@swovohq/fuel 0.2.2-alpha.86 → 0.2.2-alpha.88

package/schema/fuel.schema.json

@@ -1,158 +1,603 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "Fuel CLI Configuration",
-  "description": "Configuration file for Fuel CLI infrastructure provisioning (fuel.yml)",
-  "type": "object",
-  "required": ["name", "deployment", "ssl", "apps"],
-  "additionalProperties": false,
-  "properties": {
-    "name": {
-      "type": "string",
-      "minLength": 1,
-      "description": "Project name. Used as a prefix for all AWS and GitHub resources."
+  "oneOf": [
+    {
+      "$ref": "#/definitions/ecsConfig"
     },
-    "deployment": {
-      "type": "string",
-      "enum": ["ecs"],
-      "description": "Deployment target. Only 'ecs' is currently supported."
-    },
-    "ssl": {
-      "type": "string",
-      "minLength": 1,
-      "description": "ARN of the ACM SSL certificate (e.g. arn:aws:acm:us-east-1:123:certificate/abc)."
-    },
-    "slack_webhook_url": {
-      "type": "string",
-      "description": "Slack incoming webhook URL for deploy failure notifications. Leave empty to disable."
-    },
-    "apps": {
-      "type": "array",
-      "minItems": 1,
-      "description": "List of applications to deploy.",
-      "items": {
-        "$ref": "#/definitions/app"
-      }
+    {
+      "$ref": "#/definitions/azureConfig"
     }
-  },
+  ],
   "definitions": {
-    "worker": {
+    "ecsConfig": {
       "type": "object",
-      "required": ["name", "dockerfile"],
-      "additionalProperties": false,
       "properties": {
         "name": {
           "type": "string",
-          "minLength": 1,
-          "description": "Worker name. Used as the ECS service name."
+          "minLength": 1
         },
-        "dockerfile": {
+        "slack_webhook_url": {
+          "type": "string"
+        },
+        "github_repo_name": {
+          "description": "Name of the GitHub repository to create/use. Defaults to \"${name}-monorepo\". Set this explicitly when this fuel.yml should target a repo already used by another environment (e.g. a separate prod fuel.yml with its own `name` pointing at the same repo as dev).",
+          "type": "string"
+        },
+        "deployment": {
+          "type": "string",
+          "const": "ecs"
+        },
+        "ssl": {
           "type": "string",
           "minLength": 1,
-          "description": "Path to the worker's Dockerfile relative to the project root."
+          "description": "ACM certificate ARN attached to the ALB HTTPS listener, e.g. arn:aws:acm:us-east-1:ACCOUNT_ID:certificate/CERTIFICATE_ID."
+        },
+        "apps": {
+          "minItems": 1,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ecsApp"
+          }
         }
-      }
+      },
+      "required": [
+        "name",
+        "deployment",
+        "ssl",
+        "apps"
+      ],
+      "additionalProperties": {}
     },
-    "app": {
+    "ecsApp": {
       "type": "object",
-      "required": ["name", "technology", "dockerfile", "health_check_path", "domain", "port"],
-      "additionalProperties": false,
       "properties": {
         "name": {
           "type": "string",
-          "minLength": 1,
-          "description": "App name. Used as the ECS service and task definition name."
+          "minLength": 1
         },
         "technology": {
           "type": "string",
-          "enum": ["nest", "react"],
-          "description": "Application technology: 'nest' for NestJS API, 'react' for React/Next.js frontend."
+          "minLength": 1,
+          "description": "Application role/framework. 'nest' and 'react' get framework-specific env var injection (see docs); any other value deploys as a plain container with no extra env vars — pass everything explicitly via variables/build_env."
         },
         "dockerfile": {
           "type": "string",
-          "minLength": 1,
-          "description": "Path to the Dockerfile relative to the project root."
+          "minLength": 1
         },
         "health_check_path": {
           "type": "string",
-          "minLength": 1,
-          "description": "HTTP path for ALB health checks (e.g. /health)."
+          "minLength": 1
         },
         "domain": {
           "type": "string",
-          "minLength": 1,
-          "description": "Domain name for this app (e.g. api.example.com)."
+          "minLength": 1
         },
         "port": {
           "type": "integer",
-          "minimum": 1,
-          "description": "Container port the app listens on."
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
         },
         "branch": {
-          "type": "string",
           "default": "main",
-          "description": "Git branch that triggers deployment for this app."
+          "type": "string"
         },
         "template_repo_branch": {
-          "type": "string",
           "default": "main",
-          "description": "Branch of the template repository to use for scaffolding."
