deploy-stack 0.12.3 → 0.13.0

package/README.md

@@ -30,6 +30,7 @@ You retain complete ownership of your infrastructure code without relying on bla
 **🚀 Zero-Config Deployments**
 * **Framework Agnostic:** Tailored container presets for Next.js, Express.js, FastAPI, Go, Django, Rails, Nuxt 3, and Static Sites (React, Vue, SvelteKit, Astro).
 * **Smart Discovery:** Automatically detects build output directories and generates highly optimized, multi-stage Dockerfiles.
+* **PaaS Migration Engine:** Natively parses Heroku `Procfile` configurations to automatically translate web and background worker processes (like Celery or Sidekiq) into multi-container AWS Fargate architectures.
 * **Database Scaffolding:** Automatically provisions fully isolated, zero-trust AWS RDS PostgreSQL databases for backend monoliths.
 
 **🛡️ DevSecOps & Security**
@@ -83,7 +84,7 @@ The interactive wizard will analyze your codebase, detect your framework, estima
   Strips all `deploy-stack` metadata and management tags from your project, leaving behind pure, standard Terraform and GitHub Actions files. You retain 100% ownership.
 
 * **`npx deploy-stack --headless`**
-  Bypasses the interactive wizard for fully programmatic execution. Perfect for CI/CD pipelines, custom scripts, or AI agent integration. Accepts flags like `--framework=static`, `--region=us-east-1`, and `--size=micro`.
+  Bypasses the interactive wizard for fully programmatic execution. Perfect for CI/CD pipelines, custom scripts, or AI agent integration. Accepts flags like `--framework=static`, `--region=us-east-2`, and `--size=micro`.
 
 ---
 
@@ -123,6 +124,7 @@ your-project/
 * **[Ruby on Rails](https://github.com/anton-codes-iac/deploy-stack-rails-example):** A production Rails 7+ setup featuring an auto-provisioned PostgreSQL database and secure `.auto.tfvars` Master Key injection.
 * **[Nuxt 3 (SSR)](https://github.com/anton-codes-iac/deploy-stack-nuxt-example):** Demonstrates a fully server-side rendered Nuxt application using Nitro's optimized Node output.
 * **[Django / Python](https://github.com/anton-codes-iac/deploy-stack-django-example):** A secure Gunicorn/WSGI implementation with PostgreSQL and unprivileged container adapters.
+* **[Heroku to AWS Migration (Django)](https://github.com/anton-codes-iac/deploy-stack-heroku-django-example):** A classic Heroku-style monolith migrated via the Procfile Importer, demonstrating a multi-container Web and Celery Worker architecture deployed from a single codebase.
 * **[Go / Fiber](https://github.com/anton-codes-iac/deploy-stack-go-example):** A distroless, compiled Go binary deployment demonstrating ultra-low memory footprints and instant boot times.
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.12.3",
+  "version": "0.13.0",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "engines": {
     "node": ">=18.0.0"

package/src/commands/apply.js

@@ -111,7 +111,7 @@ export async function applyStack(options = {}) {
         // 6. Run terraform apply
         s.start('Provisioning AWS infrastructure (this may take 3–5 minutes)...');
         await runTerraformCommand(['apply', '-auto-approve'], tfDir, s, 'Provisioning');
-        s.stop('AWS infrastructure provisioned successfully!');
+        s.stop('Cloud resources provisioned.');
 
         // 7. Extract and print the outputs
         const outputs = await getTerraformOutputs(tfDir);

package/src/commands/destroy.js

@@ -77,7 +77,7 @@ export async function destroyStack() {
     const regionMatch = backendContent.match(/region\s*=\s*"([^"]+)"/);
 
     const bucketName = bucketMatch ? bucketMatch[1] : null;
-    const region = regionMatch ? regionMatch[1] : 'us-east-1';
+    const region = regionMatch ? regionMatch[1] : 'us-east-2';
 
