grada-run 0.0.2 → 0.33.0

package/templates/terraform/addons/s3.tf

@@ -0,0 +1,143 @@
+# grada addon: storage:s3
+# Generated by `grada add storage:s3`. Do not edit by hand unless
+# you know what you are doing — re-running with --force overwrites this file.
+#
+# Billing: no fixed hourly instance cost (usage-billed). S3 storage
+# ($0.023/GB-mo), S3 PUT/GET requests, and CloudFront data transfer out
+# are billed by usage on top of the stack's fixed baseline.
+
+data "aws_caller_identity" "current" {}
+
+# --- Private S3 Bucket ---
+resource "aws_s3_bucket" "storage" {
+  # Truncate and sanitize the prefix so the full account ID suffix always fits
+  # within S3's 63-character limit. Underscores are replaced because S3 names
+  # must be DNS-compatible (lowercase, hyphens only).
+  bucket = "${trimsuffix(substr(replace(lower(local.app_name), "_", "-"), 0, 42), "-")}-storage-${data.aws_caller_identity.current.account_id}"
+}
+
+resource "aws_s3_bucket_public_access_block" "storage" {
+  bucket                  = aws_s3_bucket.storage.id
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "storage" {
+  bucket = aws_s3_bucket.storage.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_s3_bucket_cors_configuration" "storage" {
+  bucket = aws_s3_bucket.storage.id
+
+  cors_rule {
+    allowed_methods  = ["GET", "PUT", "POST", "DELETE", "HEAD"]
+    # NOTE: intentionally open for zero-config presigned browser uploads.
+    # Restrict to your app domain (e.g. ["https://example.com"]) once known.
+    allowed_origins  = ["*"]
+    allowed_headers  = ["*"]
+    expose_headers   = ["ETag"]
+    max_age_seconds  = 3000
+  }
+}
+
+# --- CloudFront Distribution with Origin Access Control ---
+resource "aws_cloudfront_origin_access_control" "storage_oac" {
+  name                              = "${local.app_name}-storage-oac"
+  origin_access_control_origin_type = "s3"
+  signing_behavior                  = "always"
+  signing_protocol                  = "sigv4"
+}
+
+resource "aws_cloudfront_distribution" "storage_cdn" {
+  enabled             = true
+  is_ipv6_enabled     = true
+  wait_for_deployment = false
+
+  origin {
+    domain_name              = aws_s3_bucket.storage.bucket_regional_domain_name
+    origin_id                = "S3Origin"
+    origin_access_control_id = aws_cloudfront_origin_access_control.storage_oac.id
+  }
+
+  default_cache_behavior {
+    allowed_methods        = ["GET", "HEAD", "OPTIONS"]
+    cached_methods         = ["GET", "HEAD"]
+    target_origin_id       = "S3Origin"
+    viewer_protocol_policy = "redirect-to-https"
+
+    forwarded_values {
+      query_string = false
+
+      cookies {
+        forward = "none"
+      }
+    }
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    cloudfront_default_certificate = true
+  }
+}
+
+resource "aws_s3_bucket_policy" "storage_oac_policy" {
+  bucket = aws_s3_bucket.storage.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "AllowCloudFrontOAC"
+        Effect    = "Allow"
+        Principal = { Service = "cloudfront.amazonaws.com" }
+        Action    = "s3:GetObject"
+        Resource  = "${aws_s3_bucket.storage.arn}/*"
+        Condition = {
+          StringEquals = { "AWS:SourceArn" = aws_cloudfront_distribution.storage_cdn.arn }
+        }
+      }
+    ]
+  })
+}
+
+# --- Least-Privilege IAM Policy for the ECS Task Role ---
+resource "aws_iam_role_policy" "storage_s3_access" {
+  name = "${local.app_name}-storage-s3-access"
+  role = aws_iam_role.task_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"]
+        Resource = "${aws_s3_bucket.storage.arn}/*"
+      },
+      {
+        Effect   = "Allow"
+        Action   = ["s3:ListBucket"]
+        Resource = aws_s3_bucket.storage.arn
+      }
+    ]
+  })
+}
+
+# --- Outputs ---
+output "s3_bucket_name" {
+  value = aws_s3_bucket.storage.id
+}
+
+output "s3_cdn_domain" {
+  value = aws_cloudfront_distribution.storage_cdn.domain_name
+}

