Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 CIAgent
|
97691fd752 | ||
|
CIAgent
|
7835c2aa2a |
+16
-16
@@ -1,25 +1,25 @@
|
||||
{
|
||||
"phase": 5,
|
||||
"phase": 1,
|
||||
"stage": "verify",
|
||||
"milestone": "v1.0",
|
||||
"phase_role": "execution",
|
||||
"attempts": 0,
|
||||
"updated_at": "2026-08-20T20:45:00Z",
|
||||
"updated_at": "2026-08-20T19:00:00Z",
|
||||
"project": "nova-platform",
|
||||
"milestone_branch": "milestone/v1.0-nova-platform",
|
||||
"phase_branch": "phase/05-shell-reproducibility-tests-docs",
|
||||
"phase_0_ship": {"tag": "v0.1.0", "local_only": true},
|
||||
"phase_1_ship": {"tag": "v0.1.1", "local_only": true},
|
||||
"phase_2_ship": {"tag": "v0.1.2", "local_only": true},
|
||||
"phase_3_ship": {"tag": "v0.1.3", "local_only": true},
|
||||
"phase_4_ship": {"tag": "v0.1.4", "local_only": true},
|
||||
"phase_5_verify": {
|
||||
"tests_pass": true,
|
||||
"tests_count": 76,
|
||||
"reqs_covered": ["REQ-20", "REQ-21", "REQ-22", "REQ-29", "REQ-30", "REQ-31", "REQ-32", "REQ-33", "REQ-34", "REQ-35", "REQ-36", "REQ-37", "REQ-38"],
|
||||
"happy_path_a": "run_platform.sh --check-only → === PLATFORM CHECK OK ===",
|
||||
"happy_path_b": "run_ci.sh → === CI PIPELINE OK ===",
|
||||
"ac_8_grep": "clean"
|
||||
"phase_branch": "phase/01-contract-surface-schemas-resolver",
|
||||
"phase_0_ship": {
|
||||
"tag": "v0.1.0",
|
||||
"merged_to_milestone": true,
|
||||
"merge_commit": "7835c2a",
|
||||
"phase_branch_deleted": true,
|
||||
"local_only": true,
|
||||
"release_pending": "NOVA_FORGE_TOKEN blank"
|
||||
},
|
||||
"next_phase": "phase/06-final-review-ship"
|
||||
"phase_1_verify": {
|
||||
"tests_pass": true,
|
||||
"tests_count": 36,
|
||||
"reqs_covered": ["REQ-01", "REQ-02", "REQ-03", "REQ-04", "REQ-05", "REQ-06", "REQ-23", "REQ-24", "REQ-27", "REQ-28"]
|
||||
},
|
||||
"next_phase": "phase/02-terraform-adapter-engine-boundary"
|
||||
}
|
||||
+3
-6
@@ -58,12 +58,9 @@ documented. Ships as `v0.1.5`.
|
||||
### Phase 6 — Final Review + Ship (milestone release)
|
||||
|
||||
REVIEW + AUDIT + milestone SHIP. Merges `phase/06` →
|
||||
`milestone/v1.0-nova-platform` → `main`. Tags `v0.1.6` (the milestone
|
||||
release on the v0.1 patch line — v1.0 is the milestone *label*, tags
|
||||
run on the previous minor's patch line per branch-strategy.md; since
|
||||
there is no prior minor, v0.1.x is the patch line and v0.1.6 IS the
|
||||
v1.0 milestone release). Creates the Gitea release. Deletes all
|
||||
milestone branches.
|
||||
`milestone/v1.0-nova-platform` → `main`. Tags `v1.0.0` (major — the
|
||||
initial release). Creates the Gitea release. Deletes all milestone
|
||||
branches.
|
||||
|
||||
## Coverage (init estimate — refined by PLAN)
|
||||
|
||||
|
||||
@@ -1,127 +0,0 @@
|
||||
# Nova Platform
|
||||
|
||||
> Nova Platform — infrastructure delivery, simplified. A consumer declares
|
||||
> intent in a YAML contract; the platform resolves it to a stack, compiles
|
||||
> it through the Terraform adapter, and applies it. Every deployment is
|
||||
> reproducible from the shell, not just in CI.
|
||||
|
||||
Nova Platform is the **infrastructure-delivery core** of the Nova model.
|
||||
The DevSecOps, identity, audit-ledger, and central CI-pipeline-contract
|
||||
machinery of the reference are intentionally removed. What remains: a
|
||||
consumer writes a small YAML contract that names one or more modules by
|
||||
name + version, selects an environment, and supplies module-specific
|
||||
inputs. The platform resolves the contract to a stack instance, compiles
|
||||
it through the Terraform adapter, and applies it.
