@swovohq/fuel 0.2.2-alpha.87 → 0.2.2-alpha.89

package/dist/infra-templates/templates/azure/workflows/build_and_deploy.yml

@@ -0,0 +1,155 @@
+name: Deploy REPLACEME image
+
+on:
+  push:
+    branches:
+      - BRANCHREPLACE
+    paths:
+      - PATHSREPLACE
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: true
+
+env:
+  DEPLOY_ENV: ${{ github.ref_name == 'main' && 'production' || github.ref_name == 'staging' && 'staging' || github.ref_name == 'dev' && 'development' }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    if: github.ref == 'refs/heads/BRANCHREPLACE'
+    permissions:
+      id-token: write
+      contents: read
+      deployments: write
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set Outputs
+        id: vars
+        run: echo "::set-output name=sha_short::$(git rev-parse --short HEAD)"
+
+      - name: Azure Login (OIDC)
+        uses: azure/login@v2
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Log in to Azure Container Registry
+        run: az acr login --name ACR_NAME
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push REPLACEME image
+        uses: docker/build-push-action@v7
+        env:
+          ACR_REGISTRY: ${{ secrets.ACR_LOGIN_SERVER }}
+          IMAGE_SHA: ${{ steps.vars.outputs.sha_short }}
+        with:
+          context: ./
+          file: DOCKERFILE
+          push: true
+          tags: ${{ env.ACR_REGISTRY }}/REPLACEME:${{ steps.vars.outputs.sha_short }}
+          build-args: |
+            BUILDARGS
+
+      - name: Start GitHub Deployment
+        uses: bobheadxi/deployments@v1
+        id: deployment-start
+        with:
+          step: start
+          token: ${{ secrets.GITHUB_TOKEN }}
+          env: ${{ env.DEPLOY_ENV }}
+          ref: ${{ github.sha }}
+          desc: "Deploying REPLACEME image to Azure Container Apps"
+
+      - name: Configure ACR pull credential
+        # Not set by Terraform on purpose — at first `tofu apply` this Container App's
+        # system-assigned identity doesn't have AcrPull yet (that role assignment needs
+        # the identity to exist first), so configuring the registry at create time made
+        # Azure hang validating it. Safe to re-run every deploy (idempotent).
+        run: |
+          az containerapp registry set \
+            --name CONTAINER_APP_NAME \
+            --resource-group RESOURCE_GROUP \
+            --server ${{ secrets.ACR_LOGIN_SERVER }} \
+            --identity system
+
+      - name: Deploy new revision to Container Apps
+        run: |
+          az containerapp update \
+            --name CONTAINER_APP_NAME \
+            --resource-group RESOURCE_GROUP \
+            --image ${{ secrets.ACR_LOGIN_SERVER }}/REPLACEME:${{ steps.vars.outputs.sha_short }}
+
+      - name: Finish GitHub Deployment
+        if: always() # Ensures this runs even if previous step fails
+        uses: bobheadxi/deployments@v1
+        with:
+          step: finish
+          token: ${{ secrets.GITHUB_TOKEN }}
+          env: ${{ env.DEPLOY_ENV }}
+          status: ${{ job.status }}
+          deployment_id: ${{ steps.deployment-start.outputs.deployment_id }}
+
+  notify-slack:
+    needs: build
+    runs-on: ubuntu-latest
+    if: failure()
+    steps:
+      - name: Send Slack Notification on Failure
+        uses: slackapi/slack-github-action@v1.26.0
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "header",
+                  "text": {
+                    "type": "plain_text",
+                    "text": "🚨 Workflow Failed: `${{ github.workflow }}`"
+                  }
+                },
+                {
+                  "type": "section",
+                  "fields": [
+                    {
+                      "type": "mrkdwn",
+                      "text": "*Repository:*\n<${{ github.server_url }}/${{ github.repository }}|${{ github.repository }}>"
+                    },
+                    {
+                      "type": "mrkdwn",
+                      "text": "*Branch:*\n`${{ github.ref_name }}`"
+                    },
+                    {
+                      "type": "mrkdwn",
+                      "text": "*Triggered by:*\n`${{ github.triggering_actor }}`"
+                    }
+                  ]
+                },
+                {
+                  "type": "actions",
+                  "elements": [
+                    {
+                      "type": "button",
+                      "text": {
+                        "type": "plain_text",
+                        "text": "View Workflow Run"
+                      },
+                      "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+                      "style": "danger"
+                    }
+                  ]
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

