unoverse 0.1.69 → 0.1.71

package/operator/infra/digitalocean/outputs.tf

@@ -0,0 +1,96 @@
+# Everything .env.production needs — the rendered file is COMPLETE, nothing
+# is hand-edited afterwards:
+#   terraform output -raw env_production > ../../.env.production
+#   unoverse deploy
+
+locals {
+  # Pooled URL for the services (transaction-mode PgBouncer; prepared statements off),
+  # direct URL for migrations. BYO: your URL is used verbatim for both — you own the
+  # pooling story against your own max_connections (INFRASTRUCTURE.md § BYO).
+  # Managed modes (provisioned OR adopted existing cluster): the universe's own
+  # user/db/pool were created on local.pg_cluster_id either way.
+  pg_pooled = local.pg_managed ? "postgresql://${digitalocean_database_user.universe[0].name}:${digitalocean_database_user.universe[0].password}@${digitalocean_database_connection_pool.universe[0].private_host}:${digitalocean_database_connection_pool.universe[0].port}/${digitalocean_database_connection_pool.universe[0].name}?sslmode=require&pgbouncer=true" : var.byo_postgres_url
+  pg_direct = local.pg_managed ? "postgresql://${digitalocean_database_user.universe[0].name}:${digitalocean_database_user.universe[0].password}@${local.pg_cluster_host}:${local.pg_cluster_port}/${digitalocean_database_db.universe[0].name}?sslmode=require" : var.byo_postgres_url
+
+  # Redis is always ours — provisioned above, no BYO branch.
+  redis_host     = digitalocean_database_cluster.redis.private_host
+  redis_port     = digitalocean_database_cluster.redis.port
+  redis_password = digitalocean_database_cluster.redis.password
+  redis_tls      = true
+}
+
+output "deploy_host" {
+  description = "The droplet's public IP (.env.production DEPLOY_HOST). Point api.<domain> at the LB IP, not this."
+  value       = digitalocean_droplet.app.ipv4_address
+}
+
+output "lb_ip" {
+  description = "The load balancer's IP — api.<domain>'s A record target (created automatically when manage_dns = true)."
+  value       = digitalocean_loadbalancer.public.ip
+}
+
+output "canvas_url" {
+  description = "Public Canvas URL (canvas_public = true only) — add it to the IdP's allowed origins."
+  value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}:3001" : "http://${digitalocean_loadbalancer.public.ip}:3001") : "canvas is admin-only (direct http://<droplet-ip>:3001 from admin_cidr)"
+}
+
+output "api_url" {
+  description = "The API base URL as deployed — https://api.<domain> with a domain, http://<lb-ip> without one."
+  value       = local.has_domain ? "https://${local.api_host}" : "http://${digitalocean_loadbalancer.public.ip}"
+}
+
+output "env_production" {
+  sensitive   = true
+  description = "Rendered .env.production — complete, write to a file and deploy"
+  value       = <<-ENV
+    # UNIVERSE (DigitalOcean) — generated by infra/digitalocean. COMPLETE:
+    # do not hand-edit; change terraform.tfvars and re-render instead.
+
+    # Deploy target
+    DEPLOY_HOST=${digitalocean_droplet.app.ipv4_address}
+    DEPLOY_USER=root
+
+    # Container registry
+    DOCR_TOKEN=${var.docr_token}
+
+    # Database (pooled via managed PgBouncer, transaction mode — the Postgres law).
+    # Migrations use the DIRECT url (db-setup prefers DATABASE_URL_DIRECT).
+    DATABASE_URL=${local.pg_pooled}
+    DATABASE_URL_DIRECT=${local.pg_direct}
+
+    # Connection budget (INFRASTRUCTURE.md, size = ${var.size})
+    DB_POOL_ENGINE=${local.s.pool_engine}
+    DB_POOL_ENGINE_LEGACY=${local.s.pool_legacy}
+    DB_POOL_MEMORY=${local.s.pool_memory}
+
+    # Credential encryption at rest — per-deployment, generated by Terraform.
+    # Back this up with the database (a DB backup is unreadable without it).
+    CREDENTIAL_ENCRYPTION_KEY=${random_password.credential_key.result}
+
+    # Redis (managed, TLS)
+    REDIS_HOST=${local.redis_host}
+    REDIS_PORT=${local.redis_port}
+    REDIS_PASSWORD=${local.redis_password}
+    REDIS_TLS=${local.redis_tls}
+    REDIS_NAMESPACE=universe
+
+    # OIDC — byo (Auth0 today): the tenant is authoritative for roles/permissions.
+    AUTH_ISSUER=${var.auth_issuer}
+    AUTH_CLIENT_ID=${var.auth_client_id}
+    AUTH_AUDIENCE=${var.auth_audience}
+
+    # Service keys
+    OPENAI_API_KEY=${var.openai_api_key}
+    HYPERBROWSER_API_KEY=${var.hyperbrowser_api_key}
+
+    # Ingress. With a domain: DOMAIN drives every URL (compose derives
+    # https://api.<domain>). Without one (POC): DOMAIN stays empty and the
+    # explicit URLs below point at the load balancer's IP over plain HTTP.
+    # To upgrade later: set domain in terraform.tfvars, terraform apply,
+    # re-render this file, unoverse deploy. Nothing is destroyed.
+    DOMAIN=${var.domain}
+    ${local.has_domain ? "" : "API_URL=http://${digitalocean_loadbalancer.public.ip}"}
+    ${local.has_domain ? "" : "VITE_SERVER_WS_URL=ws://${digitalocean_loadbalancer.public.ip}"}
+    ${local.has_domain ? "" : "UNOVERSE_URL=http://${digitalocean_loadbalancer.public.ip}"}
+  ENV
+}

