@stacksjs/cloud 0.58.48 → 0.58.50

package/dist/index.js

@@ -406,6 +406,7 @@ var appEnv = config2.app.env === "local" ? "dev" : config2.app.env;
 var cloudName = `stacks-cloud-${appEnv}`;
 // src/cloud/index.ts
 import {Stack as Stack2} from "aws-cdk-lib";
+import {config as config20} from "@stacksjs/config";
 
 // src/cloud/ai.ts
 import {Duration, CfnOutput as Output, aws_iam as iam, aws_lambda as lambda} from "aws-cdk-lib";
@@ -1347,7 +1348,7 @@ class CdnStack {
     }
   }
   shouldDeployApi() {
-    return config6.cloud.api;
+    return config6.cloud.api?.deploy;
   }
   apiBehaviorOptions(scope, props) {
     const hostname = Fn.select(2, Fn.split("/", props.webServerUrl.url));
@@ -1472,7 +1473,6 @@ class CdnStack {
     if (this.shouldDeployApi()) {
       const keysToRemove = ["_HANDLER", "_X_AMZN_TRACE_ID", "AWS_REGION", "AWS_EXECUTION_ENV", "AWS_LAMBDA_FUNCTION_NAME", "AWS_LAMBDA_FUNCTION_MEMORY_SIZE", "AWS_LAMBDA_FUNCTION_VERSION", "AWS_LAMBDA_INITIALIZATION_TYPE", "AWS_LAMBDA_LOG_GROUP_NAME", "AWS_LAMBDA_LOG_STREAM_NAME", "AWS_ACCESS_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_LAMBDA_RUNTIME_API", "LAMBDA_TASK_ROOT", "LAMBDA_RUNTIME_DIR", "_"];
       keysToRemove.forEach((key) => delete env2[key]);
-      behaviorOptions = this.apiBehaviorOptions(scope, props);
     }
     if (this.shouldDeployDocs() && !config6.app.docMode) {
       behaviorOptions = {
@@ -1960,34 +1960,14 @@ class NetworkStack {
       natGateways: 0,
       subnetConfiguration: [
         {
-          cidrMask: 21,
-          name: `${props.slug}-${props.appEnv}-public-subnet-1`,
-          subnetType: ec22.SubnetType.PUBLIC
+          name: "public-subnet-1",
+          subnetType: ec22.SubnetType.PUBLIC,
+          cidrMask: 24
         },
         {
-          cidrMask: 21,
-          name: `${props.slug}-${props.appEnv}-public-subnet-2`,
-          subnetType: ec22.SubnetType.PUBLIC
-        },
-        {
-          cidrMask: 21,
-          name: `${props.slug}-${props.appEnv}-public-subnet-3`,
-          subnetType: ec22.SubnetType.PUBLIC
-        },
-        {
-          cidrMask: 21,
-          name: `${props.slug}-${props.appEnv}-private-subnet-1`,
-          subnetType: ec22.SubnetType.PRIVATE_ISOLATED
-        },
-        {
-          cidrMask: 21,
-          name: `${props.slug}-${props.appEnv}-private-subnet-2`,
-          subnetType: ec22.SubnetType.PRIVATE_ISOLATED
-        },
-        {
-          cidrMask: 21,
-          name: `${props.slug}-${props.appEnv}-private-subnet-3`,
-          subnetType: ec22.SubnetType.PRIVATE_ISOLATED
+          name: "private-subnet-1",
+          subnetType: ec22.SubnetType.PRIVATE_ISOLATED,
+          cidrMask: 28
         }
       ]
     });
@@ -2337,11 +2317,14 @@ class PermissionsStack {
 }
 
 // src/cloud/compute.ts
-import {Duration as Duration6, CfnOutput as Output6, aws_lambda as lambda5, aws_logs as logs, aws_secretsmanager as secretsmanager} from "aws-cdk-lib";
+import {Duration as Duration6, CfnOutput as Output6, RemovalPolicy as RemovalPolicy8, aws_ec2 as ec23, aws_ecs as ecs, aws_secretsmanager as secretsmanager} from "aws-cdk-lib";
