@stacksjs/cloud 0.58.48 → 0.58.50

package/src/cloud/cdn.ts

@@ -0,0 +1,374 @@
+/* eslint-disable no-new */
+import type { aws_certificatemanager as acm, aws_lambda as lambda, aws_s3 as s3, aws_wafv2 as wafv2 } from 'aws-cdk-lib'
+import { Duration, Fn, CfnOutput as Output, aws_cloudfront as cloudfront, aws_cloudfront_origins as origins, aws_route53 as route53, aws_route53_targets as targets } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import { config } from '@stacksjs/config'
+import { hasFiles } from '@stacksjs/storage'
+import { path as p } from '@stacksjs/path'
+import { env } from '@stacksjs/env'
+import type { NestedCloudProps } from '../types'
+import type { EnvKey } from '../../../../env'
+
+export interface CdnStackProps extends NestedCloudProps {
+  certificate: acm.Certificate
+  logBucket: s3.Bucket
+  publicBucket: s3.Bucket
+  firewall: wafv2.CfnWebACL
+  originRequestFunction: lambda.Function
+  zone: route53.IHostedZone
+  webServer?: lambda.Function
+  webServerUrl?: lambda.FunctionUrl
+  cliSetupUrl: lambda.FunctionUrl
+  askAiUrl: lambda.FunctionUrl
+  summarizeAiUrl: lambda.FunctionUrl
+}
+
+export class CdnStack {
+  distribution: cloudfront.Distribution
+  originAccessIdentity: cloudfront.OriginAccessIdentity
+  cdnCachePolicy: cloudfront.CachePolicy
+  apiCachePolicy: cloudfront.CachePolicy | undefined
+  vanityUrl: string
+  props: CdnStackProps
+
+  constructor(scope: Construct, props: CdnStackProps) {
+    this.props = props
+
+    this.originAccessIdentity = new cloudfront.OriginAccessIdentity(scope, 'OAI')
+
+    this.cdnCachePolicy = new cloudfront.CachePolicy(scope, 'CdnCachePolicy', {
+      comment: 'Stacks CDN Cache Policy',
+      cachePolicyName: `${props.slug}-${props.appEnv}-cdn-cache-policy`,
+      minTtl: config.cloud.cdn?.minTtl ? Duration.seconds(config.cloud.cdn.minTtl) : undefined,
+      defaultTtl: config.cloud.cdn?.defaultTtl ? Duration.seconds(config.cloud.cdn.defaultTtl) : undefined,
+      maxTtl: config.cloud.cdn?.maxTtl ? Duration.seconds(config.cloud.cdn.maxTtl) : undefined,
+      cookieBehavior: this.getCookieBehavior(config.cloud.cdn?.cookieBehavior),
+    })
+
+    // the actual CDN distribution
+    this.distribution = new cloudfront.Distribution(scope, 'Cdn', {
+      domainNames: [props.domain],
+      defaultRootObject: 'index.html',
+      comment: `CDN for ${config.app.url}`,
+      certificate: props.certificate,
+      enableLogging: true,
+      logBucket: props.logBucket,
+      httpVersion: cloudfront.HttpVersion.HTTP2_AND_3,
+      priceClass: cloudfront.PriceClass.PRICE_CLASS_ALL,
+      enabled: true,
+      minimumProtocolVersion: cloudfront.SecurityPolicyProtocol.TLS_V1_2_2021,
+      webAclId: props.firewall.attrArn,
+      enableIpv6: true,
+
+      defaultBehavior: {
+        origin: new origins.S3Origin(props.publicBucket, {
+          originAccessIdentity: this.originAccessIdentity,
+        }),
+        edgeLambdas: [
+          {
+            eventType: cloudfront.LambdaEdgeEventType.ORIGIN_REQUEST,
+            functionVersion: props.originRequestFunction.currentVersion,
+          },
+        ],
+        compress: config.cloud.cdn?.compress,
+        allowedMethods: this.allowedMethods(),
+        cachedMethods: this.cachedMethods(),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: this.cdnCachePolicy,
+      },
+
+      additionalBehaviors: this.additionalBehaviors(scope, props),
+
+      // Add custom error responses
+      errorResponses: [
+        {
+          httpStatus: 403,
+          responsePagePath: '/index.html',
+          responseHttpStatus: 200,
+          ttl: Duration.seconds(0),
+        },
+      ],
+    })
+
+    new route53.ARecord(scope, 'AliasRecord', {
+      recordName: props.domain,
+      zone: props.zone,
+      target: route53.RecordTarget.fromAlias(new targets.CloudFrontTarget(this.distribution)),
+    })
+
+    new Output(scope, 'DistributionId', {
+      value: this.distribution.distributionId,
+    })
+
+    new Output(scope, 'AppUrl', {
+      value: `https://${props.domain}`,
+      description: 'The URL of the deployed application',
+    })
+
+    this.vanityUrl = `https://${this.distribution.domainName}`
