@swovohq/fuel 0.2.2-alpha.9 → 0.2.2-alpha.90

package/dist/infra-templates/templates/ecs/main.tf

@@ -0,0 +1,185 @@
+data "external" "oidc_check" {
+  program = ["bash", "-c", <<-EOT
+    OIDC_ARN="arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/token.actions.githubusercontent.com"
+    if aws iam get-open-id-connect-provider --open-id-connect-provider-arn "$OIDC_ARN" >/dev/null 2>&1; then
+      echo "{\"exists\":\"true\",\"arn\":\"$OIDC_ARN\"}"
+    else
+      echo '{"exists":"false","arn":""}'
+    fi
+  EOT
+  ]
+}
+
+import {
+  for_each = data.external.oidc_check.result.exists == "true" ? toset([data.external.oidc_check.result.arn]) : toset([])
+  to       = module.github_oidc.aws_iam_openid_connect_provider.github
+  id       = each.value
+}
+
+module "github_oidc" {
+  source              = "../../modules/github-oidc-role"
+  project_name        = var.project_name
+  github_organization = var.github_organization
+  aws_account_id      = data.aws_caller_identity.current.account_id
+}
+
+module "iam" {
+  source       = "../../modules/iam"
+  project_name = var.project_name
+}
+
+module "redis" {
+  for_each = { for app in local.app_list : app.app_name => app if app.redis }
+  source        = "../../modules/redis"
+  vpc_id        = module.vpc.vpc_id
+  subnet_ids    = module.vpc.private_subnets
+  app_name  = each.value.app_name
+  node_type     = try(each.value.redis_instance_type)
+}
+
+module "vpc" {
+  source       = "../../modules/vpc"
+  project_name = var.project_name
+}
+
+module "s3" {
+  source       = "../../modules/simple-storage-service"
+  project_name = var.project_name
+}
+
+module "ecr" {
+  source       = "../../modules/elastic-container-registry"
+  project_name = var.project_name
+  apps = toset(local.app_list)
+  workers = toset(local.worker_list)
+}
+
+module "database" {
+  for_each = { for app in local.app_list : app.app_name => app if app.postgres }
+  source                     = "../../modules/relational-database-service"
+  app_name                   = each.value.app_name
+  db_instance_type           = try(each.value.db_instance_type)
+  db_allocated_storage       = try(each.value.db_allocated_storage)
+  allowed_ip_list            = var.access_ip_range
+  vpc_id                     = module.vpc.vpc_id
+  subnet_ids                 = module.vpc.public_subnets
+  vpc_security_group_default = module.vpc.default_security_group_id
+  db_username                = var.db_username
+  db_password                = var.db_password
+  db_name                = var.db_name
+}
+
+module "ecs_core" {
+  source = "../../modules/ecs-core"
+
+  log_group_name = var.project_name
+  aws_region = var.aws_region
+  ingress_ssl_arn = local.credentials.ssl
+  namespace = var.project_name
+  project_name = var.project_name
+  vpc_id                     = module.vpc.vpc_id
+  public_subnets                 = module.vpc.public_subnets
+  private_subnets                 = module.vpc.private_subnets
+  default_security_group_id = module.vpc.default_security_group_id
+  healthcheck_endpoint = "/health"
+  apps = toset(local.app_list)
+}
+
+module "secret_manager" {
+  for_each = { for app in local.app_list : "${app.app_name}-secrets" => app }
+  name = each.key
+  env_vars   = local.env_vars[each.value.app_name]
+  source = "../../modules/secret"
+}
+
+module "ecs_services" {
+  for_each = { for app in local.app_list : app.app_name => app }
+  source = "../../modules/ecs-service"
+
+  app_name = each.value.app_name
+  container_port = each.value.port
+  connect_to_alb = true
+  repository_url = "${module.ecr.repository_url}:${each.value.app_name}"
+  ecs_secret_arn = local.secret_arns["${each.value.app_name}-secrets"]
+  cpu_units = try(each.value.cpu_units)
+  memory = try(each.value.memory_units)
+
+  secret_name = "${each.value.app_name}-secrets"
+
+  aws_region = var.aws_region
+  default_security_group_id = module.vpc.default_security_group_id
+  ecs_task_execution_role_arn = module.ecs_core.ecs_task_execution_role_arn
+  ecs_task_role_arn = module.ecs_core.ecs_task_role_arn
+  ecs_log_group_name = module.ecs_core.ecs_log_group_name
+  ecs_cluster_id = module.ecs_core.ecs_cluster_id
+  ecs_cluster_name = module.ecs_core.ecs_cluster_name
+  ecs_container_security_group_id = module.ecs_core.ecs_container_security_group_id
+  private_subnets                 = module.vpc.private_subnets
+
+  aws_alb_target_group_arn = module.ecs_core.aws_alb_target_groups[each.key].arn
+  env_vars   = local.env_vars[each.value.app_name]
+}
+
+
+module "ecs_worker_services" {
+  for_each = { for app in local.worker_list : app.app_name => app }
+  source = "../../modules/ecs-service"
+
+  app_name = "${each.value.worker_name}"
+  connect_to_alb = false
+  repository_url = "${module.ecr.repository_url}:${each.value.worker_name}"
+  ecs_secret_arn = local.secret_arns["${each.value.app_name}-secrets"]
+  secret_name = "${each.value.app_name}-secrets"
+  cpu_units = try(each.value.cpu_units)
+  memory = try(each.value.memory_units)
+
+  aws_region = var.aws_region
+  default_security_group_id = module.vpc.default_security_group_id
+  ecs_task_execution_role_arn = module.ecs_core.ecs_task_execution_role_arn
+  ecs_task_role_arn = module.ecs_core.ecs_task_role_arn
+  ecs_log_group_name = module.ecs_core.ecs_log_group_name
+  ecs_cluster_id = module.ecs_core.ecs_cluster_id
+  ecs_cluster_name = module.ecs_core.ecs_cluster_name
+  ecs_container_security_group_id = module.ecs_core.ecs_container_security_group_id
+  private_subnets                 = module.vpc.private_subnets
+
+  aws_alb_target_group_arn = ""
+  env_vars   = local.env_vars[each.value.app_name]
+}
+
+module "random_key" {
+  source = "../../modules/random-key"
+  name   = "nest_encryption_password"
+}
+
+module "cloud-watch" {
+  source            = "../../modules/cloud-watch"
+  project_name      = var.project_name
+  slack_webhook_url = try(local.credentials.slack_webhook_url, "")
+  aws_region        = var.aws_region
+  ecs               = true
+  apps              = toset(local.app_list)
+  ecs_cluster_id    = module.ecs_core.ecs_cluster_id
+}
+
+data "external" "guardduty_check" {
+  program = ["bash", "-c", <<-EOT
+    DETECTOR_ID=$(aws guardduty list-detectors --query 'DetectorIds[0]' --output text 2>/dev/null)
+    if [ -n "$DETECTOR_ID" ] && [ "$DETECTOR_ID" != "None" ]; then
+      echo "{\"exists\":\"true\",\"id\":\"$DETECTOR_ID\"}"
+    else
+      echo '{"exists":"false","id":""}'
+    fi
+  EOT
+  ]
+}
+
+import {
+  for_each = data.external.guardduty_check.result.exists == "true" ? toset([data.external.guardduty_check.result.id]) : toset([])
+  to       = module.guardduty.aws_guardduty_detector.main
+  id       = each.value
+}
+
+module "guardduty" {
+  source = "../../modules/guardduty"
+}