 import {path as p6} from "@stacksjs/path";
 import {env as env6} from "@stacksjs/env";
+import {LogGroup} from "aws-cdk-lib/aws-logs";
+import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
 
 class ComputeStack {
+  lb;
   apiServer;
   apiServerUrl;
   constructor(scope, props) {
@@ -2349,17 +2332,122 @@ class ComputeStack {
     const fileSystem = props.fileSystem;
     if (!fileSystem)
       throw new Error("The file system is missing. Please make sure it was created properly.");
-    this.apiServer = new lambda5.Function(scope, "WebServer", {
-      functionName: `${props.slug}-${props.appEnv}-web-server`,
-      description: "The web server for the Stacks application",
-      code: lambda5.Code.fromAssetImage(p6.frameworkPath("server")),
-      handler: lambda5.Handler.FROM_IMAGE,
-      runtime: lambda5.Runtime.FROM_IMAGE,
+    const cluster = new ecs.Cluster(scope, "StacksCluster", {
+      clusterName: `${props.slug}-${props.appEnv}-web-server-cluster`,
+      vpc
+    });
+    const taskDefinition = new ecs.FargateTaskDefinition(scope, "TaskDefinition", {
+      family: `${props.appName}-${props.appEnv}-api`,
+      memoryLimitMiB: 512,
+      cpu: 256,
+      runtimePlatform: {
+        cpuArchitecture: ecs.CpuArchitecture.ARM64
+      }
+    });
+    const container = taskDefinition.addContainer("WebServerContainer", {
+      containerName: `${props.appName}-${props.appEnv}-api`,
+      image: ecs.ContainerImage.fromAsset(p6.frameworkPath("server")),
+      logging: new ecs.AwsLogDriver({
+        streamPrefix: `${props.appName}-${props.appEnv}-web`,
+        logGroup: new LogGroup(scope, "StacksApiLogs", {
+          logGroupName: "/ecs/stacks-api",
+          removalPolicy: RemovalPolicy8.DESTROY
+        })
+      }),
+      healthCheck: {
+        command: ["CMD-SHELL", "curl -f http://localhost:3000/health || exit 1"],
+        interval: Duration6.seconds(10),
+        timeout: Duration6.seconds(5),
+        retries: 3,
+        startPeriod: Duration6.seconds(10)
+      }
+    });
+    container.addPortMappings({
+      containerPort: 3000,
+      hostPort: 3000
+    });
+    const serviceSecurityGroup = new ec23.SecurityGroup(scope, "ServiceSecurityGroup", {
+      securityGroupName: `${props.appName}-${props.appEnv}-api-service-sg`,
       vpc,
-      memorySize: 512,
-      timeout: Duration6.minutes(5),
-      logRetention: logs.RetentionDays.ONE_WEEK,
-      architecture: lambda5.Architecture.ARM_64
+      description: "Stacks Security Group for API Service"
+    });
+    const publicLoadBalancerSG = new ec23.SecurityGroup(scope, "PublicLoadBalancerSG", {
+      securityGroupName: `${props.appName}-${props.appEnv}-public-load-balancer-sg`,
+      vpc,
+      description: "Access to the public facing load balancer"
+    });
+    serviceSecurityGroup.addIngressRule(publicLoadBalancerSG, ec23.Port.allTraffic(), "Ingress from the public ALB");
+    serviceSecurityGroup.addIngressRule(publicLoadBalancerSG, ec23.Port.allTraffic(), "Ingress from the public ALB");
