agentic-dev 0.1.0 → 0.2.0

package/infra/terraform/openstack/prod/variables.tf

@@ -0,0 +1,210 @@
+variable "auth_url" {
+  description = "OpenStack Keystone auth URL"
+  type        = string
+}
+
+variable "region" {
+  description = "OpenStack region name"
+  type        = string
+  default     = "RegionOne"
+}
+
+variable "interface" {
+  description = "OpenStack endpoint interface"
+  type        = string
+  default     = "public"
+}
+
+variable "auth_type" {
+  description = "OpenStack auth type (password or application_credential)"
+  type        = string
+  default     = "password"
+}
+
+variable "username" {
+  description = "OpenStack username"
+  type        = string
+  default     = ""
+}
+
+variable "password" {
+  description = "OpenStack password"
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "project_name" {
+  description = "OpenStack project name"
+  type        = string
+  default     = ""
+}
+
+variable "user_domain_name" {
+  description = "OpenStack user domain"
+  type        = string
+  default     = "Default"
+}
+
+variable "project_domain_name" {
+  description = "OpenStack project domain"
+  type        = string
+  default     = "Default"
+}
+
+variable "application_credential_id" {
+  description = "OpenStack application credential id"
+  type        = string
+  default     = ""
+}
+
+variable "application_credential_secret" {
+  description = "OpenStack application credential secret"
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "insecure" {
+  description = "Disable TLS certificate validation"
+  type        = bool
+  default     = false
+}
+
+variable "availability_zone" {
+  description = "Optional availability zone for the PROD host"
+  type        = string
+  default     = ""
+}
+
+variable "create_network" {
+  description = "Create a dedicated PROD network and subnet"
+  type        = bool
+  default     = true
+}
+
+variable "network_name" {
+  description = "PROD network name"
+  type        = string
+  default     = "templates-prod-net"
+}
+
+variable "subnet_name" {
+  description = "PROD subnet name"
+  type        = string
+  default     = "templates-prod-subnet"
+}
+
+variable "subnet_cidr" {
+  description = "PROD subnet CIDR"
+  type        = string
+  default     = "10.250.20.0/24"
+}
+
+variable "create_router" {
+  description = "Create a router and attach the created subnet to the external network"
+  type        = bool
+  default     = true
+}
+
+variable "router_name" {
+  description = "PROD router name"
+  type        = string
+  default     = "templates-prod-router"
+}
+
+variable "external_network_id" {
+  description = "External network id used by the router gateway"
+  type        = string
+  default     = ""
+}
+
+variable "network_id" {
+  description = "Existing network id to reuse when create_network=false"
+  type        = string
+  default     = ""
+}
+
+variable "subnet_id" {
+  description = "Existing subnet id to reuse when create_network=false"
+  type        = string
+  default     = ""
+}
+
+variable "service_allowed_cidrs" {
+  description = "CIDR list allowed to reach published application ports"
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
+variable "ssh_allowed_cidrs" {
+  description = "CIDR list allowed to reach SSH on the PROD host"
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
+variable "name" {
+  description = "PROD host name"
+  type        = string
+  default     = "templates-prod"
+}
+
+variable "image_name" {
+  description = "OpenStack image name"
+  type        = string
+  default     = "ubuntu-22.04"
+}
+
+variable "flavor_name" {
+  description = "OpenStack flavor name"
+  type        = string
+  default     = "m1.large"
+}
+
+variable "keypair_name" {
+  description = "OpenStack keypair name"
+  type        = string
+  default     = ""
+}
+
+variable "assign_floating_ip" {
+  description = "Allocate and associate a floating IP"
+  type        = bool
+  default     = false
+}
+
+variable "floating_ip_pool" {
+  description = "Floating IP pool name"
+  type        = string
+  default     = ""
+}
+
+variable "exposed_tcp_ports" {
+  description = "TCP ports exposed by the PROD stack"
+  type        = list(number)
+  default     = [28000, 23000, 23001, 23002, 24000]
+}
+
+variable "repo_clone_url" {
+  description = "Optional repository clone URL for boot-time deployment"
+  type        = string
+  default     = ""
+}
+
+variable "repo_ref" {
+  description = "Git ref used for boot-time deployment"
+  type        = string
+  default     = "main"
+}
+
+variable "compose_env_content" {
+  description = "Full .env.prod content used for compose boot deployment"
+  type        = string
+  default     = ""
+}
+
+variable "deploy_compose_on_boot" {
+  description = "Clone the repo and run docker compose on first boot"
+  type        = bool
+  default     = false
+}