package/dist/infra-templates/templates/ecs/outputs.tf

@@ -0,0 +1,42 @@
+output "elasticache_cluster_hostname" {
+  value = [{ for i in module.redis : "${i.app_name}" => "${i.elasticache_cluster_hostname}" }][0]
+}
+
+output "db_hostname" {
+  value = [{ for i in module.database : "${i.app_name}" => "${i.db_hostname}" }][0]
+}
+
+output "aws_region" {
+  value = "${var.aws_region}"
+}
+
+output "alb_dns" {
+  value = module.ecs_core.alb_dns
+}
+
+output "vpc_cidr_block" {
+  value = module.vpc.vpc_cidr_block
+}
+
+output "apps" {
+  value     = local.app_list
+  sensitive = true
+}
+
+output "workers" {
+  value     = local.worker_list
+  sensitive = true
+}
+
+output "ecr_url" {
+  value = module.ecr.repository_url
+}
+
+output "github_http_repo_url" {
+  value     = "https://github.com/${var.github_organization}/${var.github_repo_name}.git"
+  sensitive = true
+}
+
+output "oidc_role_arn" {
+  value = module.github_oidc.role_arn
+}

package/dist/infra-templates/templates/ecs/providers.tf

@@ -0,0 +1,21 @@
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 5.8.0"
+    }
+    kubectl = {
+      source  = "gavinbunney/kubectl"
+      version = "1.16.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.5.1"
+    }
+  }
+}
+
+provider "aws" {
+  region = var.aws_region
+}