|
||||
|
||||
- **Consumer guide:** [`docs/consumer-guide.md`](docs/consumer-guide.md)
|
||||
- **Contracts:** [`docs/contracts/`](docs/contracts/index.md)
|
||||
- **Environments:** [`docs/environments/`](docs/environments/index.md)
|
||||
- **Architecture:** [`docs/architecture.md`](docs/architecture.md)
|
||||
- **Modules:** [`docs/modules/`](docs/modules/index.md)
|
||||
|
||||
## How to run
|
||||
|
||||
### Quick start (offline, no AWS required)
|
||||
|
||||
The fastest way to verify the platform works — no AWS credentials, no
|
||||
bootstrap, no cost.
|
||||
|
||||
```bash
|
||||
# Install test dependencies
|
||||
pip install -r requirements-test.txt
|
||||
|
||||
# 1. Run the test suite (all offline)
|
||||
python3 -m pytest tests/ -q
|
||||
|
||||
# 2. Run the platform in check-only mode (offline — contract -> resolve ->
|
||||
# adapter -> structure validation). Uses the default sample contract.
|
||||
bash scripts/run_platform.sh --check-only contracts/static-assets.yml
|
||||
# Expected: "=== PLATFORM CHECK OK ==="
|
||||
|
||||
# 3. Reproduce the full CI pipeline locally (lint -> test -> check-only)
|
||||
bash scripts/run_ci.sh
|
||||
# Expected: "=== CI PIPELINE OK ==="
|
||||
|
||||
# Show all run_platform.sh flags:
|
||||
bash scripts/run_platform.sh --help
|
||||
```
|
||||
|
||||
### Run against live AWS (requires credentials + bootstrap)
|
||||
|
||||
> Prerequisites: a platform-managed environment (see
|
||||
> [docs/environments/](docs/environments/index.md); `core/environments/dev.json`
|
||||
> is the sample), AWS credentials for dev (in `.ciagent/.env.secrets`,
|
||||
> gitignored; see [Credentials](#credentials)), `terraform` (pin `>= 1.9, < 1.10`),
|
||||
> `python3` + `boto3` + `jsonschema` + `pyyaml`.
|
||||
|
||||
```bash
|
||||
# 1. Bootstrap the AWS state backend + runner IAM user (one-time, idempotent)
|
||||
# See terraform/bootstrap/README.md for the full runbook.
|
||||
export NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID="<root key>"
|
||||
export NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY="<root secret>"
|
||||
export AWS_DEFAULT_REGION="us-east-1"
|
||||
python3 terraform/bootstrap/create_state_backend.py
|
||||
python3 terraform/bootstrap/create_iam_user.py # prints the initial key
|
||||
bash scripts/rotate_spike_key.sh # writes .ciagent/.env.secrets
|
||||
|
||||
# 2. Run the full platform pipeline (contract -> environment check -> stack ->
|
||||
# adapter -> terraform init/validate/plan -> apply).
|
||||
bash scripts/run_platform.sh contracts/microservice.yml
|
||||
# Expected: "=== PLATFORM APPLY OK ==="
|
||||
|
||||
# Or plan-only (contract -> stack -> adapter -> terraform plan; no apply):
|
||||
bash scripts/run_platform.sh --plan-only contracts/static-assets.yml
|
||||
|
||||
# Add --quiet to suppress streaming (output to log files only):
|
||||
bash scripts/run_platform.sh --quiet contracts/static-assets.yml
|
||||
```
|
||||
|
||||
### run_platform.sh flags (D-031)
|
||||
|
||||
| Flag | Mode | AWS required | Description |
|
||||
|------|------|--------------|-------------|
|
||||
| `--check-only` | offline | no | contract → resolve → adapter → structure validation |
|
||||
| `--plan-only` | AWS | yes | above + `terraform init`/`validate`/`plan` (no apply) |
|
||||
| `--quiet` | any | — | suppress streaming output |
|
||||
| `-h`, `--help` | — | — | show usage |
|
||||
| *(none)* | apply | yes | full path: above + `terraform apply -auto-approve` |
|
||||
|
||||
## Repository layout
|
||||
|
||||
| Path | Purpose | Status |
|
||||
|------|---------|--------|
|
||||
| `core/` | Platform code: contract resolver, environment check, environments | active |
|
||||
| `schemas/` | JSON Schemas (draft 2020-12): contract, stack, environment | active |
|
||||
| `adapters/terraform/` | The Terraform adapter — the only engine-specific code | active |
|
||||
| `terraform/` | State backend (S3 + DynamoDB) + bootstrap scripts + platform/onboarding/ci-vpc | active |
|
||||
| `modules/` | L1 primitives (13) + L2 patterns (2) + `registry.json`. Each module has `interface.json` + `terraform/` | active |
|
||||
| `contracts/` | Sample consumer contracts (`static-assets.yml`, `microservice.yml`) + per-env variants | active |
|
||||
| `scripts/` | `run_platform.sh` (pipeline runner), `run_ci.sh` (local CI mirror), `rotate_spike_key.sh` | active |
|
||||
| `tests/` | Pytest suite (all offline — resolver, adapter, schemas, engine boundary, environment check) | active |
|
||||
| `docs/` | Documentation: consumer guide, contracts, environments, architecture, modules | active |
|
||||
| `.ciagent/` | CIAgent config + locked decisions (`ARCHITECTURE.md`, `PROJECT.md`, `CLARIFY.md`) | active |
|
||||
|
||||
## Credentials
|
||||
|
||||
Nova Platform uses a **static AWS key** for dev/local operation. There is no
|
||||
zero-trust federation layer in v1.0 — that is out of scope.
