agentic-dev 0.1.0 → 0.2.1

package/infra/terraform/aws/domain/main.tf

@@ -0,0 +1,149 @@
+provider "aws" {
+  region = var.aws_region
+}
+
+provider "aws" {
+  alias  = "us_east_1"
+  region = "us-east-1"
+}
+
+locals {
+  phase       = lower(var.phase)
+  root_domain = lower(trimspace(var.root_domain))
+  service_fqdn = lower(
+    trimspace(var.service_fqdn) != ""
+    ? var.service_fqdn
+    : (local.phase == "prod" ? local.root_domain : "dev.${local.root_domain}")
+  )
+  origin_fqdn = "origin.${local.service_fqdn}"
+  origin_id   = replace(local.origin_fqdn, ".", "-")
+}
+
+data "aws_route53_zone" "root" {
+  name         = "${local.root_domain}."
+  private_zone = false
+}
+
+resource "aws_route53_record" "origin_a" {
+  count   = var.enabled ? 1 : 0
+  zone_id = data.aws_route53_zone.root.zone_id
+  name    = local.origin_fqdn
+  type    = "A"
+  ttl     = var.ttl
+  records = [var.target_ip]
+
+  allow_overwrite = true
+}
+
+resource "aws_acm_certificate" "service" {
+  count             = var.enabled && var.cdn_enabled ? 1 : 0
+  provider          = aws.us_east_1
+  domain_name       = local.service_fqdn
+  validation_method = "DNS"
+}
+
+resource "aws_route53_record" "cert_validation" {
+  for_each = var.enabled && var.cdn_enabled ? {
+    for dvo in aws_acm_certificate.service[0].domain_validation_options : dvo.domain_name => {
+      name   = dvo.resource_record_name
+      record = dvo.resource_record_value
+      type   = dvo.resource_record_type
+    }
+  } : {}
+
+  zone_id = data.aws_route53_zone.root.zone_id
+  name    = each.value.name
+  type    = each.value.type
+  ttl     = 60
+  records = [each.value.record]
+
+  allow_overwrite = true
+}
+
+resource "aws_acm_certificate_validation" "service" {
+  count                   = var.enabled && var.cdn_enabled ? 1 : 0
+  provider                = aws.us_east_1
+  certificate_arn         = aws_acm_certificate.service[0].arn
+  validation_record_fqdns = [for row in aws_route53_record.cert_validation : row.fqdn]
+}
+
+resource "aws_cloudfront_distribution" "service" {
+  count           = var.enabled && var.cdn_enabled ? 1 : 0
+  enabled         = true
+  is_ipv6_enabled = true
+  price_class     = var.cdn_price_class
+  comment         = "template edge for ${local.service_fqdn}"
+  aliases         = [local.service_fqdn]
+
+  origin {
+    domain_name = local.origin_fqdn
+    origin_id   = local.origin_id
+
+    custom_origin_config {
+      http_port              = var.origin_port
+      https_port             = 443
+      origin_protocol_policy = "http-only"
+      origin_ssl_protocols   = ["TLSv1.2"]
+    }
+  }
+
+  default_cache_behavior {
+    target_origin_id       = local.origin_id
+    viewer_protocol_policy = "redirect-to-https"
+    compress               = true
+    allowed_methods        = ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"]
+    cached_methods         = ["GET", "HEAD", "OPTIONS"]
+
+    forwarded_values {
+      query_string = true
+      headers      = ["*"]
+
+      cookies {
+        forward = "all"
+      }
+    }
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    acm_certificate_arn      = aws_acm_certificate_validation.service[0].certificate_arn
+    ssl_support_method       = "sni-only"
+    minimum_protocol_version = "TLSv1.2_2021"
+  }
+
+  depends_on = [
+    aws_route53_record.origin_a,
+    aws_acm_certificate_validation.service,
+  ]
+}
+
+resource "aws_route53_record" "service_alias" {
+  count   = var.enabled && var.cdn_enabled ? 1 : 0
+  zone_id = data.aws_route53_zone.root.zone_id
+  name    = local.service_fqdn
+  type    = "A"
+
+  alias {
+    name                   = aws_cloudfront_distribution.service[0].domain_name
+    zone_id                = aws_cloudfront_distribution.service[0].hosted_zone_id
+    evaluate_target_health = false
+  }
+
+  allow_overwrite = true
+}
+
+resource "aws_route53_record" "service_a" {
+  count   = var.enabled && !var.cdn_enabled ? 1 : 0
+  zone_id = data.aws_route53_zone.root.zone_id
+  name    = local.service_fqdn
+  type    = "A"
+  ttl     = var.ttl
+  records = [var.target_ip]
+
+  allow_overwrite = true
+}

