@swovohq/fuel 0.2.2-alpha.9 → 0.2.2-alpha.91

package/dist/infra-templates/modules/vpc/main.tf

@@ -0,0 +1,76 @@
+module "vpc" {
+  source = "terraform-aws-modules/vpc/aws"
+  version = "5.7.1"
+
+  name = var.project_name
+  cidr = "10.0.0.0/16"
+
+  azs             = data.aws_availability_zones.available.names
+  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
+  public_subnets  = ["10.0.4.0/24", "10.0.5.0/24"]
+
+  enable_nat_gateway   = true
+  single_nat_gateway   = true
+  enable_dns_hostnames = true
+
+  default_security_group_egress = [{
+    cidr_blocks = "0.0.0.0/0"
+  }]
+
+  default_security_group_ingress = [
+    {
+      description = "Allow inbound traffic from the same security group"
+      from_port   = 0
+      to_port     = 65535
+      protocol    = "tcp"
+      self        = true
+    },
+    {
+      description = "Allow inbound traffic from the same security group (UDP)"
+      from_port   = 0
+      to_port     = 65535
+      protocol    = "udp"
+      self        = true
+    },
+  ]
+
+  tags = {
+    Terraform   = "true"
+    Environment = var.project_name
+  }
+}
+
+resource "aws_iam_role" "flow_logs_role" {
+  name = "${var.project_name}-flow-logs-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Principal = {
+        Service = "vpc-flow-logs.amazonaws.com"
+      }
+      Action = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "flow_logs_policy" {
+  name = "${var.project_name}-flow-logs-policy"
+  role = aws_iam_role.flow_logs_role.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = [
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents",
+        "logs:DescribeLogGroups",
+        "logs:DescribeLogStreams"
+      ]
+      Resource = "*"
+    }]
+  })
+}

package/dist/infra-templates/modules/vpc/outputs.tf

@@ -0,0 +1,23 @@
+output "default_security_group_id" {
+  value = module.vpc.default_security_group_id
+}
+
+output "vpc_id" {
+  value = module.vpc.vpc_id
+}
+
+output "private_subnets" {
+  value = module.vpc.private_subnets
+}
+
+output "public_subnets" {
+  value = module.vpc.public_subnets
+}
+
+output "igw_id" { 
+  value = module.vpc.igw_id
+}
+
+output "vpc_cidr_block" {
+  value = module.vpc.vpc_cidr_block
+}

package/dist/infra-templates/modules/vpc/variables.tf

@@ -0,0 +1,5 @@
+variable "project_name" {
+  description = "A unique name for your project. This will be used as part of resource names."
+  default     = ""
+}
+

package/dist/infra-templates/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@fuel/infra",
+  "version": "1.0.0",
+  "private": true,
+  "description": "AWS (ECS) and Azure (Container Apps) infrastructure templates and modules for FUEL CLI"
+}

