@ossy/deployment-tools 3.0.9 → 3.4.0

package/src/infrastructure/platform-edge-stack.js

@@ -0,0 +1,213 @@
+/* eslint-disable no-new */
+const { CfnOutput, Stack, Duration } = require('aws-cdk-lib')
+const {
+  Certificate,
+  CertificateValidation,
+} = require('aws-cdk-lib/aws-certificatemanager')
+const {
+  AllowedMethods,
+  CachePolicy,
+  CachedMethods,
+  Distribution,
+  OriginProtocolPolicy,
+  OriginRequestPolicy,
+  PriceClass,
+  ViewerProtocolPolicy,
+} = require('aws-cdk-lib/aws-cloudfront')
+const { HttpOrigin } = require('aws-cdk-lib/aws-cloudfront-origins')
+const { HostedZone } = require('aws-cdk-lib/aws-route53')
+const { CfnWebACL } = require('aws-cdk-lib/aws-wafv2')
+const { planEdgeDomains } = require('../edge/platform-edge-domains')
+
+/** CloudFront ACM + WAFv2 CloudFront-scope resources must live in us-east-1. */
+const CLOUDFRONT_REGION = 'us-east-1'
+
+/**
+ * @typedef {Object} PlatformEdgeStackProps
+ * @property {import('../config/platform-config').PlatformConfig} config
+ * @property {string} albDnsName - DNS name of the platform ALB (CloudFront origin)
+ */
+
+/**
+ * CloudFront + WAF + ACM in front of the platform ALB (#558 / epic #553).
+ *
+ * - Separate distribution from the `/media` CDN in `storage-static`
+ * - Forwards viewer `Host` (and cookies/query) so ALB host rules keep working
+ * - ACM certificate in us-east-1 covering known platform domains
+ * - WAFv2 web ACL (CLOUDFRONT scope) associated with the distribution
+ *
+ * Deploy this stack with `env.region = us-east-1`. DNS alias cutover is wired
+ * from `DnsStack` using the distribution domain name output.
+ */
+class PlatformEdgeStack extends Stack {
+  /**
+   * @param {object} scope
+   * @param {string} id
+   * @param {PlatformEdgeStackProps} props
+   */
+  constructor(scope, id, props) {
+    super(scope, id, props)
+
+    if (!props?.config) {
+      throw new Error('[PlatformEdgeStack] No config provided')
+    }
+    if (!props.albDnsName) {
+      throw new Error('[PlatformEdgeStack] albDnsName is required')
+    }
+    if (Stack.of(this).region !== CLOUDFRONT_REGION) {
+      throw new Error(
+        `[PlatformEdgeStack] must be deployed in ${CLOUDFRONT_REGION} (got ${Stack.of(this).region})`
+      )
+    }
+
+    const platformName = props.config.platformName
+    const plan = planEdgeDomains(props.config)
+
+    /** @type {Map<string, import('aws-cdk-lib/aws-route53').IHostedZone>} */
+    const zonesByRoot = new Map(
+      [...new Set(plan.validationDomainToRoot.values())].map(rootDomain => [
+        rootDomain,
+        HostedZone.fromLookup(this, `${toConstructId(rootDomain)}Zone`, {
+          domainName: rootDomain,
+        }),
+      ])
+    )
+
+    /** @type {Record<string, import('aws-cdk-lib/aws-route53').IHostedZone>} */
+    const validationZones = Object.fromEntries(
+      [...plan.validationDomainToRoot.entries()].map(([domain, root]) => [
+        domain,
+        zonesByRoot.get(root),
+      ])
+    )
+
+    const certificate = new Certificate(this, 'ViewerCertificate', {
+      domainName: plan.primaryDomain,
+      subjectAlternativeNames: plan.subjectAlternativeNames,
+      validation: CertificateValidation.fromDnsMultiZone(validationZones),
+    })
+
+    const webAcl = new CfnWebACL(this, 'WebAcl', {
+      name: truncateName(`${platformName}-app-edge`, 128),
+      description: `WAF for ${platformName} CloudFront app distribution`,
+      scope: 'CLOUDFRONT',
+      defaultAction: { allow: {} },
+      visibilityConfig: {
+        cloudWatchMetricsEnabled: true,
+        metricName: truncateName(`${platformName}AppEdge`, 128),