package/dist/infra-templates/templates/azure/workflows/tests.yml

@@ -0,0 +1,63 @@
+# This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests across different versions of node
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-nodejs
+
+name: CI tests
+
+on:
+  push:
+    branches:
+      - '*' 
+      - '!workflow-creation' 
+  pull_request:
+    branches:
+      - '*' 
+      - '!workflow-creation'  
+
+env:
+  REDIS_URL: ""
+  DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/postgres"
+  SECRET_KEY_BASE: "xx"
+  NODE_OPTIONS: --max-old-space-size=8192
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./
+
+    # Service containers to run with `container-job`
+    services:
+      # Label used to access the service container
+      postgres:
+        # Docker Hub image
+        image: postgres:16
+        # Provide the password for postgres
+        env:
+          POSTGRES_PASSWORD: postgres
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          # Maps tcp port 5432 on service container to the host
+          - 5432:5432
+
+    strategy:
+      matrix:
+        node-version: [lts/*]
+        # ruby-version: ['3.3.1']
+        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
+
+    steps:
+    - uses: actions/checkout@v7
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v6
+      with:
+        node-version: ${{ matrix.node-version }}
+    - run: yarn install
+    - run: yarn lint
+    - run: yarn test

package/dist/infra-templates/templates/ecs/README.md

@@ -0,0 +1,225 @@
+
+# 🌍 Terraform Project: Infrastructure Setup
+
+This Terraform project is designed to first create a centralized secret in AWS Secrets Manager, which serves as the foundation for provisioning the rest of the infrastructure.
+
+## ✅ Prerequisites
+
+Before you begin, ensure the following:
+
+- [Terraform](https://www.terraform.io/downloads.html) is installed and available in your `PATH`
+- AWS CLI is configured with appropriate credentials and region
+- Permissions for creating the environment
+   - AmazonECS_FullAccess
+   - AmazonElastiCacheFullAccess
+   - AmazonRDSFullAccess
+   - AmazonS3FullAccess
+   - AWSCloudTrail_FullAccess
+   - AWSCodeBuildAdminAccess
+   - AWSCodePipeline_FullAccess
+   - CloudWatchFullAccessV2
+   - IAMFullAccess
+
+### 🌐 Creating an ACM Certificate for Your Domain
+
+To deploy secure resources using the Infrastructure Automation Script, follow these steps to create an ACM certificate for your domain:
+
+1. **Log in to AWS Console**: Sign in to your AWS Management Console using your AWS account credentials.
+
+2. **Navigate to ACM**: Search for "ACM" in the AWS Management Console search bar and select the "AWS Certificate Manager" service.
+
+3. **Request a Certificate**:
+   - Click the "Request a certificate" button.
+   - Choose "Request a public certificate" and click "Next".
+
+4. **Add Domain Names**:
+   - In the "Add domain names" section, enter your domain name (e.g., `example.com`) and any subdomains you plan to use (e.g., `*.example.com`).
+   - Optionally, add additional domain names (SANs) if needed.
+   - Click "Next".
+
+5. **Validation**:
+   - Choose a validation method (e.g., DNS validation) to prove domain ownership.
+   - Follow the provided instructions to complete the validation process.
