adserver-dashboard 1.0.0

package/terraform/variables.tf

@@ -0,0 +1,226 @@
+# General Variables
+variable "aws_region" {
+  description = "AWS region for resources"
+  type        = string
+  default     = "us-east-1"
+}
+
+variable "environment" {
+  description = "Environment name (dev, staging, production)"
+  type        = string
+  validation {
+    condition     = contains(["dev", "staging", "production"], var.environment)
+    error_message = "Environment must be dev, staging, or production."
+  }
+}
+
+variable "project_name" {
+  description = "Project name for resource naming"
+  type        = string
+  default     = "adserver"
+}
+
+# Domain Configuration
+variable "domain_name" {
+  description = "Primary domain name for the application"
+  type        = string
+}
+
+variable "hosted_zone_id" {
+  description = "Route53 Hosted Zone ID for the domain"
+  type        = string
+}
+
+variable "create_dns_records" {
+  description = "Whether to create Route53 DNS records"
+  type        = bool
+  default     = true
+}
+
+# S3 Configuration
+variable "s3_bucket_name" {
+  description = "S3 bucket name for static content and frontend"
+  type        = string
+}
+
+variable "enable_versioning" {
+  description = "Enable S3 bucket versioning"
+  type        = bool
+  default     = true
+}
+
+# CloudFront Configuration
+variable "price_class" {
+  description = "CloudFront distribution price class"
+  type        = string
+  default     = "PriceClass_100"
+}
+
+variable "minimum_protocol_version" {
+  description = "Minimum TLS protocol version"
+  type        = string
+  default     = "TLSv1.2_2021"
+}
+
+variable "default_ttl" {
+  description = "Default TTL for CloudFront cache"
+  type        = number
+  default     = 86400 # 24 hours
+}
+
+variable "max_ttl" {
+  description = "Maximum TTL for CloudFront cache"
+  type        = number
+  default     = 31536000 # 1 year
+}
+
+variable "min_ttl" {
+  description = "Minimum TTL for CloudFront cache"
+  type        = number
+  default     = 0
+}
+
+variable "geo_restriction_type" {
+  description = "Geo restriction type (none, whitelist, blacklist)"
+  type        = string
+  default     = "none"
+}
+
+variable "geo_restriction_locations" {
+  description = "List of country codes for geo restriction"
+  type        = list(string)
+  default     = []
+}
+
+# Backend Configuration (ECS)
+variable "enable_ecs_backend" {
+  description = "Enable ECS Fargate for backend API"
+  type        = bool
+  default     = true
+}
+
+variable "ecs_task_cpu" {
+  description = "CPU units for ECS task"
+  type        = number
+  default     = 512
+}
+
+variable "ecs_task_memory" {
+  description = "Memory for ECS task (MB)"
+  type        = number
+  default     = 1024
+}
+
+variable "ecs_desired_count" {
+  description = "Desired number of ECS tasks"
+  type        = number
+  default     = 2
+}
+
+variable "container_port" {
+  description = "Container port for the application"
+  type        = number
+  default     = 5000
+}
+
+# Database Configuration
+variable "database_url" {
+  description = "PostgreSQL database connection string"
+  type        = string
+  sensitive   = true
+}
+
+variable "session_secret" {
+  description = "Session secret for authentication"
+  type        = string
+  sensitive   = true
+}
+
+# ECR Configuration
+variable "ecr_repository_name" {
+  description = "ECR repository name for Docker images"
+  type        = string
+  default     = "adserver"
+}
+
+variable "image_tag_mutability" {
+  description = "ECR image tag mutability"
+  type        = string
+  default     = "MUTABLE"
+}
+
+variable "image_scan_on_push" {
+  description = "Enable image scanning on push to ECR"
+  type        = bool
+  default     = true
+}
+
+# WAF Configuration
+variable "enable_waf" {
+  description = "Enable AWS WAF for CloudFront"
+  type        = bool
+  default     = true
+}
+
+variable "waf_rate_limit" {
+  description = "Rate limit for WAF (requests per 5 minutes)"
+  type        = number
+  default     = 2000
+}
+
+# Monitoring & Logging
+variable "enable_cloudwatch_logs" {
+  description = "Enable CloudWatch logs"
+  type        = bool
+  default     = true
+}
+
+variable "log_retention_days" {
+  description = "CloudWatch log retention in days"
+  type        = number
+  default     = 30
+}
+
+variable "enable_access_logs" {
+  description = "Enable S3 access logs for CloudFront"
+  type        = bool
+  default     = true
+}
+
+# Tags
+variable "tags" {
+  description = "Additional tags for resources"
+  type        = map(string)
+  default     = {}
+}
+
+# Auto Scaling
+variable "enable_autoscaling" {
+  description = "Enable ECS auto scaling"
+  type        = bool
+  default     = true
+}
+
+variable "autoscaling_min_capacity" {
+  description = "Minimum number of ECS tasks"
+  type        = number
+  default     = 2
+}
+
+variable "autoscaling_max_capacity" {
+  description = "Maximum number of ECS tasks"
+  type        = number
+  default     = 10
+}
+
+variable "autoscaling_target_cpu" {
+  description = "Target CPU utilization percentage for auto scaling"
+  type        = number
+  default     = 70
+}
+
+variable "autoscaling_target_memory" {
+  description = "Target memory utilization percentage for auto scaling"
+  type        = number
+  default     = 80
+}