+    new Output(scope, 'AppVanityUrl', {
+      value: this.vanityUrl,
+      description: 'The vanity URL of the deployed application',
+    })
+
+    // this.originAccessIdentity = originAccessIdentity
+    // this.cdnCachePolicy = cdnCachePolicy
+  }
+
+  getCookieBehavior(behavior: string | undefined): cloudfront.CacheCookieBehavior | undefined {
+    switch (behavior) {
+      case 'all':
+        return cloudfront.CacheCookieBehavior.all()
+      case 'none':
+        return cloudfront.CacheCookieBehavior.none()
+      case 'allowList':
+        // If you have a list of cookies, replace `myCookie` with your cookie
+        return cloudfront.CacheCookieBehavior.allowList(...config.cloud.cdn?.allowList.cookies || [])
+      default:
+        return undefined
+    }
+  }
+
+  allowedMethods(): cloudfront.AllowedMethods {
+    switch (config.cloud.cdn?.allowedMethods) {
+      case 'ALL':
+        return cloudfront.AllowedMethods.ALLOW_ALL
+      case 'GET_HEAD':
+        return cloudfront.AllowedMethods.ALLOW_GET_HEAD
+      case 'GET_HEAD_OPTIONS':
+        return cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS
+      default:
+        return cloudfront.AllowedMethods.ALLOW_ALL
+    }
+  }
+
+  cachedMethods(): cloudfront.CachedMethods {
+    switch (config.cloud.cdn?.cachedMethods) {
+      case 'GET_HEAD':
+        return cloudfront.CachedMethods.CACHE_GET_HEAD
+      case 'GET_HEAD_OPTIONS':
+        return cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS
+      default:
+        return cloudfront.CachedMethods.CACHE_GET_HEAD
+    }
+  }
+
+  allowedMethodsFromString(methods?: 'ALL' | 'GET_HEAD' | 'GET_HEAD_OPTIONS'): cloudfront.AllowedMethods {
+    if (!methods)
+      return cloudfront.AllowedMethods.ALLOW_ALL
+
+    switch (methods) {
+      case 'ALL':
+        return cloudfront.AllowedMethods.ALLOW_ALL
+      case 'GET_HEAD':
+        return cloudfront.AllowedMethods.ALLOW_GET_HEAD
+      case 'GET_HEAD_OPTIONS':
+        return cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS
+      default:
+        return cloudfront.AllowedMethods.ALLOW_ALL
+    }
+  }
+
+  cachedMethodsFromString(methods?: 'GET_HEAD' | 'GET_HEAD_OPTIONS'): cloudfront.CachedMethods {
+    if (!methods)
+      return cloudfront.CachedMethods.CACHE_GET_HEAD
+
+    switch (methods) {
+      case 'GET_HEAD':
+        return cloudfront.CachedMethods.CACHE_GET_HEAD
+      case 'GET_HEAD_OPTIONS':
+        return cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS
+      default:
+        return cloudfront.CachedMethods.CACHE_GET_HEAD
+    }
+  }
+
+  shouldDeployApi() {
+    return config.cloud.api?.deploy
+  }
+
+  apiBehaviorOptions(scope: Construct, props: CdnStackProps): Record<string, cloudfront.BehaviorOptions> {
+    const hostname = Fn.select(2, Fn.split('/', props.webServerUrl!.url))
+    const origin = (path: '/api' | '/api/*' = '/api') => {
+      return new origins.HttpOrigin(hostname, {
+        originPath: path,
+        protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
+      })
+    }
+
+    return {
+      '/api': {
+        origin: origin(),
+        compress: true,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
+        cachePolicy: this.setApiCachePolicy(scope),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      },
+      '/api/*': {
+        origin: origin('/api/*'),
+        compress: true,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
+        cachePolicy: this.apiCachePolicy,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      },
+    }
+  }
+
+  docsBehaviorOptions(props: CdnStackProps): Record<string, cloudfront.BehaviorOptions> {
+    return {
+      '/docs': {
+        origin: new origins.S3Origin(props.publicBucket, {
+          originAccessIdentity: this.originAccessIdentity,
+          originPath: '/docs',
+        }),
+        compress: true,
+        allowedMethods: this.allowedMethodsFromString(config.cloud.cdn?.allowedMethods),
+        cachedMethods: this.cachedMethodsFromString(config.cloud.cdn?.cachedMethods),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
+      },
+      '/docs/*': {
+        origin: new origins.S3Origin(props.publicBucket, {
