@swovohq/fuel 0.2.2-alpha.90 → 0.2.2-alpha.92

package/dist/infra-templates/TODO-azure-prod.md

@@ -6,16 +6,18 @@ specs (SQL 6 vCore GP zone-redundant, Front Door Premium+WAF, Container
 Apps Dedicated D4x2, Defender for Cloud, etc).
 
 ## Done — Key Vault per-app secrets pre-populated (closed on feature/azure-provider-support)
+
 Each app's vault now gets an `azurerm_key_vault_secret` named `app-variables`
 holding `jsonencode(local.app_variables[app])` — one JSON blob per app,
 mirroring ECS's `modules/secret` (which also stores all of an app's
 `variables:` as one JSON blob, not one secret per key).
 
 Two blockers closed:
+
 - **RBAC** (data-plane `Key Vault Secrets Officer`, which `Contributor` doesn't
-  cover): resolved *without* the Graph-lookup problem the github_oidc
+  cover): resolved _without_ the Graph-lookup problem the github_oidc
   `existing_principal_id` escape hatch needed — `data.azurerm_client_config.current.object_id`
-  resolves the *running* SP's own object_id purely via ARM, no
+  resolves the _running_ SP's own object_id purely via ARM, no
   `Application.Read.All` required.
 - **Network** (found while implementing, wasn't in this doc before): the vault
   defaults to `public_network_access_enabled = false`, so `network_acls` never
@@ -28,7 +30,7 @@ Two blockers closed:
   Azure RBAC propagation isn't instant, so writing in the same apply that
   grants the role can otherwise 403 intermittently.
 
-Not addressed: this doesn't give the *app itself* read access over the network
+Not addressed: this doesn't give the _app itself_ read access over the network
 at runtime (Container Apps egress via the NAT Gateway's public IP, which isn't
 on the allowlist and isn't covered by `bypass = "AzureServices"`). Today no app
 code actually reads from Key Vault via SDK — `KEY_VAULT_URI` is informational
@@ -38,6 +40,7 @@ ever needs to read its vault directly, this'll need a private endpoint or a
 broader firewall rule for the Container Apps subnet's egress IP.
 
 ## Already fixed (committed on feature/azure-provider-support)
+
 - `github_oidc.enabled` sensitivity leak (`for_each`/output error) — fixed via
   `nonsensitive()` in `templates/azure/locals.tf` (`local.github_oidc_enabled`).
 - Orphan private DNS zones in `modules/azure-network` (e.g. postgres zone
@@ -47,7 +50,7 @@ broader firewall rule for the Container Apps subnet's egress IP.
   Azure secret name — fixed to reuse `local.secret_names`.
 - SQL LTR + auto-pause both enabled by default, which Azure rejects on a
   serverless database — LTR now only applies when `auto_pause_delay_in_minutes
-  == -1` (i.e. provisioned/prod databases).
+== -1` (i.e. provisioned/prod databases).
 - `packages/infra` was left behind in every scaffolded project (only
   `packages/cli` was cleaned up) — now removed the same way. `templates/azure`
   had no `.gitignore` (unlike `templates/ecs`) — added one.
@@ -65,10 +68,10 @@ broader firewall rule for the Container Apps subnet's egress IP.
   without one. Added a Standard NAT Gateway to the subnet.
 - `azurerm_container_app` always declared a `registry` block pointing at the
   ACR, but the AcrPull role assignment for that identity is necessarily
-  created *after* the container app — Azure hung validating an unauthorized
+  created _after_ the container app — Azure hung validating an unauthorized
   credential on first create regardless of which image was pulled. Dropped
   the `registry` block; CI now configures it via `az containerapp registry
-  set` once the role assignment already exists.
+set` once the role assignment already exists.
 - Every Front Door route also set `link_to_default_domain = true`, so the
   second app's route collided with the first on the shared `*.azurefd.net`
   hostname/path. Now only links the default domain when an app has no custom
@@ -76,6 +79,7 @@ broader firewall rule for the Container Apps subnet's egress IP.
 - `github_repo_name` as explicit field — done, see below.
 