+          "type": "string"
         },
         "postgres": {
-          "type": "boolean",
           "default": false,
-          "description": "Provision an RDS PostgreSQL instance for this app."
+          "description": "Provision an RDS PostgreSQL instance for this app.",
+          "type": "boolean"
         },
         "redis": {
-          "type": "boolean",
           "default": false,
-          "description": "Provision an ElastiCache Redis cluster for this app."
+          "description": "Provision an ElastiCache Redis instance for this app.",
+          "type": "boolean"
         },
         "variables": {
-          "type": "object",
-          "additionalProperties": { "type": "string" },
           "default": {},
-          "description": "Runtime environment variables injected into the ECS task."
+          "type": "object",
+          "propertyNames": {
+            "type": "string"
+          },
+          "additionalProperties": {
+            "type": "string"
+          }
         },
         "build_env": {
-          "type": "object",
-          "additionalProperties": { "type": "string" },
           "default": {},
-          "description": "Build-time arguments passed to Docker build (e.g. NEXT_PUBLIC_API_HOST)."
+          "type": "object",
+          "propertyNames": {
+            "type": "string"
+          },
+          "additionalProperties": {
+            "type": "string"
+          }
         },
         "workers": {
-          "type": "array",
           "default": [],
-          "description": "Background worker processes for this app.",
+          "type": "array",
           "items": {
             "$ref": "#/definitions/worker"
           }
         },
         "cpu_units": {
-          "type": "integer",
-          "minimum": 1,
           "default": 1024,
-          "description": "CPU units for the ECS task (1024 = 1 vCPU)."
+          "description": "ECS task CPU units (1024 = 1 vCPU).",
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
         },
         "memory_units": {
-          "type": "integer",
-          "minimum": 1,
           "default": 2048,
-          "description": "Memory in MB for the ECS task."
+          "description": "ECS task memory in MB.",
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
         },
         "db_instance_type": {
-          "type": "string",
-          "description": "RDS instance type (e.g. db.t3.small). Only used when postgres is true."
+          "description": "RDS instance type, e.g. db.t3.small. Only used when postgres is true.",
+          "type": "string"
         },
         "db_allocated_storage": {
+          "description": "RDS allocated storage in GB. Only used when postgres is true.",
           "type": "integer",
-          "minimum": 1,
-          "description": "RDS storage in GB. Only used when postgres is true."
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
         },
         "redis_instance_type": {
+          "description": "ElastiCache node type, e.g. cache.t3.small. Only used when redis is true.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "technology",
+        "dockerfile",
+        "health_check_path",
+        "domain",
+        "port",
+        "branch",
+        "template_repo_branch",
+        "postgres",
+        "redis",
+        "variables",
+        "build_env",
+        "workers",
+        "cpu_units",
+        "memory_units"
+      ],
+      "additionalProperties": {}
+    },
+    "worker": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Worker name. Used as the ECS service name / Container App name depending on deployment."
+        },
+        "dockerfile": {
           "type": "string",
-          "description": "ElastiCache node type (e.g. cache.t3.small). Only used when redis is true."
+          "minLength": 1,
+          "description": "Path to the worker's Dockerfile relative to the project root."
+        }
+      },
+      "required": [
+        "name",
+        "dockerfile"
+      ],
+      "additionalProperties": {}
+    },
+    "azureConfig": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1
+        },
+        "slack_webhook_url": {
+          "type": "string"
+        },
+        "github_repo_name": {
+          "description": "Name of the GitHub repository to create/use. Defaults to \"${name}-monorepo\". Set this explicitly when this fuel.yml should target a repo already used by another environment (e.g. a separate prod fuel.yml with its own `name` pointing at the same repo as dev).",
+          "type": "string"
+        },
+        "deployment": {
+          "type": "string",
+          "const": "azure"
+        },
+        "location": {
+          "default": "eastus2",
+          "description": "Azure region for all resources.",
+          "type": "string"
+        },
+        "monitor": {
+          "default": {
+            "daily_data_cap_gb": 1,
+            "retention_days": 90,
+            "dashboard_count": 0
+          },
+          "description": "Application Insights / Log Analytics settings shared across all apps.",
+          "type": "object",
+          "properties": {
+            "daily_data_cap_gb": {
+              "default": 1,
+              "type": "number",
+              "exclusiveMinimum": 0
+            },
+            "retention_days": {
+              "default": 90,
+              "type": "integer",
+              "exclusiveMinimum": 0,
+              "maximum": 9007199254740991
+            },
+            "dashboard_count": {
+              "default": 0,
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 9007199254740991
+            }
+          },
+          "required": [
+            "daily_data_cap_gb",
+            "retention_days",
+            "dashboard_count"
+          ],
+          "additionalProperties": {}
+        },