+        sampledRequestsEnabled: true,
+      },
+      rules: [
+        {
+          name: 'AWSManagedRulesCommonRuleSet',
+          priority: 1,
+          overrideAction: { none: {} },
+          statement: {
+            managedRuleGroupStatement: {
+              vendorName: 'AWS',
+              name: 'AWSManagedRulesCommonRuleSet',
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: 'AWSManagedRulesCommonRuleSet',
+            sampledRequestsEnabled: true,
+          },
+        },
+        {
+          name: 'AWSManagedRulesKnownBadInputsRuleSet',
+          priority: 2,
+          overrideAction: { none: {} },
+          statement: {
+            managedRuleGroupStatement: {
+              vendorName: 'AWS',
+              name: 'AWSManagedRulesKnownBadInputsRuleSet',
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: 'AWSManagedRulesKnownBadInputsRuleSet',
+            sampledRequestsEnabled: true,
+          },
+        },
+      ],
+    })
+
+    const origin = new HttpOrigin(props.albDnsName, {
+      protocolPolicy: OriginProtocolPolicy.HTTP_ONLY,
+      readTimeout: Duration.seconds(60),
+      keepaliveTimeout: Duration.seconds(60),
+    })
+
+    // CloudFront associates WAF via webAclId (not CfnWebACLAssociation).
+    const distribution = new Distribution(this, 'AppDistribution', {
+      comment: `${platformName} app edge (ALB origin) — not the /media CDN`,
+      domainNames: plan.aliases,
+      certificate,
+      priceClass: PriceClass.PRICE_CLASS_100,
+      webAclId: webAcl.attrArn,
+      defaultBehavior: {
+        origin,
+        viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        allowedMethods: AllowedMethods.ALLOW_ALL,
+        cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
+        // Dynamic app traffic — do not cache at the edge by default.
+        cachePolicy: CachePolicy.CACHING_DISABLED,
+        // Forward Host so ALB listener host rules match viewer hostnames.
+        originRequestPolicy: OriginRequestPolicy.ALL_VIEWER,
+      },
+    })
+
+    this.distribution = distribution
+    this.certificate = certificate
+    this.domainName = distribution.distributionDomainName
+    this.distributionId = distribution.distributionId
+    this.aliases = plan.aliases
+
+    new CfnOutput(this, 'DistributionDomainName', {
+      value: distribution.distributionDomainName,
+      description: 'CloudFront domain for app traffic (Route53 alias target)',
+      exportName: `${platformName}-AppCloudFrontDomainName`,
+    })
+
+    new CfnOutput(this, 'DistributionId', {
+      value: distribution.distributionId,
+      description: 'CloudFront distribution id for app traffic',
+      exportName: `${platformName}-AppCloudFrontDistributionId`,
+    })
+
+    new CfnOutput(this, 'ViewerCertificateArn', {
+      value: certificate.certificateArn,
+      description: 'ACM certificate ARN (us-east-1) for CloudFront aliases',
+      exportName: `${platformName}-AppCloudFrontCertificateArn`,
+    })
+
+    new CfnOutput(this, 'WebAclArn', {
+      value: webAcl.attrArn,
+      description: 'WAFv2 web ACL ARN associated with the app distribution',
+      exportName: `${platformName}-AppCloudFrontWebAclArn`,
+    })
+  }
+}
+
+/**
+ * @param {string} key
+ * @returns {string}
+ */
+function toConstructId(key) {
+  return key.replace(/[^A-Za-z0-9]/g, '')
+}
+
+/**
+ * @param {string} name
+ * @param {number} max
+ * @returns {string}
+ */
+function truncateName(name, max) {
+  return name.length <= max ? name : name.slice(0, max)
+}
+
+module.exports = {
+  CLOUDFRONT_REGION,
+  PlatformEdgeStack,
+}