|
||||
|
||||
- The runner key is stored in **`.ciagent/.env.secrets`** (gitignored,
|
||||
`chmod 600`) using the `NOVA_AWS_*` prefix (D-032):
|
||||
`NOVA_AWS_ACCESS_KEY_ID`, `NOVA_AWS_SECRET_ACCESS_KEY`.
|
||||
- `scripts/run_platform.sh` copies `NOVA_AWS_*` to the standard `AWS_*`
|
||||
env vars before invoking Terraform, then unsets the `NOVA_*` copies.
|
||||
- Bootstrap uses a one-shot root key via `NOVA_BOOTSTRAP_AWS_*` env vars
|
||||
(never committed, never echoed). See
|
||||
[`terraform/bootstrap/README.md`](terraform/bootstrap/README.md) for the
|
||||
full bootstrap runbook (state backend + runner IAM user + key rotation).
|
||||
- Onboarding creates a per-consumer IAM **role** (cross-account assume-role
|
||||
pattern, D-025) — not a user, not federation. See
|
||||
`terraform/onboarding/main.tf`.
|
||||
|
||||
## Consumer guide
|
||||
|
||||
A step-by-step guide for a consumer to create a repo, write a contract,
|
||||
validate it offline, and run it against AWS is at
|
||||
[`docs/consumer-guide.md`](docs/consumer-guide.md). The guide is generic
|
||||
across all modules; `static-assets` is the worked example.
|
||||
@@ -1,3 +0,0 @@
|
||||
from adapters.terraform.adapter import adapt
|
||||
|
||||
__all__ = ["adapt"]
|
||||
@@ -1,102 +0,0 @@
|
||||
"""Nova Platform — Terraform Adapter.
|
||||
|
||||
The ONLY engine-specific code in the platform (per REQ-09, verified by
|
||||
tests/test_engine_boundary.py). Loads modules/registry.json internally
|
||||
to map module -> terraform_dir (per D-037/C-1 grill fix — the resolver
|
||||
does NOT put a `source` field in the stack; the adapter resolves it
|
||||
here, inside the engine boundary).
|
||||
|
||||
Stateless assembler: no `terraform` CLI invocation, no state files, no
|
||||
plan files. Emits Terraform HCL: one `module "x" { source = ...; <inputs> }`
|
||||
block per stack resource.
|
||||
"""
|
||||
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
def _load_registry(repo_root):
|
||||
"""Load modules/registry.json -> {module_name: terraform_dir}."""
|
||||
registry_path = os.path.join(str(repo_root), "modules", "registry.json")
|
||||
with open(registry_path) as fh:
|
||||
registry = json.load(fh)
|
||||
return {name: list(versions.values())[0].get("terraform_dir")
|
||||
for name, versions in registry.items()
|
||||
if list(versions.values())[0].get("terraform_dir")}
|
||||
|
||||
|
||||
def _tf_value(value):
|
||||
"""Render a Python value as an HCL expression."""
|
||||
if isinstance(value, bool):
|
||||
return "true" if value else "false"
|
||||
if isinstance(value, (int, float)):
|
||||
return str(value)
|
||||
if isinstance(value, list):
|
||||
return "[" + ", ".join(_tf_value(v) for v in value) + "]"
|
||||
if isinstance(value, dict):
|
||||
return "{ " + ", ".join(f"{k} = {_tf_value(v)}" for k, v in value.items()) + " }"
|
||||
return json.dumps(str(value))
|
||||
|
||||
|
||||
def _emit_module_block(resource, terraform_dirs, repo_root):
|
||||
"""Emit one `module "x" { source = ...; <inputs> }` block."""
|
||||
module_name = resource["module"]
|
||||
rid = module_name.replace("-", "_")
|
||||
tf_dir = terraform_dirs.get(module_name)
|
||||
if tf_dir is None:
|
||||
raise ValueError(f"module '{module_name}' has no terraform_dir in registry")
|
||||
source = os.path.join(str(repo_root), tf_dir)
|
||||
lines = [f'module "{rid}" {{', f' source = "{source}"']
|
||||
for key, val in resource.get("inputs", {}).items():
|
||||
if key == "region":
|
||||
continue
|
||||
lines.append(f" {key} = {_tf_value(val)}")
|
||||
lines.append("}")
|
||||
return "\n".join(lines)
|
||||
|
||||
|
||||
def adapt(stack, repo_root):
|
||||
"""Compile a flat stack dict to Terraform HCL.
|
||||
|
||||
Args:
|
||||
stack: a flat stack dict conforming to schemas/stack.schema.json
|
||||
(NO `source` field per D-037 — the adapter resolves
|
||||
module -> terraform_dir via the registry).
