@ossy/deployment-tools 3.4.0 → 3.7.0

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.7.0](https://github.com/ossy-se/ossy/compare/v3.6.2...v3.7.0) (2026-08-22)
+
+### Features
+
+* **deployment-tools:** give website-ossy 1 vCPU, 4 GB, two tasks, and a larger Node heap ([#667](https://github.com/ossy-se/ossy/issues/667)) ([3e81436](https://github.com/ossy-se/ossy/commit/3e814363a7f80f37a1b90f64677371cfa2f2fe44))
+
+
+# [3.6.0](https://github.com/ossy-se/ossy/compare/v3.5.1...v3.6.0) (2026-08-16)
+
+### Bug Fixes
+
+* **deployment-tools:** stabilize ECS cutover edge, OIDC, and ALB rules ([#657](https://github.com/ossy-se/ossy/issues/657)) ([257bd79](https://github.com/ossy-se/ossy/commit/257bd7965d86a09aae2b8f285c5e22e2d29160bb))
+
+
 # [3.4.0](https://github.com/ossy-se/ossy/compare/v3.3.0...v3.4.0) (2026-08-14)
 
 ### Features

package/cdk.context.json

@@ -84,5 +84,18 @@
   "hosted-zone:account=858451553223:domainName=tepit.se:region=eu-north-1": {
     "Id": "/hostedzone/Z07859112SU1GH5SKMUXD",
     "Name": "tepit.se."
+  },
+  "availability-zones:account=858451553223:region=eu-north-1": [
+    "eu-north-1a",
+    "eu-north-1b",
+    "eu-north-1c"
+  ],
+  "hosted-zone:account=858451553223:domainName=ossy.se:region=us-east-1": {
+    "Id": "/hostedzone/Z09424571CVOTIJV8Z50C",
+    "Name": "ossy.se."
+  },
+  "hosted-zone:account=858451553223:domainName=plexus-sanitas.com:region=us-east-1": {
+    "Id": "/hostedzone/Z0222639MQIJ8EOL9VAG",
+    "Name": "plexus-sanitas.com."
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/deployment-tools",
-  "version": "3.4.0",
+  "version": "3.7.0",
   "description": "Collection of scripts and tools to aid deployment of containers and static files to Amazon Web Services through GitHub Actions",
   "source": "./src/index.js",
   "main": "./src/index.js",
@@ -24,5 +24,5 @@
   "devDependencies": {
     "jest": "^30.4.2"
   },
-  "gitHead": "d36b69444268d172bc3e8e1dc77e67afc63f8650"
+  "gitHead": "622d97535abad08415963405ace2f5aaaecd7ca4"
 }

package/src/config/platform-config.js

@@ -21,6 +21,9 @@
  * @property {string} domain    - primary hostname (default ALB host when `hosts` omitted)
  * @property {string[]=} hosts  - ALB host-header values (#557); defaults to `[domain]`
  * @property {string} image     - Docker image (e.g. ghcr.io/ossy-se/website-ossy:latest)
+ * @property {number=} cpu      - Fargate CPU units; default 512
+ * @property {number=} memoryLimitMiB - Fargate memory MiB; default 1024
+ * @property {number=} desiredCount - ECS desired tasks; default 1
  *
  * @typedef {Object} TcpServiceConfig
  * @property {'tcp'} type       - raw socket service; not deployed on the ECS path (#560)

package/src/ecs/platform-ecs-services.js

@@ -42,6 +42,10 @@ const CONTAINER_ENVIRONMENT_KEYS = Object.freeze([
  * @property {string[]} hosts - ALB host-header values for this service (empty = default/catch-all)
  * @property {boolean} isDefault - when true, ALB default action forwards here (runtime)
  * @property {number} containerPort - container listen port
+ * @property {number} cpu - Fargate task CPU units (256, 512, 1024, …)
+ * @property {number} memoryLimitMiB - Fargate task memory (must be valid for `cpu`)
+ * @property {number} desiredCount - ECS service desired task count
+ * @property {string} [nodeOptions] - optional `NODE_OPTIONS` for the container
  */
 
 /**
@@ -55,7 +59,7 @@ function secretEnvKeysForEcsContainer(envKeys = []) {
   if (!Array.isArray(envKeys)) {
     throw new Error('[platform-ecs-services] envKeys must be an array')
   }
-  const reserved = new Set(CONTAINER_ENVIRONMENT_KEYS)
+  const reserved = new Set([...CONTAINER_ENVIRONMENT_KEYS, 'NODE_OPTIONS'])
   return envKeys.filter((key) => typeof key === 'string' && key && !reserved.has(key))
 }
 
