thinkwork-cli 0.12.16 → 0.13.0

package/dist/plugins/company-brain/terraform/cognee/main.tf

@@ -1,766 +0,0 @@
-################################################################################
-# Cognee (Optional Ontology/KG Add-On) - App Module
-#
-# Provisions the phase-1 Cognee substrate as an internal ECS/Fargate service.
-# The module intentionally does not expose a public endpoint mode; Thinkwork API
-# wrappers own tenant/auth boundaries in follow-up work.
-################################################################################
-
-locals {
-  legacy_name         = "thinkwork-${var.stage}-cognee"
-  legacy_cluster_name = "thinkwork-${var.stage}-brain-cluster"
-
-  raw_brain_instance_key        = var.brain_instance_key != "" ? var.brain_instance_key : var.brain_tenant_id
-  normalized_brain_instance_key = trim(replace(replace(lower(local.raw_brain_instance_key), "/[^a-z0-9-]/", "-"), "/-+/", "-"), "-")
-  tenant_scoped_brain_instance  = local.normalized_brain_instance_key != ""
-  brain_instance_hash           = substr(sha1(local.raw_brain_instance_key), 0, 12)
-  name                          = local.tenant_scoped_brain_instance ? "thinkwork-${var.stage}-cb-${local.brain_instance_hash}" : local.legacy_name
-  cluster_name                  = local.tenant_scoped_brain_instance ? "${local.name}-cluster" : local.legacy_cluster_name
-  resource_short_name           = local.tenant_scoped_brain_instance ? "tw-${substr(var.stage, 0, 8)}-cb-${substr(local.brain_instance_hash, 0, 10)}" : "tw-${var.stage}-cognee"
-
-  data_root_directory   = "/app/cognee-storage/data"
-  system_root_directory = "/app/cognee-storage/system"
-
-  vector_db_url = (
-    var.vector_db_url != ""
-    ? var.vector_db_url
-    : var.vector_db_provider == "neptune_analytics" && var.neptune_endpoint != ""
-    ? var.neptune_endpoint
-    : "${local.system_root_directory}/databases/cognee.lancedb"
-  )
-  graph_db_url = (
-    var.graph_database_url != ""
-    ? var.graph_database_url
-    : var.graph_database_provider == "neptune_analytics" && var.neptune_endpoint != ""
-    ? var.neptune_endpoint
-    : "${local.system_root_directory}/databases/cognee.kuzu"
-  )
-  log_group_name = local.tenant_scoped_brain_instance ? "/thinkwork/${var.stage}/brain/${local.normalized_brain_instance_key}/cognee" : "/thinkwork/${var.stage}/cognee"
-
-  managed_secret_specs = {
-    db_password = {
-      enabled       = var.create_secret_placeholders && var.db_password_secret_arn == ""
-      name          = local.tenant_scoped_brain_instance ? "thinkwork/${var.stage}/brain/${local.normalized_brain_instance_key}/db-credentials" : "thinkwork/${var.stage}/cognee/db-credentials"
-      description   = "Dedicated Brain/Cognee PostgreSQL credentials"
-      secret_string = jsonencode({ password = "PLACEHOLDER_SET_VIA_CLI" })
-    }
-    llm_api_key = {
-      enabled       = var.create_secret_placeholders && var.llm_provider != "bedrock" && var.llm_api_key_secret_arn == ""
-      name          = local.tenant_scoped_brain_instance ? "thinkwork/${var.stage}/brain/${local.normalized_brain_instance_key}/llm-api-key" : "thinkwork/${var.stage}/cognee/llm-api-key"
-      description   = "Brain/Cognee non-Bedrock LLM provider API key"
-      secret_string = "PLACEHOLDER_SET_VIA_CLI"
-    }
-    embedding_api_key = {
-      enabled       = var.create_secret_placeholders && var.embedding_provider != "bedrock" && var.embedding_api_key_secret_arn == ""
-      name          = local.tenant_scoped_brain_instance ? "thinkwork/${var.stage}/brain/${local.normalized_brain_instance_key}/embedding-api-key" : "thinkwork/${var.stage}/cognee/embedding-api-key"
-      description   = "Brain/Cognee non-Bedrock embedding provider API key"
-      secret_string = "PLACEHOLDER_SET_VIA_CLI"
-    }
-    vector_db_key = {
