deploy-stack 0.9.11 → 0.9.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.9.11",
+  "version": "0.9.12",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "type": "module",
   "bin": {

package/src/utils/backup.js

@@ -17,11 +17,16 @@ export async function handleExistingFiles(targetDir) {
         return; // Clean slate
     }
 
+    const foundFiles = [];
+    if (tfExists) foundFiles.push('terraform/');
+    if (dockerfileExists) foundFiles.push('Dockerfile');
+    if (wfExists) foundFiles.push('.github/workflows/deploy.yml');
+
     const overwriteDecision = await select({
-        message: color.yellow('⚠️  deploy-stack configurations already exist. What would you like to do?'),
+        message: color.yellow(`⚠️  Conflicting files found (${foundFiles.join(', ')}). To guarantee a secure, 0-CVE deployment, we must use our optimized configurations.`),
         options: [
-            { value: 'cancel', label: 'Cancel', hint: 'Exit without making changes' },
-            { value: 'backup', label: 'Backup & Regenerate', hint: 'Move old configs to .bak (ignored by Git) and regenerate' }
+            { value: 'backup', label: 'Backup & Regenerate', hint: 'Move old configs to .bak and generate secure templates' },
+            { value: 'cancel', label: 'Cancel', hint: 'Exit without making changes' }
         ]
     });
 

package/src/utils/generator.js

@@ -26,6 +26,8 @@ export async function generateTemplates(targetDir, config) {
         { src: 'README.md', dest: 'README.md' }
     ];
 
+    let secretsArray = [];
+
     if (config.NEEDS_DATABASE) {
         filesToProcess.push({ src: 'terraform/database.tf', dest: 'terraform/database.tf' });
 
@@ -34,14 +36,34 @@ export async function generateTemplates(targetDir, config) {
         { "name": "DB_PORT", "value": "5432" },
         { "name": "DB_NAME", "value": "\${aws_db_instance.postgres.db_name}" }`;
 
-        config.DB_SECRETS = `
-        { "name": "DB_USER", "valueFrom": "\${aws_db_instance.postgres.master_user_secret[0].secret_arn}:username::" },
-        { "name": "DB_PASSWORD", "valueFrom": "\${aws_db_instance.postgres.master_user_secret[0].secret_arn}:password::" }`;
+        secretsArray.push(`{ "name": "DB_USER", "valueFrom": "\${aws_db_instance.postgres.master_user_secret[0].secret_arn}:username::" }`);
+        secretsArray.push(`{ "name": "DB_PASSWORD", "valueFrom": "\${aws_db_instance.postgres.master_user_secret[0].secret_arn}:password::" }`);
     } else {
         config.DB_ENV_VARS = '';
-        config.DB_SECRETS = '';
     }
 
+    // Build the initial HCL map for AWS Secrets Manager
+    let initialSecretMap = `{\n    EXAMPLE_API_KEY = "replace_me_in_aws_console"`;
+
+    // Inject Rails Master Key if applicable
+    if (config.finalFramework === 'rails') {
+        secretsArray.push(`{ "name": "RAILS_MASTER_KEY", "valueFrom": "\${aws_secretsmanager_secret.app_secrets.arn}:RAILS_MASTER_KEY::" }`);
+
+        initialSecretMap += `,\n    RAILS_MASTER_KEY = var.rails_master_key`;
+
+        const masterKeyPath = path.join(targetDir, 'config', 'master.key');
+        if (fsSync.existsSync(masterKeyPath)) {
+            const realKey = fsSync.readFileSync(masterKeyPath, 'utf-8').trim();
+            const tfvarsPath = path.join(targetDir, 'terraform', 'secrets.auto.tfvars');
+            fsSync.writeFileSync(tfvarsPath, `rails_master_key = "${realKey}"\n`);
+        }
+    }
+
+    initialSecretMap += `\n  }`;
+
+    config.TASK_SECRETS = secretsArray.join(',\n        ');
+    config.INITIAL_SECRET_MAP = initialSecretMap;
+
     // 3. Process standard files
     for (const file of filesToProcess) {
         let content = await fs.readFile(path.join(templatesDir, file.src), 'utf-8');
@@ -100,6 +122,7 @@ terraform/*.tfstate
 terraform/*.tfstate.backup
 terraform/.terraform.lock.hcl
 terraform/secret_keys.json
+terraform/*.auto.tfvars
 .env
 
 # OS

package/templates/docker/rails.Dockerfile

@@ -1,21 +1,50 @@
-FROM ruby:3.2-slim
+# Stage 1: Build the Rails application
+FROM ruby:3.3-alpine AS builder
 WORKDIR /app
 
-RUN apt-get update -qq && apt-get install -y build-essential libpq-dev nodejs && rm -rf /var/lib/apt/lists/*
+# Install native build tools required to compile C extensions (like pg or nokogiri)
+RUN apk update && \
+    apk add --no-cache build-base postgresql-dev tzdata nodejs yarn
 
-# Create unprivileged user
-RUN groupadd -g 1001 appgroup && \
-    useradd -u 1001 -g appgroup -s /bin/sh -m appuser
+COPY Gemfile Gemfile.lock* ./
+
+# Use ENV to guarantee Bundler skips dev/test gems
+ENV BUNDLE_WITHOUT="development:test"
+
+# Install deps and remove cache
+RUN bundle install && \
+    rm -rf /usr/local/bundle/cache/*.gem
 
-COPY Gemfile Gemfile.lock ./
-RUN bundle install --without development test
+COPY . .
 