package/infra/terraform/openstack/prod/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    openstack = {
+      source  = "terraform-provider-openstack/openstack"
+      version = "~> 2.1"
+    }
+  }
+}

package/infra/terraform/openstack/server/.terraform.lock.hcl

@@ -0,0 +1,45 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/random" {
+  version     = "3.8.1"
+  constraints = ">= 3.6.0"
+  hashes = [
+    "h1:Eexl06+6J+s75uD46+WnZtpJZYRVUMB0AiuPBifK6Jc=",
+    "zh:08dd03b918c7b55713026037c5400c48af5b9f468f483463321bd18e17b907b4",
+    "zh:0eee654a5542dc1d41920bbf2419032d6f0d5625b03bd81339e5b33394a3e0ae",
+    "zh:229665ddf060aa0ed315597908483eee5b818a17d09b6417a0f52fd9405c4f57",
+    "zh:2469d2e48f28076254a2a3fc327f184914566d9e40c5780b8d96ebf7205f8bc0",
+    "zh:37d7eb334d9561f335e748280f5535a384a88675af9a9eac439d4cfd663bcb66",
+    "zh:741101426a2f2c52dee37122f0f4a2f2d6af6d852cb1db634480a86398fa3511",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:a902473f08ef8df62cfe6116bd6c157070a93f66622384300de235a533e9d4a9",
+    "zh:b85c511a23e57a2147355932b3b6dce2a11e856b941165793a0c3d7578d94d05",
+    "zh:c5172226d18eaac95b1daac80172287b69d4ce32750c82ad77fa0768be4ea4b8",
+    "zh:dab4434dba34aad569b0bc243c2d3f3ff86dd7740def373f2a49816bd2ff819b",
+    "zh:f49fd62aa8c5525a5c17abd51e27ca5e213881d58882fd42fec4a545b53c9699",
+  ]
+}
+
+provider "registry.terraform.io/terraform-provider-openstack/openstack" {
+  version     = "3.4.0"
+  constraints = ">= 3.3.0"
+  hashes = [
+    "h1:MVSoVvhjbu7s1pfYfsiYED8A++XfAoyOlSX1x9PW68E=",
+    "zh:11b3c88e24197a29b13cf5ab41771944bd16707b561645323e8cbb4f1da00b7b",
+    "zh:1c3e89cf19118fc07d7b04257251fc9897e722c16e0a0df7b07fcd261f8c12e7",
+    "zh:2dc60dbbbb822fbb1e7b17e3b89e3e6a7a8fe54a716d4477d2fa40f836c4de0f",
+    "zh:68f851e333f0ab2367e9b2680739d47e4151ca9f803934ef265f6fa70a28e6e0",
+    "zh:6995b0bcae5a291d7b0a4d3a5df109eb97f8d1d34be6eb27768fe29b5e0d8def",
+    "zh:7b68bf81891a0445c543629d4d160226a6f2d5e8e5ee4baf21e0221412437d17",
+    "zh:8f117b8b17280598a92c6202b183a77168fe573397cfb597b9c2028da281846d",
+    "zh:b0a23b990eb9260e9616fd8471f11b37485f92df0e5eef46cd286f87396b0e0a",
+    "zh:baa5052ab3207f3a996c1fd715935d79a4e1c57d3d24e3c549b6c20ea9307e38",
+    "zh:c012cbda058aa7b76b718074fd73829ecd4009ad98e3dafe496e5f26099625c0",
+    "zh:c1c95e5dbe546a935a62c63814aef04718b58dd4258e5da40d681b43322924e9",
+    "zh:c720bdbdf432041f99572bac40d24659239b989cbf1540f92ebb441900ac8bae",
+    "zh:c92ac802a3dd1abbf9c9ccf0aba1f261fe9f8c2e7fafc196c7119b73c25a0772",
+    "zh:fd4faf25ee72acef4ab12c93ea9c7a5ccb41315e8851609e08b37d3c91ea6584",
+    "zh:ff347392412fc7950635e2c1c5bb878d88b661c1c5ba052edd290d971a14028f",
+  ]
+}