package/templates/terraform/addons/ses.tf

@@ -0,0 +1,73 @@
+# grada addon: email:ses
+# Generated by `grada add email:ses`. Do not edit by hand unless
+# you know what you are doing — re-running with --force overwrites this file.
+#
+# Billing: no fixed hourly instance cost (usage-billed at $0.10 per 1,000
+# emails sent). New AWS accounts start in the SES sandbox (verified
+# recipients only) — request production access in the SES console to send
+# to unverified addresses.
+
+# --- SES Domain Identity ---
+# Account-wide singletons per domain/region: scoped to the default
+# (production) workspace so PR preview teardowns never delete them.
+resource "aws_ses_domain_identity" "ses" {
+  count  = terraform.workspace == "default" ? 1 : 0
+  domain = "{{SES_DOMAIN}}"
+}
+
+resource "aws_ses_domain_dkim" "ses" {
+  count  = terraform.workspace == "default" ? 1 : 0
+  domain = aws_ses_domain_identity.ses[0].domain
+}
+
+resource "aws_ses_domain_mail_from" "ses" {
+  count                  = terraform.workspace == "default" ? 1 : 0
+  domain                 = aws_ses_domain_identity.ses[0].domain
+  mail_from_domain       = "mail.{{SES_DOMAIN}}"
+  behavior_on_mx_failure = "UseDefaultValue"
+}
+
+{{SES_ROUTE53_RECORDS_BLOCK}}
+# --- Least-Privilege IAM Policy for the ECS Task Role ---
+resource "aws_iam_role_policy" "ses_send" {
+  name = "${local.app_name}-ses-send"
+  role = aws_iam_role.task_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["ses:SendEmail", "ses:SendRawEmail"]
+        Resource = "*"
+        Condition = {
+          StringLike = { "ses:FromAddress" = ["*@{{SES_DOMAIN}}", "{{SES_FROM_EMAIL}}"] }
+        }
+      }
+    ]
+  })
+}
+
+# --- Outputs ---
+# In external-DNS mode (no --zone-id), create these records at your DNS
+# provider: the verification TXT, the three DKIM CNAMEs
+# (`<token>._domainkey.{{SES_DOMAIN}}` -> `<token>.dkim.amazonses.com`),
+# the MAIL FROM MX/SPF at `mail.{{SES_DOMAIN}}`, and the DMARC TXT.
+output "ses_domain_identity_arn" {
+  value = terraform.workspace == "default" ? aws_ses_domain_identity.ses[0].arn : null
+}
+
+output "ses_verification_token" {
+  value = terraform.workspace == "default" ? aws_ses_domain_identity.ses[0].verification_token : null
+}
+
+output "ses_dkim_tokens" {
+  value = terraform.workspace == "default" ? aws_ses_domain_dkim.ses[0].dkim_tokens : []
+}
+
+output "ses_spf_record" {
+  value = "v=spf1 include:amazonses.com ~all"
+}
+
+output "ses_dmarc_record" {
+  value = "v=DMARC1; p=none;"
+}

