deploy-stack 0.7.0 → 0.9.0

package/README.md

@@ -3,6 +3,7 @@
 > The zero-lock-in cloud generator. Eject your containerized web app from expensive PaaS platforms to production-ready, highly available AWS infrastructure in 60 seconds.
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![Security: Trivy](https://img.shields.io/badge/Security-Trivy_Scanned-blue.svg)](https://trivy.dev/)
 
 <!-- ![deploy-stack CLI demonstration](./docs/demo.gif) -->
 
@@ -25,15 +26,19 @@ You retain complete ownership of your infrastructure code without relying on bla
 ## ✨ Features
 
 * **Zero Vendor Lock-In:** Generates standard, clean `.tf` files. Modify, expand, or decouple them at any time.
+* **Automated DevSecOps:** Integrated Trivy vulnerability scanning for your infrastructure (IaC) and Docker containers on every GitHub Actions run.
+* **Hardened, Unprivileged Containers:** Built-in Dockerfile generators explicitly drop root privileges and utilize `nginx-unprivileged` for maximum Fargate security compliance.
+* **Cost & Observability Baselines:** Prevents runaway AWS bills with explicit 14-day CloudWatch log retention policies and auto-generates 5XX error alerting.
+* **Safe Overwrite Flow:** Idempotent CLI safely backs up existing configurations to timestamped `.bak` files and updates `.gitignore` to guarantee zero data loss during rapid iteration.
 * **Framework Agnostic:** Tailored container presets for Next.js, Express.js, FastAPI, and **Zero-Config Static Sites** (React, Vue, SvelteKit, Astro, Vite).
 * **Smart Git Integration:** Automatically detects your working branch (`main`, `master`, `develop`) and binds it directly to the generated GitHub Actions pipeline.
 * **Production-Grade Defaults:** Automatically provisions an Amazon ECS Fargate cluster fronted by an Application Load Balancer across multiple availability zones.
 * **Global Edge Acceleration:** Includes an integrated AWS CloudFront CDN distribution with SSL termination and optimized caching.
-* **Keyless, Zero-Secret CI/CD:** Uses AWS IAM OpenID Connect (OIDC) for automated GitHub Actions deployments—no long-lived AWS keys stored in GitHub Secrets.
-* **Remote State with Native S3 Locking:** Automatically creates an encrypted S3 state bucket utilizing modern native S3 concurrency locking.
+* **Keyless, Zero-Secret CI/CD:** Uses AWS IAM OpenID Connect (OIDC) for automated deployments—no long-lived AWS keys stored in GitHub Secrets.
+* **Remote State with Native S3 Locking:** Automatically creates an encrypted S3 state bucket utilizing modern Terraform (1.7+) native S3 concurrency locking.
 * **Built-in Secrets Sync:** Provides a dedicated CLI workflow to securely push local `.env` variables into AWS Secrets Manager and map them directly into containers at runtime.
-* **Non-Destructive:** Safely analyzes existing directories and prompts for confirmation before updating any files.
-* **Zero-Config Detection:** Automatically resolves output directories for Vite, Astro, SvelteKit, CRA, and more.
+* **Ecosystem Ready:** Integrated directly with the [deploy-stack GitHub Action](https://github.com/marketplace/actions/deploy-stack-aws-fargate-terraform-deploy) for a secure, boilerplate-free continuous deployment pipeline.
+* **Database Scaffolding:** Automatically provisions fully isolated, zero-trust AWS RDS PostgreSQL databases for backend monoliths.
 * **Safe Teardown:** Completely remove all generated AWS resources and empty S3 state buckets with a single `destroy` command.
 
