@swovohq/fuel 0.2.2-alpha.88 → 0.2.2-alpha.89

package/dist/infra-templates/modules/azure-redis-cache/outputs.tf

@@ -0,0 +1,15 @@
+output "hostname" {
+  value       = azurerm_managed_redis.this.hostname
+  description = "Hostname of the Azure Managed Redis instance"
+}
+
+output "ssl_port" {
+  value       = azurerm_managed_redis.this.default_database[0].port
+  description = "TLS port of the Azure Managed Redis instance"
+}
+
+output "primary_access_key" {
+  value       = azurerm_managed_redis.this.default_database[0].primary_access_key
+  sensitive   = true
+  description = "Primary access key for the Azure Managed Redis default database"
+}

package/dist/infra-templates/modules/azure-redis-cache/variables.tf

@@ -0,0 +1,30 @@
+variable "name" {
+  description = "Name of the Redis Enterprise cluster"
+  type        = string
+}
+
+variable "resource_group_name" {
+  description = "Name of the resource group where the Redis Enterprise cluster will be created"
+  type        = string
+}
+
+variable "location" {
+  description = "Azure region where the Redis Enterprise cluster will be created"
+  type        = string
+}
+
+variable "sku_name" {
+  description = "SKU name for the Redis Enterprise cluster (Azure Managed Redis 'Balanced' tier, e.g. Balanced_B0, Balanced_B1, Balanced_B5)"
+  type        = string
+  default     = "Balanced_B0"
+}
+
+variable "private_endpoint_subnet_id" {
+  description = "Subnet for the Private Link endpoint (non-delegated, network policies disabled)"
+  type        = string
+}
+
+variable "private_dns_zone_id" {
+  description = "Private DNS zone (privatelink.redis.azure.net) linked to the same VNet as private_endpoint_subnet_id"
+  type        = string
+}

package/dist/infra-templates/modules/azure-resource-group/main.tf

@@ -0,0 +1,5 @@
+resource "azurerm_resource_group" "this" {
+  name     = var.name
+  location = var.location
+  tags     = var.tags
+}

package/dist/infra-templates/modules/azure-resource-group/outputs.tf

@@ -0,0 +1,11 @@
+output "name" {
+  value = azurerm_resource_group.this.name
+}
+
+output "id" {
+  value = azurerm_resource_group.this.id
+}
+
+output "location" {
+  value = azurerm_resource_group.this.location
+}

package/dist/infra-templates/modules/azure-resource-group/variables.tf

@@ -0,0 +1,16 @@
+variable "name" {
+  type        = string
+  description = "Resource group name"
+}
+
+variable "location" {
+  type        = string
+  description = "Azure region"
+  default     = "eastus"
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Tags applied to the resource group"
+  default     = {}
+}

package/dist/infra-templates/modules/azure-sql-database/main.tf

@@ -0,0 +1,63 @@
+resource "random_password" "this" {
+  length           = 24
+  special          = true
+  override_special = "!#$%&*()-_=+[]{}<>:?"
+}
+
+locals {
+  effective_password = var.admin_password != "" ? var.admin_password : random_password.this.result
+}
+
+resource "azurerm_mssql_server" "this" {
+  name                         = var.server_name
+  resource_group_name          = var.resource_group_name
+  location                     = var.location
+  administrator_login          = var.admin_username
+  administrator_login_password = local.effective_password
+  version                      = "12.0"
+  minimum_tls_version          = "1.2"
+
+  public_network_access_enabled = false
+}
+
+resource "azurerm_private_endpoint" "this" {
+  name                = "${var.server_name}-pe"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  subnet_id           = var.private_endpoint_subnet_id
+
+  private_service_connection {
+    name                           = "${var.server_name}-psc"
+    private_connection_resource_id = azurerm_mssql_server.this.id
+    subresource_names              = ["sqlServer"]
+    is_manual_connection           = false
+  }
+
+  private_dns_zone_group {
+    name                 = "default"
+    private_dns_zone_ids = [var.private_dns_zone_id]
+  }
+}
+
+resource "azurerm_mssql_database" "this" {
+  name                        = var.database_name
+  server_id                   = azurerm_mssql_server.this.id
+  sku_name                    = var.sku_name
+  min_capacity                = var.min_capacity
+  auto_pause_delay_in_minutes = var.auto_pause_delay_in_minutes
+  storage_account_type        = var.storage_account_type
+
+  short_term_retention_policy {
+    retention_days = var.pitr_retention_days
+  }
+
+  # Azure rejects long-term retention on a serverless database while auto-pause is
+  # enabled (LtrConfigPolicyUnsupportedIfAutoPauseEnabled) — only apply LTR once
+  # auto-pause is explicitly disabled (-1), e.g. for provisioned prod databases.
+  dynamic "long_term_retention_policy" {
+    for_each = var.auto_pause_delay_in_minutes == -1 ? [1] : []
+    content {
+      weekly_retention = var.ltr_weekly_retention
+    }
+  }
+}

