deploy-stack 0.9.11 → 0.9.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "type": "module",
   "bin": {

package/src/utils/backup.js

@@ -17,11 +17,16 @@ export async function handleExistingFiles(targetDir) {
         return; // Clean slate
     }
 
+    const foundFiles = [];
+    if (tfExists) foundFiles.push('terraform/');
+    if (dockerfileExists) foundFiles.push('Dockerfile');
+    if (wfExists) foundFiles.push('.github/workflows/deploy.yml');
+
     const overwriteDecision = await select({
-        message: color.yellow('⚠️  deploy-stack configurations already exist. What would you like to do?'),
+        message: color.yellow(`⚠️  Conflicting files found (${foundFiles.join(', ')}). To guarantee a secure, 0-CVE deployment, we must use our optimized configurations.`),
         options: [
-            { value: 'cancel', label: 'Cancel', hint: 'Exit without making changes' },
-            { value: 'backup', label: 'Backup & Regenerate', hint: 'Move old configs to .bak (ignored by Git) and regenerate' }
+            { value: 'backup', label: 'Backup & Regenerate', hint: 'Move old configs to .bak and generate secure templates' },
+            { value: 'cancel', label: 'Cancel', hint: 'Exit without making changes' }
         ]
     });
 

package/src/utils/generator.js

@@ -26,6 +26,8 @@ export async function generateTemplates(targetDir, config) {
         { src: 'README.md', dest: 'README.md' }
     ];
 
+    let secretsArray = [];
+
     if (config.NEEDS_DATABASE) {
         filesToProcess.push({ src: 'terraform/database.tf', dest: 'terraform/database.tf' });
 
@@ -34,14 +36,34 @@ export async function generateTemplates(targetDir, config) {
         { "name": "DB_PORT", "value": "5432" },
         { "name": "DB_NAME", "value": "\${aws_db_instance.postgres.db_name}" }`;
 
-        config.DB_SECRETS = `
-        { "name": "DB_USER", "valueFrom": "\${aws_db_instance.postgres.master_user_secret[0].secret_arn}:username::" },
-        { "name": "DB_PASSWORD", "valueFrom": "\${aws_db_instance.postgres.master_user_secret[0].secret_arn}:password::" }`;
+        secretsArray.push(`{ "name": "DB_USER", "valueFrom": "\${aws_db_instance.postgres.master_user_secret[0].secret_arn}:username::" }`);
+        secretsArray.push(`{ "name": "DB_PASSWORD", "valueFrom": "\${aws_db_instance.postgres.master_user_secret[0].secret_arn}:password::" }`);
     } else {
         config.DB_ENV_VARS = '';
-        config.DB_SECRETS = '';
     }
 
+    // Build the initial HCL map for AWS Secrets Manager
+    let initialSecretMap = `{\n    EXAMPLE_API_KEY = "replace_me_in_aws_console"`;
+
+    // Inject Rails Master Key if applicable
+    if (config.finalFramework === 'rails') {
+        secretsArray.push(`{ "name": "RAILS_MASTER_KEY", "valueFrom": "\${aws_secretsmanager_secret.app_secrets.arn}:RAILS_MASTER_KEY::" }`);
+
+        initialSecretMap += `,\n    RAILS_MASTER_KEY = var.rails_master_key`;
+
+        const masterKeyPath = path.join(targetDir, 'config', 'master.key');
+        if (fsSync.existsSync(masterKeyPath)) {
+            const realKey = fsSync.readFileSync(masterKeyPath, 'utf-8').trim();
+            const tfvarsPath = path.join(targetDir, 'terraform', 'secrets.auto.tfvars');
+            fsSync.writeFileSync(tfvarsPath, `rails_master_key = "${realKey}"\n`);
+        }
+    }
+
+    initialSecretMap += `\n  }`;
+
+    config.TASK_SECRETS = secretsArray.join(',\n        ');
+    config.INITIAL_SECRET_MAP = initialSecretMap;
+
     // 3. Process standard files
     for (const file of filesToProcess) {
         let content = await fs.readFile(path.join(templatesDir, file.src), 'utf-8');
@@ -72,34 +94,36 @@ export async function generateTemplates(targetDir, config) {
 
