@ossy/deployment-tools 3.0.9 → 3.4.0

package/src/services/platform-services.js

@@ -0,0 +1,94 @@
+/**
+ * Shared platform service naming and listing from platforms.json.
+ *
+ * Used by Secrets Manager and ECS so neither domain depends on the other.
+ * Built-in `ossy-api` is omitted — API lives in website images; only
+ * platform-runtime + configured HTTP `services[]` are included.
+ */
+
+/**
+ * @typedef {Object} PlatformService
+ * @property {string} key - short key (`runtime`, `website-ossy`, …)
+ * @property {string} secretName - `{platform}/{key}`
+ * @property {string} source - origin label (`platform-runtime` or systemd/service name)
+ * @property {object=} entry - original HTTP `services[]` entry when applicable
+ */
+
+/**
+ * Derive the canonical service key from a platforms.json HTTP service name.
+ * Strips a leading `ossy-` prefix so `ossy-website-ossy` → `website-ossy`.
+ *
+ * @param {string} serviceName
+ * @returns {string}
+ */
+function serviceKeyFromName(serviceName) {
+  if (!serviceName || typeof serviceName !== 'string') {
+    throw new Error('[platform-services] service name is required')
+  }
+  return serviceName.replace(/^ossy-/, '')
+}
+
+/**
+ * Secrets Manager / shared resource name for a service key.
+ *
+ * @param {string} platformName
+ * @param {string} key
+ * @returns {string}
+ */
+function secretNameFor(platformName, key) {
+  return `${platformName}/${key}`
+}
+
+/**
+ * HTTP `services[]` entries (skips tcp/udp and nameless rows).
+ *
+ * @param {{ services?: Array<{ name?: string, type?: string }> }} config
+ * @returns {Array<{ name: string, type?: string, domain?: string, hosts?: string[], image?: string }>}
+ */
+function listHttpServiceEntries(config) {
+  return (config.services || []).filter(
+    entry => (entry.type || 'http') === 'http' && entry.name
+  )
+}
+
+/**
+ * Platform services that get secrets / ECS targets: runtime + HTTP services[].
+ * Skips legacy `ossy-api` (key `api`).
+ *
+ * @param {{ platformName: string, services?: Array<{ name: string, type?: string }> }} config
+ * @returns {PlatformService[]}
+ */
+function listPlatformServices(config) {
+  if (!config?.platformName) {
+    throw new Error('[platform-services] platformName is required')
+  }
+
+  const { platformName } = config
+  const runtime = {
+    key: 'runtime',
+    secretName: secretNameFor(platformName, 'runtime'),
+    source: 'platform-runtime',
+  }
+
+  const httpServices = listHttpServiceEntries(config)
+    .map(entry => {
+      const key = serviceKeyFromName(entry.name)
+      return { key, entry }
+    })
+    .filter(({ key }) => key !== 'api')
+    .map(({ key, entry }) => ({
+      key,
+      secretName: secretNameFor(platformName, key),
+      source: entry.name,
+      entry,
+    }))
+
+  return [runtime, ...httpServices]
+}
+
+module.exports = {
+  serviceKeyFromName,
+  secretNameFor,
+  listHttpServiceEntries,
+  listPlatformServices,
+}