     // 2. Execute Terraform Destroy
     s.start('Destroying AWS compute resources (this takes a few minutes)...');

package/src/commands/init.js

@@ -6,7 +6,7 @@ import color from 'picocolors';
 import { execSync } from 'child_process';
 
 import { checkDependency } from '../utils/system.js';
-import { detectFramework } from '../utils/detector.js';
+import { detectFramework, parseProcfile } from '../utils/detector.js';
 import { trackEvent, flushTelemetry } from '../core/telemetry.js';
 import { getFrameworkWarning } from '../utils/warnings.js';
 import { provisionStateBucket } from '../utils/aws.js';
@@ -35,6 +35,7 @@ export async function mainStack({ isHeadless = false, headlessOptions = {} } = {
     let disableDefaultCI = false;
     let project = {};
     let currentGitBranch = 'main';
+    let procfile = null;
 
     if (isHeadless) {
         // --- HEADLESS MODE ---
@@ -43,10 +44,11 @@ export async function mainStack({ isHeadless = false, headlessOptions = {} } = {
         targetDir = projectName === '.' ? process.cwd() : path.join(process.cwd(), projectName);
 
         detectedFramework = detectFramework(targetDir);
+        procfile = parseProcfile(targetDir);
         finalFramework = getFlag('framework', detectedFramework ? detectedFramework.id : 'static');
 
         project = {
-            region: getFlag('region', 'us-east-1'),
+            region: getFlag('region', 'us-east-2'),
             port: getFlag('port', finalFramework === 'static' ? '8080' : '3000'),
             size: getFlag('size', 'micro'),
             healthCheckPath: getFlag('healthCheckPath', '/'),
@@ -85,7 +87,13 @@ export async function mainStack({ isHeadless = false, headlessOptions = {} } = {
             log.success(`Auto-detected framework: ${detectedFramework.name}`);
         }
 
-        // 2.6 Resolve the framework
+        // 2.6 Run the Procfile Parser
+        procfile = parseProcfile(targetDir);
+        if (procfile && procfile.web) {
+            log.success(`Auto-detected Procfile (web command: ${procfile.web.join(' ')})`);
+        }
+
+        // 2.7 Resolve the framework
         finalFramework = detectedFramework ? detectedFramework.id : null;
 
         if (!finalFramework) {
@@ -109,15 +117,32 @@ export async function mainStack({ isHeadless = false, headlessOptions = {} } = {
             }
         }
 
-        // --- DJANGO SPECIFIC PROMPT ---
+        // 2.8 Check if framework is Django and resolve wsgi.py path
         djangoWsgi = 'core.wsgi';
         if (finalFramework === 'django') {
-            djangoWsgi = await text({
-                message: 'What is the Python module path to your Django wsgi.py?',
-                placeholder: 'core.wsgi',
-                initialValue: 'core.wsgi',
-            });
-            if (typeof djangoWsgi === 'symbol') process.exit(0);
+            let extractedWsgi = null;
+
+            // Check if Procfile already specifies the WSGI module
+            if (procfile && procfile.web) {
+                const webCommand = procfile.web.join(' ');
+                // Matches patterns like "gunicorn my_app.wsgi" or "my_app.wsgi:application"
+                const wsgiMatch = webCommand.match(/([a-zA-Z0-9_]+)\.wsgi/);
+                if (wsgiMatch) {
+                    extractedWsgi = `${wsgiMatch[1]}.wsgi`;
+                }
+            }
+
+            if (extractedWsgi) {
+                djangoWsgi = extractedWsgi;
+                log.success(`Auto-detected Django WSGI from Procfile: ${color.cyan(djangoWsgi)}`);
+            } else {
+                djangoWsgi = await text({
+                    message: 'What is the Python module path to your Django wsgi.py?',
+                    placeholder: 'core.wsgi',
+                    initialValue: 'core.wsgi',
+                });
+                if (typeof djangoWsgi === 'symbol') process.exit(0);
+            }
         }
 
         // 3. Prompt for Setup Mode
@@ -309,7 +334,8 @@ export async function mainStack({ isHeadless = false, headlessOptions = {} } = {
         finalFramework: finalFramework,
         NEEDS_DATABASE: needsDatabase,
         DJANGO_WSGI: djangoWsgi,
-        DISABLE_DEFAULT_CI: disableDefaultCI
+        DISABLE_DEFAULT_CI: disableDefaultCI,
+        PROCFILE: procfile
     });
 