package/operator/infra/digitalocean/prices.tf

@@ -0,0 +1,49 @@
+# What this ground costs to run, priced where its sizes are chosen.
+#
+# ONE HOME FOR THE NUMBERS. These used to live in the CLI's plan summariser and again in
+# the docs, so a size change here left two stale copies behind and the deploy screen
+# disagreed with the page describing it. The ground owns its sizes, so the ground prices
+# them: `unoverse deploy` reads this map out of the plan JSON, and the docs quote the
+# same output rather than a table somebody keeps in step by hand.
+#
+# NOT A COST ORACLE. DigitalOcean's published monthly rates for exactly the slugs this
+# ground uses, so a developer sees an order of magnitude instead of a surprise. Rates
+# move; the bill is the provider's.
+
+locals {
+  # Monthly USD, keyed by the size slug it prices. A slug absent here is simply not
+  # priced (the summary shows the resource with no figure) rather than guessed at.
+  prices = {
+    # Droplets
+    "s-4vcpu-16gb-amd" = 96  # small: the POC box
+    "g-8vcpu-32gb"     = 252 # medium
+    "m-8vcpu-64gb"     = 386 # large
+    # Managed Postgres and Redis
+    "db-s-1vcpu-1gb" = 15
+    "db-s-1vcpu-2gb" = 30
+    "db-s-2vcpu-4gb" = 60
+    "db-s-4vcpu-8gb" = 120
+    # Fixed-price resources, keyed by what they are rather than a size
+    "lb" = 12
+  }
+
+  # The steady-state bill for THIS universe, as configured. Adopted or bring-your-own
+  # Postgres is not in it: that cluster is somebody else's line item, and pricing it here
+  # would invent a charge this stack does not create.
+  monthly_estimate = sum([
+    lookup(local.prices, local.s.droplet, 0),
+    local.provision_pg ? lookup(local.prices, local.s.pg, 0) : 0,
+    lookup(local.prices, local.s.redis, 0),
+    local.prices["lb"],
+  ])
+}
+
+output "prices" {
+  description = "Monthly USD by size slug. The CLI's plan summary reads this, so the deploy screen and the docs cannot drift apart."
+  value       = local.prices
+}
+
+output "monthly_estimate" {
+  description = "Roughly what this universe costs a month at list prices, for the size and Postgres mode configured."
+  value       = local.monthly_estimate
+}