+    this.lb = new elbv2.ApplicationLoadBalancer(scope, "ApplicationLoadBalancer", {
+      loadBalancerName: `${props.appName}-${props.appEnv}-alb`,
+      vpc,
+      vpcSubnets: {
+        subnets: vpc.selectSubnets({
+          subnetType: ec23.SubnetType.PUBLIC,
+          onePerAz: true
+        }).subnets
+      },
+      internetFacing: true,
+      idleTimeout: Duration6.seconds(30),
+      securityGroup: publicLoadBalancerSG
+    });
+    const serviceTargetGroup = new elbv2.ApplicationTargetGroup(scope, "ServiceTargetGroup", {
+      vpc,
+      targetType: elbv2.TargetType.IP,
+      protocol: elbv2.ApplicationProtocol.HTTP,
+      port: 3000,
+      healthCheck: {
+        interval: Duration6.seconds(6),
+        path: "/",
+        protocol: elbv2.Protocol.HTTP,
+        timeout: Duration6.seconds(5),
+        healthyThresholdCount: 2,
+        unhealthyThresholdCount: 10
+      }
+    });
+    const service = new ecs.FargateService(scope, "StacksApiService", {
+      serviceName: `${props.appName}-${props.appEnv}-api-service`,
+      cluster,
+      taskDefinition,
+      desiredCount: 2,
+      assignPublicIp: true,
+      maxHealthyPercent: 200,
+      vpcSubnets: vpc.selectSubnets({
+        subnetType: ec23.SubnetType.PUBLIC,
+        onePerAz: true
+      }),
+      minHealthyPercent: 75,
+      securityGroups: [serviceSecurityGroup]
+    });
+    service.attachToApplicationTargetGroup(serviceTargetGroup);
+    publicLoadBalancerSG.addIngressRule(ec23.Peer.anyIpv4(), ec23.Port.allTraffic());
+    this.lb.addListener("HttpListener", {
+      port: 80,
+      defaultAction: elbv2.ListenerAction.forward([serviceTargetGroup])
+    });
+    props.fileSystem.connections.allowFromAnyIpv4(ec23.Port.tcp(2049));
+    const volumeName = `${props.slug}-${props.appEnv}-efs`;
+    taskDefinition.addVolume({
+      name: volumeName,
+      efsVolumeConfiguration: {
+        fileSystemId: props.fileSystem.fileSystemId
+      }
+    });
+    container.addMountPoints({
+      sourceVolume: volumeName,
+      containerPath: "/mnt/efs",
+      readOnly: false
+    });
+    const scaling = service.autoScaleTaskCount({ maxCapacity: 2 });
+    scaling.scaleOnCpuUtilization("CpuScaling", {
+      targetUtilizationPercent: 50,
+      scaleInCooldown: Duration6.seconds(60),
+      scaleOutCooldown: Duration6.seconds(60)
+    });
+    scaling.scaleOnMemoryUtilization("MemoryScaling", {
+      targetUtilizationPercent: 60,
+      scaleInCooldown: Duration6.seconds(60),
+      scaleOutCooldown: Duration6.seconds(60)
     });
     const keysToRemove = ["_HANDLER", "_X_AMZN_TRACE_ID", "AWS_REGION", "AWS_EXECUTION_ENV", "AWS_LAMBDA_FUNCTION_NAME", "AWS_LAMBDA_FUNCTION_MEMORY_SIZE", "AWS_LAMBDA_FUNCTION_VERSION", "AWS_LAMBDA_INITIALIZATION_TYPE", "AWS_LAMBDA_LOG_GROUP_NAME", "AWS_LAMBDA_LOG_STREAM_NAME", "AWS_ACCESS_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_LAMBDA_RUNTIME_API", "LAMBDA_TASK_ROOT", "LAMBDA_RUNTIME_DIR", "_"];
     keysToRemove.forEach((key) => delete env6[key]);
@@ -2371,23 +2459,16 @@ class ComputeStack {