package/infra/terraform/openstack/server/README.md

@@ -0,0 +1,47 @@
+# Template OpenStack Server Terraform
+
+이 스택은 template repo의 backend compute를 Aspace/OpenStack 경로로 올리기 위한 generic baseline이다.
+
+구성 범위:
+
+- `Neutron`: app network + subnet + router
+- `Nova`: backend compute instance 1대
+- `Floating IP`: backend public reachability
+- `Security Group`: backend ingress / SSH ingress
+
+핵심 계약:
+
+- `terraform apply` 한 번으로 backend compute 인스턴스가 올라간다.
+- repo/source 정보(`service_name`, `phase`, `backend_repo_url`, `backend_repo_ref`)는 aspace repo onboarding auto tfvars가 채운다.
+- OpenStack provider 인증값(`auth_url`, `username`, `password`, `project_name` 등)은 aspace 또는 openrc에서 주입한다.
+- application environment는 `backend_env` map으로 주입하고, template는 최소 generic env만 기본값으로 제공한다.
+
+권장 aspace 등록:
+
+```yaml
+deployments:
+  - phase_pattern: dev
+    engine: terraform
+    path: infra/terraform/openstack/server
+    stack: infra/terraform/openstack/server
+    lifecycle_profile: stateful
+    tf_vars:
+      external_network_name: public
+      backend_image_name: ubuntu-24.04-noble-amd64
+      instance_flavor_name: m1.small
+      backend_ingress_cidrs: ["0.0.0.0/0"]
+      ssh_ingress_cidrs: ["0.0.0.0/0"]
+      ssh_keypair_name: template-dev-terminal
+      ssh_public_key: "ssh-ed25519 AAAA..."
+    prechecks:
+      - terraform fmt -check -recursive
+      - terraform validate
+    auto_approve: true
+```
+
+수동 검증:
+
+```bash
+terraform -chdir=infra/terraform/openstack/server init -backend=false
+terraform -chdir=infra/terraform/openstack/server validate
+```