package/dist/infra-templates/templates/azure/MANUAL_DEPLOY.md

@@ -0,0 +1,168 @@
+# Manual deploy (without the `fuel` CLI)
+
+`fuel infra:deploy` is a thin wrapper around Azure SDK calls (bootstrap) + `tofu`
+(everything else). This is the manual equivalent, reverse-engineered from
+`packages/cli/src/infra/{orchestrator,tofu-runner,azure-state-storage}.ts` — useful
+on a machine without Node/`fuel` installed (e.g. CI runner, teammate's laptop).
+
+Everything below assumes this `infra/` folder was already generated once by
+`fuel infra:init` (so `backend.tf`/`default.tfvars` are already patched with real
+names, not the `{placeholder}` tokens from the template source). If that never ran,
+you don't have a project to deploy yet — this doc only replaces the _deploy_ step.
+
+## 0. Prerequisites
+
+- A service principal's `AZURE_CLIENT_ID`/`AZURE_CLIENT_SECRET`/`AZURE_TENANT_ID`/
+  `AZURE_SUBSCRIPTION_ID` (same ones in `.fuel-credentials` at the project root,
+  gitignored). `az login` alone isn't enough — the bootstrap steps below and the
+  Tofu provider (`providers.tf`) are wired to these four values explicitly, not to
+  whatever identity `az` is currently logged in as.
+- `tofu` (OpenTofu) installed.
+- Your `fuel.yml` fully filled out (apps, `variables:`, etc.) — this is what gets
+  uploaded as the bootstrap secret in step 3.
+
+Compute the naming suffix once — it's deterministic, derived from the project name
+(`deriveSuffix` in `s3-state-bucket.ts`):
+
+```bash
+PROJECT_NAME=<your fuel.yml project name>
+SUFFIX=$(echo -n "$PROJECT_NAME" | shasum -a 256 | cut -c1-8)
+LOCATION=<your fuel.yml location, e.g. eastus>
+
+RESOURCE_GROUP="${PROJECT_NAME}-rg"
+STORAGE_ACCOUNT=$(echo -n "st${PROJECT_NAME}${SUFFIX}" | tr -cd 'a-zA-Z0-9' | tr 'A-Z' 'a-z' | cut -c1-24)
+KEY_VAULT_NAME=$(echo -n "kv-${PROJECT_NAME}-${SUFFIX}" | cut -c1-24)
+```
+
+These must match what's already baked into your `infra/backend.tf` and
+`infra/default.tfvars` — diff against those files if unsure instead of recomputing.
+
+## 1. Bootstrap resource group, state storage, Key Vault
+
+Skip any sub-step whose resource already exists (all of this is idempotent in the
+CLI — `create` commands below aren't, so check first if unsure):
+
+```bash
+az group create --name "$RESOURCE_GROUP" --location "$LOCATION"
+
+az storage account create \
+  --name "$STORAGE_ACCOUNT" \
+  --resource-group "$RESOURCE_GROUP" \
+  --location "$LOCATION" \
+  --sku Standard_LRS \
+  --kind StorageV2 \
+  --min-tls-version TLS1_2 \
+  --allow-blob-public-access false
+
+az storage container create \
+  --name tfstate \
+  --account-name "$STORAGE_ACCOUNT" \
+  --auth-mode login
+
+az keyvault create \
+  --name "$KEY_VAULT_NAME" \
+  --resource-group "$RESOURCE_GROUP" \
+  --location "$LOCATION"
+```
+
+## 2. Grant the deploying identity access to the bootstrap vault
+
+The bootstrap vault uses access policies (not RBAC) — see the security discussion
+in `TODO-azure-prod.md` for why that's a known gap. Grant secrets access to
+whichever identity runs `tofu apply` (service principal shown here; swap
+`--spn`/`--upn`/`--object-id` for whoever that is):
+
+```bash
+az keyvault set-policy \
+  --name "$KEY_VAULT_NAME" \
+  --resource-group "$RESOURCE_GROUP" \
+  --secret-permissions get list set delete \
+  --spn "$AZURE_CLIENT_ID"
+```
+
+Also confirm that identity can create role assignments (Terraform creates several —
