@ripla/godd-mcp 0.1.2-beta-20260312091403

package/templates/terraform/aws/cloudfront.tf.hbs

@@ -0,0 +1,96 @@
+resource "aws_cloudfront_origin_access_control" "notes_app" {
+  name                              = "${local.project}-oac"
+  origin_access_control_origin_type = "s3"
+  signing_behavior                  = "always"
+  signing_protocol                  = "sigv4"
+}
+
+resource "random_password" "origin_verify" {
+  length  = 64
+  special = false
+}
+
+resource "aws_cloudfront_distribution" "notes" {
+  enabled             = true
+  default_root_object = "index.html"
+  price_class         = "PriceClass_200"
+  tags                = local.tags
+
+  # S3 Origin (SPA)
+  origin {
+    domain_name              = aws_s3_bucket.notes_app.bucket_regional_domain_name
+    origin_id                = "s3-origin"
+    origin_access_control_id = aws_cloudfront_origin_access_control.notes_app.id
+  }
+
+  # ALB Origin (API)
+  origin {
+    domain_name = aws_lb.api.dns_name
+    origin_id   = "api-origin"
+
+    custom_origin_config {
+      http_port              = 80
+      https_port             = 443
+      origin_protocol_policy = "http-only"
+      origin_ssl_protocols   = ["TLSv1.2"]
+    }
+
+    custom_header {
+      name  = "X-Origin-Verify"
+      value = random_password.origin_verify.result
+    }
+  }
+
+  # Default behavior → S3
+  default_cache_behavior {
+    allowed_methods        = ["GET", "HEAD"]
+    cached_methods         = ["GET", "HEAD"]
+    target_origin_id       = "s3-origin"
+    viewer_protocol_policy = "redirect-to-https"
+
+    forwarded_values {
+      query_string = false
+      cookies { forward = "none" }
+    }
+  }
+
+  # /api/* → ALB
+  ordered_cache_behavior {
+    path_pattern           = "/api/*"
+    allowed_methods        = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
+    cached_methods         = ["GET", "HEAD"]
+    target_origin_id       = "api-origin"
+    viewer_protocol_policy = "redirect-to-https"
+
+    forwarded_values {
+      query_string = true
+      headers      = ["Authorization", "Origin", "Accept"]
+      cookies { forward = "all" }
+    }
+
+    min_ttl     = 0
+    default_ttl = 0
+    max_ttl     = 0
+  }
+
+  # SPA fallback
+  custom_error_response {
+    error_code         = 403
+    response_code      = 200
+    response_page_path = "/index.html"
+  }
+
+  custom_error_response {
+    error_code         = 404
+    response_code      = 200
+    response_page_path = "/index.html"
+  }
+
+  restrictions {
+    geo_restriction { restriction_type = "none" }
+  }
+
+  viewer_certificate {
+    cloudfront_default_certificate = true
+  }
+}

package/templates/terraform/aws/ecr.tf.hbs

@@ -0,0 +1,30 @@
+resource "aws_ecr_repository" "notes_api" {
+  name                 = "godd-notes-api"
+  image_tag_mutability = "MUTABLE"
+  force_delete         = local.env == "dev"
+  tags                 = local.tags
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+}
+
+resource "aws_ecr_lifecycle_policy" "notes_api" {
+  repository = aws_ecr_repository.notes_api.name
+
+  policy = jsonencode({
+    rules = [
+      {
+        rulePriority = 1
+        description  = "Delete untagged images after 1 day"
+        selection = {
+          tagStatus   = "untagged"
+          countType   = "sinceImagePushed"
+          countUnit   = "days"
+          countNumber = 1
+        }
+        action = { type = "expire" }
+      }
+    ]
+  })
+}