         generateStringKey: Object.keys(env6).join(",").length.toString()
       }
     });
-    secrets.grantRead(this.apiServer);
-    this.apiServer.addEnvironment("SECRETS_ARN", secrets.secretArn);
-    this.apiServerUrl = new lambda5.FunctionUrl(scope, "StacksServerUrl", {
-      function: this.apiServer,
-      authType: lambda5.FunctionUrlAuthType.NONE,
-      cors: {
-        allowedOrigins: ["*"]
-      }
-    });
+    secrets.grantRead(service.taskDefinition.executionRole);
+    container.addEnvironment("SECRETS_ARN", secrets.secretArn);
     const apiPrefix = "api";
     new Output6(scope, "ApiUrl", {
       value: `https://${props.domain}/${apiPrefix}`,
       description: "The URL of the deployed application"
     });
     new Output6(scope, "ApiVanityUrl", {
-      value: this.apiServerUrl.url,
-      description: "The Vanity URL of the deployed application"
+      value: `http://${this.lb.loadBalancerDnsName}`,
+      description: "The Vanity URL / DNS name of the load balancer"
     });
   }
 }
@@ -2422,13 +2503,16 @@ class Cloud extends Stack2 {
     });
     new RedirectsStack(this, props);
     new PermissionsStack(this);
-    const api = new ComputeStack(this, {
-      ...props,
-      vpc: network2.vpc,
-      fileSystem: fileSystem.fileSystem,
-      zone: dns2.zone,
-      certificate: security2.certificate
-    });
+    let api;
+    if (config20.cloud.api?.deploy) {
+      api = new ComputeStack(this, {
+        ...props,
+        vpc: network2.vpc,
+        fileSystem: fileSystem.fileSystem,
+        zone: dns2.zone,
+        certificate: security2.certificate
+      });
+    }
     const ai2 = new AiStack(this, props);
     const cli4 = new CliStack(this, props);
     const cdn2 = new CdnStack(this, {
@@ -2439,11 +2523,11 @@ class Cloud extends Stack2 {
       firewall: security2.firewall,
       originRequestFunction: docs2.originRequestFunction,
       zone: dns2.zone,
-      webServer: api.apiServer,
-      webServerUrl: api.apiServerUrl,
       cliSetupUrl: cli4.cliSetupUrl,
       askAiUrl: ai2.askAiUrl,
-      summarizeAiUrl: ai2.summarizeAiUrl
+      summarizeAiUrl: ai2.summarizeAiUrl,
+      webServer: api?.apiServer,
+      webServerUrl: api?.apiServerUrl
     });
     new DeploymentStack(this, {
       ...props,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/cloud",
   "type": "module",
-  "version": "0.58.48",
+  "version": "0.58.50",
   "description": "The Stacks cloud/serverless integration & implementation.",
   "author": "Chris Breuer",
   "license": "MIT",
@@ -40,7 +40,8 @@
   ],
   "files": [
     "README.md",
-    "dist"
+    "dist",
+    "src"
   ],
   "scripts": {
     "bootstrap": "bunx cdk bootstrap",
@@ -54,20 +55,20 @@
     "prepublishOnly": "bun run build"
   },
   "peerDependencies": {
-    "@aws-sdk/client-bedrock": "^3.503.1",
-    "@aws-sdk/client-cloudformation": "^3.503.1",
-    "@aws-sdk/client-cloudfront": "^3.503.1",
-    "@aws-sdk/client-cloudwatch-logs": "^3.503.1",
-    "@aws-sdk/client-ec2": "^3.503.1",
-    "@aws-sdk/client-efs": "^3.503.1",
-    "@aws-sdk/client-iam": "^3.503.1",