package/dist/infra-templates/templates/ecs/variables.tf

@@ -0,0 +1,105 @@
+variable "project_name" {
+  description = "A unique name for your project. This will be used as part of resource names."
+  default     = ""
+}
+
+variable "access_ip_range" {
+  description = "The range of office IP range"
+  default     = ""
+}
+
+variable "default_security_group_id" {
+  description = "Default security group ID"
+  default     = ""
+}
+
+variable "vpc_id" {
+  description = "ID of the VPC for the ECS cluster"
+  default     = ""
+}
+
+variable "private_subnets" {
+  description = "Private subnets for the ECS cluster"
+  default     = ""
+}
+
+variable "slack_namespace" {
+  description = "Additional security group"
+  default     = ""
+}
+
+variable "slack_token" {
+  description = "Additional security group"
+  default     = ""
+}
+
+variable "github_repo_name" {
+  description = "Name of the GitHub repository (created by CLI)"
+  type        = string
+  default     = ""
+}
+
+variable "github_organization" {
+  description = "Github organization where repositories should be created"
+  default     = ""
+}
+
+variable "aws_access_key_id" {
+  description = "AWS Access Key ID"
+  default     = ""
+  sensitive   = true
+}
+
+variable "aws_secret_access_key" {
+  description = "AWS Secret Access Key"
+  default     = ""
+  sensitive   = true
+}
+
+variable "aws_region" {
+  description = "AWS Region"
+}
+
+variable "db_password" {
+  description = "Password for postgres. Leave empty to auto-generate."
+  default     = ""
+  sensitive   = true
+}
+
+variable "db_username" {
+  description = "Username for postgres"
+}
+
+variable "db_name" {
+  description = "DB name for postgres"
+}
+
+variable "db_instance_type" {
+  description = "Database instance type"
+  default     = "db.t3.small"
+  type        = string
+}
+
+variable "db_allocated_storage" {
+  description = "Database allocated storage"
+  default     = 30
+  type        = number
+}
+
+variable "redis_instance_type" {
+  description = "Redis instance type"
+  default     = "cache.t3.small"
+  type        = string
+}
+
+variable "cpu_units" {
+  description = "CPU units for ECS tasks"
+  default     = 1024
+  type        = number
+}
+
+variable "memory_units" {
+  description = "Memory units for ECS tasks"
+  default     = 2048
+  type        = number
+}

package/dist/infra-templates/templates/ecs/workflows/build_and_deploy.yml

@@ -0,0 +1,188 @@
+name: Deploy REPLACEME image
+
+on:
+  push:
+    branches:
+      - BRANCHREPLACE
+    paths:
+      - PATHSREPLACE
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: true
+
+env:
+  DEPLOY_ENV: |
+    ${{
+      github.ref_name == 'main' && 'production' ||
+      github.ref_name == 'staging' && 'staging' ||
+      github.ref_name == 'dev' && 'development'
+    }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    if: github.ref == 'refs/heads/BRANCHREPLACE'
+    permissions:
+      id-token: write
+      contents: read
+      deployments: write
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set Outputs
+        id: vars
+        run: echo "::set-output name=sha_short::$(git rev-parse --short HEAD)"
+
+      - name: Free Disk Space
+        run: |
+          echo "🧹 Cleaning up system to free space..."
+          sudo swapoff -a
+          sudo rm -f /swapfile
+          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android
+          sudo apt-get clean
+          docker system prune -af
+          docker volume prune -f
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "lts/*"
+          cache: yarn
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+        with:
+          driver-opts: |
+            image=moby/buildkit:v0.12.0
+
+      - name: Build and tag REPLACEME image
+        uses: docker/build-push-action@v7
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: ${{ secrets.PROJECT_NAME }}-application
+          CURRENT_BRANCH: ${{ github.ref_name }}
+          IMAGE_SHA: ${{ steps.vars.outputs.sha_short }}
+        with:
+          context: ./
+          file: DOCKERFILE
+          push: true
+          tags: ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:REPLACEME-${{ steps.vars.outputs.sha_short }}
+          build-args: |
+            BUILDARGS
+      - name: Download existing ECS task definition
+        run: |
+          aws ecs describe-task-definition --task-definition REPLACEME --query taskDefinition > task-definition.json
+
+      - name: Fill in the new image ID in the Amazon ECS task definition
+        id: task-def
+        uses: aws-actions/amazon-ecs-render-task-definition@v1
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY: ${{ secrets.PROJECT_NAME }}-application
+          CURRENT_BRANCH: ${{ github.ref_name }}
+          IMAGE_SHA: ${{ steps.vars.outputs.sha_short }}
+        with:
+          task-definition: task-definition.json
+          container-name: REPLACEME
+          image: ${{ env.ECR_REGISTRY }}/${{ env.ECR_REPOSITORY }}:REPLACEME-${{ steps.vars.outputs.sha_short }}
+      - name: Start GitHub Deployment
+        uses: bobheadxi/deployments@v1
+        id: deployment-start
+        with:
+          step: start
+          token: ${{ secrets.GITHUB_TOKEN }}
+          env: ${{ env.DEPLOY_ENV }}
+          ref: ${{ github.sha }}
+          desc: "Deploying REPLACEME image to ECS"
+      - name: Deploy Amazon ECS task definition
+        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
+        with:
+          task-definition: ${{ steps.task-def.outputs.task-definition }}
+          service: REPLACEME
+          cluster: ${{ secrets.PROJECT_NAME }}
+          wait-for-service-stability: true
+
+      - name: Finish GitHub Deployment
+        if: always() # Ensures this runs even if previous step fails
+        uses: bobheadxi/deployments@v1
+        with:
+          step: finish
+          token: ${{ secrets.GITHUB_TOKEN }}
+          env: ${{ env.DEPLOY_ENV }}
+          status: ${{ job.status }}
+          deployment_id: ${{ steps.deployment-start.outputs.deployment_id }}
+
+  notify-slack:
+    needs: build
+    runs-on: ubuntu-latest
+    if: failure()
+    steps:
+      - name: Send Slack Notification on Failure
+        uses: slackapi/slack-github-action@v1.26.0
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "header",
+                  "text": {
+                    "type": "plain_text",
+                    "text": "🚨 Workflow Failed: `${{ github.workflow }}`"
+                  }
+                },
+                {
+                  "type": "section",
+                  "fields": [
+                    {
+                      "type": "mrkdwn",
+                      "text": "*Repository:*\n<${{ github.server_url }}/${{ github.repository }}|${{ github.repository }}>"
+                    },
+                    {
+                      "type": "mrkdwn",
+                      "text": "*Branch:*\n`${{ github.ref_name }}`"
+                    },
+                    {
+                      "type": "mrkdwn",
+                      "text": "*Triggered by:*\n`${{ github.triggering_actor }}`"
+                    },
+                    {
+                      "type": "mrkdwn",
+                      "text": "*Commit:*\n<${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}|${{ github.sha_short }}>"
+                    }
+                  ]
+                },
+                {
+                  "type": "actions",
+                  "elements": [
+                    {
+                      "type": "button",
+                      "text": {
+                        "type": "plain_text",
+                        "text": "View Workflow Run"
+                      },
+                      "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+                      "style": "danger"
+                    }
+                  ]
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