     // 11. Track the event in telemetry
@@ -336,8 +362,8 @@ export async function mainStack({ isHeadless = false, headlessOptions = {} } = {
 
     const needsCd = projectName && projectName !== '.';
     const applyStep = needsCd
-        ? `cd ${projectName} && npx deploy-stack apply --yes`
-        : 'npx deploy-stack apply';
+        ? `cd ${projectName} && npx --yes deploy-stack apply`
+        : 'npx --yes deploy-stack apply';
 
     const gitInstructions = isGitInitialized
         ? `git add . && git commit -m "chore: add AWS infrastructure and CI/CD" && git push`

package/src/utils/aws.js

@@ -21,7 +21,7 @@ export async function provisionStateBucket(region, projectName) {
     try {
         await s3Client.send(new CreateBucketCommand({
             Bucket: stateBucketName,
-            CreateBucketConfiguration: region === 'us-east-1' ? undefined : { LocationConstraint: region }
+            CreateBucketConfiguration: region === 'us-east-2' ? undefined : { LocationConstraint: region }
         }));
 
         await s3Client.send(new PutBucketTaggingCommand({

package/src/utils/detector.js

@@ -1,6 +1,7 @@
 import fsSync from 'fs';
 import path from 'path';
 
+// Detects the framework based on the presence of framework-specific files.
 export function detectFramework(targetDir) {
     const packageJsonPath = path.join(targetDir, 'package.json');
     const requirementsTxtPath = path.join(targetDir, 'requirements.txt');
@@ -62,4 +63,35 @@ export function detectFramework(targetDir) {
 
     // 5. Fallback
     return null;
+}
+
+// Parses a Heroku/Render Procfile and formats the commands for Terraform ECS.
+export function parseProcfile(targetDir) {
+    const procfilePath = path.join(targetDir, 'Procfile');
+
+    if (!fsSync.existsSync(procfilePath)) return null;
+
+    const content = fsSync.readFileSync(procfilePath, 'utf-8');
+    const processes = {};
+
+    // Match lines like "web: gunicorn myapp.wsgi"
+    const lines = content.split('\n');
+    const procRegex = /^([A-Za-z0-9_-]+):\s*(.+)$/;
+
+    for (const line of lines) {
+        const match = line.trim().match(procRegex);
+        if (match) {
+            const type = match[1].toLowerCase();
+            const rawCommand = match[2].trim();
+
+            // Terraform requires the command as a JSON array of strings
+            // This splits by spaces but respects single and double quotes
+            const commandArray = rawCommand.match(/[^\s"']+|"([^"]*)"|'([^']*)'/g)
+                .map(str => str.replace(/^["']|["']$/g, '')); // Strip the quotes
+
+            processes[type] = commandArray;
+        }
+    }
+
+    return Object.keys(processes).length > 0 ? processes : null;
 }

package/src/utils/generator.js

@@ -26,8 +26,28 @@ export async function generateTemplates(targetDir, config) {
         { src: 'README.md', dest: 'README.md' }
     ];
 
+    // 3. Configure Compute Commands & Environment Variables
     let secretsArray = [];
 
+    // 3.1. Format the ECS Task Command (Heroku Procfile Support)
+    // If a Procfile exists and has a 'web' process, override the Docker CMD
+    if (config.PROCFILE && config.PROCFILE.web) {
+        // e.g., ["gunicorn", "myproject.wsgi"] -> JSON string for Terraform
+        config.TASK_COMMAND = `command = ${JSON.stringify(config.PROCFILE.web)}`;
+    } else {
+        // Fallback to the default Dockerfile CMD
+        config.TASK_COMMAND = '';
+    }
+
+    if (config.PROCFILE && config.PROCFILE.worker) {
+        config.WORKER_COMMAND = `command = ${JSON.stringify(config.PROCFILE.worker)}`;
+        // Dynamically add worker.tf to the generation list
+        filesToProcess.push({ src: 'terraform/worker.tf', dest: 'terraform/worker.tf' });
+    } else {
+        config.WORKER_COMMAND = '';
+    }
+
+    // 3.2. Inject Managed Database Variables
     if (config.NEEDS_DATABASE) {
         filesToProcess.push({ src: 'terraform/database.tf', dest: 'terraform/database.tf' });
 
