thinkwork-cli 0.12.11 → 0.12.15

package/dist/commands/enterprise/templates/deploy-repo/terraform/main.tf

@@ -64,6 +64,234 @@ variable "database_engine" {
   default     = "aurora-serverless"
 }
 
+variable "enable_hindsight" {
+  description = "Enable Hindsight canonical user and Space memory. Full ThinkWork installs default this on; set false only for explicit low-cost/development AgentCore-only deployments."
+  type        = bool
+  default     = true
+}
+
+variable "enable_cognee" {
+  description = "Enable Cognee as optional ThinkWork Brain ontology/knowledge-graph infrastructure. Disabled by default."
+  type        = bool
+  default     = false
+}
+
+variable "memory_engine" {
+  description = "Active long-term memory engine. Empty selects Hindsight when enable_hindsight = true. Use 'agentcore' only for explicit low-cost/development managed-memory deployments; 'cognee' is legacy diagnostic compatibility, not the supported user/Space memory path."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_image_uri" {
+  description = "Cognee container image URI pinned to an immutable sha256 digest. Required when enable_cognee = true."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_db_username" {
+  description = "Dedicated PostgreSQL username for Cognee metadata storage."
+  type        = string
+  default     = "thinkwork_cognee"
+}
+
+variable "cognee_db_name" {
+  description = "Dedicated PostgreSQL database name for Cognee metadata storage."
+  type        = string
+  default     = "thinkwork_cognee"
+}
+
+variable "cognee_db_password_secret_arn" {
+  description = "Secrets Manager ARN containing a JSON password field for the dedicated Cognee PostgreSQL user. Required when enable_cognee = true."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_allowed_internal_cidr_blocks" {
+  description = "CIDR blocks allowed to reach the internal Cognee ALB."
+  type        = list(string)
+  default     = []
+}
+
+variable "cognee_allowed_internal_security_group_ids" {
+  description = "Security group IDs allowed to reach the internal Cognee ALB."
+  type        = list(string)
+  default     = []
+}
+
+variable "cognee_backend_mode" {
+  description = "Cognee backend mode. dogfood uses EFS-backed local stores; remote requires graph/vector URLs."
+  type        = string
+  default     = "dogfood"
+}
+
+variable "cognee_desired_count" {
+  description = "Desired Cognee task count. Dogfood mode must stay at 1."
+  type        = number
+  default     = 1
+}
+
+variable "cognee_llm_provider" {
+  description = "Cognee LLM provider."
+  type        = string
+  default     = "bedrock"
+}
+
+variable "cognee_llm_model" {
+  description = "Cognee LLM model."
+  type        = string
+  default     = "bedrock/amazon.nova-lite-v1:0"
+}
+
+variable "cognee_llm_api_key_secret_arn" {
+  description = "Optional Secrets Manager ARN for non-Bedrock Cognee LLM provider API key."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_embedding_provider" {
+  description = "Cognee embedding provider."
+  type        = string
+  default     = "bedrock"
+}
+
+variable "cognee_embedding_model" {
+  description = "Cognee embedding model."
+  type        = string
+  default     = "amazon.titan-embed-text-v2:0"
+}
+
+variable "cognee_embedding_dimensions" {
+  description = "Cognee embedding dimensions."
+  type        = number
+  default     = 1024
+}
+
+variable "cognee_embedding_api_key_secret_arn" {
+  description = "Optional Secrets Manager ARN for non-Bedrock Cognee embedding provider API key."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_vector_db_provider" {
+  description = "Cognee vector store provider."
+  type        = string
+  default     = "lancedb"
+}
+
+variable "cognee_vector_db_url" {
+  description = "Cognee vector store URL. Empty uses the dogfood local default."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_vector_db_key_secret_arn" {
+  description = "Optional Secrets Manager ARN for remote Cognee vector store credentials."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_graph_database_provider" {
+  description = "Cognee graph store provider."
+  type        = string
+  default     = "kuzu"
+}
+
+variable "cognee_graph_database_url" {
+  description = "Cognee graph store URL. Empty uses the dogfood local default."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_graph_database_username" {
+  description = "Optional Cognee graph store username."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_graph_database_password_secret_arn" {
+  description = "Optional Secrets Manager ARN for remote Cognee graph store password."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_bedrock_model_resource_arns" {
+  description = "Explicit Bedrock model ARNs Cognee may invoke when a Bedrock provider is selected."
+  type        = list(string)
+  default     = []
+}
+
+variable "cognee_kms_key_arns" {
+  description = "Optional KMS key ARNs needed to decrypt Cognee-injected secrets."
+  type        = list(string)
+  default     = []
+}
+
+variable "twenty_provisioned" {
+  description = "Provision the retained Twenty CRM managed-app substrate. Runtime can be parked independently with twenty_runtime_enabled."
+  type        = bool
+  default     = false
+}
+
+variable "twenty_runtime_enabled" {
+  description = "Run Twenty CRM server/worker tasks when the retained substrate is provisioned."
+  type        = bool
+  default     = false
+}
+
+variable "twenty_image_uri" {
+  description = "Twenty CRM container image URI pinned to an immutable sha256 digest. Required when twenty_provisioned = true."
+  type        = string
+  default     = ""
+}
+
+variable "twenty_db_username" {
+  description = "Dedicated PostgreSQL username for Twenty CRM."
+  type        = string
+  default     = "thinkwork_twenty"
+}
+
+variable "twenty_db_name" {
+  description = "Dedicated PostgreSQL database name for Twenty CRM."
+  type        = string
+  default     = "thinkwork_twenty"
+}
+
+variable "twenty_db_url_secret_arn" {
+  description = "Secrets Manager ARN containing a JSON PG_DATABASE_URL field for the dedicated Twenty database. Required when twenty_provisioned = true."
+  type        = string
+  default     = ""
+}
+
+variable "twenty_encryption_key_secret_arn" {
+  description = "Secrets Manager ARN containing a JSON ENCRYPTION_KEY field for Twenty. Required when twenty_provisioned = true."
+  type        = string
+  default     = ""
+}
+
+variable "twenty_email_from_address" {
+  description = "Verified SES sender address for Twenty app emails. Leave empty to derive noreply@ses_inbound_domain."
+  type        = string
+  default     = ""
+}
+
+variable "twenty_email_from_name" {
+  description = "Display name for Twenty app email From headers."
+  type        = string
+  default     = "ThinkWork CRM"
+}
+
+variable "twenty_public_url" {
+  description = "Public HTTPS URL for Twenty CRM. Leave empty to derive https://crm.<www_domain>."
+  type        = string
+  default     = ""
+}
+
+variable "twenty_certificate_arn" {
+  description = "ACM certificate ARN for the Twenty public ALB. Leave empty to reuse the www-dns certificate."
+  type        = string
+  default     = ""
+}
+
 variable "lambda_artifact_bucket" {
   description = "Customer-owned S3 bucket containing pinned ThinkWork Lambda release artifacts."
   type        = string
@@ -86,6 +314,45 @@ module "thinkwork" {
   db_password     = var.db_password
   api_auth_secret = var.api_auth_secret
 