-      enabled       = var.create_secret_placeholders && var.vector_db_provider != "lancedb" && var.vector_db_key_secret_arn == ""
-      name          = local.tenant_scoped_brain_instance ? "thinkwork/${var.stage}/brain/${local.normalized_brain_instance_key}/vector-db-key" : "thinkwork/${var.stage}/cognee/vector-db-key"
-      description   = "Brain/Cognee remote vector store key"
-      secret_string = "PLACEHOLDER_SET_VIA_CLI"
-    }
-    graph_database_password = {
-      enabled       = var.create_secret_placeholders && var.graph_database_provider != "kuzu" && var.graph_database_password_secret_arn == ""
-      name          = local.tenant_scoped_brain_instance ? "thinkwork/${var.stage}/brain/${local.normalized_brain_instance_key}/graph-database-password" : "thinkwork/${var.stage}/cognee/graph-database-password"
-      description   = "Brain/Cognee remote graph store password"
-      secret_string = "PLACEHOLDER_SET_VIA_CLI"
-    }
-  }
-
-  managed_secrets = {
-    for key, spec in local.managed_secret_specs : key => spec if spec.enabled
-  }
-
-  effective_db_password_secret_arn = (
-    var.db_password_secret_arn != ""
-    ? var.db_password_secret_arn
-    : try(aws_secretsmanager_secret.cognee["db_password"].arn, "")
-  )
-  effective_llm_api_key_secret_arn = (
-    var.llm_api_key_secret_arn != ""
-    ? var.llm_api_key_secret_arn
-    : try(aws_secretsmanager_secret.cognee["llm_api_key"].arn, "")
-  )
-  effective_embedding_api_key_secret_arn = (
-    var.embedding_api_key_secret_arn != ""
-    ? var.embedding_api_key_secret_arn
-    : try(aws_secretsmanager_secret.cognee["embedding_api_key"].arn, "")
-  )
-  effective_vector_db_key_secret_arn = (
-    var.vector_db_key_secret_arn != ""
-    ? var.vector_db_key_secret_arn
-    : try(aws_secretsmanager_secret.cognee["vector_db_key"].arn, "")
-  )
-  effective_graph_database_password_secret_arn = (
-    var.graph_database_password_secret_arn != ""
-    ? var.graph_database_password_secret_arn
-    : try(aws_secretsmanager_secret.cognee["graph_database_password"].arn, "")
-  )
-
-  efs_mount_subnet_ids_by_index = {
-    for index, subnet_id in var.subnet_ids : tostring(index) => subnet_id
-  }
-
-  brain_artifact_object_arns = [
-    for prefix in var.brain_artifacts_prefixes :
-    "${var.brain_artifacts_bucket_arn}/${trim(prefix, "/")}/*"
-  ]
-
-  base_environment = [
-    { name = "DB_PROVIDER", value = "postgres" },
-    { name = "DB_HOST", value = var.db_host },
-    { name = "DB_PORT", value = tostring(var.db_port) },
-    { name = "DB_NAME", value = var.db_name },
-    { name = "DB_USERNAME", value = var.db_username },
-    { name = "LLM_PROVIDER", value = var.llm_provider },
-    { name = "LLM_MODEL", value = var.llm_model },
-    { name = "EMBEDDING_PROVIDER", value = var.embedding_provider },
-    { name = "EMBEDDING_MODEL", value = var.embedding_model },
-    { name = "EMBEDDING_DIMENSIONS", value = tostring(var.embedding_dimensions) },
-    { name = "VECTOR_DB_PROVIDER", value = var.vector_db_provider },
-    { name = "VECTOR_DB_URL", value = local.vector_db_url },
-    { name = "GRAPH_DATABASE_PROVIDER", value = var.graph_database_provider },
-    { name = "GRAPH_DATABASE_URL", value = local.graph_db_url },
-    { name = "DATA_ROOT_DIRECTORY", value = local.data_root_directory },
-    { name = "SYSTEM_ROOT_DIRECTORY", value = local.system_root_directory },
-    { name = "BRAIN_TENANT_ID", value = var.brain_tenant_id },
-    { name = "BRAIN_INSTANCE_KEY", value = local.normalized_brain_instance_key },
-    { name = "BRAIN_STORAGE_TIER", value = var.brain_storage_tier },
-    { name = "BRAIN_S3_ARTIFACT_ROOT", value = var.brain_s3_artifact_root },
-    { name = "BRAIN_S3_MANIFEST_ROOT", value = var.brain_s3_manifest_root },
-    { name = "BRAIN_S3_VAULT_PROJECTION_ROOT", value = var.brain_s3_vault_projection_root },