package/infra/terraform/aws/domain/outputs.tf

@@ -0,0 +1,29 @@
+output "service_fqdn" {
+  value       = local.service_fqdn
+  description = "Managed public service domain."
+}
+
+output "origin_fqdn" {
+  value       = local.origin_fqdn
+  description = "Origin DNS name that points to the OpenStack backend."
+}
+
+output "origin_url" {
+  value       = "http://${local.origin_fqdn}:${var.origin_port}"
+  description = "Origin URL that CloudFront points to."
+}
+
+output "root_domain" {
+  value       = local.root_domain
+  description = "Resolved root domain."
+}
+
+output "cloudfront_domain_name" {
+  value       = var.cdn_enabled ? aws_cloudfront_distribution.service[0].domain_name : ""
+  description = "CloudFront distribution domain."
+}
+
+output "cloudfront_distribution_id" {
+  value       = var.cdn_enabled ? aws_cloudfront_distribution.service[0].id : ""
+  description = "CloudFront distribution id."
+}

package/infra/terraform/aws/domain/variables.tf

@@ -0,0 +1,58 @@
+variable "phase" {
+  type        = string
+  description = "Deployment phase."
+  default     = "dev"
+}
+
+variable "root_domain" {
+  type        = string
+  description = "Hosted zone root domain."
+  default     = "example.com"
+}
+
+variable "service_fqdn" {
+  type        = string
+  description = "Optional explicit final service domain."
+  default     = ""
+}
+
+variable "aws_region" {
+  type        = string
+  description = "AWS region for Route53 and general provider calls."
+  default     = "ap-northeast-2"
+}
+
+variable "target_ip" {
+  type        = string
+  description = "Origin target IPv4."
+}
+
+variable "origin_port" {
+  type        = number
+  description = "Origin backend port."
+  default     = 8080
+}
+
+variable "ttl" {
+  type        = number
+  description = "DNS TTL."
+  default     = 60
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Enable record management."
+  default     = true
+}
+
+variable "cdn_enabled" {
+  type        = bool
+  description = "Enable CloudFront distribution and alias record."
+  default     = true
+}
+
+variable "cdn_price_class" {
+  type        = string
+  description = "CloudFront price class."
+  default     = "PriceClass_200"
+}

package/infra/terraform/aws/domain/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}

package/infra/terraform/openstack/README.md

@@ -0,0 +1,38 @@
+# OpenStack Terraform
+
+OpenStack provider는 공용 축으로 두되, canonical compute baseline은 `server/` root를 우선한다.
+
+구조:
+
+- `modules/environment_host`: OpenStack Docker host 공통 module
+- `server/`: Aspace/OpenStack backend compute canonical root
+- `dev/`: DEV(개발계)용 Terraform root
+- `prod/`: PROD용 Terraform root
+
+원칙:
+
+- canonical delivery split에서는 `openstack/server`가 backend compute를 담당하고, `aws/domain`과 `aws/data`가 외곽 surface를 담당한다.
+- DEV(개발계)와 PROD는 state를 분리한다.
+- compose 자동 기동이 필요하면 각 환경 root의 `compose_env_content`에 대응 환경의 `.env` 전체를 넣는다.
+- 네트워크를 공유하려면 `create_network=false`와 `network_id`/`subnet_id`를 사용한다.
+
+사용:
+
+```bash
+cd infra/terraform/openstack/server
+cp zz_aspace.auto.tfvars.example.json zz_aspace.auto.tfvars.json
+terraform init -backend=false
+terraform validate
+
+cd infra/terraform/openstack/dev
+cp terraform.tfvars.example terraform.tfvars
+terraform init
+terraform validate
+terraform plan
+
+cd ../prod
+cp terraform.tfvars.example terraform.tfvars
+terraform init
+terraform validate
+terraform plan
+```