+GitHub OIDC → ACR push, per-app Key Vault RBAC, etc.). `Contributor` alone is NOT
+enough — it explicitly excludes `Microsoft.Authorization/roleAssignments/write`:
+
+```bash
+az role assignment create \
+  --assignee "$AZURE_CLIENT_ID" \
+  --role "User Access Administrator" \
+  --scope "/subscriptions/$AZURE_SUBSCRIPTION_ID"
+```
+
+## 3. Upload fuel.yml as the bootstrap secret
+
+Terraform's `data.azurerm_key_vault_secret.config` (see `data.tf`) expects a secret
+literally named `infrastructure-variables` holding your entire `fuel.yml` as YAML:
+
+```bash
+az keyvault secret set \
+  --vault-name "$KEY_VAULT_NAME" \
+  --name infrastructure-variables \
+  --file fuel.yml
+```
+
+(The CLI also injects a random `seed` and `github_org` key into this payload before
+uploading — neither is currently read by any `.tf` file in this template, so
+uploading the raw `fuel.yml` as-is is equivalent today.)
+
+## 4. Run Tofu
+
+From the `infra/` folder:
+
+```bash
+export ARM_SUBSCRIPTION_ID="$AZURE_SUBSCRIPTION_ID"
+export ARM_TENANT_ID="$AZURE_TENANT_ID"
+export ARM_CLIENT_ID="$AZURE_CLIENT_ID"
+export ARM_CLIENT_SECRET="$AZURE_CLIENT_SECRET"
+
+# The provider is wired to var.azure_client_secret directly (see providers.tf), so it still
+# needs to be supplied as a Tofu variable — but never via -var, which would leave it readable
+# in process listings (ps, /proc). TF_VAR_* is how Tofu reads variables from the environment.
+export TF_VAR_azure_client_secret="$AZURE_CLIENT_SECRET"
+
+tofu init
+
+tofu plan \
+  -var-file=default.tfvars \
+  -var="azure_subscription_id=$AZURE_SUBSCRIPTION_ID" \
+  -var="azure_tenant_id=$AZURE_TENANT_ID" \
+  -var="azure_client_id=$AZURE_CLIENT_ID" \
+  -var="github_organization=<your GitHub org>" \
+  -var="db_username=<slugified project name>" \
+  -var="db_name=<slugified project name>" \
+  -var="github_repo_name=<repo name>"
+
+# same -var flags, swap plan for apply -auto-approve when ready
+tofu apply -auto-approve \
+  -var-file=default.tfvars \
+  -var="azure_subscription_id=$AZURE_SUBSCRIPTION_ID" \
+  -var="azure_tenant_id=$AZURE_TENANT_ID" \
+  -var="azure_client_id=$AZURE_CLIENT_ID" \
+  -var="github_organization=<your GitHub org>" \
+  -var="db_username=<slugified project name>" \
+  -var="db_name=<slugified project name>" \
+  -var="github_repo_name=<repo name>"
+```
+
+`<slugified project name>` = your project name, lowercased, non-alphanumeric chars
+replaced with `_` (see `slugify()` in `orchestrator.ts`).
+
+## 5. What `fuel infra:deploy` does after `tofu apply` (manual equivalents)
+
+Not infra, but part of the same flow if you want full parity:
+
+- Reads `tofu output -json` for `acr_login_server`, `github_oidc_client_id`,
+  `front_door_endpoint_hostname`, etc.
+- Sets GitHub Actions repo secrets (`AZURE_TENANT_ID`, `AZURE_SUBSCRIPTION_ID`,
+  `AZURE_CLIENT_ID` from the OIDC output, `PROJECT_NAME`, `ACR_LOGIN_SERVER`,
+  `RESOURCE_GROUP`) via `gh secret set <name> --repo <org>/<repo> --body <value>`.
+- Creates the GitHub repo (`gh repo create`) if it doesn't exist, sets branch
+  protection, pushes the local commit.
+- Prints any custom-domain DNS validation records from
+  `custom_domain_validation` output (TXT + CNAME) for you to add at your DNS
+  provider.
+
+None of this is required for the Azure resources themselves to exist — only for
+CI/CD to work against them afterward.