     // 6. Create .dockerignore to keep images lean and secure
     const dockerignorePath = path.join(targetDir, '.dockerignore');
+    const appendDockerIgnore = '\n# Infrastructure (deploy-stack)\nterraform/\n**/.terraform/\n**/.terraform.*\n**/*.tfstate*\n.env\n';
+
     if (!fsSync.existsSync(dockerignorePath)) {
         const dockerignoreContent = `
 .git/
 .github/
-terraform/
-**/.terraform/
-**/.terraform.*
-**/*.tfstate*
-.env
 README.md
 node_modules/
 npm-debug.log
 __pycache__/
 *.pyc
 .DS_Store
-`.trim();
+`.trim() + appendDockerIgnore;
         await fs.writeFile(dockerignorePath, dockerignoreContent);
+    } else {
+        const existingDockerignore = await fs.readFile(dockerignorePath, 'utf-8');
+        if (!existingDockerignore.includes('terraform/')) {
+            await fs.appendFile(dockerignorePath, appendDockerIgnore);
+        }
     }
-}
 
-function getGitignoreContent(framework) {
-    const baseIgnore = `
+    function getGitignoreContent(framework) {
+        const baseIgnore = `
 # Infrastructure (deploy-stack)
 terraform/.terraform/
 terraform/*.tfstate
 terraform/*.tfstate.backup
 terraform/.terraform.lock.hcl
 terraform/secret_keys.json
+terraform/*.auto.tfvars
 .env
 
 # OS
@@ -107,17 +131,17 @@ terraform/secret_keys.json
 Thumbs.db
 `;
 
-    const presets = {
-        node: '\n# Node.js\nnode_modules/\nnpm-debug.log\nyarn-error.log\n',
-        nextjs: '\n# Next.js\nnode_modules/\n.next/\nout/\nbuild/\nnext-env.d.ts\n',
-        nuxt: '\n# Nuxt 3\nnode_modules/\n.nuxt/\n.output/\ndist/\n',
-        python: '\n# Python\n__pycache__/\n*.py[cod]\n*$py.class\nvenv/\nenv/\n.venv/\n.pytest_cache/\n',
-        django: '\n# Django\n*.log\n*.pot\n*.pyc\n__pycache__/\ndb.sqlite3\nmedia/\n',
-        go: '\n# Go\n/bin/\n/pkg/\n/obj/\n*.exe\n*.exe~*\n*.dll\n*.so\n*.dylib\n',
-        rails: '\n# Rails\n/*.log\n/tmp/\n/log/\n/public/system/\n/public/assets/\n/vendor/bundle/\n',
-        static: '\n# Static Sites\nnode_modules/\ndist/\nbuild/\nout/\n.output/\n.cache/\npublic/\n'
-    };
-
-    const frameworkIgnore = presets[framework] || '';
-    return (baseIgnore + frameworkIgnore).trim();
-}
+        const presets = {
+            node: '\n# Node.js\nnode_modules/\nnpm-debug.log\nyarn-error.log\n',
+            nextjs: '\n# Next.js\nnode_modules/\n.next/\nout/\nbuild/\nnext-env.d.ts\n',
+            nuxt: '\n# Nuxt 3\nnode_modules/\n.nuxt/\n.output/\ndist/\n',
+            python: '\n# Python\n__pycache__/\n*.py[cod]\n*$py.class\nvenv/\nenv/\n.venv/\n.pytest_cache/\n',
+            django: '\n# Django\n*.log\n*.pot\n*.pyc\n__pycache__/\ndb.sqlite3\nmedia/\n',
+            go: '\n# Go\n/bin/\n/pkg/\n/obj/\n*.exe\n*.exe~*\n*.dll\n*.so\n*.dylib\n',
+            rails: '\n# Rails\n/*.log\n/tmp/\n/log/\n/public/system/\n/public/assets/\n/vendor/bundle/\n',
+            static: '\n# Static Sites\nnode_modules/\ndist/\nbuild/\nout/\n.output/\n.cache/\npublic/\n'
+        };
+
+        const frameworkIgnore = presets[framework] || '';
+        return (baseIgnore + frameworkIgnore).trim();
+    }

package/templates/docker/rails.Dockerfile

@@ -1,21 +1,50 @@
-FROM ruby:3.2-slim
+# Stage 1: Build the Rails application
+FROM ruby:3.3-alpine AS builder
 WORKDIR /app
 
-RUN apt-get update -qq && apt-get install -y build-essential libpq-dev nodejs && rm -rf /var/lib/apt/lists/*
+# Install native build tools required to compile C extensions (like pg or nokogiri)
+RUN apk update && \
+    apk add --no-cache build-base postgresql-dev tzdata nodejs yarn
 
-# Create unprivileged user
-RUN groupadd -g 1001 appgroup && \
-    useradd -u 1001 -g appgroup -s /bin/sh -m appuser
+COPY Gemfile Gemfile.lock* ./
+
+# Use ENV to guarantee Bundler skips dev/test gems
+ENV BUNDLE_WITHOUT="development:test"
+
+# Install deps and remove cache
+RUN bundle install && \
+    rm -rf /usr/local/bundle/cache/*.gem
 
-COPY Gemfile Gemfile.lock ./
-RUN bundle install --without development test
+COPY . .
 