|
||||
repo_root: Path to the repo root (the adapter loads
|
||||
modules/registry.json from here).
|
||||
|
||||
Returns:
|
||||
A string of Terraform HCL with one `module "x" {}` block per
|
||||
stack resource.
|
||||
"""
|
||||
terraform_dirs = _load_registry(repo_root)
|
||||
blocks = []
|
||||
for resource in stack.get("resources", []):
|
||||
blocks.append(_emit_module_block(resource, terraform_dirs, repo_root))
|
||||
return "\n\n".join(blocks) + "\n"
|
||||
|
||||
|
||||
def main(argv=None):
|
||||
import sys
|
||||
argv = argv or sys.argv[1:]
|
||||
if len(argv) < 1:
|
||||
print("usage: adapter.py <stack.json> [out.tf]", file=sys.stderr)
|
||||
return 2
|
||||
stack_path = argv[0]
|
||||
out_path = argv[1] if len(argv) > 1 else None
|
||||
repo_root = Path(__file__).resolve().parent.parent.parent
|
||||
with open(stack_path) as fh:
|
||||
stack = json.load(fh)
|
||||
hcl = adapt(stack, repo_root)
|
||||
if out_path:
|
||||
with open(out_path, "w") as fh:
|
||||
fh.write(hcl)
|
||||
else:
|
||||
print(hcl)
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
import sys
|
||||
sys.exit(main())
|
||||
@@ -153,7 +153,6 @@ def resolve(contract, registry, modules_dir, environments_dir=None,
|
||||
|
||||
def main(argv=None):
|
||||
import sys
|
||||
sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
|
||||
argv = argv or sys.argv[1:]
|
||||
if len(argv) < 2:
|
||||
print("usage: contract_resolver.py <contract.yaml> [out.json]",
|
||||
|
||||
@@ -1,130 +0,0 @@
|
||||
# Architecture
|
||||
|
||||
> **Status:** v1.0 (current). This document mirrors `.ciagent/ARCHITECTURE.md`.
|
||||
> Where the two conflict, `.ciagent/ARCHITECTURE.md` wins.
|
||||
|
||||
## 0. Purpose
|
||||
|
||||
Nova Platform is the **infrastructure-delivery core**. A consumer declares
|
||||
intent in a YAML contract; the platform resolves it to a stack, compiles it
|
||||
through the Terraform adapter, and applies it. The DevSecOps, identity,
|
||||
audit-ledger, and central CI-pipeline-contract machinery of the Nova
|
||||
reference are intentionally removed — see the OOS list below.
|
||||
|
||||
## 1. Layers (4)
|
||||
|
||||
```
|
||||
┌──────────────────────────────────────────────────────┐
|
||||
│ 1. Contract Surface schemas/contract.schema.json
|
||||
│ contracts/*.yml (samples)
|
||||
├──────────────────────────────────────────────────────┤
|
||||
│ 2. Resolution core/contract_resolver.py
|
||||
│ core/environment_check.py
|
||||
│ schemas/stack.schema.json
|
||||
├──────────────────────────────────────────────────────┤
|
||||
│ 3. Engine Adapter adapters/terraform/ (the only
|
||||
│ (only engine-specific) engine-specific code)
|
||||
├──────────────────────────────────────────────────────┤
|
||||
│ 4. Apply terraform/ (bootstrap, modules)
|
||||
│ scripts/run_platform.sh
|
||||
└──────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
### Layer 1 — Contract Surface
|
||||
|
||||
A consumer writes a small YAML contract. The `infrastructure` field is an
|
||||
**array** (D-015), not a map:
|
||||
|
||||
```yaml
|
||||
id: stsi
|
||||
name: My Static Site
|
||||
environment: dev
|
||||
infrastructure:
|
||||
- module: static-assets
|
||||
version: "1.0.0"
|
||||
inputs:
|
||||
bucket_name: my-static-site-assets
|
||||
index_document: index.html
|
||||
```
|
||||
|
||||
Validated against `schemas/contract.schema.json`. The contract is the only
|
||||
consumer-facing surface. It is engine-agnostic — no `aws_*` terms.
|
||||
|
||||
### Layer 2 — Resolution
|
||||
|
||||
`core/contract_resolver.py` resolves a validated contract to a Stack
|
||||
instance (a typed structure conforming to `schemas/stack.schema.json`).
|
||||
Resolution is pure: contract in, stack out. No I/O beyond local file reads
|
||||
for module metadata (D-011). No engine terms.
|
||||
|
||||
`core/environment_check.py` validates that the named environment exists in
|
||||
`core/environments/*.json` and returns its definition. Environments are
|
||||
platform-managed (consumers provide no AWS account, VPC, or state bucket).
|
||||
|
||||
Interpolation (D-016): the resolver expands `${env.<field>}` and
|
||||
`${contract.<field>}` tokens after the environment is loaded. Unknown tokens
|
||||
raise `ValueError`.
