@ossy/deployment-tools 3.6.0 → 3.12.0

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.12.0](https://github.com/ossy-se/ossy/compare/v3.11.1...v3.12.0) (2026-09-06)
+
+### Bug Fixes
+
+* default the API to same-origin and drop api.ossy.se ([#794](https://github.com/ossy-se/ossy/issues/794)) ([397a06f](https://github.com/ossy-se/ossy/commit/397a06f88b01e297fb76f35c429f3e687bdd6af9))
+
+### Features
+
+* **analytics:** Host visitor locations from connection geo ([#772](https://github.com/ossy-se/ossy/issues/772)) ([a565c1b](https://github.com/ossy-se/ossy/commit/a565c1b5078219ef412148d77dc33697f2079612)), closes [#769](https://github.com/ossy-se/ossy/issues/769) [#797](https://github.com/ossy-se/ossy/issues/797) [#797](https://github.com/ossy-se/ossy/issues/797) [#797](https://github.com/ossy-se/ossy/issues/797) [#797](https://github.com/ossy-se/ossy/issues/797) [#769](https://github.com/ossy-se/ossy/issues/769) [#797](https://github.com/ossy-se/ossy/issues/797) [#769](https://github.com/ossy-se/ossy/issues/769)
+
+
+# [3.7.0](https://github.com/ossy-se/ossy/compare/v3.6.2...v3.7.0) (2026-08-22)
+
+### Features
+
+* **deployment-tools:** give website-ossy 1 vCPU, 4 GB, two tasks, and a larger Node heap ([#667](https://github.com/ossy-se/ossy/issues/667)) ([3e81436](https://github.com/ossy-se/ossy/commit/3e814363a7f80f37a1b90f64677371cfa2f2fe44))
+
+
 # [3.6.0](https://github.com/ossy-se/ossy/compare/v3.5.1...v3.6.0) (2026-08-16)
 
 ### Bug Fixes

package/README.md

@@ -9,7 +9,7 @@ Infrastructure and CDK tooling for the Ossy platform.
 ```
 Internet → CloudFront (ACM TLS, us-east-1) → WAF → ALB (:80)
              ├── host rules from platforms.json `services[].hosts|domain`
-             │     e.g. ossy.se, api.ossy.se → website-ossy Fargate service
+             │     e.g. ossy.se → website-ossy Fargate service
              ├── other known hosts / *.ossy.se → platform-runtime Fargate service
              └── default action → platform-runtime
 ```
@@ -64,7 +64,7 @@ HTTP services (default) become Fargate services with ALB host rules. The contain
     "name": "ossy-website-ossy",
     "domain": "ossy.se",
     "image": "ghcr.io/ossy-se/website-ossy:latest",
-    "hosts": ["ossy.se", "api.ossy.se"]
+    "hosts": ["ossy.se"]
   }
 ]
 ```
@@ -73,7 +73,7 @@ HTTP services (default) become Fargate services with ALB host rules. The contain
 |---|---|
 | `name` | Unique service name — Secrets Manager / ECS key strips a leading `ossy-` (`website-ossy`). |
 | `domain` | Primary hostname (default ALB host when `hosts` is omitted). |
-| `hosts` | Optional ALB host-header list. Example: `["ossy.se","api.ossy.se"]` so the website image serves apex and API host. Defaults to `[domain]`. |
+| `hosts` | Optional ALB host-header list. Example: `["ossy.se"]` so the website image serves the apex. Defaults to `[domain]`. |
 | `image` | Docker image to pull and run (GHCR). |
 
 **Built-in (always present):**
@@ -264,6 +264,8 @@ Other common env vars:
 | `AWS_SECRET_ACCESS_KEY` | API | AWS credentials for S3 |
 | `OSSY_API_KEY` | Platform, websites | API JWT for CMS reads |
 | `OSSY_COOKIE_SECRET` | Websites | Cookie signing secret |
+| `GEOLITE2_COUNTRY_MMDB` | App (`@ossy/analytics` location projection) | Absolute path to MaxMind GeoLite2-Country `.mmdb` (#769). Used by `PageViewLocationProjection` / `ProjectionRebuild` — not at ingest. Optional; without it `countryCode` is omitted (IP still stored on the event). |
+| `OSSY_TRUST_PROXY_HOPS` | Platform / websites | Express `trust proxy` hop count behind CloudFront→ALB (default: `2`). |
 | `OPENAI_API_KEY` | Worker | OpenAI API key |
 | `OPENAI_ORGANIZATION` | Worker | OpenAI organisation ID |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/deployment-tools",
-  "version": "3.6.0",
+  "version": "3.12.0",
   "description": "Collection of scripts and tools to aid deployment of containers and static files to Amazon Web Services through GitHub Actions",
   "source": "./src/index.js",
   "main": "./src/index.js",
@@ -24,5 +24,5 @@
   "devDependencies": {
     "jest": "^30.4.2"
   },
-  "gitHead": "d1fd144986b0e819d46926aeb11f7815ac52a784"