package/dist/infra-templates/modules/azure-sql-database/outputs.tf

@@ -0,0 +1,20 @@
+output "fqdn" {
+  value       = azurerm_mssql_server.this.fully_qualified_domain_name
+  description = "Fully qualified domain name of the SQL Server"
+}
+
+output "database_name" {
+  value       = azurerm_mssql_database.this.name
+  description = "Name of the SQL database"
+}
+
+output "admin_username" {
+  value       = var.admin_username
+  description = "Administrator username for the SQL Server"
+}
+
+output "admin_password" {
+  value       = local.effective_password
+  sensitive   = true
+  description = "Effective administrator password for the SQL Server"
+}

package/dist/infra-templates/modules/azure-sql-database/variables.tf

@@ -0,0 +1,78 @@
+variable "server_name" {
+  description = "Name of the Azure SQL Server. Must be globally unique."
+  type        = string
+}
+
+variable "database_name" {
+  description = "Name of the Azure SQL Database"
+  type        = string
+}
+
+variable "resource_group_name" {
+  description = "Name of the resource group where the SQL server will be created"
+  type        = string
+}
+
+variable "location" {
+  description = "Azure region where the SQL server will be created"
+  type        = string
+}
+
+variable "admin_username" {
+  description = "Administrator login for the SQL Server"
+  type        = string
+  default     = "sqladmin"
+}
+
+variable "admin_password" {
+  description = "Administrator password for the SQL Server. Leave empty to auto-generate."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "sku_name" {
+  description = "SKU name for the database (General Purpose Serverless, Standard-series Gen5)"
+  type        = string
+  default     = "GP_S_Gen5_4"
+}
+
+variable "min_capacity" {
+  description = "Minimum vCores the database will always have allocated, if not paused"
+  type        = number
+  default     = 0.5
+}
+
+variable "auto_pause_delay_in_minutes" {
+  description = "Time in minutes after which the database is automatically paused. Set to -1 to disable auto-pause — required for long_term_retention_policy to take effect (Azure disallows LTR on a serverless database with auto-pause enabled)."
+  type        = number
+  default     = 60
+}
+
+variable "storage_account_type" {
+  description = "Storage account type used to store backups. Valid values are Geo, GeoZone, Local, Zone (not to be confused with Storage Account LRS/GRS naming; 'Local' is the SQL backup equivalent of LRS)."
+  type        = string
+  default     = "Local"
+}
+
+variable "pitr_retention_days" {
+  description = "Point-in-time restore (short term retention) in days"
+  type        = number
+  default     = 20
+}
+
+variable "ltr_weekly_retention" {
+  description = "Long term retention weekly retention, in ISO 8601 format"
+  type        = string
+  default     = "P21W"
+}
+
+variable "private_endpoint_subnet_id" {
+  description = "Subnet for the Private Link endpoint (non-delegated, network policies disabled)"
+  type        = string
+}
+
+variable "private_dns_zone_id" {
+  description = "Private DNS zone (privatelink.database.windows.net) linked to the same VNet as private_endpoint_subnet_id"
+  type        = string
+}