|
||||
|
||||
### Layer 3 — Engine Adapter
|
||||
|
||||
`adapters/terraform/` is the only engine-specific code. It takes a Stack
|
||||
and emits Terraform (`module "x" { source = "../../modules/..." }` blocks).
|
||||
The adapter is a stateless assembler — lifecycle ownership belongs to
|
||||
Terraform via the shell orchestrator. This is the only place `aws_*` /
|
||||
Terraform terms appear.
|
||||
|
||||
### Layer 4 — Apply
|
||||
|
||||
`scripts/run_platform.sh` orchestrates: contract → resolve → adapter →
|
||||
`terraform init` → `terraform plan` → `terraform apply`. Modes (D-031):
|
||||
`--check-only` (offline, structure validation), `--plan-only` (no apply),
|
||||
full (apply). `--quiet` suppresses streaming.
|
||||
|
||||
## 2. Engine Boundary (Enforced)
|
||||
|
||||
The engine boundary is strict. Code outside `adapters/terraform/` MUST NOT
|
||||
contain engine-specific terms (`aws_s3_bucket`, `aws_*`, Terraform HCL).
|
||||
This invariant is verified by tests (`tests/test_engine_boundary.py`,
|
||||
scope per D-034: `.py` files in `core/`, `schemas/`, `contracts/`,
|
||||
`tests/`, `scripts/`, root — excluding `adapters/terraform/`, `modules/`,
|
||||
`.tf`/`.md`/`.json` data files).
|
||||
|
||||
## 3. What is NOT here (intentionally removed vs the reference)
|
||||
|
||||
Nova Platform is a simplified, infrastructure-only platform. The following
|
||||
reference features are **out of scope** for v1.0:
|
||||
|
||||
- No confidence signal — no score gating apply.
|
||||
- No audit outbox — no hash-chained evidence events.
|
||||
- No policy engine / policy adapter — no policy checks.
|
||||
- No identity layer, no attribute-based authorization, no human-in-the-loop
|
||||
approval gates.
|
||||
- No reusable CI workflow — local shell only (`scripts/run_ci.sh`).
|
||||
- No central pipeline contract — no `pipelines/` directory.
|
||||
- No platform telemetry / metrics.
|
||||
- No decommission transform, env-transition transform, or onboarding flow
|
||||
beyond bootstrap.
|
||||
- No leadership decks or slide rendering.
|
||||
|
||||
## 4. Module Catalog
|
||||
|
||||
L1 primitives (single resources) + L2 patterns (composites of primitives).
|
||||
Each module has an `interface.json` (inputs/outputs, no engine terms) and a
|
||||
`terraform/` directory. `modules/registry.json` indexes every module +
|
||||
version.
|
||||
|
||||
**L1 (primitives — 13):** `s3`, `vpc`, `ecs-cluster`, `ecs-service`,
|
||||
`iam-role`, `alb`, `ecr`, `cloudfront`, `waf`, `rds`, `kms-key`,
|
||||
`dynamodb`, `uptime`.
|
||||
|
||||
**L2 (patterns — 2):**
|
||||
|
||||
| Module | Composes (D-038) | Description |
|
||||
|--------|------------------|-------------|
|
||||
| `microservice` | vpc + ecs-cluster + ecs-service + iam-role + ecr + alb (6 L1s) | Container microservice with a public ALB |
|
||||
| `static-assets` | s3 + cloudfront + kms-key (3 L1s) | Static site fronted by CloudFront |
|
||||
|
||||
L2 modules are opaque stack entries (D-012): the resolver does not expand
|
||||
their children. The L2's `terraform/main.tf` composes L1 modules internally
|
||||
via `module` blocks. See [`docs/modules/index.md`](modules/index.md) for the
|
||||
full catalog and each module's README.
|
||||
@@ -1,208 +0,0 @@
|
||||
# Consumer Guide — Declare intent, deploy to AWS
|
||||
|
||||
This guide walks a consumer through creating a repo, writing a contract,
|
||||
validating it offline, and running it against AWS. It is **generic** across
|
||||
all modules in the registry; `static-assets` is the worked example, but
|
||||
every step applies to `microservice` and any future module.
|
||||
|
||||
## The model
|
||||
|
||||
You write a contract YAML file and the platform does the rest. Your
|
||||
repository contains only your application code and your contracts. You do
|
||||
not write infrastructure modules or adapter code.