@@ -42,10 +62,11 @@ export async function generateTemplates(targetDir, config) {
         config.DB_ENV_VARS = '';
     }
 
+    // 4. Configure AWS Secrets Manager Integration
     // Build the initial HCL map for AWS Secrets Manager
     let initialSecretMap = `{\n    EXAMPLE_API_KEY = "replace_me_in_aws_console"`;
 
-    // Inject Rails Master Key if applicable
+    // 4.1. Inject Rails Master Key if applicable
     if (config.finalFramework === 'rails') {
         secretsArray.push(`{ "name": "RAILS_MASTER_KEY", "valueFrom": "\${aws_secretsmanager_secret.app_secrets.arn}:RAILS_MASTER_KEY::" }`);
 
@@ -64,7 +85,11 @@ export async function generateTemplates(targetDir, config) {
     config.TASK_SECRETS = secretsArray.join(',\n        ');
     config.INITIAL_SECRET_MAP = initialSecretMap;
 
-    // 3. Process standard files
+    config.SAFE_ALB_NAME = config.PROJECT_NAME.length > 27
+        ? config.PROJECT_NAME.substring(0, 27).replace(/-$/, '') // Remove trailing hyphens
+        : config.PROJECT_NAME;
+
+    // 5. Process standard files
     for (const file of filesToProcess) {
         let content = await fs.readFile(path.join(templatesDir, file.src), 'utf-8');
 
@@ -76,10 +101,10 @@ export async function generateTemplates(targetDir, config) {
         await fs.writeFile(path.join(targetDir, file.dest), content);
     }
 
-    // 4. Create empty secrets file
+    // 6. Create empty secrets file
     await fs.writeFile(path.join(targetDir, 'terraform', 'secret_keys.json'), "[]");
 
-    // 5. Handle .gitignore dynamically based on framework
+    // 7. Handle .gitignore dynamically based on framework
     const targetGitignore = path.join(targetDir, '.gitignore');
 
     if (!fsSync.existsSync(targetGitignore)) {
@@ -92,7 +117,7 @@ export async function generateTemplates(targetDir, config) {
         }
     }
 
-    // 6. Create .dockerignore to keep images lean and secure
+    // 8. Create .dockerignore to keep images lean and secure
     const dockerignorePath = path.join(targetDir, '.dockerignore');
     const appendDockerIgnore = '\n# Infrastructure (deploy-stack)\nterraform/\n**/.terraform/\n**/.terraform.*\n**/*.tfstate*\n.env\n';
 
@@ -146,7 +171,7 @@ Thumbs.db
         return (baseIgnore + frameworkIgnore).trim();
     }
 
-    // 7. Framework-specific cleanup
+    // 9. Framework-specific cleanup
     // Disable default workflows that crash in isolated CI environments
     if (config.finalFramework === 'rails') {
         const railsCiPath = path.join(targetDir, '.github', 'workflows', 'ci.yml');

package/src/utils/visualizer.js

@@ -3,7 +3,7 @@ import pc from 'picocolors';
 import fs from 'fs';
 import path from 'path';
 
-// Cost benchmarks for AWS us-east-1 baseline (Fargate + ALB)
+// Cost benchmarks for AWS us-east-2 baseline (Fargate + ALB)
 const PRICING_TABLE = {
     fargate: {
         cpuPerHour: 0.04048,   // per vCPU hour
@@ -22,7 +22,7 @@ const PRICING_TABLE = {
 // 1. Parse the local terraform files to extract the actual configuration
 export function parseTerraformConfig(tfDir) {
     const tfvarsPath = path.join(tfDir, 'terraform.tfvars');
-    let region = 'us-east-1';
+    let region = 'us-east-2';
     let cpu = 256;
     let memory = 512;
     let framework = 'Application';
@@ -43,18 +43,22 @@ export function parseTerraformConfig(tfDir) {
 