package/templates/terraform/aws/ecs.tf.hbs

@@ -0,0 +1,136 @@
+resource "aws_ecs_cluster" "main" {
+  name = local.project
+  tags = local.tags
+}
+
+resource "aws_cloudwatch_log_group" "ecs" {
+  name              = "/ecs/godd-notes-api"
+  retention_in_days = 30
+  tags              = local.tags
+}
+
+resource "aws_iam_role" "ecs_task_execution" {
+  name = "${local.project}-ecs-task-execution"
+  tags = local.tags
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Action    = "sts:AssumeRole"
+      Effect    = "Allow"
+      Principal = { Service = "ecs-tasks.amazonaws.com" }
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_task_execution" {
+  role       = aws_iam_role.ecs_task_execution.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+}
+
+resource "aws_iam_role_policy" "ecs_secrets" {
+  name = "${local.project}-ecs-secrets"
+  role = aws_iam_role.ecs_task_execution.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["secretsmanager:GetSecretValue"]
+      Resource = "arn:aws:secretsmanager:${local.region}:${local.account_id}:secret:godd-notes/${local.env}/*"
+    }]
+  })
+}
+
+resource "aws_iam_role" "ecs_task" {
+  name = "${local.project}-ecs-task"
+  tags = local.tags
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Action    = "sts:AssumeRole"
+      Effect    = "Allow"
+      Principal = { Service = "ecs-tasks.amazonaws.com" }
+    }]
+  })
+}
+
+resource "aws_ecs_task_definition" "api" {
+  family                   = "godd-notes-api"
+  requires_compatibilities = ["FARGATE"]
+  network_mode             = "awsvpc"
+  cpu                      = local.ecs_cpu
+  memory                   = local.ecs_memory
+  execution_role_arn       = aws_iam_role.ecs_task_execution.arn
+  task_role_arn            = aws_iam_role.ecs_task.arn
+  tags                     = local.tags
+
+  runtime_platform {
+    operating_system_family = "LINUX"
+    cpu_architecture        = "ARM64"
+  }
+
+  container_definitions = jsonencode([{
+    name      = "notes-api"
+    image     = "${aws_ecr_repository.notes_api.repository_url}:latest"
+    essential = true
+    command   = ["sh", "-c", "alembic upgrade head && uvicorn app.main:app --host 0.0.0.0 --port ${local.container_port}"]
+
+    portMappings = [{
+      containerPort = local.container_port
+      protocol      = "tcp"
+    }]
+
+    environment = [
+      { name = "DB_PORT", value = "5432" },
+      { name = "DB_NAME", value = local.rds_db_name },
+      { name = "API_HOST", value = "0.0.0.0" },
+      { name = "API_PORT", value = tostring(local.container_port) },
+      { name = "ALLOWED_ORIGINS", value = "https://${aws_cloudfront_distribution.notes.domain_name}" },
+    ]
+
+    secrets = [
+      { name = "DB_HOST", valueFrom = aws_secretsmanager_secret.rds_credentials.arn },
+      { name = "DB_USER", valueFrom = aws_secretsmanager_secret.rds_credentials.arn },
+      { name = "DB_PASSWORD", valueFrom = aws_secretsmanager_secret.rds_credentials.arn },
+      { name = "JWT_SECRET", valueFrom = aws_secretsmanager_secret.jwt_secret.arn },
+      { name = "GITHUB_TOKEN", valueFrom = aws_secretsmanager_secret.github_token.arn },
+      { name = "NOTES_ADMIN_USERNAME", valueFrom = aws_secretsmanager_secret.admin_credentials.arn },
+      { name = "NOTES_ADMIN_PASSWORD", valueFrom = aws_secretsmanager_secret.admin_credentials.arn },
+    ]
+
+    logConfiguration = {
+      logDriver = "awslogs"
+      options = {
+        "awslogs-group"         = aws_cloudwatch_log_group.ecs.name
+        "awslogs-region"        = local.region
+        "awslogs-stream-prefix" = "ecs"
+      }
+    }
+  }])
+}
+
+resource "aws_ecs_service" "api" {
+  name             = "notes-api"
+  cluster          = aws_ecs_cluster.main.id
+  task_definition  = aws_ecs_task_definition.api.arn
+  desired_count    = 1
+  launch_type      = "FARGATE"
+  platform_version = "1.4.0"
+  tags             = local.tags
+
+  enable_execute_command = true
+
+  network_configuration {
+    subnets          = [aws_subnet.public_1a.id]
+    security_groups  = [aws_security_group.ecs.id]
+    assign_public_ip = true
+  }
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.api.arn
+    container_name   = "notes-api"
+    container_port   = local.container_port
+  }
+}