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
A["your repo<br/>(app code + contract)"] -->|run_platform.sh| B
|
||||
B["platform<br/>(resolver + adapter + modules)"] -->|contract -> stack -> terraform -> apply| C
|
||||
C["your resources in AWS"]
|
||||
```
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- **A consumer repository** for your application code + contract.
|
||||
- **A platform-managed environment** bound to your repo. The platform team
|
||||
provisions the AWS account, network, and state backend. See
|
||||
[Environments](environments/index.md).
|
||||
- **AWS credentials** for the target environment, in `.ciagent/.env.secrets`
|
||||
(gitignored) using the `NOVA_AWS_*` prefix. See the
|
||||
[platform README](../README.md#credentials) and
|
||||
[`terraform/bootstrap/README.md`](../terraform/bootstrap/README.md).
|
||||
|
||||
## Step 1 — Create a consumer repo
|
||||
|
||||
Create a repository for your application. The top level holds your app
|
||||
code; your contract lives at the repo root (or wherever you point
|
||||
`run_platform.sh`). Example for a static site:
|
||||
|
||||
```
|
||||
my-static-site/
|
||||
index.html
|
||||
assets/
|
||||
style.css
|
||||
logo.png
|
||||
contract.yml
|
||||
```
|
||||
|
||||
Example for a microservice:
|
||||
|
||||
```
|
||||
my-microservice/
|
||||
app.py
|
||||
Dockerfile
|
||||
contract.yml
|
||||
```
|
||||
|
||||
## Step 2 — Define the contract
|
||||
|
||||
Write `contract.yml`. The `static-assets` example:
|
||||
|
||||
```yaml
|
||||
id: stsi
|
||||
name: Static Assets Site
|
||||
environment: dev
|
||||
infrastructure:
|
||||
- module: static-assets
|
||||
version: "1.0.0"
|
||||
inputs:
|
||||
bucket_name: "${env.environment}-${contract.id}-assets"
|
||||
index_document: index.html
|
||||
```
|
||||
|
||||
A `microservice` example:
|
||||
|
||||
```yaml
|
||||
id: msvc
|
||||
name: Microservice
|
||||
environment: dev
|
||||
infrastructure:
|
||||
- module: microservice
|
||||
version: "1.0.0"
|
||||
inputs:
|
||||
service_name: "${env.environment}-${contract.id}-svc"
|
||||
desired_count: 2
|
||||
```
|
||||
|
||||
### Contract fields
|
||||
|
||||
| Field | Type | Required | Description |
|
||||
|-------|------|----------|-------------|
|
||||
| `id` | string | yes | Short operational acronym (`^[a-z][a-z0-9-]{2,5}$`, 3-6 chars). Becomes the stack name used for the Terraform state key and resource naming prefix. Stable across deploys and environment promotions. |
|
||||
| `name` | string | yes | Full human-readable stack name (min 3 chars). |
|
||||
| `environment` | string | yes | The platform-managed environment to deploy to (`dev`/`qa`/`prod`/`dr`). See [Environments](environments/index.md). |
|
||||
| `infrastructure` | array | yes | **Array** of modules to deploy (D-015). Each entry carries a `module` name (matching a registry key), an optional `version` (defaults to latest non-deprecated), and required `inputs`. One entry = single-module deploy; N entries = multi-module manifest. |
|
||||
|
||||
### Infrastructure item fields
|
||||
|
||||
| Field | Type | Required | Description |
|
||||
|-------|------|----------|-------------|
|
||||
| `module` | string | yes | Module name from `modules/registry.json` (`^[a-z][a-z0-9-]*$`). |
|
||||
| `version` | string | no | Semver pin `X.Y.Z`. Omitted = latest non-deprecated version. |
|
||||
| `inputs` | object | yes | Module-specific inputs (see the module's README). No `aws_*` keys — the contract is engine-agnostic. |
|
||||
|
||||
Each module declares its inputs in its `interface.json`. Consult the
|
||||
[module catalog](modules/index.md) for the full list, or read the module's
|
||||
own README under `modules/l1/<name>/` or `modules/l2/<name>/`.
|
||||
|
||||
The contract is validated against `schemas/contract.schema.json`. An invalid
|
||||
contract (missing field, unknown module, wrong type) fails at the
|
||||
validate-contract stage with a clear error.
|
||||
|
||||
### Interpolation reference (D-016)
|
||||
|
||||
The resolver expands `${env.*}` and `${contract.*}` tokens after the
|
||||
environment is loaded. Unknown tokens raise `ValueError` (fail loud).
|
||||
Expansion is recursive (nested map/list values expand too).
|
||||
|
||||
| Token | Resolves to | Example |
|
||||
|-------|-------------|---------|
|
||||
| `${env.name}` | the environment name | `dev` |
|
||||
| `${env.region}` | the environment's AWS region | `us-east-1` |
|
||||
| `${env.account_id}` | the environment's AWS account id | `000000000000` |
|
||||
| `${env.state_backend.bucket}` | the environment's state bucket | `nova-tfstate-dev-us-east-1` |
|
||||
| `${env.state_backend.lock_table}` | the environment's lock table | `nova-tfstate-locks` |
|
||||
| `${env.network.vpc_cidr}` | the environment's VPC CIDR | `10.0.0.0/16` |
|
||||
| `${contract.id}` | the contract's operational acronym | `stsi` |
|
||||
| `${contract.name}` | the contract's name field | `Static Assets Site` |
|
||||
| `${contract.environment}` | the contract's environment field | `dev` |
|
||||
|
||||
## Step 3 — Validate offline (no AWS required)
|
||||
|
||||
Before touching AWS, validate the contract end-to-end offline. Clone the
|
||||
Nova Platform repo and run `--check-only` against your contract:
|
||||
|
||||
```bash
|
||||
bash scripts/run_platform.sh --check-only path/to/your/contract.yml
|
||||
# Expected: "=== PLATFORM CHECK OK ==="
|
||||
```
|
||||
|
||||
This runs: environment check → contract schema validation → resolve to
|
||||
stack → adapter compiles to HCL → output structure validation. No AWS
|
||||
credentials are needed.