 ---
@@ -134,12 +139,30 @@ npx deploy-stack --no-telemetry
 
 ## 🗺️ Roadmap
 
-- [x] **Core MVP:** Interactive CLI, ECS Fargate + ALB Terraform generation, CI/CD, and Secrets sync.
-- [x] **Production Readiness:** CloudFront distribution, S3 State locking, and OIDC security.
-- [x] **Smart Experience:** Zero-config framework auto-discovery for Next.js, Express, and FastAPI.
-- [ ] **State & Storage:** Automated RDS PostgreSQL provisioning and persistent volumes.
-- [ ] **Advanced Networking:** Custom domains (Route 53), ACM SSL configuration, and environment workspaces (staging/prod).
-- [ ] **Security Hardening:** Private VPC subnets with NAT gateways, and AWS WAF integration.
+## 🗺️ Roadmap
+
+### Phase 1–3: The Core Engine (Completed)
+- [x] **Core MVP:** Interactive CLI, ECS Fargate + ALB generation, CI/CD, and Secrets sync.
+- [x] **Production Readiness:** CloudFront CDN edge distribution, native S3 state locking, and secure OIDC integration.
+- [x] **Smart Experience:** Zero-config framework auto-discovery for static output directories.
+- [x] **Trust & Observability:** DevSecOps Trivy scanning, automated 5XX alarms, 14-day log retention, and safe local overwrite protections.
+
+### Phase 4: Trust Anchors & TAM Expansion (v0.9.0 - Current)
+- [x] **Ecosystem Distribution:** Native GitHub Marketplace Action for rapid discovery.
+- [x] **Cost Transparency:** Pre-flight AWS cost estimator injected directly into the CLI wizard.
+- [x] **Zero Vendor Lock-In:** Explicit `npx deploy-stack eject` command to safely strip `ManagedBy` tags and CLI metadata, leaving behind pure IaC.
+- [x] **Heavy Backend Monoliths:** Hardened, unprivileged container adapters for Go, Nuxt.js, Django, and Rails, complete with automated zero-trust RDS PostgreSQL provisioning.
+
+### Phase 5: The Activation Engine (Pre-1.0 Growth Loops)
+- [ ] **Ephemeral PR Previews:** Generating live preview URLs on every GitHub Pull Request, turning single-user tests into team-wide advertisements.
+- [ ] **Next.js Image Optimization Handler:** A drop-in AWS Serverless handler (Lambda + CloudFront) to process images affordably, removing a massive Vercel lock-in hurdle.
+- [ ] **GitHub Deployments UI Sync:** Wiring up the native GitHub "Environments" tab for instant visual validation that the CLI succeeded in the background.
+
+### Phase 6: Workflow Interception (IDE, AI, & Local Bridges)
+- [ ] **AI Agent Rulesets:** Publishing `.cursorrules` and Copilot instructions that teach AI assistants exactly how to utilize the CLI on the user's behalf.
+- [ ] **Docker Compose to ECS Translator:** Automatically converting a familiar local `docker-compose.yml` into production ECS task definitions.
+- [ ] **Framework Registries:** Submitting official plugins to the Astro Integrations directory and Nuxt Modules to secure passive, sustained discovery.
+- [ ] **Dry-Run Visualization:** Generating a local `docker-compose.yml` mirror and a visual architecture map for local infrastructure validation.
 
 ---
 

package/bin/cli.js

@@ -4,6 +4,7 @@ import { mainStack } from '../src/commands/init.js';
 import { destroyStack } from '../src/commands/destroy.js';
 import { runDoctor } from '../src/commands/doctor.js';
 import { pushSecrets } from '../src/commands/secrets.js';
+import { ejectStack } from '../src/commands/eject.js';
 
 // 1. Extract the telemetry flag and set the environment variable
 const rawArgs = process.argv.slice(2);
@@ -25,6 +26,8 @@ if (args[0] === 'secrets' && args[1] === 'push') {
     runDoctor().catch(console.error);
 } else if (args[0] === 'destroy') {
     destroyStack().catch(console.error);
+} else if (args[0] === 'eject') {
+    ejectStack().catch(console.error);
 } else {
     mainStack().catch(console.error);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "type": "module",
   "bin": {
@@ -37,6 +37,7 @@
   ],
   "license": "MIT",
   "dependencies": {
+    "@aws-sdk/client-dynamodb": "3.1119.0",
     "@aws-sdk/client-s3": "3.1115.0",
     "@aws-sdk/client-secrets-manager": "3.1112.0",
     "@aws-sdk/client-sts": "3.1115.0",