package/src/infrastructure/platform-secrets-stack.js

@@ -0,0 +1,103 @@
+/* eslint-disable no-new */
+const { CfnOutput, RemovalPolicy, Stack } = require('aws-cdk-lib')
+const { Role, ServicePrincipal } = require('aws-cdk-lib/aws-iam')
+const { Secret } = require('aws-cdk-lib/aws-secretsmanager')
+const { listPlatformSecretServices } = require('../secrets/platform-secret-services')
+
+/**
+ * PlatformSecretsStackProps
+ * @typedef {Object} PlatformSecretsStackProps
+ * @property {import('../config/platform-config').PlatformConfig} config - platform config
+ */
+
+/**
+ * Creates one Secrets Manager secret per platform service (runtime + HTTP services[])
+ * and an ECS task role that can read that secret. Values are not set here — sync them
+ * from `platforms.json` with `npm run sync-secrets` after deploy (see #555).
+ *
+ * Also creates `{platform}/ghcr-pull` for private GHCR image pulls from ECS (#557).
+ * Put `{"username":"<github>","password":"<pat with read:packages>"}` into that secret
+ * before tasks can start (not synced from platforms.json).
+ *
+ * Long-lived secrets + task roles for ECS; independent of edge/DNS stack lifecycle.
+ */
+class PlatformSecretsStack extends Stack {
+  /**
+   * @param {object} scope
+   * @param {string} id
+   * @param {PlatformSecretsStackProps} props
+   */
+  constructor(scope, id, props) {
+    super(scope, id, props)
+
+    if (!props?.config) {
+      throw new Error('[PlatformSecretsStack] No config provided')
+    }
+
+    const platformName = props.config.platformName
+    /** @type {Record<string, import('aws-cdk-lib/aws-secretsmanager').ISecret>} */
+    this.secrets = {}
+    /** @type {Record<string, import('aws-cdk-lib/aws-iam').IRole>} */
+    this.taskRoles = {}
+
+    this.ghcrPullSecret = new Secret(this, 'GhcrPull', {
+      secretName: `${platformName}/ghcr-pull`,
+      description: `GHCR docker pull credentials for ${platformName} ECS (username + password)`,
+      removalPolicy: RemovalPolicy.RETAIN,
+    })
+
+    new CfnOutput(this, 'GhcrPullSecretArn', {
+      value: this.ghcrPullSecret.secretArn,
+      description: `Secrets Manager ARN for ${platformName}/ghcr-pull`,
+      exportName: `${platformName}-SecretArn-ghcr-pull`,
+    })
+
+    const services = listPlatformSecretServices(props.config)
+
+    for (const service of services) {
+      const idSuffix = toConstructId(service.key)
+
+      const secret = new Secret(this, `Secret${idSuffix}`, {
+        secretName: service.secretName,
+        description: `Platform secrets for ${service.source} (${platformName})`,
+        removalPolicy: RemovalPolicy.RETAIN,
+      })
+
+      // ECS Fargate task role (#557). Grant read only for this service secret.
+      const taskRole = new Role(this, `TaskRole${idSuffix}`, {
+        roleName: `${platformName}-${service.key}-task`,
+        description: `ECS task role for ${service.secretName} (read Secrets Manager)`,
+        assumedBy: new ServicePrincipal('ecs-tasks.amazonaws.com'),
+      })
+      secret.grantRead(taskRole)
+
+      this.secrets[service.key] = secret
+      this.taskRoles[service.key] = taskRole
+
+      new CfnOutput(this, `SecretArn${idSuffix}`, {
+        value: secret.secretArn,
+        description: `Secrets Manager ARN for ${service.secretName}`,
+        exportName: `${platformName}-SecretArn-${service.key}`,
+      })
+
+      new CfnOutput(this, `TaskRoleArn${idSuffix}`, {
+        value: taskRole.roleArn,
+        description: `ECS task role ARN for ${service.secretName}`,
+        exportName: `${platformName}-TaskRoleArn-${service.key}`,
+      })
+    }
+  }
+}
+
+/**
+ * CloudFormation-safe construct id fragment from a service key.
+ * @param {string} key
+ * @returns {string}
+ */
+function toConstructId(key) {
+  return key.replace(/[^A-Za-z0-9]/g, '')
+}
+
+module.exports = {
+  PlatformSecretsStack,
+}