@@ -78,6 +82,7 @@ function containerEnvironment({
   containerPort = CONTAINER_PORT,
   mediaRepository,
   mediaCdnDomainName,
+  nodeOptions,
 }) {
   if (!serviceKey) {
     throw new Error('[platform-ecs-services] serviceKey is required')
@@ -91,6 +96,7 @@ function containerEnvironment({
     OSSY_SERVICE_NAME: serviceKey,
     MEDIA_REPOSITORY: mediaRepository,
     MEDIA_CDN_DOMAIN_NAME: mediaCdnDomainName,
+    ...(nodeOptions ? { NODE_OPTIONS: nodeOptions } : {}),
   }
 }
 
@@ -151,7 +157,7 @@ function runtimeHosts(config, httpEntries) {
  * @param {{
  *   platformName: string,
  *   domains?: string[],
- *   services?: Array<{ name: string, type?: string, domain?: string, hosts?: string[], image?: string }>
+ *   services?: Array<{ name: string, type?: string, domain?: string, hosts?: string[], image?: string, cpu?: number, memoryLimitMiB?: number, desiredCount?: number }>
  * }} config
  * @returns {PlatformEcsService[]}
  */
@@ -173,6 +179,9 @@ function listPlatformEcsServices(config) {
         hosts: runtimeHostList,
         isDefault: true,
         containerPort: CONTAINER_PORT,
+        cpu: 512,
+        memoryLimitMiB: 1024,
+        desiredCount: 1,
       }
     }
 
@@ -190,6 +199,10 @@ function listPlatformEcsServices(config) {
       hosts: hostsFromServiceEntry(service.entry),
       isDefault: false,
       containerPort: CONTAINER_PORT,
+      cpu: Number.isFinite(service.entry.cpu) ? service.entry.cpu : 512,
+      memoryLimitMiB: Number.isFinite(service.entry.memoryLimitMiB) ? service.entry.memoryLimitMiB : 1024,
+      desiredCount: Number.isFinite(service.entry.desiredCount) ? service.entry.desiredCount : 1,
+      nodeOptions: typeof service.entry.nodeOptions === 'string' ? service.entry.nodeOptions : undefined,
     }
   })
 }

package/src/ecs/platform-ecs-services.spec.js

@@ -63,6 +63,16 @@ describe('containerEnvironment', () => {
     })
   })
 
+  it('adds NODE_OPTIONS when provided', () => {
+    const env = containerEnvironment({
+      serviceKey: 'website-ossy',
+      mediaRepository: 'media-bucket',
+      mediaCdnDomainName: 'https://cdn.example',
+      nodeOptions: '--max-old-space-size=3072',
+    })
+    expect(env.NODE_OPTIONS).toBe('--max-old-space-size=3072')
+  })
+
   it('requires serviceKey and media fields', () => {
     expect(() => containerEnvironment({
       mediaRepository: 'b',
@@ -82,6 +92,7 @@ describe('secretEnvKeysForEcsContainer', () => {
       'TOKEN_SECRET',
       'NODE_ENV',
       'MEDIA_REPOSITORY',
+      'NODE_OPTIONS',
       'DB_URL',
     ])).toEqual(['TOKEN_SECRET', 'DB_URL'])
   })
@@ -121,6 +132,10 @@ describe('listPlatformEcsServices', () => {
           domain: 'ossy.se',
           hosts: ['ossy.se', 'api.ossy.se'],
           image: 'ghcr.io/ossy-se/website-ossy:latest',
+          cpu: 1024,
+          memoryLimitMiB: 4096,
+          desiredCount: 2,
+          nodeOptions: '--max-old-space-size=3072',
         },
         {
           name: 'ossy-website-plexus-sanitas',
@@ -153,6 +168,19 @@ describe('listPlatformEcsServices', () => {
     expect(website.hosts).toEqual(['ossy.se', 'api.ossy.se'])
     expect(website.image).toBe('ghcr.io/ossy-se/website-ossy:latest')
     expect(website.secretName).toBe('ossybot/website-ossy')
+    expect(website.cpu).toBe(1024)
+    expect(website.memoryLimitMiB).toBe(4096)
+    expect(website.desiredCount).toBe(2)
+    expect(website.nodeOptions).toBe('--max-old-space-size=3072')
+
+    const plexus = services.find(s => s.key === 'website-plexus-sanitas')
+    expect(plexus.cpu).toBe(512)
+    expect(plexus.memoryLimitMiB).toBe(1024)
+    expect(plexus.desiredCount).toBe(1)
+    expect(plexus.nodeOptions).toBeUndefined()
+
+    expect(runtime.cpu).toBe(512)
+    expect(runtime.desiredCount).toBe(1)
 
     expect(services.some(s => s.key.includes('api'))).toBe(false)
   })

package/src/edge/platform-edge-domains.js

@@ -28,8 +28,29 @@ function rootDomainOf(domain) {
   return parts.slice(-2).join('.')
 }
 