package/src/services/platform-services.spec.js

@@ -0,0 +1,80 @@
+const { describe, expect, it } = require('@jest/globals')
+const {
+  serviceKeyFromName,
+  secretNameFor,
+  listHttpServiceEntries,
+  listPlatformServices,
+} = require('./platform-services')
+
+describe('serviceKeyFromName', () => {
+  it('strips leading ossy- prefix', () => {
+    expect(serviceKeyFromName('ossy-website-ossy')).toBe('website-ossy')
+  })
+
+  it('leaves names without ossy- prefix unchanged', () => {
+    expect(serviceKeyFromName('website-ossy')).toBe('website-ossy')
+  })
+
+  it('throws when name is missing', () => {
+    expect(() => serviceKeyFromName('')).toThrow(/service name is required/)
+  })
+})
+
+describe('secretNameFor', () => {
+  it('joins platform and key', () => {
+    expect(secretNameFor('ossybot', 'website-ossy')).toBe('ossybot/website-ossy')
+  })
+})
+
+describe('listHttpServiceEntries', () => {
+  it('keeps http entries and skips tcp', () => {
+    const entries = listHttpServiceEntries({
+      services: [
+        { name: 'ossy-website-ossy', domain: 'ossy.se' },
+        { name: 'minecraft', type: 'tcp', ports: [25565] },
+      ],
+    })
+    expect(entries.map(e => e.name)).toEqual(['ossy-website-ossy'])
+  })
+})
+
+describe('listPlatformServices', () => {
+  it('includes runtime and HTTP services, skips tcp and ossy-api', () => {
+    const services = listPlatformServices({
+      platformName: 'ossybot',
+      services: [
+        {
+          name: 'ossy-website-ossy',
+          domain: 'ossy.se',
+          image: 'ghcr.io/ossy-se/website-ossy:latest',
+        },
+        {
+          name: 'ossy-api',
+          domain: 'api.ossy.se',
+          image: 'ghcr.io/ossy-se/ossy-api:latest',
+        },
+        {
+          name: 'minecraft',
+          type: 'tcp',
+          image: 'itzg/minecraft-server',
+          ports: [25565],
+        },
+      ],
+    })
+
+    expect(services.map(s => s.secretName)).toEqual([
+      'ossybot/runtime',
+      'ossybot/website-ossy',
+    ])
+    expect(services.find(s => s.key === 'runtime').source).toBe('platform-runtime')
+    expect(services.find(s => s.key === 'website-ossy').source).toBe('ossy-website-ossy')
+    expect(services.find(s => s.key === 'website-ossy').entry.image).toBe(
+      'ghcr.io/ossy-se/website-ossy:latest'
+    )
+    expect(services.some(s => s.key === 'api' || s.secretName.endsWith('/api'))).toBe(false)
+  })
+
+  it('requires platformName', () => {
+    expect(() => listPlatformServices({})).toThrow(/platformName is required/)
+  })
+})

package/src/template/platform-template.js

@@ -3,14 +3,14 @@ const { readFileSync } = require('fs')
 const { logError, logInfo } = require('../log')
 
 /**
- * Platform template definition
+ * Platform template definition (raw entry from platforms.json before PlatformConfig defaults).
  * @typedef {Object} PlatformTemplate
  * @property {string} platformName - Name of platform
- *
  * @property {string} awsAccountId - Aws account id
- * @property {string=} awsRegion - ?
- * @property {string=} awsKeyPairName - ?
- * @property {string=} awsDeploymentSqsArn - ?
+ * @property {string=} awsRegion - AWS region (defaults applied in PlatformConfigService)
+ * @property {string[]=} githubDeployRepos - repos trusted by platform-ci OIDC (#559)
+ * @property {string[]=} domains - Route53 → CloudFront known domains (#560)
+ * @property {string=} awsKeyPairName - unused after EC2 decommission (#560)
  */
 
 /**

package/src/infrastructure/container-deployment-target/aws-profile.js

@@ -1,25 +0,0 @@
-/**
-  * @class
-*/
-class AwsProfile {
-
-  static writeFile(roleArn, region) {
-
-    const awsProfileFile = `
-[profile ci-client]
-role_arn = ${roleArn}
-credential_source = Ec2InstanceMetadata
-region = ${region}
-`
-    return [
-      'sudo mkdir /home/caddy',
-      'sudo mkdir /home/caddy/.aws',
-      `sudo echo "${awsProfileFile}" >> /home/caddy/.aws/credentials`
-    ]
-  }
-
-}
-
-module.exports = {
-  AwsProfile
-}