package/dist/infra-templates/templates/azure/backend.tf

@@ -0,0 +1,8 @@
+terraform {
+  backend "azurerm" {
+    resource_group_name  = "{resource_group_name}"
+    storage_account_name = "{storage_account_name}"
+    container_name       = "{container_name}"
+    key                  = "terraform.tfstate"
+  }
+}

package/dist/infra-templates/templates/azure/data.tf

@@ -0,0 +1,21 @@
+data "azurerm_resource_group" "this" {
+  name = var.resource_group_name
+}
+
+data "azurerm_key_vault" "bootstrap" {
+  name                = var.key_vault_name
+  resource_group_name = var.resource_group_name
+}
+
+data "azurerm_key_vault_secret" "config" {
+  name         = "infrastructure-variables"
+  key_vault_id = data.azurerm_key_vault.bootstrap.id
+}
+
+# azurerm_container_app's ip_security_restriction.ip_address_range is validated client-side as a
+# strict CIDR — unlike NSG rules or `az containerapp ingress access-restriction set`, it doesn't
+# accept the "AzureFrontDoor.Backend" service tag directly. Resolve it to real CIDRs instead.
+data "azurerm_network_service_tags" "front_door_backend" {
+  location = var.location
+  service  = "AzureFrontDoor.Backend"
+}