+/**
+ * Whether `hostname` is already covered by a `*.root` wildcard in `aliases`.
+ * CloudFront rejects overlapping CNAMEs (e.g. both `*.ossy.se` and `api.ossy.se`).
+ *
+ * @param {string} hostname
+ * @param {string[]} aliases
+ * @returns {boolean}
+ */
+function coveredByWildcardAlias(hostname, aliases) {
+  if (!hostname || hostname.includes('*')) return false
+  return aliases.some(alias => {
+    if (!alias.startsWith('*.')) return false
+    const suffix = alias.slice(1) // e.g. ".ossy.se"
+    if (!hostname.endsWith(suffix)) return false
+    const prefix = hostname.slice(0, -suffix.length)
+    // single-label subdomain only (*.ossy.se covers api.ossy.se, not a.b.ossy.se)
+    return prefix.length > 0 && !prefix.includes('.')
+  })
+}
+
 /**
  * Unique, stable sorted list of CloudFront aliases from `domains` + HTTP service hosts.
+ * Drops hostnames covered by a sibling wildcard so ACM/CloudFront accept the set.
  *
  * @param {{
  *   domains?: string[],
@@ -46,9 +67,10 @@ function listEdgeAliases(config) {
       return entry.domain ? [entry.domain] : []
     })
 
-  return [...new Set([...fromDomains, ...fromServices])].sort((a, b) =>
-    a.localeCompare(b)
-  )
+  const all = [...new Set([...fromDomains, ...fromServices])]
+  return all
+    .filter(alias => !coveredByWildcardAlias(alias, all))
+    .sort((a, b) => a.localeCompare(b))
 }
 
 /**

package/src/edge/platform-edge-domains.spec.js

@@ -14,7 +14,7 @@ describe('rootDomainOf', () => {
 })
 
 describe('listEdgeAliases', () => {
-  it('unions domains and HTTP service hosts; skips tcp', () => {
+  it('unions domains and HTTP service hosts; skips tcp; drops names under wildcards', () => {
     expect(listEdgeAliases({
       domains: ['ossy.se', '*.ossy.se', 'worker.ossy.se'],
       services: [
@@ -30,7 +30,7 @@ describe('listEdgeAliases', () => {
           ports: [25565],
         },
       ],
-    })).toEqual(['*.ossy.se', 'api.ossy.se', 'ossy.se', 'worker.ossy.se'])
+    })).toEqual(['*.ossy.se', 'ossy.se'])
   })
 })
 
@@ -59,17 +59,14 @@ describe('planEdgeDomains', () => {
     })
 
     expect(plan.primaryDomain).toBe('ossy.se')
+    // api/worker covered by *.ossy.se — CloudFront forbids overlapping CNAMEs
     expect(plan.aliases).toEqual([
       '*.ossy.se',
-      'api.ossy.se',
       'ossy.se',
-      'worker.ossy.se',
       'www.plexus-sanitas.com',
     ])
     expect(plan.subjectAlternativeNames).toEqual([
       '*.ossy.se',
-      'api.ossy.se',
-      'worker.ossy.se',
       'www.plexus-sanitas.com',
     ])
     expect(plan.validationDomainToRoot.get('*.ossy.se')).toBe('ossy.se')

package/src/infrastructure/platform-ci-stack.js

@@ -23,8 +23,9 @@ const {
  * Trust is limited to `ref:refs/heads/main` for `config.githubDeployRepos`
  * (set in platforms.json — add a repo there to allow it to assume this role).
  *
- * Note: AWS allows only one OIDC provider per URL per account. This stack is
- * intended for the primary platform stage until a shared account bootstrap exists.
+ * Note: AWS allows only one OIDC provider per URL per account. This stack
+ * references the account provider (often created earlier by `trust-ci`) instead
+ * of creating a second one.
  */
 class PlatformCiStack extends Stack {
   /**
@@ -61,10 +62,12 @@ class PlatformCiStack extends Stack {
       return `repo:${repo}:ref:refs/heads/main`
     })
 