 ## Decided, not implemented yet
+
 1. **Multi-environment pipelines.** `templates/azure/workflows/build_and_deploy.yml`
    uses repo-wide secrets (`AZURE_CLIENT_ID`/`TENANT_ID`/`SUBSCRIPTION_ID`/
    `ACR_LOGIN_SERVER`, no `environment:` on the job) and bakes
@@ -92,10 +96,11 @@ broader firewall rule for the Container Apps subnet's egress IP.
    no longer conflicts with dev/stg — just needs the schema const relaxed
    and the WAF resource added.
 3. **Container Apps Dedicated plan** (D4 x2). `modules/azure-container-apps-environment`
-   is Consumption-only *by design* (explicit comment in `main.tf`). Needs a
+   is Consumption-only _by design_ (explicit comment in `main.tf`). Needs a
    `workload_profile` block + a way to select Dedicated per-app/per-env.
 
 ## No Terraform module exists (infra gap, not config gap)
+
 - Microsoft Defender for Cloud (Containers/SQL/Storage/Key Vault plans)
 - Static Web Apps
 - Azure DevOps pipelines (stack uses GitHub Actions instead — confirm this
@@ -104,16 +109,19 @@ broader firewall rule for the Container Apps subnet's egress IP.
   won't ever be a fuel.yml field)
 
 ## Still need to verify
+
 - Count actual `azurerm_private_endpoint`-equivalent resources created
   today (SQL, Redis) vs. the prod spec line "5 private endpoints x 730h,
-  100GB in/out" — only confirmed the network *structure* (subnets/DNS
+  100GB in/out" — only confirmed the network _structure_ (subnets/DNS
   zones) exists, not an exact endpoint count against spec.
 
 ## Action not yet taken
+
 - No one has actually scaffolded `infra-prod` yet (new `fuel.yml` + running
   the CLI generation into a separate target dir). Isolation is designed but
   not yet real until that runs.
 
 ## Suggested next pick (unresolved — pick one to start)
+
 - GitHub Environments wiring (workflow template + docs)
 - Front Door WAF (schema + module)

package/dist/infra-templates/templates/azure/MANUAL_DEPLOY.md

@@ -8,7 +8,7 @@ on a machine without Node/`fuel` installed (e.g. CI runner, teammate's laptop).
 Everything below assumes this `infra/` folder was already generated once by
 `fuel infra:init` (so `backend.tf`/`default.tfvars` are already patched with real
 names, not the `{placeholder}` tokens from the template source). If that never ran,
-you don't have a project to deploy yet — this doc only replaces the *deploy* step.
+you don't have a project to deploy yet — this doc only replaces the _deploy_ step.
 
 ## 0. Prerequisites
 

package/dist/infra-templates/templates/ecs/README.md

@@ -1,4 +1,3 @@
-
 # 🌍 Terraform Project: Infrastructure Setup
 
 This Terraform project is designed to first create a centralized secret in AWS Secrets Manager, which serves as the foundation for provisioning the rest of the infrastructure.
@@ -10,15 +9,15 @@ Before you begin, ensure the following:
 - [Terraform](https://www.terraform.io/downloads.html) is installed and available in your `PATH`
 - AWS CLI is configured with appropriate credentials and region
 - Permissions for creating the environment
-   - AmazonECS_FullAccess
-   - AmazonElastiCacheFullAccess
-   - AmazonRDSFullAccess
-   - AmazonS3FullAccess
-   - AWSCloudTrail_FullAccess
-   - AWSCodeBuildAdminAccess
-   - AWSCodePipeline_FullAccess
-   - CloudWatchFullAccessV2
-   - IAMFullAccess
+  - AmazonECS_FullAccess
+  - AmazonElastiCacheFullAccess
+  - AmazonRDSFullAccess
+  - AmazonS3FullAccess
+  - AWSCloudTrail_FullAccess
+  - AWSCodeBuildAdminAccess
+  - AWSCodePipeline_FullAccess
+  - CloudWatchFullAccessV2
+  - IAMFullAccess
 