package/templates/terraform/aws/iam.tf.hbs

@@ -0,0 +1,88 @@
+data "aws_iam_openid_connect_provider" "github" {
+  url = "https://token.actions.githubusercontent.com"
+}
+
+resource "aws_iam_role" "github_actions" {
+  name = "github-actions-${local.env}"
+  tags = local.tags
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Principal = {
+        Federated = data.aws_iam_openid_connect_provider.github.arn
+      }
+      Action = "sts:AssumeRoleWithWebIdentity"
+      Condition = {
+        StringLike = {
+          "token.actions.githubusercontent.com:sub" = "repo:${local.github_owner}/${local.github_repo}:*"
+        }
+        StringEquals = {
+          "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
+        }
+      }
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "github_actions" {
+  name = "${local.project}-github-actions"
+  role = aws_iam_role.github_actions.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "ECR"
+        Effect = "Allow"
+        Action = [
+          "ecr:GetAuthorizationToken",
+          "ecr:BatchCheckLayerAvailability",
+          "ecr:GetDownloadUrlForLayer",
+          "ecr:BatchGetImage",
+          "ecr:PutImage",
+          "ecr:InitiateLayerUpload",
+          "ecr:UploadLayerPart",
+          "ecr:CompleteLayerUpload",
+        ]
+        Resource = "*"
+      },
+      {
+        Sid    = "ECS"
+        Effect = "Allow"
+        Action = [
+          "ecs:UpdateService",
+          "ecs:DescribeServices",
+          "ecs:DescribeTaskDefinition",
+          "ecs:RegisterTaskDefinition",
+          "iam:PassRole",
+        ]
+        Resource = "*"
+      },
+      {
+        Sid    = "S3"
+        Effect = "Allow"
+        Action = [
+          "s3:PutObject",
+          "s3:GetObject",
+          "s3:DeleteObject",
+          "s3:ListBucket",
+        ]
+        Resource = [
+          "arn:aws:s3:::${local.project}-${local.account_id}",
+          "arn:aws:s3:::${local.project}-${local.account_id}/*",
+        ]
+      },
+      {
+        Sid    = "CloudFront"
+        Effect = "Allow"
+        Action = [
+          "cloudfront:CreateInvalidation",
+          "cloudfront:GetDistribution",
+        ]
+        Resource = "*"
+      },
+    ]
+  })
+}

package/templates/terraform/aws/local.tf.hbs

@@ -0,0 +1,34 @@
+locals {
+  project    = "godd-ripla-notes"
+  env        = "{{env}}"
+  account_id = "{{accountId}}"
+  region     = "{{region}}"
+
+  # VPC
+  vpc_cidr            = "{{vpcCidr}}"
+  public_subnet_1a    = cidrsubnet(local.vpc_cidr, 8, 1)
+  public_subnet_1c    = cidrsubnet(local.vpc_cidr, 8, 2)
+  private_subnet_1a   = cidrsubnet(local.vpc_cidr, 8, 10)
+  private_subnet_1c   = cidrsubnet(local.vpc_cidr, 8, 11)
+
+  # ECS
+  ecs_cpu    = {{ecsCpu}}
+  ecs_memory = {{ecsMemory}}
+
+  # RDS
+  rds_instance_class = "{{rdsInstanceClass}}"
+  rds_engine_version = "16"
+  rds_db_name        = "notes"
+
+  # Container
+  container_port = 3100
+
+  # GitHub
+  github_owner = "{{githubOwner}}"
+  github_repo  = "{{githubRepo}}"
+
+  tags = {
+    Project     = local.project
+    Environment = local.env
+  }
+}