package/infra/terraform/openstack/server/main.tf

@@ -0,0 +1,161 @@
+resource "random_password" "jwt" {
+  count   = var.jwt_secret_key == "" ? 1 : 0
+  length  = 40
+  special = false
+}
+
+locals {
+  phase                = lower(var.phase)
+  stack_name           = "${var.service_name}-${local.phase}"
+  app_network_name     = var.app_network_name != "" ? var.app_network_name : "${local.stack_name}-net"
+  app_subnet_name      = var.app_subnet_name != "" ? var.app_subnet_name : "${local.stack_name}-subnet"
+  effective_jwt_secret = var.jwt_secret_key != "" ? var.jwt_secret_key : random_password.jwt[0].result
+  power_state          = lower(var.desired_state) == "stopped" ? "shutoff" : "active"
+  runtime_root         = "/opt/${var.service_name}"
+  common_tags = merge(
+    {
+      Name       = local.stack_name
+      Service    = var.service_name
+      Phase      = local.phase
+      ManagedBy  = "terraform"
+      ManagedVia = "aspace"
+      Cloud      = "openstack"
+    },
+    var.tags,
+  )
+  backend_env_lines = concat(
+    [
+      "APP_NAME=${var.application_name}",
+      "DEBUG=${local.phase == "prod" ? "false" : "true"}",
+      "JWT_SECRET_KEY=${local.effective_jwt_secret}"
+    ],
+    [for key, value in var.backend_env : "${key}=${value}"]
+  )
+}
+
+data "openstack_images_image_v2" "backend" {
+  name        = var.backend_image_name
+  most_recent = true
+}
+
+data "openstack_compute_flavor_v2" "backend" {
+  name = var.instance_flavor_name
+}
+
+data "openstack_networking_network_v2" "external" {
+  name     = var.external_network_name
+  external = true
+}
+
+resource "openstack_networking_network_v2" "app" {
+  name           = local.app_network_name
+  admin_state_up = true
+}
+
+resource "openstack_networking_subnet_v2" "app" {
+  name            = local.app_subnet_name
+  network_id      = openstack_networking_network_v2.app.id
+  cidr            = var.app_subnet_cidr
+  ip_version      = 4
+  dns_nameservers = var.dns_nameservers
+}
+
+resource "openstack_networking_router_v2" "app" {
+  name                = "${local.stack_name}-router"
+  external_network_id = data.openstack_networking_network_v2.external.id
+  enable_snat         = true
+}
+
+resource "openstack_networking_router_interface_v2" "app" {
+  router_id = openstack_networking_router_v2.app.id
+  subnet_id = openstack_networking_subnet_v2.app.id
+}
+
+resource "openstack_networking_secgroup_v2" "backend" {
+  name                 = "${local.stack_name}-backend"
+  description          = "Template backend ingress"
+  delete_default_rules = true
+}
+
+resource "openstack_networking_secgroup_rule_v2" "backend_http" {
+  for_each          = toset(var.backend_ingress_cidrs)
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = "tcp"
+  port_range_min    = var.backend_port
+  port_range_max    = var.backend_port
+  remote_ip_prefix  = each.value
+  security_group_id = openstack_networking_secgroup_v2.backend.id
+}
+
+resource "openstack_networking_secgroup_rule_v2" "backend_ssh" {
+  for_each          = toset(var.ssh_ingress_cidrs)
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = "tcp"
+  port_range_min    = 22
+  port_range_max    = 22
+  remote_ip_prefix  = each.value
+  security_group_id = openstack_networking_secgroup_v2.backend.id
+}
+
+resource "openstack_networking_secgroup_rule_v2" "backend_egress" {
+  direction         = "egress"
+  ethertype         = "IPv4"
+  remote_ip_prefix  = "0.0.0.0/0"
+  security_group_id = openstack_networking_secgroup_v2.backend.id
+}
+
+resource "openstack_compute_keypair_v2" "terminal" {
+  count      = trimspace(var.ssh_public_key) != "" ? 1 : 0
+  name       = trimspace(var.ssh_keypair_name) != "" ? trimspace(var.ssh_keypair_name) : "${local.stack_name}-terminal"
+  public_key = trimspace(var.ssh_public_key)
+}
+
+resource "openstack_networking_port_v2" "backend" {
+  name               = "${local.stack_name}-backend"
+  network_id         = openstack_networking_network_v2.app.id
+  security_group_ids = [openstack_networking_secgroup_v2.backend.id]
+
+  fixed_ip {
+    subnet_id = openstack_networking_subnet_v2.app.id
+  }
+}
+
+resource "openstack_compute_instance_v2" "backend" {
+  name         = "${local.stack_name}-backend"
+  image_id     = data.openstack_images_image_v2.backend.id
+  flavor_id    = data.openstack_compute_flavor_v2.backend.id
+  key_pair     = length(openstack_compute_keypair_v2.terminal) > 0 ? openstack_compute_keypair_v2.terminal[0].name : null
+  config_drive = true
+  user_data = templatefile("${path.module}/templates/server-user-data.sh.tftpl", {
+    runtime_root            = local.runtime_root
+    service_name            = var.service_name
+    backend_container_image = var.backend_container_image
+    backend_container_name  = var.backend_container_name
+    backend_port            = var.backend_port
+    backend_repo_url        = var.backend_repo_url
+    backend_repo_ref        = var.backend_repo_ref
+    backend_repo_subdir     = var.backend_repo_subdir
+    backend_env_text        = join("\n", local.backend_env_lines)
+  })
+  power_state = local.power_state
+  metadata    = local.common_tags
+
+  network {
+    port = openstack_networking_port_v2.backend.id
+  }
+
+  depends_on = [openstack_networking_router_interface_v2.app]
+}
+
+resource "openstack_networking_floatingip_v2" "backend" {
+  count = var.associate_floating_ip ? 1 : 0
+  pool  = var.external_network_name
+}
+
+resource "openstack_networking_floatingip_associate_v2" "backend" {
+  count       = var.associate_floating_ip ? 1 : 0
+  floating_ip = openstack_networking_floatingip_v2.backend[0].address
+  port_id     = openstack_networking_port_v2.backend.id
+}