 ### 🌐 Creating an ACM Certificate for Your Domain
 
@@ -61,92 +60,101 @@ To deploy secure resources using the Infrastructure Automation Script, follow th
   - **HOST_URL**: Similarly, this URL is currently pointing to Flatirons' domain, and you will need to change it to match your own domain.
   - **ssl**: Copy the certificate arn from the previous step
 
+### 🌱 How to Modify app.json
 
-### 🌱  How to Modify app.json
-   
 ##### 1. **SSL Certificate ARN**
-   - Replace the `"ssl"` field with the correct ARN for your SSL certificate, which you should have obtained through AWS Certificate Manager (ACM):
-   
-     ```json
-     "ssl": "arn:aws:acm:========================="
-     ```
+
+- Replace the `"ssl"` field with the correct ARN for your SSL certificate, which you should have obtained through AWS Certificate Manager (ACM):
+
+  ```json
+  "ssl": "arn:aws:acm:========================="
+  ```
+
 ##### 2. **Access IP Range**
-   - Update the `"access_ip_range"` field to specify the IP range that can access your database. You can enter your IP address or any other IP range:
-   
-     ```json
-     "access_ip_range": "73.153.163.118/32"
-     ```
+
+- Update the `"access_ip_range"` field to specify the IP range that can access your database. You can enter your IP address or any other IP range:
+
+  ```json
+  "access_ip_range": "73.153.163.118/32"
+  ```
 
 ##### 3. **Cognito API Key Header**
-   - Ensure the `"cognito_apikey_header"` field points to the header for API key authentication if you are using Cognito for authentication:
-   
-     ```json
-     "cognito_apikey_header": "x-api-key"
-     ```
+
+- Ensure the `"cognito_apikey_header"` field points to the header for API key authentication if you are using Cognito for authentication:
+
+  ```json
+  "cognito_apikey_header": "x-api-key"
+  ```
+
 ##### 4. **Slack Webhook URL**
-   - Provide your Slack Webhook URL to receive alarms. If you don't have one, you can use the default placeholder URL:
-   
-     ```json
-     "slack_webhook_url": "Enter webhook URL to receive alarms or set default value https://hooks.slack.com/services/YOUR_WORKSPACE_ID/YOUR_CHANNEL_ID/YOUR_WEBHOOK_TOKEN"
-     ```
+
+- Provide your Slack Webhook URL to receive alarms. If you don't have one, you can use the default placeholder URL:
+
+  ```json
+  "slack_webhook_url": "Enter webhook URL to receive alarms or set default value https://hooks.slack.com/services/YOUR_WORKSPACE_ID/YOUR_CHANNEL_ID/YOUR_WEBHOOK_TOKEN"
+  ```
 
 ##### 5. **Environment Setup**
-   - Update the `"name"` field with your project name:
-   
-     ```json
-     "name": "your-project"
-     ```
 
-   - The `"deployment"` field specifies the deployment method (ecs or eks):
-   
-     ```json
-     "deployment": "ecs"
-     ```
+- Update the `"name"` field with your project name:
 
-     Nota: This application only works with ecs
+  ```json
+  "name": "your-project"
+  ```
+
+- The `"deployment"` field specifies the deployment method (ecs or eks):
+
+  ```json
+  "deployment": "ecs"
+  ```
+
+  Nota: This application only works with ecs
 
 ##### 6. **Application Modules Configuration**
-   - Modify the `"modules"` field to set the options for the different modules you are using in your application. For instance:
-   
-     ```json
-     "modules": "[{'name': 'auth', 'options': {'two_factor': False, 'invitation_only': False, 'remove_sign_up_phone': False}}, {'name': 'team', 'options': {'remove': True}}, {'name': 'billing', 'options': {'remove_stripe': True}}, {'name': 'e2e', 'options': {'remove': True}}]"
-     ```
+
+- Modify the `"modules"` field to set the options for the different modules you are using in your application. For instance:
+
+  ```json
+  "modules": "[{'name': 'auth', 'options': {'two_factor': False, 'invitation_only': False, 'remove_sign_up_phone': False}}, {'name': 'team', 'options': {'remove': True}}, {'name': 'billing', 'options': {'remove_stripe': True}}, {'name': 'e2e', 'options': {'remove': True}}]"
+  ```
 