package/src/infrastructure/container-deployment-target/caddy.service.js

@@ -1,117 +0,0 @@
-/**
- * Builds the full Caddyfile content.
- * - Global block: on-demand TLS pointing at the API ask endpoint
- * - API block: explicit Route53 TLS for api.ossy.se
- * - One block per ContainerService (from platforms.json `services`)
- * - Catch-all :443 block: on-demand TLS, routes to the platform runtime
- *
- * @param {import('./container-service').ContainerService[]} services
- */
-const buildCaddyfile = (services) => {
-  const serviceBlocks = services.map(s => s.caddyBlock).join('\n')
-
-  return `
-{
-  on_demand_tls {
-    ask http://localhost:3001/api/v0/apps/ask
-  }
-}
-
-api.ossy.se {
-  tls {
-    dns route53 {
-      max_retries 10
-    }
-  }
-  reverse_proxy localhost:3001
-}
-${serviceBlocks}
-
-:443 {
-  tls {
-    on_demand
-    dns route53 {
-      max_retries 10
-    }
-  }
-  reverse_proxy localhost:3000
-}
-`
-}
-
-const systemdServiceFile = `
-# caddy-route53.service — Caddy with Route53 DNS plugin for on-demand TLS.
-# Configured via /etc/caddy/Caddyfile.
-
-[Unit]
-Description=Caddy
-Documentation=https://caddyserver.com/docs/
-After=network.target network-online.target
-Requires=network-online.target
-
-[Service]
-Type=notify
-User=caddy
-Group=caddy
-ExecStart=/usr/bin/caddy.route53 run --config /etc/caddy/Caddyfile
-TimeoutStopSec=5s
-LimitNOFILE=1048576
-LimitNPROC=512
-PrivateTmp=true
-ProtectSystem=full
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-
-[Install]
-WantedBy=multi-user.target cloud-init.target
-`
-
-/**
-  * @class
-*/
-class CaddyService {
-
-  /**
-   * @param {import('./container-service').ContainerService[]} services
-   */
-  static install(services = []) {
-    const caddyfile = buildCaddyfile(services)
-    return [
-      // Write Caddyfile
-      'sudo mkdir -p /etc/caddy',
-      `sudo tee /etc/caddy/Caddyfile > /dev/null << 'CADDYEOF'\n${caddyfile}\nCADDYEOF`,
-      // Write systemd unit
-      `sudo tee /etc/systemd/system/caddy-route53.service > /dev/null << 'UNITEOF'\n${systemdServiceFile}\nUNITEOF`,
-      // Create caddy system user (apt install caddy may not run on all Ubuntu versions)
-      'sudo useradd --system --home /var/lib/caddy --shell /usr/sbin/nologin --create-home caddy || true',
-      'sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https',
-      'sudo curl -1sLf \'https://dl.cloudsmith.io/public/caddy/stable/gpg.key\' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg',
-      'sudo curl -1sLf \'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt\' | sudo tee /etc/apt/sources.list.d/caddy-stable.list',
-      'sudo curl -1sLf \'https://dl.cloudsmith.io/public/caddy/xcaddy/gpg.key\' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg',
-      'sudo curl -1sLf \'https://dl.cloudsmith.io/public/caddy/xcaddy/debian.deb.txt\' | sudo tee /etc/apt/sources.list.d/caddy-xcaddy.list',
-      'sudo add-apt-repository ppa:longsleep/golang-backports -y',
-      'sudo apt update',
-      'sudo apt install caddy xcaddy golang-go -y',
-      'sudo xcaddy build --with github.com/caddy-dns/route53',
-      'sudo mv ./caddy /usr/bin/caddy.route53'
-    ]
-  }
-
-  static enable() {
-    return [
-      'sudo systemctl disable caddy.service',
-      'sudo systemctl enable caddy-route53.service'
-    ]
-  }
-
-  static start() {
-    return [
-      'sudo systemctl stop caddy.service',
-      'sudo systemctl start caddy-route53.service'
-    ]
-  }
-
-}
-
-module.exports = {
-  CaddyService
-}

package/src/infrastructure/container-deployment-target/container-deployment-target.js