+          originAccessIdentity: this.originAccessIdentity,
+          originPath: '/docs',
+        }),
+        compress: true,
+        allowedMethods: this.allowedMethodsFromString(config.cloud.cdn?.allowedMethods),
+        cachedMethods: this.cachedMethodsFromString(config.cloud.cdn?.cachedMethods),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
+      },
+    }
+  }
+
+  aiBehaviorOptions(scope: Construct, props: CdnStackProps): Record<string, cloudfront.BehaviorOptions> {
+    const hostname = Fn.select(2, Fn.split('/', props.askAiUrl.url))
+    const summaryHostname = Fn.select(2, Fn.split('/', props.summarizeAiUrl.url))
+
+    const aiCachePolicy = new cloudfront.CachePolicy(scope, 'AiCachePolicy', {
+      comment: 'Stacks AI Cache Policy',
+      cachePolicyName: `${this.props.slug}-${this.props.appEnv}-ai-cache-policy`,
+      defaultTtl: Duration.seconds(0),
+      // minTtl: config.cloud.cdn?.minTtl ? Duration.seconds(config.cloud.cdn.minTtl) : undefined,
+      cookieBehavior: cloudfront.CacheCookieBehavior.none(),
+      headerBehavior: cloudfront.CacheHeaderBehavior.allowList('Accept', 'x-api-key', 'Authorization', 'Content-Type'),
+      queryStringBehavior: cloudfront.CacheQueryStringBehavior.all(),
+    })
+
+    return {
+      '/ai/ask': {
+        origin: new origins.HttpOrigin(hostname, {
+          originPath: '/ai',
+          protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
+        }),
+        compress: false,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: aiCachePolicy,
+      },
+      '/ai/summary': {
+        origin: new origins.HttpOrigin(summaryHostname, {
+          originPath: '/ai',
+          protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
+        }),
+        compress: false,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: aiCachePolicy,
+      },
+    }
+  }
+
+  cliSetupBehaviorOptions(scope: Construct, props: CdnStackProps): Record<string, cloudfront.BehaviorOptions> {
+    const hostname = Fn.select(2, Fn.split('/', props.cliSetupUrl.url))
+
+    return {
+      '/install': {
+        origin: new origins.HttpOrigin(hostname, {
+        // origin: new origins.HttpOrigin('tipevv3dfx35fb7ptyq7nrxtga0qkcgc.lambda-url.us-east-1.on.aws', {
+          originPath: '/cli-setup',
+          protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
+        }),
+        compress: false,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: new cloudfront.CachePolicy(scope, 'CliSetupCachePolicy', {
+          comment: 'Stacks CLI Setup Cache Policy',
+          cachePolicyName: `${this.props.slug}-${this.props.appEnv}-cli-setup-cache-policy`,
+          defaultTtl: Duration.seconds(0),
+          // minTtl: config.cloud.cdn?.minTtl ? Duration.seconds(config.cloud.cdn.minTtl) : undefined,
+          cookieBehavior: cloudfront.CacheCookieBehavior.none(),
+          headerBehavior: cloudfront.CacheHeaderBehavior.none(),
+          queryStringBehavior: cloudfront.CacheQueryStringBehavior.none(),
+        }),
+      },
+    }
+  }
+
+  shouldDeployAiEndpoints() {
+    return config.cloud.ai
+  }
+
+  shouldDeployCliSetup() {
+    return config.cloud.cli
+  }
+
+  shouldDeployDocs() {
+    return hasFiles(p.projectPath('docs'))
+  }
+
+  additionalBehaviors(scope: Construct, props: CdnStackProps): Record<string, cloudfront.BehaviorOptions> {
+    let behaviorOptions: Record<string, cloudfront.BehaviorOptions> = {}
+
+    if (this.shouldDeployApi()) {
+      const keysToRemove = ['_HANDLER', '_X_AMZN_TRACE_ID', 'AWS_REGION', 'AWS_EXECUTION_ENV', 'AWS_LAMBDA_FUNCTION_NAME', 'AWS_LAMBDA_FUNCTION_MEMORY_SIZE', 'AWS_LAMBDA_FUNCTION_VERSION', 'AWS_LAMBDA_INITIALIZATION_TYPE', 'AWS_LAMBDA_LOG_GROUP_NAME', 'AWS_LAMBDA_LOG_STREAM_NAME', 'AWS_ACCESS_KEY', 'AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_SESSION_TOKEN', 'AWS_LAMBDA_RUNTIME_API', 'LAMBDA_TASK_ROOT', 'LAMBDA_RUNTIME_DIR', '_']
+      keysToRemove.forEach(key => delete env[key as EnvKey])
+
+      // behaviorOptions = this.apiBehaviorOptions(scope, props)
+    }
+
+    // if docMode is used, we don't need to add a behavior for the docs
+    // because the docs will be the root of the site
+    if (this.shouldDeployDocs() && !config.app.docMode) {