+        "front_door": {
+          "default": {
+            "sku_name": "Standard_AzureFrontDoor"
+          },
+          "type": "object",
+          "properties": {
+            "sku_name": {
+              "default": "Standard_AzureFrontDoor",
+              "type": "string",
+              "const": "Standard_AzureFrontDoor"
+            }
+          },
+          "required": [
+            "sku_name"
+          ],
+          "additionalProperties": {}
+        },
+        "storage_account": {
+          "default": {
+            "account_kind": "BlockBlobStorage",
+            "account_tier": "Premium",
+            "account_replication_type": "LRS",
+            "access_tier": "Hot"
+          },
+          "description": "Shared app storage account, used for app file uploads (not the Terraform state storage account).",
+          "type": "object",
+          "properties": {
+            "account_kind": {
+              "default": "BlockBlobStorage",
+              "type": "string",
+              "const": "BlockBlobStorage"
+            },
+            "account_tier": {
+              "default": "Premium",
+              "type": "string",
+              "const": "Premium"
+            },
+            "account_replication_type": {
+              "default": "LRS",
+              "type": "string",
+              "const": "LRS"
+            },
+            "access_tier": {
+              "default": "Hot",
+              "type": "string",
+              "const": "Hot"
+            }
+          },
+          "required": [
+            "account_kind",
+            "account_tier",
+            "account_replication_type",
+            "access_tier"
+          ],
+          "additionalProperties": {}
+        },
+        "key_vault": {
+          "default": {
+            "sku_name": "standard"
+          },
+          "type": "object",
+          "properties": {
+            "sku_name": {
+              "default": "standard",
+              "type": "string",
+              "const": "standard"
+            }
+          },
+          "required": [
+            "sku_name"
+          ],
+          "additionalProperties": {}
+        },
+        "github_oidc": {
+          "default": {
+            "enabled": true,
+            "manage_role_assignment": true
+          },
+          "description": "GitHub Actions OIDC identity used to push images and redeploy Container Apps.",
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "default": true,
+              "description": "Set to false to skip GitHub Actions OIDC entirely — no app registration, no role assignment for CI. Use this to unblock testing the rest of the stack while waiting on a tenant admin.",
+              "type": "boolean"
+            },
+            "existing_client_id": {
+              "description": "Client ID of an app registration + service principal + federated identity credential(s) already created out-of-band by a tenant admin. Set this when the deploying SP lacks the Entra ID \"Application Administrator\" role (creating an app registration requires it, regardless of subscription-level RBAC) — the module then reuses that identity instead of creating a new one. The Contributor role assignment is still managed by Terraform either way, since that only needs \"User Access Administrator\" on the subscription.",
+              "type": "string"
+            },
+            "existing_principal_id": {
+              "description": "Object ID (principal ID) of the service principal identified by existing_client_id, when already known. Strongly recommended whenever existing_client_id is set: without it, Terraform looks the object ID up via Microsoft Graph, which needs Directory.Read.All or Application.Read.All on the deploying SP — permissions many tenant admins won't grant just to resolve one known object. Whoever created the app out-of-band can get this by running `az ad sp show --id <existing_client_id> --query id -o tsv`.",
+              "type": "string"
+            },
+            "manage_role_assignment": {
+              "default": true,
+              "description": "Whether Terraform should create/manage the Contributor role assignment for this identity. Set to false when it was already granted out-of-band alongside existing_client_id (e.g. a tenant admin's onboarding runbook already ran the role assignment) — otherwise Terraform tries to create it again on every apply and fails with RoleAssignmentExists.",
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "enabled",
+            "manage_role_assignment"
+          ],
+          "additionalProperties": {}
+        },
+        "apps": {
+          "minItems": 1,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/azureApp"
+          }
+        }
+      },
+      "required": [
+        "name",
+        "deployment",
+        "location",
+        "monitor",
+        "front_door",
+        "storage_account",
+        "key_vault",
+        "github_oidc",
+        "apps"
+      ],
+      "additionalProperties": {}
+    },
+    "azureApp": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1
+        },
+        "technology": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Application role/framework. 'nest' and 'react' get framework-specific env var injection (see docs); any other value deploys as a plain Container App with no extra env vars — pass everything explicitly via variables/build_env."
+        },
+        "dockerfile": {
+          "type": "string",
+          "minLength": 1
+        },
+        "health_check_path": {
+          "type": "string",
+          "minLength": 1
+        },
+        "domain": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Custom domain for this app. A managed TLS certificate is issued automatically via Front Door once DNS validation completes (see the custom_domain_validation deploy output)."