-    "@aws-sdk/client-lambda": "^3.503.1",
-    "@aws-sdk/client-route-53-domains": "^3.503.1",
-    "@aws-sdk/client-s3": "^3.503.1",
-    "@aws-sdk/client-ses": "^3.503.1",
-    "@aws-sdk/client-sesv2": "^3.503.1",
-    "@aws-sdk/client-ssm": "^3.503.1",
-    "@aws-sdk/lib-dynamodb": "^3.503.1",
+    "@aws-sdk/client-bedrock": "^3.504.0",
+    "@aws-sdk/client-cloudformation": "^3.504.0",
+    "@aws-sdk/client-cloudfront": "^3.504.0",
+    "@aws-sdk/client-cloudwatch-logs": "^3.504.0",
+    "@aws-sdk/client-ec2": "^3.504.0",
+    "@aws-sdk/client-efs": "^3.504.0",
+    "@aws-sdk/client-iam": "^3.504.0",
+    "@aws-sdk/client-lambda": "^3.504.0",
+    "@aws-sdk/client-route-53-domains": "^3.504.0",
+    "@aws-sdk/client-s3": "^3.504.0",
+    "@aws-sdk/client-ses": "^3.504.0",
+    "@aws-sdk/client-sesv2": "^3.504.0",
+    "@aws-sdk/client-ssm": "^3.504.0",
+    "@aws-sdk/lib-dynamodb": "^3.506.0",
     "@stacksjs/config": "latest",
     "@stacksjs/env": "latest",
     "@stacksjs/logging": "latest",
@@ -79,20 +80,20 @@
     "@stacksjs/validation": "latest"
   },
   "dependencies": {
-    "@aws-sdk/client-bedrock": "^3.503.1",
-    "@aws-sdk/client-cloudformation": "^3.503.1",
-    "@aws-sdk/client-cloudfront": "^3.503.1",
-    "@aws-sdk/client-cloudwatch-logs": "^3.503.1",
-    "@aws-sdk/client-dynamodb": "3.503.1",
-    "@aws-sdk/client-ec2": "^3.503.1",
-    "@aws-sdk/client-efs": "^3.503.1",
-    "@aws-sdk/client-iam": "^3.503.1",
-    "@aws-sdk/client-lambda": "^3.503.1",
-    "@aws-sdk/client-route-53-domains": "^3.503.1",
-    "@aws-sdk/client-s3": "^3.503.1",
-    "@aws-sdk/client-ses": "^3.503.1",
-    "@aws-sdk/client-sesv2": "^3.503.1",
-    "@aws-sdk/client-ssm": "^3.503.1",
+    "@aws-sdk/client-bedrock": "^3.504.0",
+    "@aws-sdk/client-cloudformation": "^3.504.0",
+    "@aws-sdk/client-cloudfront": "^3.504.0",
+    "@aws-sdk/client-cloudwatch-logs": "^3.504.0",
+    "@aws-sdk/client-dynamodb": "3.506.0",
+    "@aws-sdk/client-ec2": "^3.504.0",
+    "@aws-sdk/client-efs": "^3.504.0",
+    "@aws-sdk/client-iam": "^3.504.0",
+    "@aws-sdk/client-lambda": "^3.504.0",
+    "@aws-sdk/client-route-53-domains": "^3.504.0",
+    "@aws-sdk/client-s3": "^3.504.0",
+    "@aws-sdk/client-ses": "^3.504.0",
+    "@aws-sdk/client-sesv2": "^3.504.0",
+    "@aws-sdk/client-ssm": "^3.504.0",
     "@stacksjs/config": "latest",
     "@stacksjs/dns": "latest",
     "@stacksjs/env": "latest",
@@ -102,13 +103,13 @@
     "@stacksjs/storage": "latest",
     "@stacksjs/utils": "latest",
     "@stacksjs/validation": "latest",
-    "aws-cdk": "^2.124.0",
-    "aws-cdk-lib": "^2.124.0",
+    "aws-cdk": "^2.126.0",
+    "aws-cdk-lib": "^2.126.0",
     "aws4fetch": "^1.0.17",
     "constructs": "^10.3.0"
   },
   "devDependencies": {
-    "@oclif/plugin-plugins": "^4.1.23",
+    "@oclif/plugin-plugins": "^4.2.1",
     "@stacksjs/cli": "latest",
     "@stacksjs/development": "latest",
     "@stacksjs/env": "latest",

package/src/cloud/ai.ts

@@ -0,0 +1,94 @@
+/* eslint-disable no-new */