-    { name = "NEPTUNE_GRAPH_ID", value = var.neptune_graph_id },
-    { name = "NEPTUNE_ENDPOINT", value = var.neptune_endpoint },
-    { name = "TELEMETRY_DISABLED", value = "true" },
-    { name = "REQUIRE_AUTHENTICATION", value = tostring(var.require_authentication) },
-    { name = "ENABLE_BACKEND_ACCESS_CONTROL", value = tostring(var.enable_backend_access_control) },
-    { name = "CORS_ALLOWED_ORIGINS", value = var.cors_allowed_origins },
-    { name = "AWS_DEFAULT_REGION", value = data.aws_region.current.name },
-    { name = "AWS_REGION", value = data.aws_region.current.name },
-    # litellm's default embedding timeout (30s) is too tight for a batch of
-    # entity embeddings routed sequentially through the Bedrock VPC endpoint —
-    # cognify errored with EmbeddingException (timeout) mid-run. Raise the
-    # per-request embedding + LLM timeouts so a batch completes.
-    { name = "EMBEDDING_REQUEST_TIMEOUT", value = "180" },
-    { name = "LLM_REQUEST_TIMEOUT", value = "180" },
-    # Bedrock throttles (HTTP 429) the burst of per-entity titan embedding
-    # calls cognify fires — the pipeline errored on EmbeddingException. The
-    # account's hard quota is exactly 60 req/min for Titan Text Embeddings V2
-    # (Service Quotas), so a limiter set AT 60 still tips over under any
-    # concurrency. Pace embeddings to 25/min — comfortably under the ceiling
-    # with headroom for litellm retries. The single dogfood task is slow but
-    # completes; the self-invoke ingest chain drains the backlog across runs.
-    # Production-scale volume needs a Titan-embed quota increase (Service
-    # Quotas) — 60 RPM caps throughput regardless of pacing.
-    { name = "EMBEDDING_RATE_LIMIT_ENABLED", value = "true" },
-    { name = "EMBEDDING_RATE_LIMIT_REQUESTS", value = "25" },
-    { name = "EMBEDDING_RATE_LIMIT_INTERVAL", value = "60" },
-    # Cognee's generic LLM rate limiter (shared limiter implementation) —
-    # enable it too so the Kimi extraction calls don't trip Bedrock either.
-    { name = "LLM_RATE_LIMIT_ENABLED", value = "true" },
-    { name = "LLM_RATE_LIMIT_REQUESTS", value = "30" },
-    { name = "LLM_RATE_LIMIT_INTERVAL", value = "60" },
-  ]
-
-  optional_environment = concat(
-    var.embedding_max_completion_tokens != "" ? [{ name = "EMBEDDING_MAX_COMPLETION_TOKENS", value = var.embedding_max_completion_tokens }] : [],
-    var.graph_database_username != "" ? [{ name = "GRAPH_DATABASE_USERNAME", value = var.graph_database_username }] : []
-  )
-
-  container_secrets = concat(
-    [{ name = "DB_PASSWORD", valueFrom = "${local.effective_db_password_secret_arn}:password::" }],
-    local.effective_llm_api_key_secret_arn != "" ? [{ name = "LLM_API_KEY", valueFrom = local.effective_llm_api_key_secret_arn }] : [],
-    local.effective_embedding_api_key_secret_arn != "" ? [{ name = "EMBEDDING_API_KEY", valueFrom = local.effective_embedding_api_key_secret_arn }] : [],
-    local.effective_vector_db_key_secret_arn != "" ? [{ name = "VECTOR_DB_KEY", valueFrom = local.effective_vector_db_key_secret_arn }] : [],
-    local.effective_graph_database_password_secret_arn != "" ? [{ name = "GRAPH_DATABASE_PASSWORD", valueFrom = local.effective_graph_database_password_secret_arn }] : []
-  )
-
-  secret_arns = compact([
-    local.effective_db_password_secret_arn,
-    local.effective_llm_api_key_secret_arn,
-    local.effective_embedding_api_key_secret_arn,
-    local.effective_vector_db_key_secret_arn,
-    local.effective_graph_database_password_secret_arn,
-  ])
-}
-
-data "aws_region" "current" {}
-
-resource "aws_secretsmanager_secret" "cognee" {
-  for_each = local.managed_secrets
-
-  name        = each.value.name
-  description = each.value.description
-
-  tags = {
-    Name = each.value.name