@@ -1,222 +0,0 @@
-const { Construct } = require('constructs')
-const {
-  Instance,
-  InstanceType,
-  InstanceClass,
-  InstanceSize,
-  GenericLinuxImage,
-  Vpc,
-  SecurityGroup,
-  Peer,
-  Port,
-  UserData,
-  KeyPair,
-  BlockDeviceVolume,
-  CfnEIP,
-  CfnEIPAssociation
-} = require('aws-cdk-lib/aws-ec2')
-const { Role, ServicePrincipal, Policy, PolicyStatement, Effect } = require('aws-cdk-lib/aws-iam')
-const { Source, BucketDeployment } = require('aws-cdk-lib/aws-s3-deployment')
-const { getInstallNodeJs, getInstallNpm, getInstallDocker } = require('./user-data-commands')
-const { CaddyService } = require('./caddy.service')
-const { OssyRuntimeService } = require('./ossy-runtime.service')
-const { OssyApiService } = require('./ossy-api.service')
-const { fromConfig: buildContainerServices } = require('./container-service')
-const { SupportedRegions } = require('../../config')
-
-/**
- * ContainerServerProps
- * @namespace ContainerServer
- * @typedef {Object} ContainerServerProps
- * @property {PlatformConfig} config - platform config
- * @property {Bucket} bucket - s3 bucket
- */
-
-const InstanceImages = {
-  UBUNTU: 'ami-067bcf851477ebb78' // Ubuntu Server 24.04 LTS (HVM), eu-north-1
-}
-
-/**
-  * @class
-*/
-class ContainerDeploymentTarget extends Construct {
-
-  /**
-   * @param {object} scope - scope
-   * @param {string} id - id
-   * @param {ContainerServerProps} props - ContainerServerProps
-   */
-  constructor(scope, id, props) {
-    super(scope, id)
-
-    const vpc = Vpc.fromLookup(this, 'VPC', { isDefault: true })
-    const securityGroup = new SecurityGroup(this, 'SecurityGroup', { vpc, allowAllOutbound: true })
-
-    securityGroup.addIngressRule(
-      Peer.anyIpv4(),
-      Port.tcp(22),
-      'allow SSH access from anywhere'
-    )
-
-    securityGroup.addIngressRule(
-      Peer.anyIpv4(),
-      Port.tcp(80),
-      'allow HTTP traffic from anywhere'
-    )
-
-    securityGroup.addIngressRule(
-      Peer.anyIpv4(),
-      Port.tcp(443),
-      'allow HTTPS traffic from anywhere'
-    )
-
-    // Build container services from config — opens additional security group ports for TCP/UDP services
-    const containerServices = buildContainerServices(props.config.services)
-
-    containerServices.forEach(service => {
-      service.securityGroupPorts.forEach(({ port, protocol }) => {
-        const portRule = protocol === 'udp' ? Port.udp(port) : Port.tcp(port)
-        securityGroup.addIngressRule(Peer.anyIpv4(), portRule, `${service.name} ${protocol.toUpperCase()} ${port}`)
-      })
-    })
-
-    const platformConfigDeployment = new BucketDeployment(this, 'PlatformConfigDeployment', {
-      sources: [Source.jsonData('platform-config.json', { ...props.config, env: undefined })],
-      destinationBucket: props.bucket,
-      // Default prune:true would delete every other object (e.g. media/*) on each infra deploy.
-      prune: false
-    })
-
-    const role = new Role(this, 'role', {
-      assumedBy: new ServicePrincipal('ec2.amazonaws.com')
-    })
-
-    role.attachInlinePolicy(new Policy(this, 'policy', {
-      statements: [
-        new PolicyStatement({
-          effect: Effect.ALLOW,
-          actions: [
-            'route53:ListResourceRecordSets',
-            'route53:GetChange',
-            'route53:ChangeResourceRecordSets'
-          ],
-          resources: [
-            `arn:aws:route53:::hostedzone/*`,
-            'arn:aws:route53:::change/*'
-          ]
-        }),
-        new PolicyStatement({
-          effect: Effect.ALLOW,
-          actions: [
-            'route53:ListHostedZonesByName',
-            'route53:ListHostedZones'
-          ],