+      behaviorOptions = {
+        ...this.docsBehaviorOptions(props),
+        ...behaviorOptions,
+      }
+    }
+
+    if (this.shouldDeployAiEndpoints()) {
+      behaviorOptions = {
+        ...this.aiBehaviorOptions(scope, props),
+        ...behaviorOptions,
+      }
+    }
+
+    if (this.shouldDeployCliSetup()) {
+      behaviorOptions = {
+        ...this.cliSetupBehaviorOptions(scope, props),
+        ...behaviorOptions,
+      }
+    }
+
+    return behaviorOptions
+  }
+
+  setApiCachePolicy(scope: Construct) {
+    if (this.apiCachePolicy)
+      return this.apiCachePolicy
+
+    this.apiCachePolicy = new cloudfront.CachePolicy(scope, 'ApiCachePolicy', {
+      comment: 'Stacks API Cache Policy',
+      cachePolicyName: `${this.props.slug}-${this.props.appEnv}-api-cache-policy`,
+      defaultTtl: Duration.seconds(0),
+      // minTtl: config.cloud.cdn?.minTtl ? Duration.seconds(config.cloud.cdn.minTtl) : undefined,
+      cookieBehavior: cloudfront.CacheCookieBehavior.none(),
+      headerBehavior: cloudfront.CacheHeaderBehavior.allowList('Accept', 'x-api-key', 'Authorization', 'Content-Type'),
+      queryStringBehavior: cloudfront.CacheQueryStringBehavior.none(),
+    })
+
+    return this.apiCachePolicy
+  }
+}

package/src/cloud/cli.ts

@@ -0,0 +1,45 @@
+/* eslint-disable no-new */
+import { Duration, CfnOutput as Output, aws_lambda as lambda } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface CliStackProps extends NestedCloudProps {
+}
+
+export class CliStack {
+  cliSetupUrl: lambda.FunctionUrl
+
+  constructor(scope: Construct, props: CliStackProps) {
+    const cliSetupFunc = new lambda.Function(scope, 'CliSetupFunction', {
+      functionName: `${props.slug}-${props.appEnv}-cli-setup`,
+      description: 'Lambda function that triggers setup script for a Stacks project',
+      runtime: lambda.Runtime.NODEJS_20_X,
+      handler: 'index.handler',
+      code: lambda.Code.fromAsset('src/cloud/lambda/cli-setup'), // path relative to the cloud root package dir
+      timeout: Duration.seconds(30),
+    })
+
+    // create a Lambda.FunctionUrl to be used in the CloudFront OriginRequestPolicy
+    // this will be used to trigger the function
+    this.cliSetupUrl = new lambda.FunctionUrl(scope, 'CliSetupFunctionUrl', {
+      function: cliSetupFunc,
+      authType: lambda.FunctionUrlAuthType.NONE,
+      cors: {
+        allowedOrigins: ['*'],
+      },
+    })
+
+    new Output(scope, 'CliSetupVanityUrl', {
+      value: `${this.cliSetupUrl.url}cli-setup`,
+    })
+
+    new Output(scope, 'CliSetupUrl', {
+      value: `https://${props.domain}/install`,
+      description: 'URL to trigger the CLI setup function',
+    })
+
+    // once deployed, need to create logic in the cdn origin request to check if the request is for the cli
+    // if it is, then we need the to use the function url as the origin
+    // if it is not, then we need don't adjust the origin
+  }
+}

package/src/cloud/compute.ts

@@ -0,0 +1,202 @@
+/* eslint-disable no-new */
+import type { aws_certificatemanager as acm, aws_efs as efs, aws_lambda as lambda, aws_route53 as route53 } from 'aws-cdk-lib'
+import { Duration, CfnOutput as Output, RemovalPolicy, aws_ec2 as ec2, aws_ecs as ecs, aws_secretsmanager as secretsmanager } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import { path as p } from '@stacksjs/path'
+import { env } from '@stacksjs/env'
+import { LogGroup } from 'aws-cdk-lib/aws-logs'
+import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2'
+import type { NestedCloudProps } from '../types'
+import type { EnvKey } from '../../../../env'
+
+export interface ComputeStackProps extends NestedCloudProps {
+  vpc: ec2.Vpc
+  fileSystem: efs.FileSystem
+  zone: route53.IHostedZone
+  certificate: acm.Certificate
+}
+
+export class ComputeStack {
+  lb: elbv2.ApplicationLoadBalancer
+  apiServer: lambda.Function
+  apiServerUrl: lambda.FunctionUrl
+
+  constructor(scope: Construct, props: ComputeStackProps) {
+    const vpc = props.vpc
+    const fileSystem = props.fileSystem
+
+    if (!fileSystem)
+      throw new Error('The file system is missing. Please make sure it was created properly.')