package/dist/infra-templates/modules/azure-storage-account/main.tf

@@ -0,0 +1,13 @@
+# NOTE: the azurerm provider does not support `access_tier` on BlockBlobStorage
+# accounts (it's only valid for StorageV2/BlobStorage). We pass null in that
+# case so the attribute is omitted instead of failing a plan/apply.
+resource "azurerm_storage_account" "this" {
+  name                      = var.name
+  resource_group_name       = var.resource_group_name
+  location                  = var.location
+  account_kind              = var.account_kind
+  account_tier              = var.account_tier
+  account_replication_type  = var.account_replication_type
+  access_tier               = var.account_kind == "BlockBlobStorage" ? null : var.access_tier
+  min_tls_version           = "TLS1_2"
+}

package/dist/infra-templates/modules/azure-storage-account/outputs.tf

@@ -0,0 +1,16 @@
+output "id" {
+  value = azurerm_storage_account.this.id
+}
+
+output "name" {
+  value = azurerm_storage_account.this.name
+}
+
+output "primary_blob_endpoint" {
+  value = azurerm_storage_account.this.primary_blob_endpoint
+}
+
+output "primary_access_key" {
+  value     = azurerm_storage_account.this.primary_access_key
+  sensitive = true
+}

package/dist/infra-templates/modules/azure-storage-account/variables.tf

@@ -0,0 +1,38 @@
+variable "name" {
+  type        = string
+  description = "Storage account name (3-24 chars, lowercase alphanumeric). Not validated here; caller is responsible for compliance."
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "Resource group where the storage account is created"
+}
+
+variable "location" {
+  type        = string
+  description = "Azure region"
+}
+
+variable "account_kind" {
+  type        = string
+  description = "Storage account kind"
+  default     = "BlockBlobStorage"
+}
+
+variable "account_tier" {
+  type        = string
+  description = "Storage account tier. BlockBlobStorage kind only exists in the Premium tier."
+  default     = "Premium"
+}
+
+variable "account_replication_type" {
+  type        = string
+  description = "Storage account replication type"
+  default     = "LRS"
+}
+
+variable "access_tier" {
+  type        = string
+  description = "Storage account access tier (ignored for BlockBlobStorage, which does not support this attribute)"
+  default     = "Hot"
+}

package/dist/infra-templates/modules/cloud-watch/event-bridge.tf

@@ -0,0 +1,15 @@
+resource "aws_cloudwatch_event_rule" "ecs_deploy_events" {
+  count = var.ecs ? 1 : 0
+
+  name          = "${var.project_name}-ecs-deploy-events"
+  description   = "This rule is used to send notifications to Slack for success or failure in the deployment process"
+  event_pattern = jsonencode({
+    "source" : ["aws.ecs"],
+    "detail-type" : ["ECS Deployment State Change"],
+    "region" : [var.aws_region],
+    "detail" : {
+      "clusterArn": [var.ecs_cluster_id],
+      "eventName" : ["SERVICE_DEPLOYMENT_FAILED", "SERVICE_DEPLOYMENT_COMPLETED"]
+    }
+  })
+}