+
+6. **Review and Confirm**:
+   - Review the domain names and validation method you've selected.
+   - Click "Confirm and request" to submit your certificate request.
+
+7. **Certificate Issued**:
+   - Once validation is successful, the certificate status will change to "Issued".
+
+8. **Copy the ARN**:
+   - Click on the issued certificate to view its details.
+   - Copy the "Amazon Resource Name (ARN)" of the certificate and paste it into your `config.json` under the SSL session section.
+
+---
+
+### 📝 Additional Observations
+
+- **config.json Adjustments**: If you do not have the `config.json` file, please note that there are a few parameters that need to be manually adjusted:
+  - **FRONT_END_URL**: Ensure this is updated to the correct domain for your front-end application.
+  - **HOST_URL**: Similarly, this URL is currently pointing to Flatirons' domain, and you will need to change it to match your own domain.
+  - **ssl**: Copy the certificate arn from the previous step
+
+
+### 🌱  How to Modify app.json
+   
+##### 1. **SSL Certificate ARN**
+   - Replace the `"ssl"` field with the correct ARN for your SSL certificate, which you should have obtained through AWS Certificate Manager (ACM):
+   
+     ```json
+     "ssl": "arn:aws:acm:========================="
+     ```
+##### 2. **Access IP Range**
+   - Update the `"access_ip_range"` field to specify the IP range that can access your database. You can enter your IP address or any other IP range:
+   
+     ```json
+     "access_ip_range": "73.153.163.118/32"
+     ```
+
+##### 3. **Cognito API Key Header**
+   - Ensure the `"cognito_apikey_header"` field points to the header for API key authentication if you are using Cognito for authentication:
+   
+     ```json
+     "cognito_apikey_header": "x-api-key"
+     ```
+##### 4. **Slack Webhook URL**
+   - Provide your Slack Webhook URL to receive alarms. If you don't have one, you can use the default placeholder URL:
+   
+     ```json
+     "slack_webhook_url": "Enter webhook URL to receive alarms or set default value https://hooks.slack.com/services/YOUR_WORKSPACE_ID/YOUR_CHANNEL_ID/YOUR_WEBHOOK_TOKEN"
+     ```
+
+##### 5. **Environment Setup**
+   - Update the `"name"` field with your project name:
+   
+     ```json
+     "name": "your-project"
+     ```
+
+   - The `"deployment"` field specifies the deployment method (ecs or eks):
+   
+     ```json
+     "deployment": "ecs"
+     ```
+
+     Nota: This application only works with ecs
+
+##### 6. **Application Modules Configuration**
+   - Modify the `"modules"` field to set the options for the different modules you are using in your application. For instance:
+   
+     ```json
+     "modules": "[{'name': 'auth', 'options': {'two_factor': False, 'invitation_only': False, 'remove_sign_up_phone': False}}, {'name': 'team', 'options': {'remove': True}}, {'name': 'billing', 'options': {'remove_stripe': True}}, {'name': 'e2e', 'options': {'remove': True}}]"
+     ```
+
+##### 7. **Application Configurations for API and Web**
+   - Modify the application configuration under the `"apps"` section. For each app (e.g., `projectname-dev-api`, `projectname-staging-api`), update the following:
+     
+     - **Domain Name**: Set the domain for each app.