-    const provider = new OpenIdConnectProvider(this, 'GithubOidcProvider', {
-      url: 'https://token.actions.githubusercontent.com',
-      clientIds: ['sts.amazonaws.com'],
-    })
+    // One provider per issuer URL per account — reuse the existing GitHub OIDC IdP.
+    const provider = OpenIdConnectProvider.fromOpenIdConnectProviderArn(
+      this,
+      'GithubOidcProvider',
+      `arn:aws:iam::${account}:oidc-provider/token.actions.githubusercontent.com`
+    )
 
     const deployRole = new Role(this, 'GithubDeployRole', {
       roleName,

package/src/infrastructure/platform-ecs-stack.js

@@ -166,8 +166,8 @@ class PlatformEcsStack extends Stack {
 
       const taskDefinition = new FargateTaskDefinition(this, `TaskDef${idSuffix}`, {
         family: `${platformName}-${service.key}`,
-        cpu: 512,
-        memoryLimitMiB: 1024,
+        cpu: service.cpu,
+        memoryLimitMiB: service.memoryLimitMiB,
         runtimePlatform: {
           cpuArchitecture: CpuArchitecture.X86_64,
           operatingSystemFamily: OperatingSystemFamily.LINUX,
@@ -199,6 +199,7 @@ class PlatformEcsStack extends Stack {
           containerPort: service.containerPort,
           mediaRepository: props.bucket.bucketName,
           mediaCdnDomainName: `https://${props.cdnDomainName}`,
+          nodeOptions: service.nodeOptions,
         }),
         secrets: containerSecrets,
         // Node fetch → GET /health (no curl in node:*-slim; no image-local script required).
@@ -222,7 +223,7 @@ class PlatformEcsStack extends Stack {
         serviceName: truncateAwsName(`${platformName}-${service.key}`, 255),
         cluster,
         taskDefinition,
-        desiredCount: 1,
+        desiredCount: service.desiredCount,
         assignPublicIp: false,
         securityGroups: [serviceSecurityGroup],
         vpcSubnets: { subnetType: SubnetType.PRIVATE_WITH_EGRESS },
@@ -281,23 +282,18 @@ class PlatformEcsStack extends Stack {
 
     // Lower priority number = evaluated first. Specific hosts before wildcards
     // so `api.ossy.se` is not swallowed by `*.ossy.se`.
-    const orderedHostRules = [...hostRules].sort((a, b) => {
-      const aWild = a.host.includes('*') ? 1 : 0
-      const bWild = b.host.includes('*') ? 1 : 0
-      return aWild - bWild
-    })
-
-    let rulePriority = 10
-    for (const rule of orderedHostRules) {
+    // Priorities are hash-stable per host — sequential 10,11,12… renumbers
+    // every insert and CloudFormation cannot swap ALB priorities in one update.
+    const usedPriorities = new Set()
+    for (const rule of hostRules) {
       listener.addTargetGroups(
         `Rule${rule.idSuffix}${toConstructId(rule.host)}`,
         {
-          priority: rulePriority,
+          priority: albHostRulePriority(rule.host, usedPriorities),
           conditions: [ListenerCondition.hostHeaders([rule.host])],
           targetGroups: [rule.targetGroup],
         }
       )
-      rulePriority += 1
     }
 
     this.vpc = vpc
@@ -325,6 +321,29 @@ class PlatformEcsStack extends Stack {
   }
 }
 
+/**
+ * Stable ALB listener-rule priority for a host header (1–50000).
+ * Specific hosts: 10000–29999; wildcards: 40000–49999 (evaluated later).
+ * @param {string} host
+ * @param {Set<number>} used
+ * @returns {number}
+ */
+function albHostRulePriority(host, used) {
+  const band = host.includes('*') ? 40000 : 10000
+  let hash = 2166136261
+  for (let i = 0; i < host.length; i += 1) {
+    hash ^= host.charCodeAt(i)
+    hash = Math.imul(hash, 16777619) >>> 0
+  }
+  let priority = band + (hash % 20000)
+  while (used.has(priority)) {
+    priority += 1
+    if (priority >= band + 20000) priority = band
+  }
+  used.add(priority)
+  return priority
+}
+
 /**
  * CloudFormation-safe construct id fragment.
  * @param {string} key
@@ -346,4 +365,5 @@ function truncateAwsName(name, max) {
 
 module.exports = {
   PlatformEcsStack,
+  albHostRulePriority,
 }