+
+    const cluster = new ecs.Cluster(scope, 'StacksCluster', {
+      clusterName: `${props.slug}-${props.appEnv}-web-server-cluster`,
+      vpc,
+    })
+
+    const taskDefinition = new ecs.FargateTaskDefinition(scope, 'TaskDefinition', {
+      family: `${props.appName}-${props.appEnv}-api`,
+      memoryLimitMiB: 512, // Match your Lambda memory size
+      cpu: 256, // Choose an appropriate value
+      runtimePlatform: {
+        cpuArchitecture: ecs.CpuArchitecture.ARM64,
+      },
+    })
+
+    const container = taskDefinition.addContainer('WebServerContainer', {
+      containerName: `${props.appName}-${props.appEnv}-api`,
+      image: ecs.ContainerImage.fromAsset(p.frameworkPath('server')),
+      logging: new ecs.AwsLogDriver({
+        streamPrefix: `${props.appName}-${props.appEnv}-web`,
+        logGroup: new LogGroup(scope, 'StacksApiLogs', {
+          logGroupName: '/ecs/stacks-api',
+          removalPolicy: RemovalPolicy.DESTROY, // Automatically remove logs on stack deletion
+        }),
+      }),
+      healthCheck: {
+        command: ['CMD-SHELL', 'curl -f http://localhost:3000/health || exit 1'],
+        interval: Duration.seconds(10),
+        timeout: Duration.seconds(5),
+        retries: 3,
+        startPeriod: Duration.seconds(10),
+      },
+    })
+
+    container.addPortMappings({
+      containerPort: 3000,
+      hostPort: 3000,
+    })
+
+    const serviceSecurityGroup = new ec2.SecurityGroup(scope, 'ServiceSecurityGroup', {
+      securityGroupName: `${props.appName}-${props.appEnv}-api-service-sg`,
+      vpc,
+      description: 'Stacks Security Group for API Service',
+    })
+
+    const publicLoadBalancerSG = new ec2.SecurityGroup(scope, 'PublicLoadBalancerSG', {
+      securityGroupName: `${props.appName}-${props.appEnv}-public-load-balancer-sg`,
+      vpc,
+      description: 'Access to the public facing load balancer',
+    })
+
+    // Assuming serviceSecurityGroup and publicLoadBalancerSG are already defined
+    serviceSecurityGroup.addIngressRule(
+      publicLoadBalancerSG,
+      ec2.Port.allTraffic(),
+      'Ingress from the public ALB',
+    )
+
+    // Assuming serviceSecurityGroup and publicLoadBalancerSG are already defined
+    serviceSecurityGroup.addIngressRule(publicLoadBalancerSG, ec2.Port.allTraffic(), 'Ingress from the public ALB')
+
+    this.lb = new elbv2.ApplicationLoadBalancer(scope, 'ApplicationLoadBalancer', {
+      loadBalancerName: `${props.appName}-${props.appEnv}-alb`,
+      vpc,
+      vpcSubnets: {
+        subnets: vpc.selectSubnets({
+          subnetType: ec2.SubnetType.PUBLIC,
+          onePerAz: true,
+        }).subnets,
+      },
+      internetFacing: true,
+      idleTimeout: Duration.seconds(30),
+      securityGroup: publicLoadBalancerSG,
+    })
+
+    const serviceTargetGroup = new elbv2.ApplicationTargetGroup(scope, 'ServiceTargetGroup', {
+      // targetGroupName: `${props.appName}-${props.appEnv}-service-tg`,
+      vpc,
+      targetType: elbv2.TargetType.IP,
+      protocol: elbv2.ApplicationProtocol.HTTP,
+      port: 3000,
+      healthCheck: {
+        interval: Duration.seconds(6),
+        path: '/',
+        protocol: elbv2.Protocol.HTTP,
+        timeout: Duration.seconds(5),