package/src/infrastructure/platform-stage.js

@@ -1,9 +1,15 @@
 /* eslint-disable no-new */
 const { Stage } = require('aws-cdk-lib')
 const { StorageStaticStack } = require('./storage-static-stack')
-const { DeploymentTargetStack } = require('./deployment-target-stack')
 const { DnsStack } = require('./dns-stack')
 const { SesStack } = require('./ses-stack')
+const { PlatformSecretsStack } = require('./platform-secrets-stack')
+const { PlatformEcsStack } = require('./platform-ecs-stack')
+const { PlatformCiStack } = require('./platform-ci-stack')
+const {
+  PlatformEdgeStack,
+  CLOUDFRONT_REGION,
+} = require('./platform-edge-stack')
 
 /**
  * PlatformStage groups all stacks that make up a single platform deployment.
@@ -12,7 +18,10 @@ const { SesStack } = require('./ses-stack')
  *   cdk deploy 'ossybot/**' --profile ossybot
  *
  * Stack names within the stage are automatically prefixed with the platform name,
- * e.g. ossybot/trust-ci, ossybot/storage-static, ossybot/deployment-target, etc.
+ * e.g. ossybot/storage-static, ossybot/platform-ecs, ossybot/platform-edge, etc.
+ *
+ * EC2 + Caddy (`deployment-target`) is removed from the stage (#560). Destroy any
+ * leftover CloudFormation stack of that name after edge + DNS are live.
  */
 class PlatformStage extends Stage {
   constructor(scope, id, props) {
@@ -20,15 +29,33 @@ class PlatformStage extends Stage {
 
     const storageStatic = new StorageStaticStack(this, 'storage-static', props)
 
-    const deploymentTarget = new DeploymentTargetStack(this, 'deployment-target', {
+    const platformSecrets = new PlatformSecretsStack(this, 'platform-secrets', props)
+
+    const platformEcs = new PlatformEcsStack(this, 'platform-ecs', {
       ...props,
       bucket: storageStatic.bucket,
-      cdnDomainName: storageStatic.cdnDomainName
+      cdnDomainName: storageStatic.cdnDomainName,
+      secrets: platformSecrets.secrets,
+      taskRoles: platformSecrets.taskRoles,
+      ghcrPullSecret: platformSecrets.ghcrPullSecret,
+    })
+
+    new PlatformCiStack(this, 'platform-ci', props)
+
+    // CloudFront + WAF + ACM (#558). Must be us-east-1 for viewer certs / CLOUDFRONT WAF.
+    const platformEdge = new PlatformEdgeStack(this, 'platform-edge', {
+      config: props.config,
+      albDnsName: platformEcs.loadBalancer.loadBalancerDnsName,
+      env: {
+        account: props.env?.account ?? props.config.awsAccountId,
+        region: CLOUDFRONT_REGION,
+      },
     })
 