package/terraform/waf.tf

@@ -0,0 +1,165 @@
+# WAF Web ACL for CloudFront (must be in us-east-1)
+resource "aws_wafv2_web_acl" "cloudfront" {
+  count    = var.enable_waf ? 1 : 0
+  provider = aws.us_east_1
+
+  name  = "${var.project_name}-${var.environment}-waf"
+  scope = "CLOUDFRONT"
+
+  default_action {
+    allow {}
+  }
+
+  # Rate Limiting Rule
+  rule {
+    name     = "RateLimitRule"
+    priority = 1
+
+    action {
+      block {}
+    }
+
+    statement {
+      rate_based_statement {
+        limit              = var.waf_rate_limit
+        aggregate_key_type = "IP"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "RateLimitRule"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  # AWS Managed Rules - Common Rule Set
+  rule {
+    name     = "AWSManagedRulesCommonRuleSet"
+    priority = 2
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "AWSManagedRulesCommonRuleSetMetric"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  # AWS Managed Rules - Known Bad Inputs
+  rule {
+    name     = "AWSManagedRulesKnownBadInputsRuleSet"
+    priority = 3
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "AWSManagedRulesKnownBadInputsRuleSetMetric"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  # AWS Managed Rules - SQL Injection
+  rule {
+    name     = "AWSManagedRulesSQLiRuleSet"
+    priority = 4
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesSQLiRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "AWSManagedRulesSQLiRuleSetMetric"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  # Block IPs with bad reputation
+  rule {
+    name     = "AWSManagedRulesAmazonIpReputationList"
+    priority = 5
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesAmazonIpReputationList"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "AWSManagedRulesAmazonIpReputationListMetric"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "${var.project_name}-${var.environment}-waf"
+    sampled_requests_enabled   = true
+  }
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-waf"
+    }
+  )
+}
+
+# CloudWatch Log Group for WAF
+resource "aws_cloudwatch_log_group" "waf" {
+  count    = var.enable_waf && var.enable_cloudwatch_logs ? 1 : 0
+  provider = aws.us_east_1
+
+  name              = "/aws/wafv2/${var.project_name}-${var.environment}"
+  retention_in_days = var.log_retention_days
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.project_name}-${var.environment}-waf-logs"
+    }
+  )
+}
+
+# WAF Logging Configuration
+resource "aws_wafv2_web_acl_logging_configuration" "cloudfront" {
+  count    = var.enable_waf && var.enable_cloudwatch_logs ? 1 : 0
+  provider = aws.us_east_1
+
+  resource_arn            = aws_wafv2_web_acl.cloudfront[0].arn
+  log_destination_configs = [aws_cloudwatch_log_group.waf[0].arn]
+}

package/terraform-frontend/.terraform.lock.hcl

@@ -0,0 +1,25 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "5.100.0"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:Ijt7pOlB7Tr7maGQIqtsLFbl7pSMIj06TVdkoSBcYOw=",
+    "zh:054b8dd49f0549c9a7cc27d159e45327b7b65cf404da5e5a20da154b90b8a644",
+    "zh:0b97bf8d5e03d15d83cc40b0530a1f84b459354939ba6f135a0086c20ebbe6b2",
+    "zh:1589a2266af699cbd5d80737a0fe02e54ec9cf2ca54e7e00ac51c7359056f274",
+    "zh:6330766f1d85f01ae6ea90d1b214b8b74cc8c1badc4696b165b36ddd4cc15f7b",
+    "zh:7c8c2e30d8e55291b86fcb64bdf6c25489d538688545eb48fd74ad622e5d3862",
+    "zh:99b1003bd9bd32ee323544da897148f46a527f622dc3971af63ea3e251596342",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:9f8b909d3ec50ade83c8062290378b1ec553edef6a447c56dadc01a99f4eaa93",
+    "zh:aaef921ff9aabaf8b1869a86d692ebd24fbd4e12c21205034bb679b9caf883a2",
+    "zh:ac882313207aba00dd5a76dbd572a0ddc818bb9cbf5c9d61b28fe30efaec951e",
+    "zh:bb64e8aff37becab373a1a0cc1080990785304141af42ed6aa3dd4913b000421",
+    "zh:dfe495f6621df5540d9c92ad40b8067376350b005c637ea6efac5dc15028add4",
+    "zh:f0ddf0eaf052766cfe09dea8200a946519f653c384ab4336e2a4a64fdd6310e9",
+    "zh:f1b7e684f4c7ae1eed272b6de7d2049bb87a0275cb04dbb7cda6636f600699c9",
+    "zh:ff461571e3f233699bf690db319dfe46aec75e58726636a0d97dd9ac6e32fb70",
+  ]
+}