package/templates/terraform/aws/output.tf.hbs

@@ -0,0 +1,49 @@
+output "cloudfront_domain" {
+  description = "CloudFront distribution domain name"
+  value       = aws_cloudfront_distribution.notes.domain_name
+}
+
+output "cloudfront_distribution_id" {
+  description = "CloudFront distribution ID"
+  value       = aws_cloudfront_distribution.notes.id
+}
+
+output "alb_dns_name" {
+  description = "ALB DNS name"
+  value       = aws_lb.api.dns_name
+}
+
+output "ecr_repository_url" {
+  description = "ECR repository URL for notes-api"
+  value       = aws_ecr_repository.notes_api.repository_url
+}
+
+output "ecs_cluster_name" {
+  description = "ECS cluster name"
+  value       = aws_ecs_cluster.main.name
+}
+
+output "ecs_service_name" {
+  description = "ECS service name"
+  value       = aws_ecs_service.api.name
+}
+
+output "rds_endpoint" {
+  description = "RDS endpoint"
+  value       = aws_db_instance.main.endpoint
+}
+
+output "s3_bucket_name" {
+  description = "S3 bucket name for notes-app"
+  value       = aws_s3_bucket.notes_app.id
+}
+
+output "notes_app_url" {
+  description = "Notes App URL"
+  value       = "https://${aws_cloudfront_distribution.notes.domain_name}"
+}
+
+output "notes_api_url" {
+  description = "Notes API URL"
+  value       = "https://${aws_cloudfront_distribution.notes.domain_name}/api"
+}

package/templates/terraform/aws/provider.tf.hbs

@@ -0,0 +1,26 @@
+terraform {
+  required_version = ">= 1.5"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "{{region}}"
+
+  default_tags {
+    tags = {
+      Project     = "godd-ripla-notes"
+      Environment = "{{env}}"
+      ManagedBy   = "terraform"
+    }
+  }
+}

package/templates/terraform/aws/rds.tf.hbs

@@ -0,0 +1,38 @@
+resource "aws_db_subnet_group" "main" {
+  name       = "${local.project}-db-subnet"
+  subnet_ids = [aws_subnet.private_1a.id, aws_subnet.private_1c.id]
+  tags       = local.tags
+}
+
+resource "aws_db_instance" "main" {
+  identifier     = "${local.project}-db"
+  engine         = "postgres"
+  engine_version = local.rds_engine_version
+  instance_class = local.rds_instance_class
+
+  allocated_storage     = 20
+  max_allocated_storage = 30
+  storage_type          = "gp3"
+  storage_encrypted     = true
+
+  db_name  = local.rds_db_name
+  username = "app_user"
+  password = random_password.rds_password.result
+
+  db_subnet_group_name   = aws_db_subnet_group.main.name
+  vpc_security_group_ids = [aws_security_group.rds.id]
+
+  multi_az            = false
+  publicly_accessible = false
+
+  backup_retention_period = 7
+  skip_final_snapshot     = local.env == "dev"
+  deletion_protection     = local.env != "dev"
+
+  tags = local.tags
+}
+
+resource "random_password" "rds_password" {
+  length  = 32
+  special = false
+}

package/templates/terraform/aws/s3.tf.hbs

@@ -0,0 +1,34 @@
+resource "aws_s3_bucket" "notes_app" {
+  bucket        = "${local.project}-${local.account_id}"
+  force_destroy = local.env == "dev"
+  tags          = local.tags
+}
+
+resource "aws_s3_bucket_public_access_block" "notes_app" {
+  bucket                  = aws_s3_bucket.notes_app.id
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_policy" "notes_app" {
+  bucket = aws_s3_bucket.notes_app.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "AllowCloudFrontOAC"
+        Effect    = "Allow"
+        Principal = { Service = "cloudfront.amazonaws.com" }
+        Action    = "s3:GetObject"
+        Resource  = "${aws_s3_bucket.notes_app.arn}/*"
+        Condition = {
+          StringEquals = {
+            "AWS:SourceArn" = aws_cloudfront_distribution.notes.arn
+          }
+        }
+      }
+    ]
+  })
+}