package/operator/infra/digitalocean/terraform.tfvars.example

@@ -0,0 +1,52 @@
+# Copy to terraform.tfvars and fill in — or let `./unoverse ground do` write it
+# for you, prefilled from doctl (your IP, SSH key, existing Postgres clusters).
+# terraform.tfvars is gitignored.
+# Token: set DIGITALOCEAN_TOKEN in the environment (preferred) or do_token here.
+
+region       = "lon1"
+name         = "universe-poc"
+size         = "small"                  # small (POC) | medium | large
+admin_cidr   = "203.0.113.7/32"         # YOUR IP — SSH + Dozzle only
+ssh_key_name = "your-do-ssh-key-name"   # must already exist in the DO account
+# Domain is OPTIONAL. Leave it empty and the universe comes up on the load
+# balancer's IP over plain HTTP (POC mode) — `terraform output api_url` tells
+# you the address. When you have a domain, fill it in and `terraform apply`
+# again: the SAME deployment upgrades in place to TLS at api.<domain>.
+domain       = ""                       # empty = HTTP on the LB IP; "yourdomain.com" = TLS at api.yourdomain.com
+manage_dns   = false                    # true only if the domain's DNS is on DO
+
+# ⚠ With a domain set, the managed Let's Encrypt certificate requires the
+# domain's DNS to be HOSTED on DigitalOcean (registrar can stay GoDaddy etc. —
+# point the nameservers at ns1/ns2/ns3.digitalocean.com and add the domain
+# under Networking). Then manage_dns = true also creates the records for you.
+
+# POC ONLY: public Canvas at https://api.<domain>:3001 (a second port on the ONE LB).
+# Add that URL to the IdP's allowed origins. Default false = admin-only.
+canvas_public = true
+
+# Auth — byo-oidc (the standing choice: DO universes use the existing Auth0
+# tenant; roles/permissions live THERE, Terraform doesn't touch them).
+auth_issuer    = "https://your-tenant.auth0.com"
+auth_client_id = "your-spa-client-id"
+auth_audience  = "gravity-api"
+
+# Service secrets — with these set, the rendered .env.production is COMPLETE.
+docr_token           = "dop_v1_..."   # registry token (pulls platform images)
+openai_api_key       = "sk-..."       # memory server + OpenAI nodes
+# hyperbrowser_api_key = ""           # optional — page intelligence
+
+# Postgres — three OPTIONAL modes (leave all unset = provision a fresh cluster):
+#   Reuse YOUR existing DO Postgres (the usual case) — Terraform adds the
+#   universe's own db/user/pool to it, touching nothing else. Name from
+#   `doctl databases list`:
+# existing_pg_cluster_name = "your-existing-cluster-name"
+#   Or a fully external database, used verbatim:
+# byo_postgres_url = "postgresql://user:pass@host:5432/db?sslmode=require"
+
+# Redis: always provisioned by Terraform (Managed Redis, TLS). Not configurable.
+
+# The rendered output (terraform output -raw env_production > ../../.env.production)
+# IS your universe's secrets, including the MASTER KEY (CREDENTIAL_ENCRYPTION_KEY)
+# that locks every credential users save in the platform. If it's lost, no backup
+# can bring them back. Never commit it; keep a safe copy with your database backups.
+# To change any value: edit this file and re-render. Never hand-edit the output.