package/dist/infra-templates/templates/ecs/workflows/tests.yml

@@ -0,0 +1,65 @@
+# This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests across different versions of node
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-nodejs
+
+name: CI tests
+
+on:
+  push:
+    branches:
+      - '*' 
+      - '!workflow-creation' 
+  pull_request:
+    branches:
+      - '*' 
+      - '!workflow-creation'  
+
+env:
+  REDIS_URL: ""
+  DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/postgres"
+  SECRET_KEY_BASE: "xx"
+  NODE_OPTIONS: --max-old-space-size=8192
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./
+
+    # Service containers to run with `container-job`
+    services:
+      # Label used to access the service container
+      postgres:
+        # Docker Hub image
+        image: postgres:16
+        # Provide the password for postgres
+        env:
+          POSTGRES_PASSWORD: postgres
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          # Maps tcp port 5432 on service container to the host
+          - 5432:5432
+
+    strategy:
+      matrix:
+        node-version: [lts/*]
+        # ruby-version: ['3.3.1']
+        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
+
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v6
+      with:
+        node-version: ${{ matrix.node-version }}
+    - run: yarn install
+    - run: yarn lint
+    - run: yarn test

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swovohq/fuel",
-  "version": "0.2.2-alpha.9",
+  "version": "0.2.2-alpha.90",
   "bin": {
     "fuel": "dist/bin/fuel.js"
   },
@@ -22,7 +22,8 @@
     "url": "https://github.com/swovohq/fuel-nest.git"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "yarn generate:schema && tsc -p tsconfig.json && node scripts/copy-infra-templates.js",
+    "generate:schema": "ts-node scripts/generate-schema.ts",
     "dev": "ts-node src/bin/fuel.ts",
     "test": "jest --passWithNoTests",
     "lint": "eslint \"src/**/*.ts\""
@@ -30,6 +31,13 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1022.0",
     "@aws-sdk/client-secrets-manager": "^3.1022.0",
+    "@azure/arm-authorization": "^9.0.0",
+    "@azure/arm-keyvault": "^3.1.0",
+    "@azure/arm-resources": "^5.2.0",
+    "@azure/arm-storage": "^18.3.0",
+    "@azure/identity": "^4.4.1",
+    "@azure/keyvault-secrets": "^4.9.0",
+    "@azure/storage-blob": "^12.25.0",
     "@octokit/rest": "^22.0.1",
     "chalk": "^4.1.2",
     "commander": "^14.0.3",