+     - **API Keys and Secrets**: Ensure all required API keys and secrets (like Snowflake, JWT) are correctly configured.
+     - **Environment Variables**: Update any specific environment variables (e.g., `HOST_URL`, `FRONT_END_URL`).
+
+   Example for the **dev API app**:
+   
+   ```json
+   "apps": [
+     {
+       "name": "projectname-dev-api",
+       "technology": "nest",
+       "dockerfile": "apps/api/Dockerfile",
+       "health_check_path": "/health",
+       "domain": "projectname-dev-api.******.com",
+       "port": 3000,
+       "cognito": false,
+       "postgres": false,
+       "redis": false,
+       "variables": {
+         "NODE_TLS_REJECT_UNAUTHORIZED": 0,
+         "API_KEY_HEADER": "x-api-key",
+         "ENCRYPTION_PASSWORD": "xxxxxxxxxxxxxxx",
+         "HOST_URL": "https://projectname-dev-api.****.com",
+         "FRONT_END_URL": "https://projectname-dev.******.com",
+         "APP_NAME": "AppName",
+         "APP_COMPANY": "Flatirons",
+         "ADMIN_JS_EMAIL": "admin@flatirons.com",
+         "ADMIN_JS_PASSWORD": "xxxxxxxxxxxxxxxxx!!!"
+       }
+     }
+   ]
+   ```
+---
+
+## 🚀 Usage
+
+### 1. Verify Terraform Installation
+
+Make sure Terraform is correctly installed by running the following command:
+
+```bash
+terraform -v
+```
+
+### 2. Initialize and Create the Centralized Secret
+
+To begin, initialize the project and apply the `secret-main` module to create the centralized secret. This step is required only once, unless the secret is already created.
+Note: For this step the config.json file is mandatory, please request it from the project administrator and place it at the root of the project directory
+
+Region=fill your region below (if it is different from us-east-1)
+```bash
+cd modules/secret-main
+terraform init -backend-config="region=us-east-1"
+terraform plan
+terraform apply
+```
+
+### 3. Apply the Full Infrastructure
+
+After the centralized secret is in place, proceed to initialize and apply the full infrastructure:
+
+Region=fill your region below (if it is different from us-east-1)
+```bash
+terraform init -backend-config="region=us-east-1"
+terraform plan
+terraform apply
+```
+
+---
+
+## 📁 Project Structure
+
+```bash
+.
+├── modules/                        # ALL Terraform Modules
+│   └── secret-main/        # Module for creating the centralized secret
+├── main.tf                         # Main Terraform entrypoint
+├── variables.tf                    # Input variable definitions
+├── outputs.tf                      # Output values
+├── providers.tf                    # Provider settings
+├── locals.tf                    # Provider settings
+└── README.md                       # Project documentation
+```
+
+---
+
+## 🔐 Security Considerations
+
+- **Never hardcode secrets**: Use variables and Secrets Manager for sensitive data.
+- **Restrict access**: Implement AWS IAM policies to control who can access the centralized secret.
+- **Remote state encryption**: Ensure remote state is encrypted, especially when using shared backends like S3.
+
+---
+
+## 🧹 Clean Up
+
+To destroy all infrastructure and resources, run the following command:
+
+```bash
+terraform destroy
+```
+
+To only destroy the centralized secret:
+
+```bash
+cd modules/secret-main
+terraform destroy
+```