package/operator/infra/digitalocean/variables.tf

@@ -0,0 +1,125 @@
+variable "do_token" {
+  description = "DigitalOcean API token (or set DIGITALOCEAN_TOKEN in the environment and leave this empty)."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "region" {
+  description = "DigitalOcean region for everything."
+  type        = string
+  default     = "lon1"
+}
+
+variable "name" {
+  description = "Prefix for every resource."
+  type        = string
+  default     = "universe-poc"
+}
+
+variable "size" {
+  description = "Deployment size (INFRASTRUCTURE.md size table): small = POC box."
+  type        = string
+  default     = "small"
+  validation {
+    condition     = contains(["small", "medium", "large"], var.size)
+    error_message = "size must be small, medium or large."
+  }
+}
+
+variable "admin_cidr" {
+  description = "The ONLY CIDR allowed to SSH (22) and view logs (Dozzle 8080). Your IP as x.x.x.x/32."
+  type        = string
+}
+
+variable "ssh_key_name" {
+  description = "Name of an SSH key already uploaded to the DigitalOcean account."
+  type        = string
+}
+
+variable "domain" {
+  description = "OPTIONAL. Empty (the default) = no certificate and no hostnames: the LB serves plain HTTP on its IP — the zero-friction first apply. Set it later and re-apply to upgrade IN PLACE to TLS at api.<domain> (the DNS A record is created only when manage_dns = true). Nothing is destroyed by the upgrade."
+  type        = string
+  default     = ""
+}
+
+variable "manage_dns" {
+  description = "true = the domain's DNS is hosted on DigitalOcean and Terraform manages the records. false = you point api.<domain> at the LB IP yourself (the LB cert still needs the record in place before it can issue)."
+  type        = bool
+  default     = false
+}
+
+# ── Auth: DigitalOcean universes run byo-oidc (Auth0 today) — the tenant is
+# authoritative for roles/permissions; Terraform only passes the pointers through
+# (INFRASTRUCTURE.md: roles are PROVISIONED only under Cognito on AWS).
+variable "auth_issuer" {
+  description = "OIDC issuer, e.g. https://your-tenant.auth0.com"
+  type        = string
+}
+
+variable "auth_client_id" {
+  description = "OIDC SPA client id (public by definition)."
+  type        = string
+}
+
+variable "auth_audience" {
+  description = "OIDC audience (the Auth0 API identifier, e.g. gravity-api)."
+  type        = string
+  default     = "gravity-api"
+}
+
+# ── Postgres: three modes, first match wins ───────────────────────────────────
+#   1. byo_postgres_url      — fully external DB, URL used verbatim (you own
+#                              pooling, backups, reachability).
+#   2. existing_pg_cluster_name — an EXISTING DO managed cluster (the usual case:
+#                              "I already have Postgres in DO"): Terraform creates
+#                              the universe's OWN database, user, transaction
+#                              pool, and firewall rule ON that cluster. Your
+#                              existing databases are untouched — but the
+#                              cluster's max_connections is now SHARED between
+#                              your existing workload and this universe's pools;
+#                              on the 1GB tier (~22 connections) watch the sum.
+#   3. neither set           — Terraform provisions a fresh cluster + pool.
+variable "byo_postgres_url" {
+  description = "Mode 1: fully external Postgres URL (PG 14+, include sslmode=require). Empty = see existing_pg_cluster_id / provision."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "existing_pg_cluster_name" {
+  description = "Mode 2: the NAME of an EXISTING DO managed Postgres cluster (doctl databases list). Terraform adds the universe's db/user/pool/firewall to it and creates no cluster."
+  type        = string
+  default     = ""
+}
+
+variable "canvas_public" {
+  description = "POC ONLY (decided 2026-07-29): Canvas publicly at https://api.<domain>:3001 — a second port on the ONE load balancer (no second LB, no extra cost; DO LBs cannot host-route, and a clean hostname would cost a second LB). false = Canvas stays admin-only direct :3001 (the standing posture). Add https://api.<domain>:3001 to the IdP's allowed origins."
+  type        = bool
+  default     = false
+}
+
+# Redis is NOT flexible: always provisioned by Terraform (Managed Redis, TLS).
+# It is the platform's shared-state backbone (and the active/active future) —
+# the stack owns its version and locality. Only Postgres is BYO-able.
+
+# ── Service secrets: taken here so the rendered .env.production is COMPLETE —
+# the operator fills terraform.tfvars once and never hand-edits the env file.
+variable "docr_token" {
+  description = "Container registry token — pulls the platform images."
+  type        = string
+  sensitive   = true
+}
+
+variable "openai_api_key" {
+  description = "OpenAI API key — memory server + OpenAI nodes."
+  type        = string
+  sensitive   = true
+}
+
+variable "hyperbrowser_api_key" {
+  description = "Optional — page-intelligence features. Empty = feature off."
+  type        = string
+  default     = ""
+  sensitive   = true
+}