+    // Known Route53 domains → CloudFront (#558 / #560). No EIP path.
     new DnsStack(this, 'dns', {
       ...props,
-      containerDeploymentTargetPublicIp: deploymentTarget.containerDeploymentTargetPublicIp
+      cloudFrontDomainName: platformEdge.domainName,
     })
 
     new SesStack(this, 'ses', props)

package/src/infrastructure/storage-static-stack.js

@@ -9,13 +9,12 @@ const { S3BucketOrigin } = require('aws-cdk-lib/aws-cloudfront-origins')
  * StorageStaticStack provisions the S3 bucket used for static assets and media,
  * a CloudFront CDN distribution serving the /media prefix, and a daily backup plan.
  *
- * This stack is intentionally kept separate from the deployment-target stack so that
- * the long-lived storage resources are never touched when the EC2 instance is updated
- * or replaced, avoiding CloudFormation cross-stack export conflicts.
+ * Kept separate from compute stacks so media storage is not replaced when ECS/edge
+ * stacks change (avoids CloudFormation cross-stack export conflicts).
  *
- * Exports (consumed by deployment-target-stack via cross-stack reference):
+ * Exports (consumed by platform-ecs via cross-stack reference):
  *   - `bucket`          — the S3 Bucket construct
- *   - `cdnDomainName`   — the CloudFront distribution domain name
+ *   - `cdnDomainName`   — the CloudFront distribution domain name (media CDN)
  */
 class StorageStaticStack extends Stack {
   constructor(scope, id, props) {

package/src/secrets/platform-secret-services.js

@@ -0,0 +1,32 @@
+/**
+ * Platform secret service targets for Secrets Manager.
+ *
+ * Naming and service set come from shared `platform-services` (#557 review).
+ */
+
+const { listPlatformServices } = require('../services/platform-services')
+
+/**
+ * @typedef {Object} PlatformSecretService
+ * @property {string} key - short key used in the secret name (after platform prefix)
+ * @property {string} secretName - full Secrets Manager name `{platform}/{key}`
+ * @property {string} source - origin label for docs/logs (`platform-runtime` or `services[].name`)
+ */
+
+/**
+ * List of platform services that should have a Secrets Manager secret.
+ *
+ * @param {{ platformName: string, services?: Array<{ name: string, type?: string }> }} config
+ * @returns {PlatformSecretService[]}
+ */
+function listPlatformSecretServices(config) {
+  return listPlatformServices(config).map(({ key, secretName, source }) => ({
+    key,
+    secretName,
+    source,
+  }))
+}
+
+module.exports = {
+  listPlatformSecretServices,
+}

package/src/secrets/platform-secret-services.spec.js

@@ -0,0 +1,40 @@
+const { describe, expect, it } = require('@jest/globals')
+const { listPlatformSecretServices } = require('./platform-secret-services')
+
+describe('listPlatformSecretServices', () => {
+  it('includes runtime and HTTP services, skips tcp and ossy-api', () => {
+    const services = listPlatformSecretServices({
+      platformName: 'ossybot',
+      services: [
+        {
+          name: 'ossy-website-ossy',
+          domain: 'ossy.se',
+          image: 'ghcr.io/ossy-se/website-ossy:latest',
+        },
+        {
+          name: 'ossy-api',
+          domain: 'api.ossy.se',
+          image: 'ghcr.io/ossy-se/ossy-api:latest',
+        },
+        {
+          name: 'minecraft',
+          type: 'tcp',
+          image: 'itzg/minecraft-server',
+          ports: [25565],
+        },
+      ],
+    })
+
+    expect(services.map(s => s.secretName)).toEqual([
+      'ossybot/runtime',
+      'ossybot/website-ossy',
+    ])
+    expect(services.find(s => s.key === 'runtime').source).toBe('platform-runtime')
+    expect(services.find(s => s.key === 'website-ossy').source).toBe('ossy-website-ossy')
+    expect(services.some(s => s.key === 'api' || s.secretName.endsWith('/api'))).toBe(false)
+  })
+
+  it('requires platformName', () => {
+    expect(() => listPlatformSecretServices({})).toThrow(/platformName is required/)
+  })
+})