-    Role = "cognee"
-  }
-}
-
-resource "aws_secretsmanager_secret_version" "cognee" {
-  for_each = local.managed_secrets
-
-  secret_id     = aws_secretsmanager_secret.cognee[each.key].id
-  secret_string = each.value.secret_string
-
-  lifecycle {
-    ignore_changes = [secret_string]
-  }
-}
-
-################################################################################
-# Plan-time safety guardrails
-################################################################################
-
-resource "terraform_data" "configuration_guardrails" {
-  input = {
-    backend_mode                 = var.backend_mode
-    brain_tenant_id              = var.brain_tenant_id
-    brain_instance_key           = local.normalized_brain_instance_key
-    brain_storage_tier           = var.brain_storage_tier
-    desired_count                = var.desired_count
-    vector_db_url                = local.vector_db_url
-    vector_db_provider           = var.vector_db_provider
-    graph_database_url           = local.graph_db_url
-    graph_database_provider      = var.graph_database_provider
-    neptune_graph_id             = var.neptune_graph_id
-    neptune_endpoint             = var.neptune_endpoint
-    llm_provider                 = var.llm_provider
-    embedding_provider           = var.embedding_provider
-    db_password_secret_arn       = local.effective_db_password_secret_arn
-    llm_api_key_secret_arn       = local.effective_llm_api_key_secret_arn
-    embedding_api_key_secret_arn = local.effective_embedding_api_key_secret_arn
-    bedrock_model_resource_arns  = var.bedrock_model_resource_arns
-  }
-
-  lifecycle {
-    precondition {
-      condition     = var.backend_mode != "dogfood" || var.desired_count == 1
-      error_message = "dogfood backend mode uses local graph/vector storage and must run with desired_count = 1."
-    }
-
-    precondition {
-      condition = (
-        var.brain_storage_tier != "default" ||
-        (
-          var.backend_mode == "dogfood" &&
-          var.vector_db_provider == "lancedb" &&
-          var.graph_database_provider == "kuzu" &&
-          var.desired_count == 1
-        )
-      )
-      error_message = "default Brain tier must use dogfood backend mode, lancedb vectors, kuzu graph storage, and desired_count = 1."
-    }
-
-    precondition {
-      condition = (
-        var.brain_storage_tier != "production" ||
-        (
-          var.backend_mode == "remote" &&
-          var.vector_db_provider == "neptune_analytics" &&
-          var.graph_database_provider == "neptune_analytics" &&
-          var.neptune_graph_id != "" &&
-          var.neptune_endpoint != ""
-        )
-      )
-      error_message = "production Brain tier must use remote mode with Neptune Analytics graph/vector providers, neptune_graph_id, and neptune_endpoint."
-    }
-
-    precondition {
-      condition     = !contains(["opensearch", "opensearch_serverless", "aoss"], lower(var.vector_db_provider))
-      error_message = "Company Brain production must not use direct OpenSearch vector storage; use Neptune Analytics for production graph/vector."
-    }
-
-    precondition {
-      condition     = var.private_substrate_mode
-      error_message = "Company Brain substrate must remain private/internal-only."
-    }
-
-    precondition {
-      condition = (
-        var.backend_mode != "remote" ||
-        (
-          local.vector_db_url != "" &&
-          local.graph_db_url != "" &&
-          local.vector_db_url != "${local.system_root_directory}/databases/cognee.lancedb" &&
-          local.graph_db_url != "${local.system_root_directory}/databases/cognee.kuzu"
-        )
-      )
-      error_message = "remote backend mode requires vector and graph URLs, or Neptune Analytics providers with neptune_endpoint."