     // Check if database files exist
     const hasDb = fs.existsSync(path.join(tfDir, 'rds.tf')) || fs.existsSync(path.join(tfDir, 'database.tf'));
+    const hasWorker = fs.existsSync(path.join(tfDir, 'worker.tf'));
 
-    return { framework, region, cpu, memory, hasDb };
+    return { framework, region, cpu, memory, hasDb, hasWorker };
 }
 
 // 2. Calculate itemized monthly costs based on task definition settings
-export function estimateMonthlyCost({ cpu = 256, memory = 512, hasDb = false }) {
+export function estimateMonthlyCost({ cpu = 256, memory = 512, hasDb = false, hasWorker = false }) {
     const vCpu = cpu / 1024;
     const memGb = memory / 1024;
     const hoursInMonth = 730;
 
+    // If a worker service exists, we are running a second identical Fargate task
+    const taskMultiplier = hasWorker ? 2 : 1;
+
     const fargateCost = ((vCpu * PRICING_TABLE.fargate.cpuPerHour) +
-        (memGb * PRICING_TABLE.fargate.memoryPerHour)) * hoursInMonth;
+        (memGb * PRICING_TABLE.fargate.memoryPerHour)) * hoursInMonth * taskMultiplier;
     const albCost = (PRICING_TABLE.alb.basePerHour + PRICING_TABLE.alb.lcuPerHour) * hoursInMonth;
     const dbCost = hasDb ? (PRICING_TABLE.rds.microPerHour * hoursInMonth) + PRICING_TABLE.rds.storagePerMonth : 0;
 
@@ -70,17 +74,21 @@ export function estimateMonthlyCost({ cpu = 256, memory = 512, hasDb = false })
 
 // 3. Render the terminal architecture visualization and requests confirmation
 export async function renderDryRunPreview(config, isDryRunFlag = false) {
-    const { framework = 'Node.js', region = 'us-east-1', cpu = 256, memory = 512, hasDb = false } = config;
-    const cost = estimateMonthlyCost({ cpu, memory, hasDb });
+    const { framework = 'Node.js', region = 'us-east-2', cpu = 256, memory = 512, hasDb = false, hasWorker = false } = config;
+
+    // Fixed the duplicate hasWorker argument
+    const cost = estimateMonthlyCost({ cpu, memory, hasDb, hasWorker });
 
     const hourlyRate = (cost.totalMonthly / 730).toFixed(3); // 730 hours in a month
 
+    // Flattened the tree to eliminate nesting and vertical bloat
     const treeOutput = [
         `${pc.bold('Topology')} (${pc.cyan(region)}):`,
         `  ${pc.gray('├──')} 🌐 ${pc.bold('ALB')} (Public Entry & Health: ${pc.green('200 OK')})`,
         `  ${pc.gray('├──')} 🔒 ${pc.bold('IAM OIDC')} (GitHub Auth) & 🐳 ${pc.bold('ECR')} (Registry)`,
-        `  ${pc.gray('└──')} 📦 ${pc.bold('ECS Fargate Cluster')} 🟢 ${pc.green(framework)} [${cpu} CPU / ${memory} MB]`,
-        hasDb ? `       └── 🛢️  ${pc.yellow('Amazon RDS')} (PostgreSQL managed instance)` : '',
+        hasDb ? `  ${pc.gray('├──')} 🐘 ${pc.yellow('Amazon RDS')} (PostgreSQL managed instance)` : '',
+        `  ${pc.gray(hasWorker ? '├──' : '└──')} 📦 ${pc.bold('ECS Web Service')} 🟢 ${pc.green(framework)} [${cpu} CPU / ${memory} MB]`,
+        hasWorker ? `  ${pc.gray('└──')} 📦 ${pc.bold('ECS Worker Service')} 🔄 Background Tasks [${cpu} CPU / ${memory} MB]` : '',
         '',
         `${pc.bold('Est. Monthly Cost:')} ${pc.green(pc.bold(`~$${cost.totalMonthly}`))} ${pc.dim(`(ALB: $${cost.albMonthly}, Fargate: $${cost.fargateMonthly}${hasDb ? `, RDS: $${cost.dbMonthly}` : ''})`)}`,
         `  ${pc.dim(`* Hourly billing: ~$${hourlyRate}/hr. Destroy anytime with "npx deploy-stack destroy --yes"`)}`

