalancer.loadBalancerArn,
+      description: 'ALB ARN',
+      exportName: `${platformName}-AlbArn`,
+    })
+
+    new CfnOutput(this, 'ClusterName', {
+      value: cluster.clusterName,
+      description: 'ECS cluster name',
+      exportName: `${platformName}-EcsClusterName`,
+    })
+  }
+}
+
+/**
+ * CloudFormation-safe construct id fragment.
+ * @param {string} key
+ * @returns {string}
+ */
+function toConstructId(key) {
+  return key.replace(/[^A-Za-z0-9]/g, '')
+}
+
+/**
+ * AWS name length limits (ALB, IAM, ECS, target groups).
+ * @param {string} name
+ * @param {number} max
+ * @returns {string}
+ */
+function truncateAwsName(name, max) {
+  return name.length <= max ? name : name.slice(0, max)
+}
+
+module.exports = {
+  PlatformEcsStack,
+}