-    }
-
-    precondition {
-      condition     = local.effective_db_password_secret_arn != ""
-      error_message = "Cognee requires db_password_secret_arn or create_secret_placeholders = true."
-    }
-
-    precondition {
-      condition = (
-        var.llm_provider == "bedrock" || local.effective_llm_api_key_secret_arn != ""
-        ) && (
-        var.embedding_provider == "bedrock" || local.effective_embedding_api_key_secret_arn != ""
-      )
-      error_message = "Non-Bedrock LLM or embedding providers must use Secrets Manager ARNs, not plaintext environment values."
-    }
-
-    precondition {
-      condition = (
-        (var.llm_provider != "bedrock" && var.embedding_provider != "bedrock") ||
-        length(var.bedrock_model_resource_arns) > 0
-      )
-      error_message = "Bedrock LLM or embedding providers require explicit bedrock_model_resource_arns."
-    }
-  }
-}
-
-################################################################################
-# ECS Cluster
-################################################################################
-
-resource "aws_ecs_cluster" "main" {
-  name = local.cluster_name
-
-  setting {
-    name  = "containerInsights"
-    value = "enabled"
-  }
-
-  tags = { Name = local.cluster_name }
-}
-
-################################################################################
-# IAM
-################################################################################
-
-resource "aws_iam_role" "ecs_execution" {
-  name = "${local.name}-execution"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Action    = "sts:AssumeRole"
-      Effect    = "Allow"
-      Principal = { Service = "ecs-tasks.amazonaws.com" }
-    }]
-  })
-}
-
-resource "aws_iam_role_policy_attachment" "ecs_execution" {
-  role       = aws_iam_role.ecs_execution.name
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
-}
-
-resource "aws_iam_role_policy" "ecs_execution_secrets" {
-  name = "cognee-secrets"
-  role = aws_iam_role.ecs_execution.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = concat(
-      [{
-        Effect   = "Allow"
-        Action   = ["secretsmanager:GetSecretValue"]
-        Resource = local.secret_arns
-      }],
-      length(var.kms_key_arns) > 0 ? [{
-        Effect   = "Allow"
-        Action   = ["kms:Decrypt"]
-        Resource = var.kms_key_arns
-      }] : []
-    )
-  })
-}
-
-resource "aws_iam_role" "ecs_task" {
-  name = "${local.name}-task"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Action    = "sts:AssumeRole"
-      Effect    = "Allow"
-      Principal = { Service = "ecs-tasks.amazonaws.com" }
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "bedrock_access" {
-  count = var.llm_provider == "bedrock" || var.embedding_provider == "bedrock" ? 1 : 0
-
-  name = "bedrock-access"
-  role = aws_iam_role.ecs_task.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect   = "Allow"
-      Action   = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"]
-      Resource = var.bedrock_model_resource_arns
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "brain_artifacts" {
-  count = var.brain_artifacts_bucket_arn != "" && length(var.brain_artifacts_prefixes) > 0 ? 1 : 0
-
-  name = "brain-artifacts"
-  role = aws_iam_role.ecs_task.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect   = "Allow"
-        Action   = ["s3:ListBucket"]
-        Resource = var.brain_artifacts_bucket_arn
-        Condition = {
-          StringLike = {
-            "s3:prefix" = [for prefix in var.brain_artifacts_prefixes : "${trim(prefix, "/")}/*"]
-          }
-        }
-      },
-      {
-        Effect = "Allow"
-        Action = [
-          "s3:GetObject",
-          "s3:PutObject",
-          "s3:DeleteObject",
-          "s3:GetObjectVersion",
-        ]
-        Resource = local.brain_artifact_object_arns
-      },
-    ]
-  })
-}
-
-resource "aws_iam_role_policy" "neptune_graph_access" {
-  count = var.neptune_graph_arn != "" ? 1 : 0
-
-  name = "neptune-graph-access"
-  role = aws_iam_role.ecs_task.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect = "Allow"
-      Action = [
-        "neptune-graph:GetGraph",
-        "neptune-graph:ReadDataViaQuery",
-        "neptune-graph:WriteDataViaQuery",
-      ]
-      Resource = var.neptune_graph_arn
-    }]
-  })
-}
-
-# ECS Exec (`aws ecs execute-command`) needs the SSM messages channel on the
-# TASK role. Gated by var.enable_execute_command so it only grants when exec is
-# on. Used operationally to inspect the dogfood Cognee store / API directly
-# (its ALB is VPC-internal) — e.g. verify dataset names and graph-fetch scope.