+        },
+        "port": {
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
+        },
+        "branch": {
+          "default": "main",
+          "type": "string"
+        },
+        "template_repo_branch": {
+          "default": "main",
+          "type": "string"
+        },
+        "variables": {
+          "default": {},
+          "type": "object",
+          "propertyNames": {
+            "type": "string"
+          },
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "build_env": {
+          "default": {},
+          "type": "object",
+          "propertyNames": {
+            "type": "string"
+          },
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "workers": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/worker"
+          }
+        },
+        "database": {
+          "default": {
+            "enabled": false,
+            "engine": "mssql",
+            "storage_account_type": "Local",
+            "pitr_retention_days": 20,
+            "ltr_weekly_retention": "P21W"
+          },
+          "description": "Azure SQL Database or PostgreSQL Flexible Server for this app.",
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "default": false,
+              "type": "boolean"
+            },
+            "engine": {
+              "default": "mssql",
+              "description": "Database engine: 'mssql' provisions Azure SQL Database, 'postgres' provisions Azure Database for PostgreSQL Flexible Server.",
+              "type": "string",
+              "enum": [
+                "mssql",
+                "postgres"
+              ]
+            },
+            "sku_name": {
+              "description": "SKU name — e.g. GP_S_Gen5_4 for mssql, GP_Standard_D4s_v3 for postgres.",
+              "type": "string"
+            },
+            "storage_account_type": {
+              "default": "Local",
+              "description": "Backup storage redundancy (mssql only).",
+              "type": "string",
+              "enum": [
+                "Local",
+                "Zone",
+                "Geo",
+                "GeoZone"
+              ]
+            },
+            "pitr_retention_days": {
+              "default": 20,
+              "description": "Point-in-time restore retention in days (mssql only).",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 35
+            },
+            "ltr_weekly_retention": {
+              "default": "P21W",
+              "description": "Long-term retention ISO 8601 duration, e.g. P21W (mssql only).",
+              "type": "string"
+            },
+            "allocated_storage_mb": {
+              "description": "Allocated storage in MB (postgres only).",
+              "type": "integer",
+              "exclusiveMinimum": 0,
+              "maximum": 9007199254740991
+            }
+          },
+          "required": [
+            "enabled",
+            "engine",
+            "storage_account_type",
+            "pitr_retention_days",
+            "ltr_weekly_retention"
+          ],
+          "additionalProperties": {}
+        },
+        "redis": {
+          "default": {
+            "enabled": false,
+            "sku_name": "Balanced_B0"
+          },
+          "description": "Azure Managed Redis for this app.",
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "default": false,
+              "type": "boolean"
+            },
+            "sku_name": {
+              "default": "Balanced_B0",
+              "description": "Azure Managed Redis 'Balanced' tier SKU, e.g. Balanced_B0, Balanced_B1, Balanced_B5.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "enabled",
+            "sku_name"
+          ],
+          "additionalProperties": {}
+        },
+        "container_app": {
+          "default": {
+            "cpu": 1,
+            "memory": "2Gi",
+            "concurrent_requests": 20,
+            "min_replicas": 0,
+            "max_replicas": 3
+          },
+          "description": "Azure Container Apps (Consumption plan) sizing. Every app runs as a Container App.",
+          "type": "object",
+          "properties": {
+            "cpu": {
+              "default": 1,
+              "type": "number",
+              "exclusiveMinimum": 0
+            },
+            "memory": {
+              "default": "2Gi",
+              "description": "CPU:memory ratio is fixed at 1:2 by the platform.",
+              "type": "string"
+            },
+            "concurrent_requests": {
+              "default": 20,
+              "description": "HTTP concurrency threshold that triggers scale-out.",
+              "type": "integer",
+              "exclusiveMinimum": 0,
+              "maximum": 9007199254740991
+            },
+            "min_replicas": {
+              "default": 0,
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 9007199254740991
+            },
+            "max_replicas": {
+              "default": 3,
+              "type": "integer",
+              "exclusiveMinimum": 0,
+              "maximum": 9007199254740991
+            }
+          },
+          "required": [
+            "cpu",
+            "memory",
+            "concurrent_requests",
+            "min_replicas",
+            "max_replicas"
+          ],
+          "additionalProperties": {}
         }
-      }
+      },
+      "required": [
+        "name",
+        "technology",
+        "dockerfile",
+        "health_check_path",
+        "domain",
+        "port",
+        "branch",
+        "template_repo_branch",
+        "variables",
+        "build_env",
+        "workers",
+        "database",
+        "redis",
+        "container_app"
+      ],
+      "additionalProperties": {}
     }
   }
 }