package/infra/terraform/openstack/dev/.terraform.lock.hcl

@@ -0,0 +1,24 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/terraform-provider-openstack/openstack" {
+  version     = "2.1.0"
+  constraints = "~> 2.1"
+  hashes = [
+    "h1:2TcmfEzBOGQPALErrXTaL6v+k/WAL40adao4izRYmdw=",
+    "zh:113661750398bf21c8fe36aade9fb6f5eb82b5bcd3bcd30bd37ac805d83398f4",
+    "zh:1b3c26347b9cd61e413ee93c2f422cc3278a77f55fd3516eaabb3e2a85f65281",
+    "zh:1b751bbf1e4152829a643b532fd3f5967a2e89a41fac381257e0b41665be3306",
+    "zh:1b967bbfd9b344419c0e0df0c3a15fcbd731e91f19a18955a55aace8d9ec039a",
+    "zh:1bc0fc7c0a21e568db043b654501ce668ba19bf7628d37a7d2aaa512fd6e5aeb",
+    "zh:425cbf61757d4b503e7bf0f409ea59835ca3afbd2432d56ad552c2e5d234a572",
+    "zh:67d4f059cb4d73bf6c060313ec32962c4e5bd8dc7be2542a6f2098ab32575cd9",
+    "zh:7fe841ac5b68a4f52fb3cf45070828f3845de44746679d434e4349f3c23e3ef2",
+    "zh:ac1ed4c6ef0b6a3410568a05d3f9933d184497f065988503c43da0b2f0786ab2",
+    "zh:c5c0d14c86fabd9ab6a5d555e6a8d511942665fb5fa948dd452b0d1934068344",
+    "zh:c9ae5c210192275185d6823566a9421983e8e64c2665a4cae00b92dd0706bd19",
+    "zh:ee9865ccc053e7f345e532654fb628d1cf1e81cd2e929643c1691bebffcf7b98",
+    "zh:f3416d2f666095e740522c4964e436470bb9ec17bd53aaae8169ad93297d07bd",
+    "zh:fbca85457dd49e17168989d64f7cfc4a519d55ef4e00e89cea2859e87ad87f83",
+  ]
+}

package/infra/terraform/openstack/dev/README.md

@@ -0,0 +1,18 @@
+# OpenStack DEV
+
+DEV(개발계) 전용 Terraform root다.
+
+사용:
+
+```bash
+cd infra/terraform/openstack/dev
+cp terraform.tfvars.example terraform.tfvars
+terraform init
+terraform validate
+terraform plan
+```
+
+메모:
+
+- 기본 compose 파일은 `infra/compose/dev.yml`이다.
+- cloud-init 자동 기동을 쓰려면 `compose_env_content`에 `infra/compose/.env.dev` 전체를 넣는다.

package/infra/terraform/openstack/dev/main.tf

@@ -0,0 +1,49 @@
+module "environment_host" {
+  source = "../modules/environment_host"
+
+  availability_zone      = var.availability_zone
+  create_network         = var.create_network
+  network_name           = var.network_name
+  subnet_name            = var.subnet_name
+  subnet_cidr            = var.subnet_cidr
+  create_router          = var.create_router
+  router_name            = var.router_name
+  external_network_id    = var.external_network_id
+  network_id             = var.network_id
+  subnet_id              = var.subnet_id
+  service_allowed_cidrs  = var.service_allowed_cidrs
+  ssh_allowed_cidrs      = var.ssh_allowed_cidrs
+  name                   = var.name
+  image_name             = var.image_name
+  flavor_name            = var.flavor_name
+  keypair_name           = var.keypair_name
+  assign_floating_ip     = var.assign_floating_ip
+  floating_ip_pool       = var.floating_ip_pool
+  exposed_tcp_ports      = var.exposed_tcp_ports
+  repo_clone_url         = var.repo_clone_url
+  repo_ref               = var.repo_ref
+  compose_file           = "infra/compose/dev.yml"
+  compose_env_filename   = ".env.dev"
+  compose_env_content    = var.compose_env_content
+  deploy_compose_on_boot = var.deploy_compose_on_boot
+}
+
+output "network_id" {
+  description = "Effective network id used by the DEV(개발계) host"
+  value       = module.environment_host.network_id
+}
+
+output "subnet_id" {
+  description = "Effective subnet id used by the DEV(개발계) host"
+  value       = module.environment_host.subnet_id
+}
+
+output "router_id" {
+  description = "Created router id when create_router=true"
+  value       = module.environment_host.router_id
+}
+
+output "instance" {
+  description = "DEV(개발계) host summary"
+  value       = module.environment_host.instance
+}