-resource "aws_iam_role_policy" "ecs_exec_ssm" {
-  count = var.enable_execute_command ? 1 : 0
-
-  name = "ecs-exec-ssm-messages"
-  role = aws_iam_role.ecs_task.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect = "Allow"
-      Action = [
-        "ssmmessages:CreateControlChannel",
-        "ssmmessages:CreateDataChannel",
-        "ssmmessages:OpenControlChannel",
-        "ssmmessages:OpenDataChannel",
-      ]
-      Resource = "*"
-    }]
-  })
-}
-
-################################################################################
-# Security Groups
-################################################################################
-
-resource "aws_security_group" "cognee" {
-  name_prefix = "${local.name}-"
-  description = "Cognee ECS task"
-  vpc_id      = var.vpc_id
-
-  ingress {
-    description     = "Internal ALB to Cognee API"
-    from_port       = var.container_port
-    to_port         = var.container_port
-    protocol        = "tcp"
-    security_groups = [aws_security_group.alb.id]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = { Name = "${local.name}-sg" }
-  lifecycle { create_before_destroy = true }
-}
-
-resource "aws_security_group" "alb" {
-  name_prefix = "${local.name}-alb-"
-  description = "Internal Cognee ALB"
-  vpc_id      = var.vpc_id
-
-  dynamic "ingress" {
-    for_each = var.allowed_internal_cidr_blocks
-
-    content {
-      description = "Allowed internal caller CIDR"
-      from_port   = 80
-      to_port     = 80
-      protocol    = "tcp"
-      cidr_blocks = [ingress.value]
-    }
-  }
-
-  dynamic "ingress" {
-    for_each = var.allowed_internal_security_group_ids
-
-    content {
-      description     = "Allowed internal caller security group"
-      from_port       = 80
-      to_port         = 80
-      protocol        = "tcp"
-      security_groups = [ingress.value]
-    }
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = { Name = "${local.name}-alb-sg" }
-  lifecycle { create_before_destroy = true }
-}
-
-resource "aws_security_group" "efs" {
-  name_prefix = "${local.name}-efs-"
-  description = "Cognee EFS storage"
-  vpc_id      = var.vpc_id
-
-  ingress {
-    description     = "Cognee task to EFS"
-    from_port       = 2049
-    to_port         = 2049
-    protocol        = "tcp"
-    security_groups = [aws_security_group.cognee.id]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = { Name = "${local.name}-efs-sg" }
-  lifecycle { create_before_destroy = true }
-}
-
-resource "aws_security_group_rule" "aurora_from_cognee" {
-  type                     = "ingress"
-  from_port                = var.db_port
-  to_port                  = var.db_port
-  protocol                 = "tcp"
-  source_security_group_id = aws_security_group.cognee.id
-  security_group_id        = var.db_security_group_id
-}
-
-################################################################################
-# ALB
-################################################################################
-
-resource "aws_lb" "cognee" {
-  name               = local.resource_short_name
-  internal           = true
-  load_balancer_type = "application"
-  security_groups    = [aws_security_group.alb.id]
-  subnets            = var.subnet_ids
-
-  tags = { Name = "${local.name}-alb" }
-}
-
-resource "aws_lb_target_group" "cognee" {
-  name        = local.resource_short_name
-  port        = var.container_port
-  protocol    = "HTTP"
-  vpc_id      = var.vpc_id
-  target_type = "ip"
-
-  health_check {
-    path                = var.health_check_path
-    port                = tostring(var.container_port)
-    protocol            = "HTTP"
-    healthy_threshold   = 2
-    unhealthy_threshold = 3
-    timeout             = 10
-    interval            = 30
-    matcher             = "200-399"
-  }
-
-  tags = { Name = "${local.name}-tg" }
-}
-
-resource "aws_lb_listener" "cognee" {
-  load_balancer_arn = aws_lb.cognee.arn
-  port              = 80
-  protocol          = "HTTP"
-
-  default_action {
-    type             = "forward"
-    target_group_arn = aws_lb_target_group.cognee.arn
-  }
-}
-
-################################################################################
-# Persistent writable storage