+  "gitHead": "c2650803219ad1831559b512848358d9550ffad2"
 }

package/src/config/platform-config.js

@@ -21,6 +21,9 @@
  * @property {string} domain    - primary hostname (default ALB host when `hosts` omitted)
  * @property {string[]=} hosts  - ALB host-header values (#557); defaults to `[domain]`
  * @property {string} image     - Docker image (e.g. ghcr.io/ossy-se/website-ossy:latest)
+ * @property {number=} cpu      - Fargate CPU units; default 512
+ * @property {number=} memoryLimitMiB - Fargate memory MiB; default 1024
+ * @property {number=} desiredCount - ECS desired tasks; default 1
  *
  * @typedef {Object} TcpServiceConfig
  * @property {'tcp'} type       - raw socket service; not deployed on the ECS path (#560)

package/src/ecs/platform-ecs-services.js

@@ -42,6 +42,10 @@ const CONTAINER_ENVIRONMENT_KEYS = Object.freeze([
  * @property {string[]} hosts - ALB host-header values for this service (empty = default/catch-all)
  * @property {boolean} isDefault - when true, ALB default action forwards here (runtime)
  * @property {number} containerPort - container listen port
+ * @property {number} cpu - Fargate task CPU units (256, 512, 1024, …)
+ * @property {number} memoryLimitMiB - Fargate task memory (must be valid for `cpu`)
+ * @property {number} desiredCount - ECS service desired task count
+ * @property {string} [nodeOptions] - optional `NODE_OPTIONS` for the container
  */
 
 /**
@@ -55,7 +59,7 @@ function secretEnvKeysForEcsContainer(envKeys = []) {
   if (!Array.isArray(envKeys)) {
     throw new Error('[platform-ecs-services] envKeys must be an array')
   }
-  const reserved = new Set(CONTAINER_ENVIRONMENT_KEYS)
+  const reserved = new Set([...CONTAINER_ENVIRONMENT_KEYS, 'NODE_OPTIONS'])
   return envKeys.filter((key) => typeof key === 'string' && key && !reserved.has(key))
 }
 
@@ -78,6 +82,7 @@ function containerEnvironment({
   containerPort = CONTAINER_PORT,
   mediaRepository,
   mediaCdnDomainName,
+  nodeOptions,
 }) {
   if (!serviceKey) {
     throw new Error('[platform-ecs-services] serviceKey is required')
@@ -91,6 +96,7 @@ function containerEnvironment({
     OSSY_SERVICE_NAME: serviceKey,
     MEDIA_REPOSITORY: mediaRepository,
     MEDIA_CDN_DOMAIN_NAME: mediaCdnDomainName,
+    ...(nodeOptions ? { NODE_OPTIONS: nodeOptions } : {}),
   }
 }
 
@@ -151,7 +157,7 @@ function runtimeHosts(config, httpEntries) {
  * @param {{
  *   platformName: string,
  *   domains?: string[],
- *   services?: Array<{ name: string, type?: string, domain?: string, hosts?: string[], image?: string }>
+ *   services?: Array<{ name: string, type?: string, domain?: string, hosts?: string[], image?: string, cpu?: number, memoryLimitMiB?: number, desiredCount?: number }>
  * }} config
  * @returns {PlatformEcsService[]}
  */
@@ -173,6 +179,9 @@ function listPlatformEcsServices(config) {
         hosts: runtimeHostList,
         isDefault: true,
         containerPort: CONTAINER_PORT,
+        cpu: 512,
+        memoryLimitMiB: 1024,
+        desiredCount: 1,
       }
     }
 
@@ -190,6 +199,10 @@ function listPlatformEcsServices(config) {
       hosts: hostsFromServiceEntry(service.entry),
       isDefault: false,
       containerPort: CONTAINER_PORT,
+      cpu: Number.isFinite(service.entry.cpu) ? service.entry.cpu : 512,
+      memoryLimitMiB: Number.isFinite(service.entry.memoryLimitMiB) ? service.entry.memoryLimitMiB : 1024,
+      desiredCount: Number.isFinite(service.entry.desiredCount) ? service.entry.desiredCount : 1,
+      nodeOptions: typeof service.entry.nodeOptions === 'string' ? service.entry.nodeOptions : undefined,
     }
   })
 }

package/src/ecs/platform-ecs-services.spec.js

@@ -63,6 +63,16 @@ describe('containerEnvironment', () => {
     })
   })
 
+  it('adds NODE_OPTIONS when provided', () => {
+    const env = containerEnvironment({
+      serviceKey: 'website-ossy',
+      mediaRepository: 'media-bucket',
+      mediaCdnDomainName: 'https://cdn.example',
+      nodeOptions: '--max-old-space-size=3072',
+    })
+    expect(env.NODE_OPTIONS).toBe('--max-old-space-size=3072')
+  })
+
   it('requires serviceKey and media fields', () => {
     expect(() => containerEnvironment({
       mediaRepository: 'b',