package/dist/infra-templates/modules/cloud-watch/lambda.tf

@@ -0,0 +1,84 @@
+resource "aws_iam_role" "lambda_execution_role" {
+  name = "lambda_execution_role_${var.project_name}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Action = "sts:AssumeRole",
+        Principal = {
+          Service = "lambda.amazonaws.com",
+        },
+        Effect = "Allow",
+      },
+    ],
+  })
+}
+
+resource "aws_lambda_function" "sns_to_slack" {
+  function_name = "snsToSlack-${var.project_name}"
+  handler       = "index.lambda_handler"
+  runtime       = "python3.9"
+  role          = aws_iam_role.lambda_execution_role.arn
+
+  filename         = "${path.module}/lambda_function.zip"
+  source_code_hash = filebase64sha256("${path.module}/lambda_function.zip")
+
+  environment {
+    variables = {
+      SLACK_WEBHOOK_URL = var.slack_webhook_url
+    }
+  }
+}
+
+resource "aws_lambda_permission" "sns" {
+  statement_id  = "AllowExecutionFromSNS"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.sns_to_slack.arn
+  principal     = "sns.amazonaws.com"
+  source_arn    = aws_sns_topic.rds_alarm_topic.arn
+}
+
+resource "aws_sns_topic_subscription" "lambda_subscription" {
+  topic_arn = aws_sns_topic.rds_alarm_topic.arn
+  protocol  = "lambda"
+  endpoint  = aws_lambda_function.sns_to_slack.arn
+}
+
+
+resource "aws_lambda_function" "sns_deploy_to_slack" {
+  count = var.ecs ? 1 : 0
+
+  function_name = "snsDeployInfoToSlack-${var.project_name}"
+  handler       = "index.handler"
+  runtime       = "nodejs22.x"
+  role             = aws_iam_role.lambda_execution_role.arn
+
+  filename         = "${path.module}/lambda_function_deploy.zip"
+  source_code_hash = filebase64sha256("${path.module}/lambda_function_deploy.zip")
+
+  environment {
+    variables = {
+      SLACK_WEBHOOK_URL = var.slack_webhook_url
+    }
+  }
+
+}
+
+resource "aws_cloudwatch_event_target" "trigger_lambda" {
+  count = var.ecs ? 1 : 0
+
+  rule      = aws_cloudwatch_event_rule.ecs_deploy_events[0].name
+  target_id = "SendToLambda"
+  arn       = aws_lambda_function.sns_deploy_to_slack[0].arn
+}
+
+resource "aws_lambda_permission" "allow_eventbridge" {
+  count = var.ecs ? 1 : 0
+
+  statement_id  = "AllowExecutionFromEventBridge"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.sns_deploy_to_slack[0].function_name
+  principal     = "events.amazonaws.com"
+  source_arn    = aws_cloudwatch_event_rule.ecs_deploy_events[0].arn
+}