package/src/secrets/sync-platform-secrets.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+/**
+ * Upsert Secrets Manager secret *values* from platforms.json env blocks.
+ *
+ * CDK (`PlatformSecretsStack`) owns the secret resources and IAM. This script
+ * only writes values — it never prints secret contents.
+ *
+ * Usage:
+ *   npm run sync-secrets -- --profile ossybot
+ *   node src/secrets/sync-platform-secrets.js --platforms-path ../infrastructure/platforms.json --profile ossybot
+ */
+
+const { resolve } = require('path')
+const {
+  SecretsManagerClient,
+  PutSecretValueCommand,
+  DescribeSecretCommand,
+} = require('@aws-sdk/client-secrets-manager')
+const { PlatformTemplateService } = require('../template')
+const { PlatformConfigService } = require('../config')
+const { listPlatformSecretServices } = require('./platform-secret-services')
+const { logInfo, logError } = require('../log')
+
+function getArg(argv, name) {
+  const flag = `--${name}`
+  const index = argv.indexOf(flag)
+  if (index === -1) return undefined
+  return argv[index + 1]
+}
+
+function hasFlag(argv, name) {
+  return argv.includes(`--${name}`)
+}
+
+/**
+ * @param {object} options
+ * @param {string} options.platformsPath
+ * @param {string=} options.profile
+ * @param {string=} options.platformName - sync a single platform when set
+ * @param {boolean=} options.dryRun
+ */
+async function syncPlatformSecrets({
+  platformsPath,
+  profile,
+  platformName,
+  dryRun = false,
+}) {
+  if (profile) {
+    process.env.AWS_PROFILE = profile
+  }
+
+  const templates = await PlatformTemplateService.readFromFile(platformsPath)
+  const configs = templates.map(PlatformConfigService.from)
+    .filter(config => !platformName || config.platformName === platformName)
+
+  if (configs.length === 0) {
+    throw new Error(
+      platformName
+        ? `No platform named "${platformName}" in ${platformsPath}`
+        : `No platforms found in ${platformsPath}`
+    )
+  }
+
+  for (const config of configs) {
+    const region = config.awsRegion
+    const client = new SecretsManagerClient({ region })
+    const services = listPlatformSecretServices(config)
+    const env = config.env || {}
+    const keyCount = Object.keys(env).length
+
+    logInfo({
+      message: `[sync-platform-secrets] ${config.platformName}: upserting ${services.length} secret(s), ${keyCount} env key(s) each`,
+    })
+
+    for (const service of services) {
+      if (dryRun) {
+        logInfo({
+          message: `[sync-platform-secrets] dry-run: would put ${service.secretName} (${keyCount} keys)`,
+        })
+        continue
+      }
+
+      try {
+        await client.send(new DescribeSecretCommand({ SecretId: service.secretName }))
+      } catch (error) {
+        if (error.name === 'ResourceNotFoundException' || error.__type === 'ResourceNotFoundException') {
+          throw new Error(
+            `Secret "${service.secretName}" does not exist. Deploy the platform-secrets CDK stack first ` +
+              `(npx cdk deploy '${config.platformName}/platform-secrets'), then re-run sync-secrets.`
+          )
+        }
+        throw error
+      }
+
+      await client.send(new PutSecretValueCommand({
+        SecretId: service.secretName,
+        SecretString: JSON.stringify(env),
+      }))
+
+      logInfo({
+        message: `[sync-platform-secrets] upserted ${service.secretName} (${keyCount} keys)`,
+      })
+    }
+  }
+}
+
+async function main(argv = process.argv.slice(2)) {
+  const platformsPath = resolve(
+    getArg(argv, 'platforms-path') || '../infrastructure/platforms.json'
+  )
+  const profile = getArg(argv, 'profile')
+  const platformName = getArg(argv, 'platform')
+  const dryRun = hasFlag(argv, 'dry-run')
+
+  await syncPlatformSecrets({
+    platformsPath,
+    profile,
+    platformName,
+    dryRun,
+  })
+}
+
+if (require.main === module) {
+  main().catch(error => {
+    logError({
+      message: '[sync-platform-secrets] failed',
+      error: error?.message || error,
+    })
+    process.exitCode = 1
+  })
+}
+
+module.exports = {
+  syncPlatformSecrets,
+  main,
+}