@@ -82,6 +92,7 @@ describe('secretEnvKeysForEcsContainer', () => {
       'TOKEN_SECRET',
       'NODE_ENV',
       'MEDIA_REPOSITORY',
+      'NODE_OPTIONS',
       'DB_URL',
     ])).toEqual(['TOKEN_SECRET', 'DB_URL'])
   })
@@ -95,8 +106,8 @@ describe('hostsFromServiceEntry', () => {
   it('uses hosts when provided', () => {
     expect(hostsFromServiceEntry({
       domain: 'ossy.se',
-      hosts: ['ossy.se', 'api.ossy.se'],
-    })).toEqual(['ossy.se', 'api.ossy.se'])
+      hosts: ['ossy.se', 'www.ossy.se'],
+    })).toEqual(['ossy.se', 'www.ossy.se'])
   })
 
   it('falls back to domain', () => {
@@ -109,7 +120,6 @@ describe('listPlatformEcsServices', () => {
     const services = listPlatformEcsServices({
       platformName: 'ossybot',
       domains: [
-        'api.ossy.se',
         'ossy.se',
         '*.ossy.se',
         'www.plexus-sanitas.com',
@@ -119,8 +129,12 @@ describe('listPlatformEcsServices', () => {
         {
           name: 'ossy-website-ossy',
           domain: 'ossy.se',
-          hosts: ['ossy.se', 'api.ossy.se'],
+          hosts: ['ossy.se'],
           image: 'ghcr.io/ossy-se/website-ossy:latest',
+          cpu: 1024,
+          memoryLimitMiB: 4096,
+          desiredCount: 2,
+          nodeOptions: '--max-old-space-size=3072',
         },
         {
           name: 'ossy-website-plexus-sanitas',
@@ -150,9 +164,22 @@ describe('listPlatformEcsServices', () => {
 
     const website = services.find(s => s.key === 'website-ossy')
     expect(website.isDefault).toBe(false)
-    expect(website.hosts).toEqual(['ossy.se', 'api.ossy.se'])
+    expect(website.hosts).toEqual(['ossy.se'])
     expect(website.image).toBe('ghcr.io/ossy-se/website-ossy:latest')
     expect(website.secretName).toBe('ossybot/website-ossy')
+    expect(website.cpu).toBe(1024)
+    expect(website.memoryLimitMiB).toBe(4096)
+    expect(website.desiredCount).toBe(2)
+    expect(website.nodeOptions).toBe('--max-old-space-size=3072')
+
+    const plexus = services.find(s => s.key === 'website-plexus-sanitas')
+    expect(plexus.cpu).toBe(512)
+    expect(plexus.memoryLimitMiB).toBe(1024)
+    expect(plexus.desiredCount).toBe(1)
+    expect(plexus.nodeOptions).toBeUndefined()
+
+    expect(runtime.cpu).toBe(512)
+    expect(runtime.desiredCount).toBe(1)
 
     expect(services.some(s => s.key.includes('api'))).toBe(false)
   })

package/src/infrastructure/platform-ecs-stack.js

@@ -166,8 +166,8 @@ class PlatformEcsStack extends Stack {
 
       const taskDefinition = new FargateTaskDefinition(this, `TaskDef${idSuffix}`, {
         family: `${platformName}-${service.key}`,
-        cpu: 512,
-        memoryLimitMiB: 1024,
+        cpu: service.cpu,
+        memoryLimitMiB: service.memoryLimitMiB,
         runtimePlatform: {
           cpuArchitecture: CpuArchitecture.X86_64,
           operatingSystemFamily: OperatingSystemFamily.LINUX,
@@ -199,6 +199,7 @@ class PlatformEcsStack extends Stack {
           containerPort: service.containerPort,
           mediaRepository: props.bucket.bucketName,
           mediaCdnDomainName: `https://${props.cdnDomainName}`,
+          nodeOptions: service.nodeOptions,
         }),
         secrets: containerSecrets,
         // Node fetch → GET /health (no curl in node:*-slim; no image-local script required).
@@ -222,7 +223,7 @@ class PlatformEcsStack extends Stack {
         serviceName: truncateAwsName(`${platformName}-${service.key}`, 255),
         cluster,
         taskDefinition,
-        desiredCount: 1,
+        desiredCount: service.desiredCount,
         assignPublicIp: false,
         securityGroups: [serviceSecurityGroup],
         vpcSubnets: { subnetType: SubnetType.PRIVATE_WITH_EGRESS },
@@ -280,7 +281,7 @@ class PlatformEcsStack extends Stack {
     })
 
     // Lower priority number = evaluated first. Specific hosts before wildcards
-    // so `api.ossy.se` is not swallowed by `*.ossy.se`.
+    // so `ossy.se` is not swallowed by `*.ossy.se`.
     // Priorities are hash-stable per host — sequential 10,11,12… renumbers
     // every insert and CloudFormation cannot swap ALB priorities in one update.
     const usedPriorities = new Set()