package/infra/terraform/openstack/dev/providers.tf

@@ -0,0 +1,15 @@
+provider "openstack" {
+  auth_url      = var.auth_url
+  region        = var.region
+  endpoint_type = var.interface
+  insecure      = var.insecure
+
+  user_name           = var.auth_type == "password" ? var.username : null
+  password            = var.auth_type == "password" ? var.password : null
+  tenant_name         = var.auth_type == "password" ? var.project_name : null
+  user_domain_name    = var.auth_type == "password" ? var.user_domain_name : null
+  project_domain_name = var.auth_type == "password" ? var.project_domain_name : null
+
+  application_credential_id     = var.auth_type == "application_credential" ? var.application_credential_id : null
+  application_credential_secret = var.auth_type == "application_credential" ? var.application_credential_secret : null
+}

package/infra/terraform/openstack/dev/terraform.tfvars.example

@@ -0,0 +1,54 @@
+auth_url      = "https://keystone.example.com:5000/v3"
+region        = "RegionOne"
+interface     = "public"
+auth_type     = "password"
+username      = "devops"
+password      = "change-me"
+project_name  = "service-dev"
+user_domain_name    = "Default"
+project_domain_name = "Default"
+insecure      = false
+
+create_network      = true
+network_name        = "templates-dev-net"
+subnet_name         = "templates-dev-subnet"
+subnet_cidr         = "10.250.10.0/24"
+create_router       = true
+router_name         = "templates-dev-router"
+external_network_id = "public"
+
+service_allowed_cidrs = ["0.0.0.0/0"]
+ssh_allowed_cidrs     = ["203.0.113.10/32"]
+
+name               = "templates-dev"
+image_name         = "ubuntu-22.04"
+flavor_name        = "m1.medium"
+keypair_name       = "devops"
+assign_floating_ip = true
+floating_ip_pool   = "public"
+repo_clone_url     = "git@github.com:your-org/templates.git"
+repo_ref           = "main"
+deploy_compose_on_boot = true
+compose_env_content = <<-ENV
+  DEV_POSTGRES_DB=template
+  DEV_POSTGRES_USER=template
+  DEV_POSTGRES_PASSWORD=template
+  DEV_POSTGRES_PORT=15432
+  DEV_SERVER_HTTP_PORT=18000
+  DEV_SERVER_APP_NAME=Template Server DEV
+  DEV_SERVER_ENVIRONMENT=development
+  DEV_SERVER_API_PREFIX=/api/v1
+  DEV_SERVER_DATABASE_BACKEND=postgres
+  DEV_SERVER_POSTGRES_URL=postgresql+psycopg://template:template@postgres:5432/template
+  DEV_SERVER_JWT_SECRET=change-me
+  DEV_SERVER_ACCESS_TOKEN_TTL_MINUTES=120
+  DEV_SERVER_CORS_ORIGINS=https://dev-landing.example.com,https://dev-platform.example.com,https://dev-mobile.example.com,https://dev-admin.example.com
+  DEV_CLIENT_LANDING_PORT=13000
+  DEV_CLIENT_PLATFORM_PORT=13001
+  DEV_CLIENT_MOBILE_PORT=13002
+  DEV_CLIENT_ADMIN_PORT=14000
+  DEV_CLIENT_LANDING_VITE_API_BASE_URL=https://dev-api.example.com/api/v1
+  DEV_CLIENT_PLATFORM_VITE_API_BASE_URL=https://dev-api.example.com/api/v1
+  DEV_CLIENT_MOBILE_VITE_API_BASE_URL=https://dev-api.example.com/api/v1
+  DEV_CLIENT_ADMIN_VITE_API_BASE_URL=https://dev-api.example.com/api/v1
+ENV