-# Copy code with explicit ownership
-COPY --chown=appuser:appgroup . .
+# Precompile assets (we use a dummy key since it's just for building)
+RUN SECRET_KEY_BASE=dummy bundle exec rails assets:precompile || true
+
+# Stage 2: Production runner
+FROM ruby:3.3-alpine AS runner
+WORKDIR /app
+
+ENV RAILS_ENV=production \
+    RAILS_SERVE_STATIC_FILES=true \
+    RAILS_LOG_TO_STDOUT=true \
+    BUNDLE_WITHOUT="development:test" \
+    PORT={{PORT}}
+
+# Upgrade Alpine OS to patch system CVEs and install runtime libs
+# The pure Ruby Alpine image has no NPM/Yarn ghosts to vaporize!
+RUN apk update && apk upgrade --no-cache && \
+    apk add --no-cache postgresql-libs tzdata && \
+    rm -rf /var/cache/apk/*
+
+# Create unprivileged user
+RUN addgroup -g 1001 -S railsgroup && \
+    adduser -S railsuser -u 1001 -G railsgroup
 
-RUN SECRET_KEY_BASE_DUMMY=1 bundle exec rails assets:precompile
+# Copy built gems and application code
+COPY --from=builder --chown=railsuser:railsgroup /usr/local/bundle /usr/local/bundle
+COPY --from=builder --chown=railsuser:railsgroup /app /app
 
-USER appuser
+USER railsuser
 EXPOSE {{PORT}}
 
-CMD ["bundle", "exec", "puma", "-C", "config/puma.rb"]
+CMD ["bundle", "exec", "puma", "-b", "tcp://0.0.0.0:{{PORT}}"]

package/templates/terraform/cloudfront.tf

@@ -59,5 +59,22 @@ output "cloudfront_url" {
 }
 
 output "z_NEXT_STEP_REQUIRED" {
-  value = "⚠️ Your infrastructure is up, but these URLs will return 503 errors until you push your code to GitHub and the Actions pipeline deploys your container."
+  value = <<EOT
+
+====================================================================
+🚀 INFRASTRUCTURE PROVISIONED SUCCESSFULLY!
+====================================================================
+
+Your AWS environment is ready. However, your URLs listed above will 
+return an error until your application code is actually deployed.
+
+TO DEPLOY YOUR APP:
+1. git add .
+2. git commit -m "ci: configure deploy-stack"
+3. git push origin main
+
+Once the GitHub Action completes, your site will be live at the 
+CloudFront URL!
+====================================================================
+EOT
 }

package/templates/terraform/main.tf

@@ -95,7 +95,7 @@ resource "aws_ecs_task_definition" "app" {
           }
         ],
         [
-          {{DB_SECRETS}}
+          {{TASK_SECRETS}}
         ]
       )
       
@@ -198,8 +198,8 @@ resource "aws_iam_role_policy" "secrets_policy" {
 }
 
 # --- Outputs ---
-output "website_url" {
-  description = "The public URL of your load balancer"
+output "alb_direct_url" {
+  description = "Direct Load Balancer URL (Bypasses CloudFront/CDN)"
   value       = "http://${aws_lb.main.dns_name}"
 }
 

package/templates/terraform/secrets.tf

@@ -5,12 +5,16 @@ resource "aws_secretsmanager_secret" "app_secrets" {
   recovery_window_in_days = 0 # Allows instant deletion for dev/POC environments
 }
 
+# Fallback dummy key for CI/CD environments where the real key isn't present
+variable "rails_master_key" {
+  type    = string
+  default = "1234567890abcdef1234567890abcdef"
+}
+
 # Initial placeholder secret so the ECS task doesn't fail on first boot
 resource "aws_secretsmanager_secret_version" "app_secrets_initial" {
   secret_id = aws_secretsmanager_secret.app_secrets.id
-  secret_string = jsonencode({
-    EXAMPLE_API_KEY = "replace_me_in_aws_console_or_cli"
-  })
+  secret_string = jsonencode({{INITIAL_SECRET_MAP}})
 
   lifecycle {
     ignore_changes = [secret_string]