package/templates/terraform/addons/sqs.tf

@@ -0,0 +1,67 @@
+# grada addon: queue:sqs
+# Generated by `grada add queue:sqs`. Do not edit by hand unless
+# you know what you are doing — re-running with --force overwrites this file.
+#
+# Billing: no fixed hourly instance cost (usage-billed). The first 1M SQS
+# requests/mo are free, then $0.40 per million requests.
+
+# --- Dead-Letter Queue ---
+resource "aws_sqs_queue" "dlq" {
+  name                      = "${local.app_name}-dlq"
+  message_retention_seconds = 1209600
+  sqs_managed_sse_enabled   = true
+}
+
+# --- Primary Queue ---
+resource "aws_sqs_queue" "main" {
+  name                      = "${local.app_name}-queue"
+  visibility_timeout_seconds = 30
+  message_retention_seconds = 345600
+  receive_wait_time_seconds = 20
+  sqs_managed_sse_enabled   = true
+  redrive_policy = jsonencode({
+    deadLetterTargetArn = aws_sqs_queue.dlq.arn
+    maxReceiveCount     = 3
+  })
+}
+
+# --- Least-Privilege IAM Policy for the ECS Task Role ---
+resource "aws_iam_role_policy" "queue_sqs_access" {
+  name = "${local.app_name}-queue-sqs-access"
+  role = aws_iam_role.task_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "sqs:SendMessage",
+          "sqs:ReceiveMessage",
+          "sqs:DeleteMessage",
+          "sqs:ChangeMessageVisibility",
+          "sqs:GetQueueAttributes",
+          "sqs:GetQueueUrl"
+        ]
+        Resource = [
+          aws_sqs_queue.main.arn,
+          aws_sqs_queue.dlq.arn
+        ]
+      }
+    ]
+  })
+}
+
+{{WORKER_AUTOSCALING_BLOCK}}
+
+# --- Outputs ---
+output "sqs_queue_url" {
+  value = aws_sqs_queue.main.id
+}
+
+output "sqs_queue_arn" {
+  value = aws_sqs_queue.main.arn
+}
+
+output "sqs_dlq_url" {
+  value = aws_sqs_queue.dlq.id
+}

package/templates/terraform/backend.tf

@@ -0,0 +1,22 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+    tls = {
+      source  = "hashicorp/tls"
+      version = "~> 4.0"
+    }
+  }
+
+  backend "s3" {
+    bucket       = "{{STATE_BUCKET}}"
+    key          = "state/terraform.tfstate"
+    region       = "{{REGION}}"
+    encrypt      = true
+    use_lockfile = true
+  }
+}

package/templates/terraform/cloudfront-lambda.tf

@@ -0,0 +1,80 @@
+# Fetch the AWS Managed Cache Policy (Optimized for standard web traffic)
+data "aws_cloudfront_cache_policy" "optimized" {
+  name = "Managed-CachingOptimized"
+}
+
+# Fetch the AWS Managed Origin Request Policy (Passes query strings/cookies to your app)
+data "aws_cloudfront_origin_request_policy" "all_viewer" {
+  name = "Managed-AllViewerExceptHostHeader"
+}
+
+# trivy:ignore:AVD-AWS-0011 - WAF is omitted by default to prevent unexpected monthly costs for users
+resource "aws_cloudfront_distribution" "cdn" {
+  enabled             = true
+  is_ipv6_enabled     = true
+  wait_for_deployment = false # Prevents Terraform from hanging for 10+ minutes
+
+  origin {
+    # Point the CDN at the API Gateway HTTP API provisioned in main.tf
+    domain_name = replace(aws_apigatewayv2_api.main.api_endpoint, "https://", "")
+    origin_id   = "ApiGatewayOrigin"
+
+    custom_origin_config {
+      http_port              = 80
+      https_port             = 443
+      # API Gateway HTTP API endpoints are HTTPS-only
+      origin_protocol_policy = "https-only"
+      origin_ssl_protocols   = ["TLSv1.2"]
+    }
+  }
+
+  default_cache_behavior {
+    # Allow all HTTP methods so API POST/PUT requests still work
+    allowed_methods  = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
+    cached_methods   = ["GET", "HEAD"]
+    target_origin_id = "ApiGatewayOrigin"
+
+    viewer_protocol_policy = "redirect-to-https"
+
+    # Attach the Managed Policies
+    cache_policy_id          = data.aws_cloudfront_cache_policy.optimized.id
+    origin_request_policy_id = data.aws_cloudfront_origin_request_policy.all_viewer.id
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    # Gives the user a free HTTPS *.cloudfront.net domain out of the box
+    cloudfront_default_certificate = true
+  }
+}
+
+output "cloudfront_url" {
+  description = "Your globally cached, HTTPS-secured application URL"
+  value       = "https://${aws_cloudfront_distribution.cdn.domain_name}"
+}
+
+output "z_NEXT_STEP_REQUIRED" {
+  value = <<EOT
+
+====================================================================
+🚀 INFRASTRUCTURE PROVISIONED SUCCESSFULLY!
+====================================================================
+
+Your AWS environment is ready. However, your URLs listed above will
+return an error until your application code is actually deployed.
+
+TO DEPLOY YOUR APP:
+1. git add .
+2. git commit -m "ci: configure grada"
+3. git push origin main
+
+Once the GitHub Action completes, your site will be live at the
+CloudFront URL!
+====================================================================
+EOT
+}