+        healthyThresholdCount: 2,
+        unhealthyThresholdCount: 10,
+      },
+    })
+
+    const service = new ecs.FargateService(scope, 'StacksApiService', {
+      serviceName: `${props.appName}-${props.appEnv}-api-service`,
+      cluster,
+      taskDefinition,
+      desiredCount: 2,
+      assignPublicIp: true,
+      maxHealthyPercent: 200,
+      vpcSubnets: vpc.selectSubnets({
+        subnetType: ec2.SubnetType.PUBLIC,
+        onePerAz: true,
+      }),
+      minHealthyPercent: 75,
+      securityGroups: [serviceSecurityGroup],
+    })
+
+    service.attachToApplicationTargetGroup(serviceTargetGroup)
+    publicLoadBalancerSG.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.allTraffic())
+
+    this.lb.addListener('HttpListener', {
+      port: 80,
+      defaultAction: elbv2.ListenerAction.forward([serviceTargetGroup]),
+    })
+
+    props.fileSystem.connections.allowFromAnyIpv4(ec2.Port.tcp(2049)) // port 2049 (NFS) for EFS
+
+    const volumeName = `${props.slug}-${props.appEnv}-efs`
+    taskDefinition.addVolume({
+      name: volumeName,
+      efsVolumeConfiguration: {
+        fileSystemId: props.fileSystem.fileSystemId,
+      },
+    })
+
+    container.addMountPoints({
+      sourceVolume: volumeName,
+      containerPath: '/mnt/efs',
+      readOnly: false,
+    })
+
+    // Setup AutoScaling policy
+    // TODO: make this configurable in cloud.compute
+    const scaling = service.autoScaleTaskCount({ maxCapacity: 2 })
+
+    scaling.scaleOnCpuUtilization('CpuScaling', {
+      targetUtilizationPercent: 50,
+      scaleInCooldown: Duration.seconds(60),
+      scaleOutCooldown: Duration.seconds(60),
+    })
+
+    scaling.scaleOnMemoryUtilization('MemoryScaling', {
+      targetUtilizationPercent: 60,
+      scaleInCooldown: Duration.seconds(60),
+      scaleOutCooldown: Duration.seconds(60),
+    })
+
+    const keysToRemove = ['_HANDLER', '_X_AMZN_TRACE_ID', 'AWS_REGION', 'AWS_EXECUTION_ENV', 'AWS_LAMBDA_FUNCTION_NAME', 'AWS_LAMBDA_FUNCTION_MEMORY_SIZE', 'AWS_LAMBDA_FUNCTION_VERSION', 'AWS_LAMBDA_INITIALIZATION_TYPE', 'AWS_LAMBDA_LOG_GROUP_NAME', 'AWS_LAMBDA_LOG_STREAM_NAME', 'AWS_ACCESS_KEY', 'AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_SESSION_TOKEN', 'AWS_LAMBDA_RUNTIME_API', 'LAMBDA_TASK_ROOT', 'LAMBDA_RUNTIME_DIR', '_']
+    keysToRemove.forEach(key => delete env[key as EnvKey])
+
+    const secrets = new secretsmanager.Secret(scope, 'StacksSecrets', {
+      secretName: `${props.slug}-${props.appEnv}-secrets`,
+      description: 'Secrets for the Stacks application',
+      generateSecretString: {
+        secretStringTemplate: JSON.stringify(env),
+        generateStringKey: Object.keys(env).join(',').length.toString(),
+      },
+    })
+
+    secrets.grantRead(service.taskDefinition.executionRole!)
+    container.addEnvironment('SECRETS_ARN', secrets.secretArn)
+
+    const apiPrefix = 'api'
+    new Output(scope, 'ApiUrl', {
+      value: `https://${props.domain}/${apiPrefix}`,
+      description: 'The URL of the deployed application',
+    })
+
+    new Output(scope, 'ApiVanityUrl', {
+      value: `http://${this.lb.loadBalancerDnsName}`,
+      description: 'The Vanity URL / DNS name of the load balancer',
+    })
+  }
+}