|
||||
|
||||
## Step 4 — Run against live AWS
|
||||
|
||||
Once the contract validates offline, run the full pipeline against AWS.
|
||||
Ensure your credentials are in `.ciagent/.env.secrets` (see
|
||||
[Credentials](../README.md#credentials)):
|
||||
|
||||
```bash
|
||||
bash scripts/run_platform.sh contracts/static-assets.yml
|
||||
# Expected: "=== PLATFORM APPLY OK ==="
|
||||
```
|
||||
|
||||
The full path: environment check → validate contract → resolve to stack →
|
||||
adapter compiles to HCL → load AWS credentials → `terraform init` →
|
||||
`terraform validate` → `terraform plan` → `terraform apply -auto-approve`.
|
||||
|
||||
To stop before apply (review the plan only):
|
||||
|
||||
```bash
|
||||
bash scripts/run_platform.sh --plan-only contracts/static-assets.yml
|
||||
# Expected: "=== PLATFORM PLAN OK ==="
|
||||
```
|
||||
|
||||
## Step 5 — What gets created
|
||||
|
||||
After a successful `dev` run, the resources declared by your module's
|
||||
pattern exist in your AWS account.
|
||||
|
||||
For the `static-assets` example (s3 + cloudfront + kms-key, D-038):
|
||||
|
||||
- An **S3 bucket** (named via your `bucket_name` input, interpolation
|
||||
expanded) with versioning enabled.
|
||||
- A **CloudFront distribution** with the S3 bucket as the origin.
|
||||
- A **KMS key** for SSE.
|
||||
|
||||
For other modules, consult the module's README
|
||||
(`modules/l1/<name>/README.md` or `modules/l2/<name>/README.md`) for the
|
||||
exact resources created.
|
||||
|
||||
## Step 6 — Upload your content (static-assets example)
|
||||
|
||||
The platform provisions the infrastructure; you upload your content. For the
|
||||
`static-assets` module:
|
||||
|
||||
```bash
|
||||
aws s3 sync ./assets s3://<your-bucket-name>/
|
||||
```
|
||||
|
||||
For a `microservice`, the platform provisions the ECS service and ALB; you
|
||||
push your container image to the ECR repo the platform created.
|
||||
|
||||
## Reference
|
||||
|
||||
| Resource | Path | Description |
|
||||
|----------|------|-------------|
|
||||
| Contract schema | `schemas/contract.schema.json` | JSON Schema for consumer contracts. |
|
||||
| Stack schema | `schemas/stack.schema.json` | JSON Schema for the resolved stack instance. |
|
||||
| Module catalog | [modules/](modules/index.md) | All primitives and modules. |
|
||||
| Sample contract | `contracts/static-assets.yml` | The reference example contract. |
|
||||
| Sample contract | `contracts/microservice.yml` | The microservice example contract. |
|
||||
| Module examples | `modules/<name>/examples/` | Validated per-module example contracts. |
|
||||
| Contract resolver | `core/contract_resolver.py` | Resolves contracts to stack instances. |
|
||||
| Terraform adapter | `adapters/terraform/adapter.py` | Compiles stack instances to Terraform. |
|
||||
| Pipeline runner | `scripts/run_platform.sh` | The pipeline runner. |
|
||||
| Environments | [environments/](environments/index.md) | Platform-managed environments. |
|
||||
| Platform README | `README.md` | How the platform works + how to run it. |
|
||||
| Credentials | `README.md#credentials` | The static-key model + bootstrap runbook. |
|
||||
@@ -1,139 +0,0 @@
|
||||
# Contracts
|
||||
|
||||
A consumer declares intent in a **contract** — a small YAML file that names
|
||||
infrastructure (one or more modules), selects an environment, and supplies
|
||||
module-specific inputs. The platform validates, resolves, and deploys it.
|
||||
|
||||
## The contract file
|
||||
|
||||
A minimal example (the `static-assets` module):
|
||||
|
||||
```yaml
|
||||
id: stsi
|
||||
name: Static Assets Site
|
||||
environment: dev
|
||||
infrastructure:
|
||||
- module: static-assets
|
||||
version: "1.0.0"
|
||||
inputs:
|
||||
bucket_name: "${env.environment}-${contract.id}-assets"
|
||||
index_document: index.html
|
||||
```
|
||||
|
||||
A `microservice` example:
|
||||
|
||||
```yaml
|
||||
id: msvc
|
||||
name: Microservice
|
||||
environment: dev
|
||||
infrastructure:
|
||||
- module: microservice
|
||||
version: "1.0.0"
|
||||
inputs:
|
||||
service_name: "${env.environment}-${contract.id}-svc"
|
||||
desired_count: 2
|
||||
```
|
||||
|
||||
## Array-based infrastructure (D-015)
|
||||
|
||||
The `infrastructure` field is an **array** of module entries, not a map
|
||||
keyed by module name. This is a locked deviation from the Nova reference
|
||||
(D-015). Each entry is an object with `module`, `version` (optional), and
|
||||
`inputs`.