package/templates/docker/django.Dockerfile

@@ -1,5 +1,8 @@
 FROM python:3.12-alpine
 
+# --- DevSecOps Patch: Upgrade Alpine system packages to clear OS-level CVEs ---
+RUN apk upgrade --no-cache
+
 # Prevent Python from writing .pyc files and buffer stdout for cleaner logs
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1

package/templates/terraform/main.tf

@@ -99,6 +99,8 @@ resource "aws_ecs_task_definition" "app" {
         ]
       )
       
+      {{TASK_COMMAND}}
+
       portMappings = [
         {
           containerPort = {{PORT}}
@@ -122,7 +124,7 @@ resource "aws_ecs_task_definition" "app" {
 # --- Application Load Balancer ---
 # trivy:ignore:AVD-AWS-0053 - This ALB is intended to be publicly facing behind CloudFront
 resource "aws_lb" "main" {
-  name               = "{{PROJECT_NAME}}-alb"
+  name               = "{{SAFE_ALB_NAME}}-alb"
   load_balancer_type = "application"
   security_groups    = [aws_security_group.alb.id]
   subnets            = aws_subnet.public[*].id
@@ -130,7 +132,7 @@ resource "aws_lb" "main" {
 }
 
 resource "aws_lb_target_group" "app" {
-  name        = "{{PROJECT_NAME}}-tg"
+  name        = "{{SAFE_ALB_NAME}}-tg"
   port        = {{PORT}}
   protocol    = "HTTP"
   vpc_id      = aws_vpc.main.id

package/templates/terraform/worker.tf

@@ -0,0 +1,62 @@
+# --- Worker ECS Task Definition ---
+resource "aws_ecs_task_definition" "worker" {
+  family                   = "{{PROJECT_NAME}}-worker-task"
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  cpu                      = "{{CPU}}"
+  memory                   = "{{MEMORY}}"
+  execution_role_arn       = aws_iam_role.execution_role.arn
+  task_role_arn            = aws_iam_role.task_role.arn
+
+  container_definitions = jsonencode([
+    {
+      name      = "{{PROJECT_NAME}}-worker-container"
+      image     = "${aws_ecr_repository.app.repository_url}:latest"
+      essential = true
+
+      environment = [
+        { "name": "NODE_ENV", "value": "production" },
+        {{DB_ENV_VARS}}
+      ]
+
+      secrets = concat(
+        [
+          for key in local.secret_keys : {
+            name      = key
+            valueFrom = "${aws_secretsmanager_secret.app_secrets.arn}:${key}::"
+          }
+        ],
+        [
+          {{TASK_SECRETS}}
+        ]
+      )
+
+      {{WORKER_COMMAND}}
+
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          "awslogs-group"         = aws_cloudwatch_log_group.app_logs.name
+          "awslogs-region"        = "{{REGION}}"
+          "awslogs-stream-prefix" = "worker" # Isolates worker logs from web logs
+        }
+      }
+    }
+  ])
+}
+
+# --- Worker ECS Service ---
+# Notice there is NO load_balancer block. This service is strictly private.
+resource "aws_ecs_service" "worker" {
+  name            = "{{PROJECT_NAME}}-worker-service"
+  cluster         = aws_ecs_cluster.main.id
+  task_definition = aws_ecs_task_definition.worker.arn
+  launch_type     = "FARGATE"
+  desired_count   = 1
+
+  network_configuration {
+    subnets          = aws_subnet.public[*].id
+    security_groups  = [aws_security_group.ecs_tasks.id]
+    assign_public_ip = true 
+  }
+}