package/infra/terraform/openstack/dev/variables.tf

@@ -0,0 +1,210 @@
+variable "auth_url" {
+  description = "OpenStack Keystone auth URL"
+  type        = string
+}
+
+variable "region" {
+  description = "OpenStack region name"
+  type        = string
+  default     = "RegionOne"
+}
+
+variable "interface" {
+  description = "OpenStack endpoint interface"
+  type        = string
+  default     = "public"
+}
+
+variable "auth_type" {
+  description = "OpenStack auth type (password or application_credential)"
+  type        = string
+  default     = "password"
+}
+
+variable "username" {
+  description = "OpenStack username"
+  type        = string
+  default     = ""
+}
+
+variable "password" {
+  description = "OpenStack password"
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "project_name" {
+  description = "OpenStack project name"
+  type        = string
+  default     = ""
+}
+
+variable "user_domain_name" {
+  description = "OpenStack user domain"
+  type        = string
+  default     = "Default"
+}
+
+variable "project_domain_name" {
+  description = "OpenStack project domain"
+  type        = string
+  default     = "Default"
+}
+
+variable "application_credential_id" {
+  description = "OpenStack application credential id"
+  type        = string
+  default     = ""
+}
+
+variable "application_credential_secret" {
+  description = "OpenStack application credential secret"
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "insecure" {
+  description = "Disable TLS certificate validation"
+  type        = bool
+  default     = false
+}
+
+variable "availability_zone" {
+  description = "Optional availability zone for the DEV(개발계) host"
+  type        = string
+  default     = ""
+}
+
+variable "create_network" {
+  description = "Create a dedicated DEV(개발계) network and subnet"
+  type        = bool
+  default     = true
+}
+
+variable "network_name" {
+  description = "DEV(개발계) network name"
+  type        = string
+  default     = "templates-dev-net"
+}
+
+variable "subnet_name" {
+  description = "DEV(개발계) subnet name"
+  type        = string
+  default     = "templates-dev-subnet"
+}
+
+variable "subnet_cidr" {
+  description = "DEV(개발계) subnet CIDR"
+  type        = string
+  default     = "10.250.10.0/24"
+}
+
+variable "create_router" {
+  description = "Create a router and attach the created subnet to the external network"
+  type        = bool
+  default     = true
+}
+
+variable "router_name" {
+  description = "DEV(개발계) router name"
+  type        = string
+  default     = "templates-dev-router"
+}
+
+variable "external_network_id" {
+  description = "External network id used by the router gateway"
+  type        = string
+  default     = ""
+}
+
+variable "network_id" {
+  description = "Existing network id to reuse when create_network=false"
+  type        = string
+  default     = ""
+}
+
+variable "subnet_id" {
+  description = "Existing subnet id to reuse when create_network=false"
+  type        = string
+  default     = ""
+}
+
+variable "service_allowed_cidrs" {
+  description = "CIDR list allowed to reach published application ports"
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
+variable "ssh_allowed_cidrs" {
+  description = "CIDR list allowed to reach SSH on the DEV(개발계) host"
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
+variable "name" {
+  description = "DEV(개발계) host name"
+  type        = string
+  default     = "templates-dev"
+}
+
+variable "image_name" {
+  description = "OpenStack image name"
+  type        = string
+  default     = "ubuntu-22.04"
+}
+
+variable "flavor_name" {
+  description = "OpenStack flavor name"
+  type        = string
+  default     = "m1.medium"
+}
+
+variable "keypair_name" {
+  description = "OpenStack keypair name"
+  type        = string
+  default     = ""
+}
+
+variable "assign_floating_ip" {
+  description = "Allocate and associate a floating IP"
+  type        = bool
+  default     = false
+}
+
+variable "floating_ip_pool" {
+  description = "Floating IP pool name"
+  type        = string
+  default     = ""
+}
+
+variable "exposed_tcp_ports" {
+  description = "TCP ports exposed by the DEV(개발계) stack"
+  type        = list(number)
+  default     = [18000, 13000, 13001, 13002, 14000]
+}
+
+variable "repo_clone_url" {
+  description = "Optional repository clone URL for boot-time deployment"
+  type        = string
+  default     = ""
+}
+
+variable "repo_ref" {
+  description = "Git ref used for boot-time deployment"
+  type        = string
+  default     = "main"
+}
+
+variable "compose_env_content" {
+  description = "Full .env.dev content used for compose boot deployment"
+  type        = string
+  default     = ""
+}
+
+variable "deploy_compose_on_boot" {
+  description = "Clone the repo and run docker compose on first boot"
+  type        = bool
+  default     = false
+}

package/infra/terraform/openstack/dev/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    openstack = {
+      source  = "terraform-provider-openstack/openstack"
+      version = "~> 2.1"
+    }
+  }
+}