package/src/commands/eject.js

@@ -0,0 +1,82 @@
+import fs from 'fs';
+import path from 'path';
+import { intro, outro, confirm, spinner, cancel } from '@clack/prompts';
+import color from 'picocolors';
+
+export async function ejectStack() {
+    intro(color.bgRed(color.white(' deploy-stack eject ⏏️  ')));
+
+    console.log(color.yellow('This will permanently decouple your infrastructure from the deploy-stack CLI.'));
+    console.log(color.gray('It removes all ManagedBy tags and tool-specific metadata from your local files.'));
+    console.log(color.gray('Your infrastructure will remain fully operational as raw, standalone Terraform.'));
+
+    const shouldEject = await confirm({
+        message: 'Are you sure you want to eject? (This cannot be undone)',
+        initialValue: false,
+    });
+
+    if (!shouldEject || typeof shouldEject === 'symbol') {
+        cancel('Eject cancelled. You are still managed by deploy-stack.');
+        process.exit(0);
+    }
+
+    const s = spinner();
+    s.start('Ejecting deploy-stack metadata...');
+
+    const targetDir = process.cwd();
+    const tfDir = path.join(targetDir, 'terraform');
+    const mainTfPath = path.join(tfDir, 'main.tf');
+    const gitignorePath = path.join(targetDir, '.gitignore');
+
+    // 1. Clean main.tf
+    if (fs.existsSync(mainTfPath)) {
+        let content = fs.readFileSync(mainTfPath, 'utf8');
+
+        // Remove the top header comment
+        content = content.replace(/# deploy-stack generated infrastructure\n?/g, '');
+
+        // Safely remove the default_tags block
+        const defaultTagsRegex = /[ \t]*default_tags\s*\{\s*tags\s*=\s*\{\s*ManagedBy\s*=\s*"deploy-stack"\s*\}\s*\}\n?/g;
+        content = content.replace(defaultTagsRegex, '');
+
+        fs.writeFileSync(mainTfPath, content.trim() + '\n');
+    }
+
+    // 2. Clean up .gitignore
+    if (fs.existsSync(gitignorePath)) {
+        let gitignore = fs.readFileSync(gitignorePath, 'utf8');
+        // Remove the exact block we injected in backup.js
+        gitignore = gitignore.replace(/\n# deploy-stack backups\n\*\.bak\.\*\n/g, '\n');
+        fs.writeFileSync(gitignorePath, gitignore.trim() + '\n');
+    }
+
+    // 3. Purge all local `.bak` files to leave a pristine directory
+    const cleanBackups = (dir) => {
+        if (!fs.existsSync(dir)) return;
+        const files = fs.readdirSync(dir);
+        for (const file of files) {
+            const fullPath = path.join(dir, file);
+            if (file.includes('.bak.')) {
+                fs.rmSync(fullPath, { recursive: true, force: true });
+            } else if (fs.statSync(fullPath).isDirectory() && file !== 'node_modules' && file !== '.git') {
+                cleanBackups(fullPath); // Recursively check subdirectories like .github/workflows
+            }
+        }
+    };
+
+    cleanBackups(targetDir);
+
+    s.stop('Ejection complete.');
+
+    outro(`
+    ${color.green('✅ Successfully ejected from deploy-stack!')}
+    
+    Your Terraform and CI/CD files are now 100% vanilla. 
+    
+    ${color.blue('Next Step:')}
+    Run ${color.cyan('terraform apply')} inside your terraform/ folder. 
+    AWS will sync your state and automatically remove the 'ManagedBy' tags from your live cloud resources.
+
+    ${color.magenta('Godspeed! You are now the sole owner of your infrastructure.')}
+    `);
+}

package/src/commands/init.js

@@ -73,7 +73,11 @@ export async function mainStack() {
             options: [
                 { value: 'node', label: 'Node.js / Express' },
                 { value: 'nextjs', label: 'Next.js (Standalone)' },
+                { value: 'nuxt', label: 'Nuxt 3 (SSR)' },
                 { value: 'python', label: 'Python FastAPI' },
+                { value: 'django', label: 'Django (Python)' },
+                { value: 'rails', label: 'Ruby on Rails' },
+                { value: 'go', label: 'Go (Golang)' },
                 { value: 'static', label: 'Static Site (Gatsby, React, plain HTML via Nginx)' },
             ],
         });
@@ -88,7 +92,9 @@ export async function mainStack() {
     let defaultPort = '3000';
 
     if (finalFramework === 'static') defaultPort = '8080';
-    if (finalFramework === 'python') defaultPort = '8000';
+    if (finalFramework === 'python' || finalFramework === 'django') defaultPort = '8000';
+    if (finalFramework === 'rails') defaultPort = '3000';
+    if (finalFramework === 'go') defaultPort = '8080';
 