package/templates/terraform/cloudfront.tf

@@ -0,0 +1,80 @@
+# Fetch the AWS Managed Cache Policy (Optimized for standard web traffic)
+data "aws_cloudfront_cache_policy" "optimized" {
+  name = "Managed-CachingOptimized"
+}
+
+# Fetch the AWS Managed Origin Request Policy (Passes query strings/cookies to your app)
+data "aws_cloudfront_origin_request_policy" "all_viewer" {
+  name = "Managed-AllViewerExceptHostHeader"
+}
+
+# trivy:ignore:AVD-AWS-0011 - WAF is omitted by default to prevent unexpected monthly costs for users
+resource "aws_cloudfront_distribution" "cdn" {
+  enabled             = true
+  is_ipv6_enabled     = true
+  wait_for_deployment = false # Prevents Terraform from hanging for 10+ minutes
+  
+  origin {
+    # Point the CDN at the Load Balancer we provision in main.tf
+    domain_name = aws_lb.main.dns_name
+    origin_id   = "ALBOrigin"
+
+    custom_origin_config {
+      http_port              = 80
+      https_port             = 443
+      # Because this is the free tier without a custom SSL domain, we route internally via HTTP
+      origin_protocol_policy = "http-only" 
+      origin_ssl_protocols   = ["TLSv1.2"]
+    }
+  }
+
+  default_cache_behavior {
+    # Allow all HTTP methods so API POST/PUT requests still work
+    allowed_methods  = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
+    cached_methods   = ["GET", "HEAD"]
+    target_origin_id = "ALBOrigin"
+
+    viewer_protocol_policy = "redirect-to-https"
+
+    # Attach the Managed Policies
+    cache_policy_id          = data.aws_cloudfront_cache_policy.optimized.id
+    origin_request_policy_id = data.aws_cloudfront_origin_request_policy.all_viewer.id
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    # Gives the user a free HTTPS *.cloudfront.net domain out of the box
+    cloudfront_default_certificate = true
+  }
+}
+
+output "cloudfront_url" {
+  description = "Your globally cached, HTTPS-secured application URL"
+  value       = "https://${aws_cloudfront_distribution.cdn.domain_name}"
+}
+
+output "z_NEXT_STEP_REQUIRED" {
+  value = <<EOT
+
+====================================================================
+🚀 INFRASTRUCTURE PROVISIONED SUCCESSFULLY!
+====================================================================
+
+Your AWS environment is ready. However, your URLs listed above will 
+return an error until your application code is actually deployed.
+
+TO DEPLOY YOUR APP:
+1. git add .
+2. git commit -m "ci: configure grada"
+3. git push origin main
+
+Once the GitHub Action completes, your site will be live at the 
+CloudFront URL!
+====================================================================
+EOT
+}