package/dist/infra-templates/modules/cloud-watch/main.tf

@@ -0,0 +1,156 @@
+
+resource "aws_cloudwatch_metric_alarm" "high_cpu_utilization" {
+  alarm_name          = "high-cpu-utilization-${var.project_name}"
+  comparison_operator = "GreaterThanThreshold"
+  evaluation_periods  = "2"
+  metric_name         = "CPUUtilization"
+  namespace           = "AWS/RDS"
+  period              = "120"
+  statistic           = "Average"
+  threshold           = "70"
+  alarm_description   = "This metric monitors RDS CPU utilization"
+  actions_enabled     = true
+  alarm_actions       = [aws_sns_topic.rds_alarm_topic.arn]
+  dimensions = {
+    DBInstanceIdentifier = "${var.project_name}"
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "low_free_storage_space" {
+  alarm_name          = "low-free-storage-space-${var.project_name}"
+  comparison_operator = "LessThanThreshold"
+  evaluation_periods  = "1"
+  metric_name         = "FreeStorageSpace"
+  namespace           = "AWS/RDS"
+  period              = "300"
+  statistic           = "Average"
+  threshold           = "10000000000"
+  alarm_description   = "This metric monitors RDS free storage space"
+  actions_enabled     = true
+  alarm_actions       = [aws_sns_topic.rds_alarm_topic.arn]
+  dimensions = {
+    DBInstanceIdentifier = "${var.project_name}"
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "low_freeable_memory" {
+  alarm_name          = "low-freeable-memory-${var.project_name}"
+  comparison_operator = "LessThanThreshold"
+  evaluation_periods  = "1"
+  metric_name         = "FreeableMemory"
+  namespace           = "AWS/RDS"
+  period              = "300"
+  statistic           = "Average"
+  threshold           = 209715200
+  alarm_description   = "This metric monitors RDS freeable memory"
+  actions_enabled     = true
+  alarm_actions       = [aws_sns_topic.rds_alarm_topic.arn]
+  dimensions = {
+    DBInstanceIdentifier = "${var.project_name}"
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "high_database_connections" {
+  alarm_name          = "high-database-connections-${var.project_name}"
+  comparison_operator = "GreaterThanThreshold"
+  evaluation_periods  = "1"
+  metric_name         = "DatabaseConnections"
+  namespace           = "AWS/RDS"
+  period              = "300"
+  statistic           = "Average"
+  threshold           = "30"
+  alarm_description   = "This metric monitors RDS database connections"
+  actions_enabled     = true
+  alarm_actions       = [aws_sns_topic.rds_alarm_topic.arn]
+  dimensions = {
+    DBInstanceIdentifier = "${var.project_name}"
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "freespace" {
+  for_each = { for app in var.apps : app.app_name => app if app.postgres }
+  
+  actions_enabled     = true
+  alarm_name          = "FreeStorageSpace - ${each.value.app_name} - DB"
+  comparison_operator = "LessThanOrEqualToThreshold"
+  datapoints_to_alarm = 1
+
+  dimensions = {
+    DBInstanceIdentifier = each.value.app_name
+  }
+
+  evaluation_periods = 1
+  metric_name        = "FreeStorageSpace"
+  namespace          = "AWS/RDS"
+  period             = 300
+  statistic          = "Average"
+  threshold          = 30 * 0.1 * pow(1024, 3)
+  treat_missing_data = "missing"
+}
+
+resource "aws_cloudwatch_metric_alarm" "high-cpu" {
+  for_each = { for app in var.apps : app.app_name => app if app.postgres }
+  
+  actions_enabled     = "true"
+  alarm_name          = "High CPU Usage - ${each.value.app_name} -db"
+  comparison_operator = "GreaterThanThreshold"
+  datapoints_to_alarm = "1"
+
+  dimensions = {
+    DBInstanceIdentifier = each.value.app_name
+  }
+
+  evaluation_periods = "1"
+  metric_name        = "CPUUtilization"
+  namespace          = "AWS/RDS"
+  period             = "300"
+  statistic          = "Average"
+  threshold          = "90"
+  treat_missing_data = "missing"
+}
+
+
+resource "aws_cloudwatch_metric_alarm" "freeable_memory" {
+  for_each = { for app in var.apps : app.app_name => app if app.postgres }
+  
+  actions_enabled     = true
+  alarm_description   = "500Mb available for use"
+  alarm_name          = "High Memory Usage - ${each.value.app_name} - DB"
+  comparison_operator = "LessThanOrEqualToThreshold"
+  datapoints_to_alarm = 1
+
+  dimensions = {
+    DBInstanceIdentifier = each.value.app_name
+  }
+
+  evaluation_periods = 1
+  metric_name        = "FreeableMemory"
+  namespace          = "AWS/RDS"
+  period             = 60
+  statistic          = "Maximum"
+  threshold          = 500000000
+  treat_missing_data = "missing"
+}
+
+resource "aws_cloudwatch_metric_alarm" "readiops" {
+  for_each = { for app in var.apps : app.app_name => app if app.postgres }
+
+  actions_enabled     = true
+  alarm_name          = "ReadIOPS - ${each.value.app_name} - DB"
+  comparison_operator = "GreaterThanThreshold"
+  datapoints_to_alarm = 1
+
+  dimensions = {
+    DBInstanceIdentifier = each.value.app_name
+  }
+
+  evaluation_periods = 1
+  metric_name        = "ReadIOPS"
+  namespace          = "AWS/RDS"
+  period             = 300
+  statistic          = "Maximum"
+  threshold          = 1000
+  treat_missing_data = "missing"
+}
+
+

package/dist/infra-templates/modules/cloud-watch/sns.tf

@@ -0,0 +1,3 @@
+resource "aws_sns_topic" "rds_alarm_topic" {
+  name = "rds-alarm-topic-${var.project_name}"
+}

package/dist/infra-templates/modules/cloud-watch/variables.tf

@@ -0,0 +1,38 @@
+variable "project_name" {
+  description = "Repository name will be created based on project name"
+  default     = ""
+}
+
+variable "slack_webhook_url" {
+  description = "The Slack webhook URL for sending notifications"
+  type        = string
+  default     = "https://hooks.slack.com/services/YOUR_WORKSPACE_ID/YOUR_CHANNEL_ID/YOUR_WEBHOOK_TOKEN"
+}
+
+
+variable "aws_region" {
+  description = "Aws Region"
+  type        = string
+}
+
+variable "ecs_cluster_id" {
+  description = "cluster Arn"
+  default     = ""
+}
+
+variable "ecs" {
+  description = "Whether ECS resources are deployed"
+  type        = bool
+  default     = true
+}
+
+variable "apps" {
+  description = "An array of apps from config.json"
+  type = set(object({
+    app_name     = string
+    technology = string
+    dockerfile = optional(string)
+    build_env = optional(string)
+    postgres = optional(string)
+  }))
+}