     // 2.8 Check current Git branch
     let currentGitBranch = 'main';
@@ -98,6 +104,23 @@ export async function mainStack() {
         // Not a git repo yet, fallback to 'main'
     }
 
+    // 2.9 Ask for Managed Database (Only for Backend/Fullstack Frameworks)
+    let needsDatabase = false;
+    const isBackendFramework = ['node', 'nextjs', 'nuxt', 'python', 'django', 'rails', 'go'].includes(finalFramework);
+
+    if (isBackendFramework) {
+        const dbChoice = await confirm({
+            message: 'Do you need a managed AWS RDS PostgreSQL database? (Adds ~$14/month or uses AWS Free Tier)',
+            initialValue: false,
+        });
+
+        if (typeof dbChoice === 'symbol') {
+            cancel('Provisioning cancelled.')
+            process.exit(0);
+        }
+        needsDatabase = dbChoice;
+    }
+
     // 3. Prompt Configuration Group
     const project = await group(
         {
@@ -167,15 +190,31 @@ export async function mainStack() {
     const cpu = project.size === 'small' ? '512' : '256';
     const memory = project.size === 'small' ? '1024' : '512';
 
+    const baseCost = project.size === 'small' ? 35 : 25;
+    const dbCost = needsDatabase ? 14 : 0;
+    const totalCost = baseCost + dbCost;
+
     const computeTier = project.size === 'small' ? 'Small (0.5 vCPU, 1GB RAM)' : 'Micro (0.25 vCPU, 512MB RAM)';
-    const estimatedCost = project.size === 'small' ? '~$35.00 / month' : '~$25.00 / month';
+    const estimatedCost = `~$${totalCost}.00 / month${needsDatabase ? ' (Includes Fargate + RDS PostgreSQL)' : ''}`;
 
     const healthCheckPath = project.healthCheckPath || '/';
     const desiredCount = project.desiredCount || '1';
     const deployBranch = project.branch || currentGitBranch;
-
     const buildDir = detectedFramework?.buildDir || 'dist';
 
+    // 4.5. The Pre-Flight Cost Estimator
+    // We explicitly ask for financial consent to eliminate AWS billing anxiety.
+    console.log(''); // Add a blank line for visual pacing
+    const costConsent = await confirm({
+        message: color.yellow(`⚠️  Pre-Flight Check: This AWS architecture will cost ${estimatedCost}. Proceed with provisioning?`),
+        initialValue: true,
+    });
+
+    if (!costConsent || typeof costConsent === 'symbol') {
+        cancel('Deployment cancelled. No AWS resources were provisioned.');
+        process.exit(0);
+    }
+
     // 5. Safely handle existing files (Backup and auto-prune)
     await handleExistingFiles(targetDir);
 
@@ -213,7 +252,8 @@ export async function mainStack() {
         DESIRED_COUNT: desiredCount,
         DEPLOY_BRANCH: deployBranch,
         BUILD_DIR: buildDir,
-        finalFramework: finalFramework
+        finalFramework: finalFramework,
+        NEEDS_DATABASE: needsDatabase
     });
 
     // 8. Track the event in telemetry

package/src/utils/detector.js

@@ -4,6 +4,9 @@ import path from 'path';
 export function detectFramework(targetDir) {
     const packageJsonPath = path.join(targetDir, 'package.json');
     const requirementsTxtPath = path.join(targetDir, 'requirements.txt');
+    const managePyPath = path.join(targetDir, 'manage.py');
+    const goModPath = path.join(targetDir, 'go.mod');
+    const gemfilePath = path.join(targetDir, 'Gemfile');
 
     // 1. Detect Node.js Frameworks
     if (fsSync.existsSync(packageJsonPath)) {
@@ -12,15 +15,15 @@ export function detectFramework(targetDir) {
             // Merge dependencies and devDependencies to check both
             const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
 
-            // Next.js & Express
+            // Fullstack / API
             if (deps['next']) return { id: 'nextjs', name: 'Next.js' };
+            if (deps['nuxt']) return { id: 'nuxt', name: 'Nuxt 3 (SSR)' };
             if (deps['express']) return { id: 'node', name: 'Node.js / Express' };
 