package/terraform-frontend/README.md

@@ -0,0 +1,85 @@
+# Terraform Frontend Infrastructure
+
+This directory contains Terraform configuration for deploying the CloudFront distribution for the Influence Adserver frontend.
+
+## Prerequisites
+
+1. **AWS Credentials**: Ensure AWS credentials are configured
+2. **ACM Certificate**: You need an ACM certificate for `influence-stg.movingwalls.com` in `us-east-1`
+3. **S3 Bucket**: The bucket `moving-audience-unified` already exists
+4. **DNS**: Ability to create DNS records for `influence-stg.movingwalls.com`
+
+## Setup Steps
+
+### 1. Get Your ACM Certificate ARN
+
+```bash
+aws acm list-certificates --region us-east-1
+```
+
+Find the certificate for `*.movingwalls.com` or `influence-stg.movingwalls.com` and copy the ARN.
+
+### 2. Update terraform.tfvars
+
+Add your certificate ARN to `terraform.tfvars`:
+
+```hcl
+certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/abc-def-123"
+```
+
+### 3. Initialize Terraform
+
+```bash
+cd terraform-frontend
+terraform init
+```
+
+### 4. Review the Plan
+
+```bash
+terraform plan
+```
+
+### 5. Apply the Configuration
+
+```bash
+terraform apply
+```
+
+## What Gets Created
+
+- **CloudFront Distribution**: CDN distribution for `influence-stg.movingwalls.com`
+- **Origin Access Control**: Secure access to S3 bucket
+- **S3 Bucket Policy**: Updated to allow CloudFront access
+
+## Outputs
+
+After deployment, Terraform will output:
+
+- `cloudfront_distribution_id`: Use this in your CI/CD pipeline
+- `cloudfront_domain_name`: CloudFront URL
+- `deployment_url`: Your custom domain URL
+
+## Next Steps
+
+1. **Update CI/CD**: Add the distribution ID to GitLab CI/CD variables:
+   ```
+   CLOUDFRONT_DISTRIBUTION_ID_STG=E1XXXXXXXXXXXXX
+   ```
+
+2. **Update DNS**: Create a CNAME record:
+   ```
+   influence-stg.movingwalls.com -> d1234abcdef.cloudfront.net
+   ```
+
+3. **Deploy Frontend**: Push to `stg` branch to trigger deployment
+
+## Cleanup
+
+To destroy the infrastructure:
+
+```bash
+terraform destroy
+```
+
+**Note**: This will NOT delete the S3 bucket or its contents.