package/dist/infra-templates/templates/azure/locals.tf

@@ -0,0 +1,116 @@
+locals {
+  credentials = yamldecode(data.azurerm_key_vault_secret.config.value)
+  apps        = yamldecode(data.azurerm_key_vault_secret.config.value).apps
+
+  # Sensitive variables per app — kept separate so they never leak into plan output
+  app_variables = { for i in local.apps : nonsensitive(i.name) => try(i.variables, {}) }
+  app_build_env = { for i in local.apps : nonsensitive(i.name) => try(i.build_env, {}) }
+
+  worker_list = nonsensitive(flatten([for i in local.apps : [
+    [for worker in try(i.workers, []) : {
+      app_name    = i.name
+      technology  = i.technology
+      dockerfile  = worker.dockerfile
+      worker_name = worker.name
+      branch      = i.branch
+    }]
+  ]]))
+
+  app_list = nonsensitive([for i in local.apps :
+    {
+      app_name          = i.name
+      technology        = i.technology
+      port              = i.port
+      domain            = i.domain
+      health_check_path = i.health_check_path
+      dockerfile        = i.dockerfile
+      branch            = i.branch
+
+      database_enabled      = try(i.database.enabled, false)
+      database_engine       = try(i.database.engine, "mssql")
+      database_sku          = try(i.database.sku_name, "GP_S_Gen5_4")
+      database_storage_type = try(i.database.storage_account_type, "Local")
+      database_pitr_days    = try(i.database.pitr_retention_days, 20)
+      database_ltr          = try(i.database.ltr_weekly_retention, "P21W")
+      database_min_capacity = try(i.database.min_capacity, 0.5)
+      database_storage_mb   = try(i.database.allocated_storage_mb, 32768)
+
+      redis_enabled = try(i.redis.enabled, false)
+      redis_sku     = try(i.redis.sku_name, "Balanced_B0")
+
+      cpu                 = try(i.container_app.cpu, 1)
+      memory              = try(i.container_app.memory, "2Gi")
+      concurrent_requests = try(i.container_app.concurrent_requests, 20)
+      min_replicas        = try(i.container_app.min_replicas, 0)
+      max_replicas        = try(i.container_app.max_replicas, 3)
+    }
+  ])
+
+  # Every app (nest or react/Next.js) runs as a Container App — matches how ECS always ran them.
+  container_apps = local.app_list
+
+  # Keyed lookup so container_app_worker (for_each'd by worker_name) can read its parent app's
+  # flags (redis_enabled, database_enabled, ...) without going through the shared `env_vars` trap below.
+  app_list_by_name = { for a in local.app_list : a.app_name => a }
+
+  # Keyed lookup so worker_key_vault_secrets_user (for_each'd by worker_name via
+  # module.container_app_worker) can find its parent app's name.
+  worker_list_by_name = { for w in local.worker_list : w.worker_name => w }
+
+  # Just a feature flag, not a real secret — stripped so it can be used in count/for_each.
+  github_oidc_enabled = nonsensitive(try(local.credentials.github_oidc.enabled, true))
+
+  # An Azure AD app client ID/object ID is a public identifier, not a secret — stripped so it
+  # doesn't poison the github_oidc_client_id output (var.enabled had this same issue, above).
+  github_oidc_existing_client_id    = nonsensitive(try(local.credentials.github_oidc.existing_client_id, null))
+  github_oidc_existing_principal_id = nonsensitive(try(local.credentials.github_oidc.existing_principal_id, null))
+  # Just a feature flag, not a real secret — same treatment as github_oidc_enabled above.
+  github_oidc_manage_role_assignment = nonsensitive(try(local.credentials.github_oidc.manage_role_assignment, true))
+
+  # Container Apps' ip_security_restriction rejects IPv6 ranges (IpRestrictionsAddressEnteredInvalid)
+  # even though the AzureFrontDoor.Backend service tag includes them — IPv4-only until that's fixed.
+  front_door_backend_ipv4_cidrs = [
+    for cidr in data.azurerm_network_service_tags.front_door_backend.address_prefixes : cidr
+    if !strcontains(cidr, ":")
+  ]
+
+  # Seeds every Container App on first create. The real ACR tag never exists yet at that
+  # point — the CI pipeline that pushes it depends on this same apply having already
+  # created the GitHub OIDC identity/repo secrets. module.container_app/container_app_worker
+  # ignore_changes on this attribute, so CI's first real push takes over permanently.
+  bootstrap_container_image = "mcr.microsoft.com/azuredocs/containerapps-helloworld:latest"
+
+  # Drives which private DNS zones/subnets module.network actually provisions —
+  # no point creating a postgres zone when every app uses mssql, etc.
+  network_needs_postgres = anytrue([for a in local.app_list : a.database_enabled && a.database_engine == "postgres"])
+  network_needs_mssql    = anytrue([for a in local.app_list : a.database_enabled && a.database_engine == "mssql"])
+  network_needs_redis    = anytrue([for a in local.app_list : a.redis_enabled])
+
+  storage_account_name = substr(lower(replace("${var.project_name}app", "/[^a-zA-Z0-9]/", "")), 0, 24)
+
+  # One Key Vault per app (mirrors the ECS template's one-Secrets-Manager-secret-per-app
+  # pattern) — each app's Container App identity only gets RBAC on its own vault, not a
+  # shared one every app could read every other app's secrets from.
+  #
+  # Key Vault names are globally unique and capped at 24 chars, so truncating the naive
+  # "kv" + project_name + app_name concatenation can wipe out app_name entirely for long
+  # project names, making every app in the project collide on the same vault name. Reserve
+  # the last 8 chars of the (slugified) app_name as a fixed suffix and only truncate the
+  # project_name portion, so distinct apps always produce distinct names.
+  app_name_suffixes = {
+    for a in local.app_list : a.app_name => substr(lower(replace(a.app_name, "/[^a-zA-Z0-9]/", "")), -8, 8)
+  }
+  app_key_vault_names = {
+    for a in local.app_list : a.app_name => "kv${substr(lower(replace(var.project_name, "/[^a-zA-Z0-9]/", "")), 0, max(0, 24 - 2 - length(local.app_name_suffixes[a.app_name])))}${local.app_name_suffixes[a.app_name]}"
+  }
+
+  # Whoever runs `tofu apply` (local machine, not CI) needs a data-plane network path to
+  # write app_variables into each vault — see data.http.tofu_operator_ip in main.tf.
+  tofu_operator_ip_cidr = "${chomp(data.http.tofu_operator_ip.response_body)}/32"
+
+  # NOTE: env vars are computed inline inside each `module.container_app`/`container_app_worker`
+  # instance (main.tf), not as a single shared local here. A `for` over all apps producing one map
+  # value can't be partially resolved — if any one app's database/redis module fails, HCL can't
+  # tell Terraform "the other keys are fine," so the whole map (and everything reading from it)
+  # blocks. Computing it per for_each instance keeps each app's Container App creation independent.
+}