             // Static Site Generators & SPAs (with precise build directories)
             if (deps['@sveltejs/kit']) return { id: 'static', name: 'SvelteKit', buildDir: 'build' };
             if (deps['react-scripts']) return { id: 'static', name: 'Create React App', buildDir: 'build' };
             if (deps['gatsby']) return { id: 'static', name: 'Gatsby', buildDir: 'public' };
-            if (deps['nuxt']) return { id: 'static', name: 'Nuxt', buildDir: '.output/public' };
             if (deps['astro']) return { id: 'static', name: 'Astro', buildDir: 'dist' };
             if (deps['vite']) return { id: 'static', name: 'Vite', buildDir: 'dist' };
             if (deps['@vue/cli-service']) return { id: 'static', name: 'Vue.js', buildDir: 'dist' };
@@ -35,11 +38,28 @@ export function detectFramework(targetDir) {
         try {
             const reqs = fsSync.readFileSync(requirementsTxtPath, 'utf-8').toLowerCase();
             if (reqs.includes('fastapi')) return { id: 'python', name: 'Python FastAPI' };
+            if (reqs.includes('django')) return { id: 'django', name: 'Django' };
         } catch (e) {
             // Silently fail
         }
     }
 
-    // 3. Fallback
+    // Fallback Django detection (sometimes requirements.txt is named differently)
+    if (fsSync.existsSync(managePyPath)) return { id: 'django', name: 'Django' };
+
+    // 3. Detect Ruby on Rails
+    if (fsSync.existsSync(gemfilePath)) {
+        try {
+            const gemfile = fsSync.readFileSync(gemfilePath, 'utf-8').toLowerCase();
+            if (/gem\s+['"]rails['"]/i.test(gemfile)) { return { id: 'rails', name: 'Ruby on Rails' }; }
+        } catch (e) {
+            // Silently fail
+        }
+    }
+
+    // 4. Detect Go
+    if (fsSync.existsSync(goModPath)) return { id: 'go', name: 'Go' };
+
+    // 5. Fallback
     return null;
 }

package/src/utils/generator.js

@@ -26,6 +26,22 @@ export async function generateTemplates(targetDir, config) {
         { src: 'README.md', dest: 'README.md' }
     ];
 
+    if (config.NEEDS_DATABASE) {
+        filesToProcess.push({ src: 'terraform/database.tf', dest: 'terraform/database.tf' });
+
+        config.DB_ENV_VARS = `
+        { "name": "DB_HOST", "value": "\${aws_db_instance.postgres.address}" },
+        { "name": "DB_PORT", "value": "5432" },
+        { "name": "DB_NAME", "value": "\${aws_db_instance.postgres.db_name}" }`;
+
+        config.DB_SECRETS = `
+        { "name": "DB_USER", "valueFrom": "\${aws_db_instance.postgres.master_user_secret[0].secret_arn}:username::" },
+        { "name": "DB_PASSWORD", "valueFrom": "\${aws_db_instance.postgres.master_user_secret[0].secret_arn}:password::" }`;
+    } else {
+        config.DB_ENV_VARS = '';
+        config.DB_SECRETS = '';
+    }
+
     // 3. Process standard files
     for (const file of filesToProcess) {
         let content = await fs.readFile(path.join(templatesDir, file.src), 'utf-8');
@@ -71,49 +87,17 @@ terraform/.terraform.*
 Thumbs.db
 `;
 