-          resources: ['*']
-        }),
-      ]
-    }))
-
-    const userData = UserData.forLinux()
-
-    // Write platform env vars to /etc/environment so all systemd services pick them up.
-    const envLines = Object.entries(props.config.env ?? {}).map(([k, v]) => `${k}=${v}`)
-
-    userData.addCommands(
-      'sudo groupadd docker',
-      'sudo usermod -aG docker ubuntu',
-      'newgrp docker',
-      'sudo apt update -y',
-      ...getInstallNodeJs(),
-      ...getInstallNpm(),
-      ...getInstallDocker(),
-      'sudo apt-get install awscli --yes',
-      // Write all platform env vars before starting any service
-      `sudo tee /etc/environment << 'ENVEOF'\n${envLines.join('\n')}\nENVEOF`,
-      // Create shared Docker network for inter-container communication
-      'docker network create ossy-network || true',
-      ...CaddyService.install(containerServices.filter(s => s.caddyBlock !== null)),
-      ...OssyRuntimeService.install(),
-      ...OssyApiService.install(),
-      ...containerServices.flatMap(s => s.install())
-    )
-
-    userData.addS3DownloadCommand({
-      bucket: props.bucket,
-      bucketKey: 'platform-config.json',
-      localFile: '/home/ubuntu/platform-config.json'
-    })
-
-    userData.addCommands(
-      'sudo systemctl daemon-reload',
-      ...CaddyService.enable(),
-      ...CaddyService.start(),
-      ...OssyRuntimeService.enable(),
-      ...OssyRuntimeService.start(),
-      ...OssyApiService.enable(),
-      ...OssyApiService.start(),
-      ...containerServices.flatMap(s => [...s.enable(), ...s.start()])
-    )
-
-    const instanceClassMap = {
-      t2: InstanceClass.T2,
-      t3: InstanceClass.T3,
-      t3a: InstanceClass.T3A,
-      t4g: InstanceClass.T4G,
-      m5: InstanceClass.M5,
-      m6i: InstanceClass.M6I,
-      c5: InstanceClass.C5,
-      c6i: InstanceClass.C6I,
-    }
-
-    const instanceSizeMap = {
-      nano: InstanceSize.NANO,
-      micro: InstanceSize.MICRO,
-      small: InstanceSize.SMALL,
-      medium: InstanceSize.MEDIUM,
-      large: InstanceSize.LARGE,
-      xlarge: InstanceSize.XLARGE,
-      '2xlarge': InstanceSize.XLARGE2,
-    }
-
-    const instanceClass = instanceClassMap[props.config.awsInstanceClass ?? 't3']
-    const instanceSize = instanceSizeMap[props.config.awsInstanceSize ?? 'small']
-
-    if (!instanceClass) throw new Error(`[ContainerDeploymentTarget] Unknown awsInstanceClass: ${props.config.awsInstanceClass}`)
-    if (!instanceSize) throw new Error(`[ContainerDeploymentTarget] Unknown awsInstanceSize: ${props.config.awsInstanceSize}`)
-
-    const ec2Instance = new Instance(this, 'Ec2Instance', {
-      vpc,
-      securityGroup,
-      userData,
-      role,
-      instanceType: InstanceType.of(instanceClass, instanceSize),
-      machineImage: new GenericLinuxImage({
-        [SupportedRegions.North]: InstanceImages.UBUNTU
-      }),
-      blockDevices: [
-        {
-          deviceName: '/dev/sda1',
-          volume: BlockDeviceVolume.ebs(50)
-        }
-      ],
-      keyPair: KeyPair.fromKeyPairName(this, 'KeyPair', props.config.awsKeyPairName)
-    })
-
-    props.bucket.grantRead(ec2Instance, '*')
-
-    // Elastic IP gives the instance a stable public IP that survives instance replacements,
-    // preventing CloudFormation cross-stack export conflicts when the EC2 instance is updated.
-    const eip = new CfnEIP(this, 'ElasticIp', { domain: 'vpc' })
-    new CfnEIPAssociation(this, 'EipAssociation', {
-      instanceId: ec2Instance.instanceId,
-      allocationId: eip.attrAllocationId
-    })
-
-    this.instancePublicIp = eip.attrPublicIp
-
-  }
-}
-
-module.exports = {
-  ContainerDeploymentTarget
-}