package/infra/terraform/openstack/server/outputs.tf

@@ -0,0 +1,30 @@
+output "backend_instance_id" {
+  value       = openstack_compute_instance_v2.backend.id
+  description = "Server compute instance id."
+}
+
+output "backend_fixed_ip" {
+  value       = try(openstack_networking_port_v2.backend.all_fixed_ips[0], "")
+  description = "Server fixed IP address."
+}
+
+output "backend_public_ip" {
+  value       = try(openstack_networking_floatingip_v2.backend[0].address, "")
+  description = "Server floating IP."
+}
+
+output "backend_origin_url" {
+  value       = try(openstack_networking_floatingip_v2.backend[0].address, "") != "" ? "http://${openstack_networking_floatingip_v2.backend[0].address}:${var.backend_port}" : "http://${try(openstack_networking_port_v2.backend.all_fixed_ips[0], "")}:${var.backend_port}"
+  description = "Reachable backend origin URL."
+}
+
+output "app_network_id" {
+  value       = openstack_networking_network_v2.app.id
+  description = "App network id."
+}
+
+output "generated_jwt_secret" {
+  value       = local.effective_jwt_secret
+  description = "Effective JWT secret."
+  sensitive   = true
+}

package/infra/terraform/openstack/server/providers.tf

@@ -0,0 +1,30 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    openstack = {
+      source  = "terraform-provider-openstack/openstack"
+      version = ">= 3.3.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.6.0"
+    }
+  }
+}
+
+provider "openstack" {
+  auth_url      = var.auth_url
+  region        = var.region
+  endpoint_type = var.interface
+  insecure      = var.insecure
+
+  user_name           = var.auth_type == "password" ? var.username : null
+  password            = var.auth_type == "password" ? var.password : null
+  tenant_name         = var.auth_type == "password" ? var.project_name : null
+  user_domain_name    = var.auth_type == "password" ? var.user_domain_name : null
+  project_domain_name = var.auth_type == "password" ? var.project_domain_name : null
+
+  application_credential_id     = var.auth_type == "application_credential" ? var.application_credential_id : null
+  application_credential_secret = var.auth_type == "application_credential" ? var.application_credential_secret : null
+}

package/infra/terraform/openstack/server/templates/server-user-data.sh.tftpl

@@ -0,0 +1,50 @@
+#!/bin/bash
+set -Eeuo pipefail
+
+mkdir -p ${runtime_root}
+
+cat > ${runtime_root}/server.env <<'ENVEOF'
+${backend_env_text}
+ENVEOF
+
+install_container_runtime() {
+  if command -v apt-get >/dev/null 2>&1; then
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update
+    apt-get install -y docker.io git ca-certificates curl
+  elif command -v dnf >/dev/null 2>&1; then
+    dnf update -y
+    dnf install -y docker git ca-certificates curl
+  else
+    yum update -y
+    yum install -y docker git ca-certificates curl
+  fi
+
+  systemctl enable docker
+  systemctl start docker
+  usermod -aG docker ubuntu >/dev/null 2>&1 || true
+
+  docker rm -f ${backend_container_name} >/dev/null 2>&1 || true
+
+  if [ -n "${backend_container_image}" ]; then
+    docker pull "${backend_container_image}"
+    docker run -d \
+      --name "${backend_container_name}" \
+      --restart unless-stopped \
+      --env-file ${runtime_root}/server.env \
+      -p ${backend_port}:${backend_port} \
+      "${backend_container_image}"
+  elif [ -n "${backend_repo_url}" ]; then
+    rm -rf "${runtime_root}/src"
+    git clone --depth 1 --branch "${backend_repo_ref}" "${backend_repo_url}" "${runtime_root}/src"
+    docker build -t ${backend_container_name}:bootstrap "${runtime_root}/src/${backend_repo_subdir}"
+    docker run -d \
+      --name "${backend_container_name}" \
+      --restart unless-stopped \
+      --env-file ${runtime_root}/server.env \
+      -p ${backend_port}:${backend_port} \
+      ${backend_container_name}:bootstrap
+  fi
+}
+
+install_container_runtime