-    const nodeIgnore = `
-# Node.js
-node_modules/
-npm-debug.log
-yarn-error.log
-`;
-
-    const nextjsIgnore = `
-# Next.js
-node_modules/
-.next/
-out/
-build/
-next-env.d.ts
-`;
-
-    const pythonIgnore = `
-# Python
-__pycache__/
-*.py[cod]
-*$py.class
-venv/
-env/
-.venv/
-.pytest_cache/
-`;
-
-    const staticIgnore = `
-# Static Sites
-node_modules/
-dist/
-build/
-out/
-.output/
-.cache/
-public/
-`;
-
-    let frameworkIgnore = '';
-    if (framework === 'node') frameworkIgnore = nodeIgnore;
-    if (framework === 'nextjs') frameworkIgnore = nextjsIgnore;
-    if (framework === 'python') frameworkIgnore = pythonIgnore;
-    if (framework === 'static') frameworkIgnore = staticIgnore;
-
+    const presets = {
+        node: '\n# Node.js\nnode_modules/\nnpm-debug.log\nyarn-error.log\n',
+        nextjs: '\n# Next.js\nnode_modules/\n.next/\nout/\nbuild/\nnext-env.d.ts\n',
+        nuxt: '\n# Nuxt 3\nnode_modules/\n.nuxt/\n.output/\ndist/\n',
+        python: '\n# Python\n__pycache__/\n*.py[cod]\n*$py.class\nvenv/\nenv/\n.venv/\n.pytest_cache/\n',
+        django: '\n# Django\n*.log\n*.pot\n*.pyc\n__pycache__/\ndb.sqlite3\nmedia/\n',
+        go: '\n# Go\n/bin/\n/pkg/\n/obj/\n*.exe\n*.exe~*\n*.dll\n*.so\n*.dylib\n',
+        rails: '\n# Rails\n/*.log\n/tmp/\n/log/\n/public/system/\n/public/assets/\n/vendor/bundle/\n',
+        static: '\n# Static Sites\nnode_modules/\ndist/\nbuild/\nout/\n.output/\n.cache/\npublic/\n'
+    };
+
+    const frameworkIgnore = presets[framework] || '';
     return (baseIgnore + frameworkIgnore).trim();
 }

package/templates/README.md

@@ -29,7 +29,7 @@ This infrastructure provisions a highly available Application Load Balancer (ALB
    ```
 
 3. **Automated CI/CD (Keyless via OIDC):**
-   Push this repository to GitHub. Your deployment pipeline uses AWS IAM OpenID Connect (OIDC) to authenticate securely with temporary credentials—**no long-lived AWS secret keys are required in GitHub Secrets**. Every push to `{{DEPLOY_BRANCH}}` will automatically build, package, and deploy your application.
+   Push this repository to GitHub. Your deployment pipeline uses the official [deploy-stack GitHub Action](https://github.com/marketplace/actions/deploy-stack-aws-fargate-terraform-deploy) and AWS IAM OpenID Connect (OIDC) to authenticate securely with temporary credentials—**no long-lived AWS secret keys are required in GitHub Secrets**. Every push to `{{DEPLOY_BRANCH}}` will automatically run your infrastructure changes, build your container, and deploy your application.
 
 ### ⚠️ Troubleshooting: OIDC Provider Already Exists
 AWS only permits one GitHub Actions OIDC provider per AWS account. If `terraform apply` fails with an `EntityAlreadyExists` error regarding the OIDC provider, it indicates GitHub Actions was previously configured in this account.
@@ -98,6 +98,16 @@ If you are deploying a static site, your application is served via a highly opti
 * **Zero-Config Build:** The CLI automatically detected your framework's output folder (`dist`, `build`, etc.) and pre-configured your Dockerfile. 
 * **Health Checks:** You do not need to configure a custom `/health` route. Nginx will automatically return a `200 OK` when AWS pings the root `/` index page.
 
+### 5. Database Connections (Backend Frameworks Only)
+If you opted to include a managed AWS RDS PostgreSQL database, the infrastructure automatically creates the database in isolated private subnets and injects the credentials into your container's environment variables. 
+
+Ensure your backend framework (Rails, Django, Go, etc.) is configured to consume these variables at runtime:
+* `DB_HOST`: The AWS RDS endpoint URL
+* `DB_PORT`: `5432`
+* `DB_NAME`: The auto-formatted database name
+* `DB_USER`: The auto-generated master username
+* `DB_PASSWORD`: The securely injected master password (sourced from AWS Secrets Manager)
+
 ## 🛡️ Security Scanning
 
 This pipeline includes automated DevSecOps guardrails using [Trivy](https://trivy.dev/). 