package/dist/infra-templates/templates/ecs/backend.tf

@@ -0,0 +1,7 @@
+terraform {
+  backend "s3" {
+    bucket = "{project_name}-infrastructure-tf-{unique_suffix}"
+    key    = "terraform.tfstate"
+    region = "{aws_region}"
+  }
+}

package/dist/infra-templates/templates/ecs/data.tf

@@ -0,0 +1,6 @@
+data "aws_caller_identity" "current" {
+}
+
+data "aws_secretsmanager_secret_version" "this" {
+  secret_id = "${var.project_name}-infrastructure-variables"
+}

package/dist/infra-templates/templates/ecs/default.tfvars

@@ -0,0 +1 @@
+access_ip_range       = ""

package/dist/infra-templates/templates/ecs/locals.tf

@@ -0,0 +1,97 @@
+locals {
+  credentials = yamldecode(
+    data.aws_secretsmanager_secret_version.this.secret_string
+  )
+  apps = yamldecode(
+    data.aws_secretsmanager_secret_version.this.secret_string
+  ).apps
+
+  # Sensitive variables per app — kept separate so they never leak into plan output
+  app_variables = { for i in local.apps : nonsensitive(i.name) => try(i.variables, {}) }
+
+  worker_list = nonsensitive(flatten([for i in local.apps: [
+    [for worker in try(i.workers, []): {
+      app_name:             i.name,
+      technology:           i.technology,
+      dockerfile:           worker.dockerfile,
+      worker_name:          worker.name,
+      branch:               i.branch,
+      template_repo_branch: i.template_repo_branch,
+      cpu_units:            try(i.cpu_units, var.cpu_units),
+      memory_units:         try(i.memory_units, var.memory_units),
+      build_env:            length(try(i.build_env, {})) > 0 ? join("\n            ", [for k, v in i.build_env : "${upper(k)}=${v}"]) : ""
+    }]
+  ]]))
+
+  app_list = nonsensitive([for i in local.apps :
+    {
+      app_name:             i.name,
+      technology:           i.technology,
+      port:                 i.port,
+      domain:               i.domain,
+      health_check_path:    i.health_check_path,
+
+      postgres:             try(i.postgres, false),
+      redis:                try(i.redis, false),
+      dockerfile:           i.dockerfile,
+      branch:               i.branch,
+      template_repo_branch: i.template_repo_branch,
+      db_instance_type:     try(i.db_instance_type, var.db_instance_type),
+      db_allocated_storage: try(i.db_allocated_storage, var.db_allocated_storage),
+      cpu_units:            try(i.cpu_units, var.cpu_units),
+      memory_units:         try(i.memory_units, var.memory_units),
+      redis_instance_type:  try(i.redis_instance_type, var.redis_instance_type),
+      build_env:            length(try(i.build_env, {})) > 0 ? join("\n            ", [for k, v in i.build_env : "${upper(k)}=${v}"]) : ""
+      build_env_map:        try(i.build_env, {})
+
+    }
+  ])
+
+  env_vars = {
+    for app in local.app_list :
+    app.app_name => merge(
+
+      app.technology == "react" ? {
+        NEXT_PUBLIC_API_HOST = app.build_env_map["NEXT_PUBLIC_API_HOST"]
+      } : {},
+
+      app.technology == "nest" ? {
+        NODE_TLS_REJECT_UNAUTHORIZED = "0"
+        API_KEY_HEADER               = "x-api-key"
+        ENCRYPTION_PASSWORD          = module.random_key.value
+        HOST_URL                     = try(local.app_variables[app.app_name].host_url, "https://${app.domain}")
+        FRONT_END_URL                = try(local.app_variables[app.app_name].front_end_url, "https://${app.app_name}")
+        APP_NAME                     = "Fuel App"
+        APP_COMPANY                  = try(local.app_variables[app.app_name].app_company, "Swovo")
+        AWS_ACCESS_KEY_ID            = var.aws_access_key_id
+        AWS_SECRET_ACCESS_KEY        = var.aws_secret_access_key
+      } : {},
+
+
+      app.redis == true ? {
+        REDIS_URL = "redis://${module.redis[app.app_name].elasticache_cluster_hostname}:6379/0"
+      } : {},
+
+      app.postgres == true ? {
+        DATABASE_PORT     = "5432"
+        DATABASE_USERNAME = var.db_username
+        DATABASE_PASSWORD = module.database[app.app_name].db_password
+        DATABASE_NAME     = var.db_name
+        DATABASE_HOST = split(":", module.database[app.app_name].db_hostname)[0]
+        DATABASE_URL      = "postgresql://${var.db_username}:${module.database[app.app_name].db_password}@${module.database[app.app_name].db_hostname}/${var.db_name}"
+      } : {},
+
+      contains(["react", "nest"], app.technology) ? {
+        NODE_OPTIONS = "--max-old-space-size=${floor(app.memory_units * 0.75)}"
+      } : {},
+
+      length(try(local.app_variables[app.app_name], {})) > 0 ? {
+        for k, v in local.app_variables[app.app_name] : upper(k) => v
+      } : {}
+    )
+  }
+  secret_arns = {
+    for k, mod in module.secret_manager :
+    k => mod.secret_arn
+  }
+}