+  enable_hindsight                           = var.enable_hindsight
+  memory_engine                              = var.memory_engine
+  enable_cognee                              = var.enable_cognee
+  cognee_image_uri                           = var.cognee_image_uri
+  cognee_db_username                         = var.cognee_db_username
+  cognee_db_name                             = var.cognee_db_name
+  cognee_db_password_secret_arn              = var.cognee_db_password_secret_arn
+  cognee_allowed_internal_cidr_blocks        = var.cognee_allowed_internal_cidr_blocks
+  cognee_allowed_internal_security_group_ids = var.cognee_allowed_internal_security_group_ids
+  cognee_backend_mode                        = var.cognee_backend_mode
+  cognee_desired_count                       = var.cognee_desired_count
+  cognee_llm_provider                        = var.cognee_llm_provider
+  cognee_llm_model                           = var.cognee_llm_model
+  cognee_llm_api_key_secret_arn              = var.cognee_llm_api_key_secret_arn
+  cognee_embedding_provider                  = var.cognee_embedding_provider
+  cognee_embedding_model                     = var.cognee_embedding_model
+  cognee_embedding_dimensions                = var.cognee_embedding_dimensions
+  cognee_embedding_api_key_secret_arn        = var.cognee_embedding_api_key_secret_arn
+  cognee_vector_db_provider                  = var.cognee_vector_db_provider
+  cognee_vector_db_url                       = var.cognee_vector_db_url
+  cognee_vector_db_key_secret_arn            = var.cognee_vector_db_key_secret_arn
+  cognee_graph_database_provider             = var.cognee_graph_database_provider
+  cognee_graph_database_url                  = var.cognee_graph_database_url
+  cognee_graph_database_username             = var.cognee_graph_database_username
+  cognee_graph_database_password_secret_arn  = var.cognee_graph_database_password_secret_arn
+  cognee_bedrock_model_resource_arns         = var.cognee_bedrock_model_resource_arns
+  cognee_kms_key_arns                        = var.cognee_kms_key_arns
+  twenty_provisioned                         = var.twenty_provisioned
+  twenty_runtime_enabled                     = var.twenty_runtime_enabled
+  twenty_image_uri                           = var.twenty_image_uri
+  twenty_db_username                         = var.twenty_db_username
+  twenty_db_name                             = var.twenty_db_name
+  twenty_db_url_secret_arn                   = var.twenty_db_url_secret_arn
+  twenty_encryption_key_secret_arn           = var.twenty_encryption_key_secret_arn
+  twenty_email_from_address                  = var.twenty_email_from_address
+  twenty_email_from_name                     = var.twenty_email_from_name
+  twenty_public_url                          = var.twenty_public_url
+  twenty_certificate_arn                     = var.twenty_certificate_arn
+
   lambda_artifact_bucket   = var.lambda_artifact_bucket
   lambda_artifact_prefix   = var.lambda_artifact_prefix
   require_lambda_artifacts = true
@@ -99,3 +366,22 @@ output "lambda_artifact_mode" {
   value = module.thinkwork.lambda_artifact_mode
 }
 
+output "cognee_enabled" {
+  value = module.thinkwork.cognee_enabled
+}
+
+output "cognee_endpoint" {
+  value = module.thinkwork.cognee_endpoint
+}
+
+output "twenty_provisioned" {
+  value = module.thinkwork.twenty_provisioned
+}
+
+output "twenty_runtime_enabled" {
+  value = module.thinkwork.twenty_runtime_enabled
+}
+
+output "twenty_url" {
+  value = module.thinkwork.twenty_url
+}