package/templates/docker/django.Dockerfile

@@ -0,0 +1,19 @@
+FROM python:3.11-slim
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends gcc libpq-dev && rm -rf /var/lib/apt/lists/*
+
+# Create unprivileged user
+RUN groupadd -g 1001 appgroup && \
+    useradd -u 1001 -g appgroup -s /bin/sh -m appuser
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt gunicorn
+
+# Copy code with explicit ownership
+COPY --chown=appuser:appgroup . .
+
+USER appuser
+EXPOSE {{PORT}}
+
+CMD ["gunicorn", "--bind", "0.0.0.0:{{PORT}}", "--workers", "3", "your_project.wsgi:application"]

package/templates/docker/go.Dockerfile

@@ -0,0 +1,23 @@
+# Stage 1: Compile
+FROM golang:1.22-alpine AS builder
+WORKDIR /app
+COPY go.mod go.sum* ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -o /main .
+
+# Stage 2: Production runner
+FROM alpine:3.19
+WORKDIR /app
+
+# Create unprivileged user
+RUN addgroup -g 1001 -S appgroup && \
+    adduser -S appuser -u 1001 -G appgroup
+
+# Copy compiled binary with explicit ownership
+COPY --from=builder --chown=appuser:appgroup /main /main
+
+USER appuser
+EXPOSE {{PORT}}
+
+CMD ["/main"]

package/templates/docker/nuxt.Dockerfile

@@ -0,0 +1,29 @@
+# Stage 1: Build the Nuxt Nitro output
+FROM node:22-alpine AS builder
+WORKDIR /app
+
+COPY package.json package-lock.json* ./
+RUN npm ci
+
+COPY . .
+RUN npm run build
+
+# Stage 2: Production runner
+FROM node:22-alpine AS runner
+WORKDIR /app
+
+ENV NODE_ENV=production
+ENV PORT={{PORT}}
+ENV HOSTNAME="0.0.0.0"
+
+# Create an unprivileged user and group
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S nuxtjs -u 1001 -G nodejs
+
+# Copy the standalone output and assign ownership
+COPY --from=builder --chown=nuxtjs:nodejs /app/.output ./.output
+
+USER nuxtjs
+EXPOSE {{PORT}}
+
+CMD ["node", ".output/server/index.mjs"]

package/templates/docker/rails.Dockerfile

@@ -0,0 +1,21 @@
+FROM ruby:3.2-slim
+WORKDIR /app
+
+RUN apt-get update -qq && apt-get install -y build-essential libpq-dev nodejs && rm -rf /var/lib/apt/lists/*
+
+# Create unprivileged user
+RUN groupadd -g 1001 appgroup && \
+    useradd -u 1001 -g appgroup -s /bin/sh -m appuser
+
+COPY Gemfile Gemfile.lock ./
+RUN bundle install --without development test
+
+# Copy code with explicit ownership
+COPY --chown=appuser:appgroup . .
+
+RUN SECRET_KEY_BASE_DUMMY=1 bundle exec rails assets:precompile
+
+USER appuser
+EXPOSE {{PORT}}
+
+CMD ["bundle", "exec", "puma", "-C", "config/puma.rb"]

package/templates/github/deploy.yml

@@ -48,18 +48,19 @@ jobs:
             echo '```' >> $GITHUB_STEP_SUMMARY
           fi
 
-      # --- 2. DEPLOYMENT PREP ---
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+      # --- 2. INFRASTRUCTURE SYNC (The New Marketplace Action) ---
+      - name: Apply Infrastructure Changes
+        uses: anton-codes-iac/deploy-stack-action@v1
         with:
-          role-to-assume: arn:aws:iam::{{AWS_ACCOUNT_ID}}:role/{{PROJECT_NAME}}-github-actions-role
           aws-region: ${{ env.AWS_REGION }}
+          role-to-assume: arn:aws:iam::{{AWS_ACCOUNT_ID}}:role/{{PROJECT_NAME}}-github-actions-role
+          terraform-dir: 'terraform'
 
+      # --- 3. BUILD & PUSH ---
       - name: Login to Amazon ECR
         id: login-ecr
         uses: aws-actions/amazon-ecr-login@v2
 