 ##### 7. **Application Configurations for API and Web**
-   - Modify the application configuration under the `"apps"` section. For each app (e.g., `projectname-dev-api`, `projectname-staging-api`), update the following:
-     
-     - **Domain Name**: Set the domain for each app.
-     - **API Keys and Secrets**: Ensure all required API keys and secrets (like Snowflake, JWT) are correctly configured.
-     - **Environment Variables**: Update any specific environment variables (e.g., `HOST_URL`, `FRONT_END_URL`).
-
-   Example for the **dev API app**:
-   
-   ```json
-   "apps": [
-     {
-       "name": "projectname-dev-api",
-       "technology": "nest",
-       "dockerfile": "apps/api/Dockerfile",
-       "health_check_path": "/health",
-       "domain": "projectname-dev-api.******.com",
-       "port": 3000,
-       "cognito": false,
-       "postgres": false,
-       "redis": false,
-       "variables": {
-         "NODE_TLS_REJECT_UNAUTHORIZED": 0,
-         "API_KEY_HEADER": "x-api-key",
-         "ENCRYPTION_PASSWORD": "xxxxxxxxxxxxxxx",
-         "HOST_URL": "https://projectname-dev-api.****.com",
-         "FRONT_END_URL": "https://projectname-dev.******.com",
-         "APP_NAME": "AppName",
-         "APP_COMPANY": "Flatirons",
-         "ADMIN_JS_EMAIL": "admin@flatirons.com",
-         "ADMIN_JS_PASSWORD": "xxxxxxxxxxxxxxxxx!!!"
-       }
-     }
-   ]
-   ```
+
+- Modify the application configuration under the `"apps"` section. For each app (e.g., `projectname-dev-api`, `projectname-staging-api`), update the following:
+
+  - **Domain Name**: Set the domain for each app.
+  - **API Keys and Secrets**: Ensure all required API keys and secrets (like Snowflake, JWT) are correctly configured.
+  - **Environment Variables**: Update any specific environment variables (e.g., `HOST_URL`, `FRONT_END_URL`).
+
+Example for the **dev API app**:
+
+```json
+"apps": [
+  {
+    "name": "projectname-dev-api",
+    "technology": "nest",
+    "dockerfile": "apps/api/Dockerfile",
+    "health_check_path": "/health",
+    "domain": "projectname-dev-api.******.com",
+    "port": 3000,
+    "cognito": false,
+    "postgres": false,
+    "redis": false,
+    "variables": {
+      "NODE_TLS_REJECT_UNAUTHORIZED": 0,
+      "API_KEY_HEADER": "x-api-key",
+      "ENCRYPTION_PASSWORD": "xxxxxxxxxxxxxxx",
+      "HOST_URL": "https://projectname-dev-api.****.com",
+      "FRONT_END_URL": "https://projectname-dev.******.com",
+      "APP_NAME": "AppName",
+      "APP_COMPANY": "Flatirons",
+      "ADMIN_JS_EMAIL": "admin@flatirons.com",
+      "ADMIN_JS_PASSWORD": "xxxxxxxxxxxxxxxxx!!!"
+    }
+  }
+]
+```
+
 ---
 
 ## 🚀 Usage
@@ -165,6 +173,7 @@ To begin, initialize the project and apply the `secret-main` module to create th
 Note: For this step the config.json file is mandatory, please request it from the project administrator and place it at the root of the project directory
 
 Region=fill your region below (if it is different from us-east-1)
+
 ```bash
 cd modules/secret-main
 terraform init -backend-config="region=us-east-1"
@@ -177,6 +186,7 @@ terraform apply
 After the centralized secret is in place, proceed to initialize and apply the full infrastructure:
 
 Region=fill your region below (if it is different from us-east-1)
+
 ```bash
 terraform init -backend-config="region=us-east-1"
 terraform plan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swovohq/fuel",
-  "version": "0.2.2-alpha.90",
+  "version": "0.2.2-alpha.92",
   "bin": {
     "fuel": "dist/bin/fuel.js"
   },