-# Copy code with explicit ownership
-COPY --chown=appuser:appgroup . .
+# Precompile assets (we use a dummy key since it's just for building)
+RUN SECRET_KEY_BASE=dummy bundle exec rails assets:precompile || true
+
+# Stage 2: Production runner
+FROM ruby:3.3-alpine AS runner
+WORKDIR /app
+
+ENV RAILS_ENV=production \
+    RAILS_SERVE_STATIC_FILES=true \
+    RAILS_LOG_TO_STDOUT=true \
+    BUNDLE_WITHOUT="development:test" \
+    PORT={{PORT}}
+
+# Upgrade Alpine OS to patch system CVEs and install runtime libs
+# The pure Ruby Alpine image has no NPM/Yarn ghosts to vaporize!
+RUN apk update && apk upgrade --no-cache && \
+    apk add --no-cache postgresql-libs tzdata && \
+    rm -rf /var/cache/apk/*
+
+# Create unprivileged user
+RUN addgroup -g 1001 -S railsgroup && \
+    adduser -S railsuser -u 1001 -G railsgroup
 
-RUN SECRET_KEY_BASE_DUMMY=1 bundle exec rails assets:precompile
+# Copy built gems and application code
+COPY --from=builder --chown=railsuser:railsgroup /usr/local/bundle /usr/local/bundle
+COPY --from=builder --chown=railsuser:railsgroup /app /app
 
-USER appuser
+USER railsuser
 EXPOSE {{PORT}}
 
-CMD ["bundle", "exec", "puma", "-C", "config/puma.rb"]
+CMD ["bundle", "exec", "puma", "-b", "tcp://0.0.0.0:{{PORT}}"]

package/templates/terraform/cloudfront.tf

@@ -59,5 +59,22 @@ output "cloudfront_url" {
 }
 
 output "z_NEXT_STEP_REQUIRED" {
-  value = "⚠️ Your infrastructure is up, but these URLs will return 503 errors until you push your code to GitHub and the Actions pipeline deploys your container."
+  value = <<EOT
+
+====================================================================
+🚀 INFRASTRUCTURE PROVISIONED SUCCESSFULLY!
+====================================================================
+
+Your AWS environment is ready. However, your URLs will return an 
+error until your application code is actually deployed.
+
+TO DEPLOY YOUR APP:
+1. git add .
+2. git commit -m "ci: configure deploy-stack"
+3. git push origin main
+
+Once the GitHub Action completes, your site will be live at the 
+CloudFront URL!
+====================================================================
+EOT
 }

package/templates/terraform/main.tf

@@ -95,7 +95,7 @@ resource "aws_ecs_task_definition" "app" {
           }
         ],
         [
-          {{DB_SECRETS}}
+          {{TASK_SECRETS}}
         ]
       )
       
@@ -198,8 +198,8 @@ resource "aws_iam_role_policy" "secrets_policy" {
 }
 
 # --- Outputs ---
-output "website_url" {
-  description = "The public URL of your load balancer"
+output "alb_direct_url" {
+  description = "Direct Load Balancer URL (Bypasses CloudFront/CDN)"
   value       = "http://${aws_lb.main.dns_name}"
 }
 

package/templates/terraform/secrets.tf

@@ -5,12 +5,16 @@ resource "aws_secretsmanager_secret" "app_secrets" {
   recovery_window_in_days = 0 # Allows instant deletion for dev/POC environments
 }
 
+# Fallback dummy key for CI/CD environments where the real key isn't present
+variable "rails_master_key" {
+  type    = string
+  default = "1234567890abcdef1234567890abcdef"
+}
+
 # Initial placeholder secret so the ECS task doesn't fail on first boot
 resource "aws_secretsmanager_secret_version" "app_secrets_initial" {
   secret_id = aws_secretsmanager_secret.app_secrets.id
-  secret_string = jsonencode({
-    EXAMPLE_API_KEY = "replace_me_in_aws_console_or_cli"
-  })
+  secret_string = jsonencode({{INITIAL_SECRET_MAP}})
 
   lifecycle {
     ignore_changes = [secret_string]