-      # --- 3. BUILD ---
       - name: Build Docker image
         id: build-image
         env:

package/templates/terraform/database.tf

@@ -0,0 +1,71 @@
+# 1. Isolated Subnets (No Internet Gateway routing)
+resource "aws_subnet" "db_isolated" {
+  count             = 2
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 8, count.index + 10)
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+
+  tags = {
+    Name = "{{PROJECT_NAME}}-db-isolated-${count.index}"
+  }
+}
+
+resource "aws_db_subnet_group" "main" {
+  name       = "{{PROJECT_NAME}}-db-subnet-group"
+  subnet_ids = aws_subnet.db_isolated[*].id
+}
+
+# 2. Database Security Group
+resource "aws_security_group" "rds" {
+  name        = "{{PROJECT_NAME}}-rds-sg"
+  vpc_id      = aws_vpc.main.id
+
+  # ONLY allow inbound traffic from the ECS Fargate tasks
+  ingress {
+    from_port       = 5432
+    to_port         = 5432
+    protocol        = "tcp"
+    security_groups = [aws_security_group.ecs_tasks.id]
+  }
+}
+
+# 3. The PostgreSQL Instance
+resource "aws_db_instance" "postgres" {
+  identifier                  = "{{PROJECT_NAME}}-db"
+  engine                      = "postgres"
+  engine_version              = "16"
+  instance_class              = "db.t4g.micro"
+  allocated_storage           = 20
+  storage_encrypted           = true
+  
+  # Clean up dashes for the database name (e.g. my-project -> my_project)
+  db_name                     = replace("{{PROJECT_NAME}}", "-", "_") 
+  username                    = "dbadmin"
+  
+  # AWS automatically creates and manages the secret in Secrets Manager!
+  manage_master_user_password = true 
+
+  db_subnet_group_name        = aws_db_subnet_group.main.name
+  vpc_security_group_ids      = [aws_security_group.rds.id]
+  
+  skip_final_snapshot         = true
+  publicly_accessible         = false
+}
+
+# 4. IAM Permission for RDS Master Password Secret
+resource "aws_iam_role_policy" "rds_secret_access" {
+  name   = "{{PROJECT_NAME}}-rds-secret-policy"
+  role   = aws_iam_role.execution_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = ["secretsmanager:GetSecretValue"]
+        Resource = [
+          aws_db_instance.postgres.master_user_secret[0].secret_arn
+        ]
+      }
+    ]
+  })
+}

package/templates/terraform/main.tf

@@ -1,6 +1,12 @@
 # deploy-stack generated infrastructure
 provider "aws" {
   region = "{{REGION}}"
+
+  default_tags {
+    tags = {
+      ManagedBy = "deploy-stack"
+    }
+  }
 }
 
 locals {
@@ -76,14 +82,23 @@ resource "aws_ecs_task_definition" "app" {
       image     = "${aws_ecr_repository.app.repository_url}:latest"
       essential = true
 
-      # Dynamically map every secret key found in the local JSON file
-      secrets = [
-        for key in local.secret_keys : {
-          name      = key
-          valueFrom = "${aws_secretsmanager_secret.app_secrets.arn}:${key}::"
-        }
+      environment = [
+        {{DB_ENV_VARS}}
       ]
 
+      # Dynamically map every secret key found in the local JSON file
+      secrets = concat(
+        [
+          for key in local.secret_keys : {
+            name      = key
+            valueFrom = "${aws_secretsmanager_secret.app_secrets.arn}:${key}::"
+          }
+        ],
+        [
+          {{DB_SECRETS}}
+        ]
+      )
+      
       portMappings = [
         {
           containerPort = {{PORT}}
@@ -191,4 +206,21 @@ output "website_url" {
 output "ecr_repository_url" {
   description = "The URL of the ECR repository"
   value       = aws_ecr_repository.app.repository_url
+}
+
+# --- CloudWatch Alarms ---
+resource "aws_cloudwatch_metric_alarm" "alb_5xx_errors" {
+  alarm_name          = "{{PROJECT_NAME}}-high-5xx-errors"
+  comparison_operator = "GreaterThanThreshold"
+  evaluation_periods  = "2"
+  metric_name         = "HTTPCode_Target_5XX_Count"
+  namespace           = "AWS/ApplicationELB"
+  period              = "60"
+  statistic           = "Sum"
+  threshold           = "10"
+  alarm_description   = "Triggers if the ALB receives more than 10 5XX errors in 2 minutes."
+  
+  dimensions = {
+    LoadBalancer = aws_lb.main.arn_suffix
+  }
 }