+import { Duration, CfnOutput as Output, aws_iam as iam, aws_lambda as lambda } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import { config } from '@stacksjs/config'
+import type { NestedCloudProps } from '../types'
+
+export interface AiStackProps extends NestedCloudProps {
+}
+
+export class AiStack {
+  askAiUrl: lambda.FunctionUrl
+  summarizeAiUrl: lambda.FunctionUrl
+
+  constructor(scope: Construct, props: AiStackProps) {
+    // Define the Lambda Layer for aws-sdk
+    const awsSdkLayer = new lambda.LayerVersion(scope, 'AwsSdkLayer', {
+      code: lambda.Code.fromAsset('src/cloud/aws-sdk-layer'),
+      compatibleRuntimes: [lambda.Runtime.NODEJS_20_X],
+      description: 'Layer with aws-sdk',
+    })
+
+    const bedrockAccessPolicy = new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      actions: [
+        'bedrock:InvokeModel',
+        'bedrock:InvokeModelWithResponseStream',
+      ],
+      resources: config.ai.models?.map(model => `arn:aws:bedrock:us-east-1::foundation-model/${model}`),
+    })
+
+    const bedrockAccessRole = new iam.Role(scope, 'BedrockAccessRole', {
+      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+      managedPolicies: [
+        iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
+      ],
+    })
+
+    bedrockAccessRole.addToPolicy(bedrockAccessPolicy)
+
+    const askAi = new lambda.Function(scope, 'AskAiFunction', {
+      functionName: `${props.slug}-${props.appEnv}-ai-ask`,
+      description: 'Lambda function to invoke the AI model',
+      runtime: lambda.Runtime.NODEJS_20_X,
+      handler: 'index.handler',
+      code: lambda.Code.fromAsset('src/cloud/lambda/ask'), // path relative to the cloud root package dir
+      layers: [awsSdkLayer],
+      role: bedrockAccessRole,
+      timeout: Duration.seconds(30),
+    })
+
+    this.askAiUrl = new lambda.FunctionUrl(scope, 'AskAiFunctionUrl', {
+      function: askAi,
+      authType: lambda.FunctionUrlAuthType.NONE,
+      cors: {
+        allowedOrigins: ['*'],
+      },
+    })
+
+    const summarizeAi = new lambda.Function(scope, 'SummarizeAiFunction', {
+      functionName: `${props.slug}-${props.appEnv}-ai-summarize`,
+      description: 'Lambda function to summarize any given text',
+      runtime: lambda.Runtime.NODEJS_20_X,
+      handler: 'index.handler',
+      code: lambda.Code.fromAsset('src/cloud/lambda/summarize'),
+      layers: [awsSdkLayer],
+      role: bedrockAccessRole,
+      timeout: Duration.seconds(30),
+    })
+
+    this.summarizeAiUrl = new lambda.FunctionUrl(scope, 'SummarizeAiFunctionUrl', {
+      function: summarizeAi,
+      authType: lambda.FunctionUrlAuthType.NONE,
+      cors: {
+        allowedOrigins: ['*'],
+      },
+    })
+
+    new Output(scope, 'AiVanityAskApiUrl', {
+      value: this.askAiUrl.url,
+    })
+
+    new Output(scope, 'AiVanitySummarizeApiUrl', {
+      value: this.summarizeAiUrl.url,
+    })
+
+    new Output(scope, 'AiAskApiUrl', {
+      value: `https://${props.domain}/ai/ask`,
+    })
+
+    new Output(scope, 'AiSummarizeApiUrl', {
+      value: `https://${props.domain}/ai/summary`,
+    })
+  }
+}