package/templates/terraform/database-aurora-postgresql.tf

@@ -0,0 +1,92 @@
+# 1. Isolated Subnets (No Internet Gateway routing)
+resource "aws_subnet" "db_isolated" {
+  count             = 2
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 8, count.index + 10)
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+
+  tags = {
+    Name = "${local.app_name}-db-isolated-${count.index}"
+  }
+}
+
+resource "aws_db_subnet_group" "main" {
+  name       = "${local.app_name}-db-subnet-group"
+  subnet_ids = aws_subnet.db_isolated[*].id
+}
+
+# 2. Database Security Group
+resource "aws_security_group" "rds" {
+  name   = "${local.app_name}-rds-sg"
+  vpc_id = aws_vpc.main.id
+
+  # ONLY allow inbound traffic from the ECS Fargate tasks
+  ingress {
+    from_port       = 5432
+    to_port         = 5432
+    protocol        = "tcp"
+    security_groups = [aws_security_group.ecs_tasks.id]
+  }
+}
+
+# 3. The Aurora PostgreSQL Serverless v2 Cluster (scale-to-zero)
+resource "aws_rds_cluster" "postgres" {
+  cluster_identifier = "${local.app_name}-db-cluster"
+  engine             = "aurora-postgresql"
+
+  # engine_version is intentionally omitted: AWS retires Aurora minor versions
+  # (e.g. 16.4 in us-east-2), so new clusters take the regional default.
+  # Strip dashes for the database name: Aurora database_name must begin with a
+  # letter and contain only alphanumeric characters (e.g. my-project -> myproject)
+  database_name   = replace(local.app_name, "-", "")
+  master_username = "dbadmin"
+
+  # AWS automatically creates and manages the secret in Secrets Manager!
+  manage_master_user_password = true
+
+  db_subnet_group_name   = aws_db_subnet_group.main.name
+  vpc_security_group_ids = [aws_security_group.rds.id]
+
+  skip_final_snapshot = true
+  storage_encrypted   = true
+
+  serverlessv2_scaling_configuration {
+    min_capacity             = 0
+    max_capacity             = 2
+    seconds_until_auto_pause = 300
+  }
+
+  lifecycle {
+    # RDS auto-assigns AZ ordering beyond our 2-subnet group; never treat
+    # that drift as a change on subsequent applies.
+    ignore_changes = [availability_zones]
+  }
+}
+
+resource "aws_rds_cluster_instance" "postgres" {
+  identifier         = "${local.app_name}-db-instance-1"
+  cluster_identifier = aws_rds_cluster.postgres.id
+  instance_class     = "db.serverless"
+  engine             = aws_rds_cluster.postgres.engine
+  engine_version     = aws_rds_cluster.postgres.engine_version
+
+  publicly_accessible = false
+}
+
+# 4. IAM Permission for RDS Master Password Secret
+resource "aws_iam_role_policy" "rds_secret_access" {
+  name = "${local.app_name}-rds-secret-policy"
+  role = aws_iam_role.execution_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = ["secretsmanager:GetSecretValue"]
+        Resource = [
+          aws_rds_cluster.postgres.master_user_secret[0].secret_arn
+        ]
+      }
+    ]
+  })
+}

package/templates/terraform/database-mysql.tf

@@ -0,0 +1,72 @@
+# 1. Isolated Subnets (No Internet Gateway routing)
+resource "aws_subnet" "db_isolated" {
+  count             = 2
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 8, count.index + 10)
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+
+  tags = {
+    Name = "${local.app_name}-db-isolated-${count.index}"
+  }
+}
+
+resource "aws_db_subnet_group" "main" {
+  name       = "${local.app_name}-db-subnet-group"
+  subnet_ids = aws_subnet.db_isolated[*].id
+}
+
+# 2. Database Security Group
+resource "aws_security_group" "rds" {
+  name   = "${local.app_name}-rds-sg"
+  vpc_id = aws_vpc.main.id
+
+  # ONLY allow inbound traffic from the ECS Fargate tasks
+  ingress {
+    from_port       = 3306
+    to_port         = 3306
+    protocol        = "tcp"
+    security_groups = [aws_security_group.ecs_tasks.id]
+  }
+}
+
+# 3. The MySQL Instance
+resource "aws_db_instance" "postgres" {
+  identifier        = "${local.app_name}-db"
+  engine            = "mysql"
+  engine_version    = "8.0"
+  instance_class    = "db.t4g.micro"
+  allocated_storage = 20
+  storage_encrypted = true
+
+  # Strip dashes for the database name: RDS MySQL db_name must begin with a
+  # letter and contain only alphanumeric characters (e.g. my-project -> myproject)
+  db_name  = replace(local.app_name, "-", "")
+  username = "dbadmin"
+
+  # AWS automatically creates and manages the secret in Secrets Manager!
+  manage_master_user_password = true
+
+  db_subnet_group_name   = aws_db_subnet_group.main.name
+  vpc_security_group_ids = [aws_security_group.rds.id]
+
+  skip_final_snapshot = true
+  publicly_accessible = false
+}
+
+# 4. IAM Permission for RDS Master Password Secret
+resource "aws_iam_role_policy" "rds_secret_access" {
+  name = "${local.app_name}-rds-secret-policy"
+  role = aws_iam_role.execution_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = ["secretsmanager:GetSecretValue"]
+        Resource = [
+          aws_db_instance.postgres.master_user_secret[0].secret_arn
+        ]
+      }
+    ]
+  })
+}