package/terraform-frontend/cloudfront.tf

@@ -0,0 +1,125 @@
+# CloudFront Origin Access Control for S3
+resource "aws_cloudfront_origin_access_control" "s3_oac" {
+  name                              = "adserver-${var.environment}-oac"
+  description                       = "OAC for ${var.domain_name}"
+  origin_access_control_origin_type = "s3"
+  signing_behavior                  = "always"
+  signing_protocol                  = "sigv4"
+}
+
+# CloudFront Distribution
+resource "aws_cloudfront_distribution" "frontend" {
+  enabled             = true
+  is_ipv6_enabled     = var.enable_ipv6
+  comment             = var.comment
+  default_root_object = "index.html"
+  price_class         = var.price_class
+  aliases             = [var.domain_name]
+
+  origin {
+    domain_name              = "${var.s3_bucket}.s3.${var.aws_region}.amazonaws.com"
+    origin_id                = "S3-${var.s3_bucket}/${var.s3_prefix}"
+    origin_path              = "/${var.s3_prefix}"
+    origin_access_control_id = aws_cloudfront_origin_access_control.s3_oac.id
+  }
+
+  default_cache_behavior {
+    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
+    cached_methods   = ["GET", "HEAD"]
+    target_origin_id = "S3-${var.s3_bucket}/${var.s3_prefix}"
+
+    forwarded_values {
+      query_string = false
+      cookies {
+        forward = "none"
+      }
+    }
+
+    viewer_protocol_policy = "redirect-to-https"
+    min_ttl                = 0
+    default_ttl            = 3600
+    max_ttl                = 86400
+    compress               = true
+  }
+
+  # Cache behavior for static assets (JS, CSS, images)
+  ordered_cache_behavior {
+    path_pattern     = "/assets/*"
+    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
+    cached_methods   = ["GET", "HEAD"]
+    target_origin_id = "S3-${var.s3_bucket}/${var.s3_prefix}"
+
+    forwarded_values {
+      query_string = false
+      cookies {
+        forward = "none"
+      }
+    }
+
+    viewer_protocol_policy = "redirect-to-https"
+    min_ttl                = 31536000
+    default_ttl            = 31536000
+    max_ttl                = 31536000
+    compress               = true
+  }
+
+  # SPA routing - handle all requests with index.html
+  custom_error_response {
+    error_code         = 403
+    response_code      = 200
+    response_page_path = "/index.html"
+  }
+
+  custom_error_response {
+    error_code         = 404
+    response_code      = 200
+    response_page_path = "/index.html"
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    acm_certificate_arn      = var.certificate_arn
+    ssl_support_method       = "sni-only"
+    minimum_protocol_version = "TLSv1.2_2021"
+  }
+
+  tags = {
+    Name        = "adserver-${var.environment}"
+    Environment = var.environment
+    Project     = "influence-adserver"
+  }
+}
+
+# Update S3 bucket policy to allow CloudFront access
+data "aws_s3_bucket" "existing" {
+  bucket = var.s3_bucket
+}
+
+resource "aws_s3_bucket_policy" "cloudfront_access" {
+  bucket = data.aws_s3_bucket.existing.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "AllowCloudFrontServicePrincipal"
+        Effect = "Allow"
+        Principal = {
+          Service = "cloudfront.amazonaws.com"
+        }
+        Action   = "s3:GetObject"
+        Resource = "${data.aws_s3_bucket.existing.arn}/${var.s3_prefix}/*"
+        Condition = {
+          StringEquals = {
+            "AWS:SourceArn" = aws_cloudfront_distribution.frontend.arn
+          }
+        }
+      }
+    ]
+  })
+}

package/terraform-frontend/main.tf

@@ -0,0 +1,31 @@
+# Terraform configuration for Influence Adserver Frontend - Staging
+# This creates only the CloudFront distribution for the static frontend
+# The S3 bucket (moving-audience-unified/influence-adserver-stg) already exists
+
+terraform {
+  required_version = ">= 1.0"
+  
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+
+  # Optional: Configure backend for state storage
+  # backend "s3" {
+  #   bucket = "your-terraform-state-bucket"
+  #   key    = "adserver/staging/terraform.tfstate"
+  #   region = "ap-southeast-1"
+  # }
+}
+
+provider "aws" {
+  region = var.aws_region
+}
+
+# CloudFront requires ACM certificates in us-east-1
+provider "aws" {
+  alias  = "us_east_1"
+  region = "us-east-1"
+}

package/terraform-frontend/outputs.tf

@@ -0,0 +1,24 @@
+output "cloudfront_distribution_id" {
+  description = "CloudFront distribution ID"
+  value       = aws_cloudfront_distribution.frontend.id
+}
+
+output "cloudfront_domain_name" {
+  description = "CloudFront distribution domain name"
+  value       = aws_cloudfront_distribution.frontend.domain_name
+}
+
+output "cloudfront_arn" {
+  description = "CloudFront distribution ARN"
+  value       = aws_cloudfront_distribution.frontend.arn
+}
+
+output "s3_bucket_domain" {
+  description = "S3 bucket domain name"
+  value       = data.aws_s3_bucket.existing.bucket_domain_name
+}
+
+output "deployment_url" {
+  description = "Deployment URL"
+  value       = "https://${var.domain_name}"
+}

package/terraform-frontend/terraform.tfvars

@@ -0,0 +1,12 @@
+# Staging Environment Configuration
+environment      = "staging"
+aws_region       = "ap-southeast-1"
+domain_name      = "influence-stg.movingwalls.com"
+s3_bucket        = "moving-audience-unified"
+s3_prefix        = "influence-adserver-stg"
+price_class      = "PriceClass_All"
+enable_ipv6      = true
+comment          = "MW-Influence-Adserver-FE"
+
+# Wildcard certificate for *.movingwalls.com
+certificate_arn = "arn:aws:acm:us-east-1:966460077433:certificate/3287f309-e4f6-4123-8706-86775a4f268f"