package/templates/terraform/aws/secrets.tf.hbs

@@ -0,0 +1,38 @@
+resource "aws_secretsmanager_secret" "rds_credentials" {
+  name = "godd-notes/${local.env}/rds-credentials"
+  tags = local.tags
+}
+
+resource "aws_secretsmanager_secret_version" "rds_credentials" {
+  secret_id = aws_secretsmanager_secret.rds_credentials.id
+  secret_string = jsonencode({
+    host     = aws_db_instance.main.address
+    username = aws_db_instance.main.username
+    password = random_password.rds_password.result
+  })
+}
+
+resource "aws_secretsmanager_secret" "jwt_secret" {
+  name = "godd-notes/${local.env}/jwt-secret"
+  tags = local.tags
+}
+
+resource "aws_secretsmanager_secret" "github_token" {
+  name = "godd-notes/${local.env}/github-token"
+  tags = local.tags
+}
+
+resource "aws_secretsmanager_secret" "admin_credentials" {
+  name = "godd-notes/${local.env}/admin-credentials"
+  tags = local.tags
+}
+
+resource "aws_secretsmanager_secret" "origin_verify" {
+  name = "godd-notes/${local.env}/origin-verify"
+  tags = local.tags
+}
+
+resource "aws_secretsmanager_secret_version" "origin_verify" {
+  secret_id     = aws_secretsmanager_secret.origin_verify.id
+  secret_string = random_password.origin_verify.result
+}

package/templates/terraform/aws/security_groups.tf.hbs

@@ -0,0 +1,72 @@
+data "aws_ec2_managed_prefix_list" "cloudfront" {
+  name = "com.amazonaws.global.cloudfront.origin-facing"
+}
+
+resource "aws_security_group" "alb" {
+  name_prefix = "${local.project}-alb-"
+  vpc_id      = aws_vpc.main.id
+  tags        = merge(local.tags, { Name = "${local.project}-alb-sg" })
+
+  lifecycle { create_before_destroy = true }
+}
+
+resource "aws_security_group_rule" "alb_from_cloudfront" {
+  type              = "ingress"
+  from_port         = 80
+  to_port           = 80
+  protocol          = "tcp"
+  prefix_list_ids   = [data.aws_ec2_managed_prefix_list.cloudfront.id]
+  security_group_id = aws_security_group.alb.id
+}
+
+resource "aws_security_group_rule" "alb_to_ecs" {
+  type                     = "egress"
+  from_port                = local.container_port
+  to_port                  = local.container_port
+  protocol                 = "tcp"
+  source_security_group_id = aws_security_group.ecs.id
+  security_group_id        = aws_security_group.alb.id
+}
+
+resource "aws_security_group" "ecs" {
+  name_prefix = "${local.project}-ecs-"
+  vpc_id      = aws_vpc.main.id
+  tags        = merge(local.tags, { Name = "${local.project}-ecs-sg" })
+
+  lifecycle { create_before_destroy = true }
+}
+
+resource "aws_security_group_rule" "ecs_from_alb" {
+  type                     = "ingress"
+  from_port                = local.container_port
+  to_port                  = local.container_port
+  protocol                 = "tcp"
+  source_security_group_id = aws_security_group.alb.id
+  security_group_id        = aws_security_group.ecs.id
+}
+
+resource "aws_security_group_rule" "ecs_to_internet" {
+  type              = "egress"
+  from_port         = 443
+  to_port           = 443
+  protocol          = "tcp"
+  cidr_blocks       = ["0.0.0.0/0"]
+  security_group_id = aws_security_group.ecs.id
+}
+
+resource "aws_security_group" "rds" {
+  name_prefix = "${local.project}-rds-"
+  vpc_id      = aws_vpc.main.id
+  tags        = merge(local.tags, { Name = "${local.project}-rds-sg" })
+
+  lifecycle { create_before_destroy = true }
+}
+
+resource "aws_security_group_rule" "rds_from_ecs" {
+  type                     = "ingress"
+  from_port                = 5432
+  to_port                  = 5432
+  protocol                 = "tcp"
+  source_security_group_id = aws_security_group.ecs.id
+  security_group_id        = aws_security_group.rds.id
+}