-################################################################################
-
-resource "aws_efs_file_system" "cognee" {
-  creation_token = local.name
-  encrypted      = true
-
-  tags = { Name = "${local.name}-efs" }
-}
-
-resource "aws_efs_mount_target" "cognee" {
-  for_each = local.efs_mount_subnet_ids_by_index
-
-  file_system_id  = aws_efs_file_system.cognee.id
-  subnet_id       = each.value
-  security_groups = [aws_security_group.efs.id]
-}
-
-################################################################################
-# CloudWatch Logs
-################################################################################
-
-resource "aws_cloudwatch_log_group" "cognee" {
-  name              = local.log_group_name
-  retention_in_days = var.log_retention_days
-
-  tags = { Name = "${local.name}-logs" }
-}
-
-################################################################################
-# ECS Task Definition
-################################################################################
-
-resource "aws_ecs_task_definition" "cognee" {
-  family                   = local.name
-  requires_compatibilities = ["FARGATE"]
-  network_mode             = "awsvpc"
-  cpu                      = var.cpu
-  memory                   = var.memory
-  execution_role_arn       = aws_iam_role.ecs_execution.arn
-  task_role_arn            = aws_iam_role.ecs_task.arn
-
-  runtime_platform {
-    operating_system_family = "LINUX"
-    cpu_architecture        = var.cpu_architecture
-  }
-
-  volume {
-    name = "cognee-storage"
-
-    efs_volume_configuration {
-      file_system_id     = aws_efs_file_system.cognee.id
-      transit_encryption = "ENABLED"
-    }
-  }
-
-  container_definitions = jsonencode([{
-    name      = "cognee"
-    image     = var.image_uri
-    essential = true
-
-    portMappings = [{
-      containerPort = var.container_port
-      protocol      = "tcp"
-    }]
-
-    environment = concat(local.base_environment, local.optional_environment)
-    secrets     = local.container_secrets
-
-    mountPoints = [{
-      sourceVolume  = "cognee-storage"
-      containerPath = "/app/cognee-storage"
-      readOnly      = false
-    }]
-
-    logConfiguration = {
-      logDriver = "awslogs"
-      options = {
-        "awslogs-group"         = aws_cloudwatch_log_group.cognee.name
-        "awslogs-region"        = data.aws_region.current.name
-        "awslogs-stream-prefix" = "cognee"
-      }
-    }
-
-    healthCheck = {
-      command     = ["CMD-SHELL", "curl -f http://localhost:${var.container_port}${var.health_check_path} || exit 1"]
-      interval    = 30
-      timeout     = 10
-      retries     = 3
-      startPeriod = 300
-    }
-  }])
-
-  depends_on = [aws_efs_mount_target.cognee, terraform_data.configuration_guardrails]
-
-  tags = { Name = local.name }
-}
-
-################################################################################
-# ECS Service
-################################################################################
-
-resource "aws_ecs_service" "cognee" {
-  name            = local.name
-  cluster         = aws_ecs_cluster.main.id
-  task_definition = aws_ecs_task_definition.cognee.arn
-  desired_count   = var.desired_count
-  launch_type     = "FARGATE"
-
-  # Allow `aws ecs execute-command` into the running container (operational
-  # introspection of the dogfood Cognee store/API, whose ALB is VPC-internal).
-  enable_execute_command = var.enable_execute_command
-
-  deployment_minimum_healthy_percent = var.backend_mode == "dogfood" ? 0 : 100
-  deployment_maximum_percent         = var.backend_mode == "dogfood" ? 100 : 200
-  health_check_grace_period_seconds  = var.health_check_grace_period_seconds
-  wait_for_steady_state              = var.wait_for_steady_state
-
-  network_configuration {
-    subnets          = var.subnet_ids
-    security_groups  = [aws_security_group.cognee.id]
-    assign_public_ip = true
-  }
-
-  load_balancer {
-    target_group_arn = aws_lb_target_group.cognee.arn
-    container_name   = "cognee"
-    container_port   = var.container_port
-  }
-
-  depends_on = [aws_lb_listener.cognee, terraform_data.configuration_guardrails]
-
-  tags = { Name = local.name }
-}