|
||||
|
||||
One entry = single-module deploy. N entries = multi-module manifest deployed
|
||||
in one pipeline run:
|
||||
|
||||
```yaml
|
||||
id: app
|
||||
name: Pricing Service API
|
||||
environment: dev
|
||||
infrastructure:
|
||||
- module: microservice
|
||||
version: "1.0.0"
|
||||
inputs: { ... }
|
||||
- module: static-assets
|
||||
version: "1.0.0"
|
||||
inputs: { ... }
|
||||
```
|
||||
|
||||
All modules deploy to the same `environment` in one pipeline run.
|
||||
|
||||
## Fields
|
||||
|
||||
| Field | Type | Required | Description |
|
||||
|-------|------|----------|-------------|
|
||||
| `id` | string | yes | Short operational acronym (`^[a-z][a-z0-9-]{2,5}$`, 3-6 chars). Becomes the stack name used for the Terraform state key and resource naming prefix. Stable across deploys and environment promotions. |
|
||||
| `name` | string | yes | Full human-readable stack name (min 3 chars). |
|
||||
| `environment` | string | yes | The platform-managed environment to deploy to (`dev`/`qa`/`prod`/`dr`). See [Environments](../environments/index.md). |
|
||||
| `infrastructure` | array | yes | Array of modules to deploy (D-015). `minItems: 1`. |
|
||||
|
||||
### Infrastructure item fields
|
||||
|
||||
| Field | Type | Required | Description |
|
||||
|-------|------|----------|-------------|
|
||||
| `module` | string | yes | Module name from `modules/registry.json` (`^[a-z][a-z0-9-]*$`). |
|
||||
| `version` | string | no | Semver pin (`^\d+\.\d+\.\d+$`). Omitted = latest non-deprecated version from the registry. |
|
||||
| `inputs` | object | yes | Module-specific inputs (see the module's README / `interface.json`). No `aws_*` keys — the contract is engine-agnostic. |
|
||||
|
||||
## Validation
|
||||
|
||||
The contract is validated against
|
||||
[`schemas/contract.schema.json`](../../schemas/contract.schema.json). An
|
||||
invalid contract (missing field, unknown module, wrong type) fails at the
|
||||
validate-contract stage with a clear error.
|
||||
|
||||
## Interpolation tokens (D-016)
|
||||
|
||||
The resolver expands `${env.*}` and `${contract.*}` tokens after the
|
||||
environment is loaded. Unknown tokens raise `ValueError` (fail loud).
|
||||
Expansion is recursive (nested map/list values expand too).
|
||||
|
||||
| Token | Resolves to | Example |
|
||||
|-------|-------------|---------|
|
||||
| `${env.name}` | the environment name | `dev` |
|
||||
| `${env.region}` | the environment's AWS region | `us-east-1` |
|
||||
| `${env.account_id}` | the environment's AWS account id | `000000000000` |
|
||||
| `${env.state_backend.bucket}` | the environment's state bucket | `nova-tfstate-dev-us-east-1` |
|
||||
| `${env.state_backend.lock_table}` | the environment's lock table | `nova-tfstate-locks` |
|
||||
| `${env.network.vpc_cidr}` | the environment's VPC CIDR | `10.0.0.0/16` |
|
||||
| `${env.network.azs}` | the environment's availability zones | `["us-east-1a","us-east-1b"]` |
|
||||
| `${contract.id}` | the contract's operational acronym | `stsi` |
|
||||
| `${contract.name}` | the contract's name field | `Static Assets Site` |
|
||||
| `${contract.environment}` | the contract's environment field | `dev` |
|
||||
|
||||
## Sample contracts
|
||||
|
||||
Two reference examples exist in `contracts/`:
|
||||
|
||||
- [`contracts/static-assets.yml`](../../contracts/static-assets.yml) — the
|
||||
`static-assets` module (s3 + cloudfront + kms-key, D-038).
|
||||
- [`contracts/microservice.yml`](../../contracts/microservice.yml) — the
|
||||
`microservice` module (vpc + ecs-cluster + ecs-service + iam-role + ecr +
|
||||
alb, D-038).
|
||||
|
||||
Additionally, every module has a `modules/<name>/examples/` directory with
|
||||
validated example contracts. See the [module catalog](../modules/index.md)
|
||||
for the full list.
|
||||
|
||||
## Per-environment variants (D-033)
|
||||
|
||||
Each sample contract has per-environment variants that differ **only** in
|
||||
the `environment` field — all other fields are identical. Interpolation
|
||||
resolves environment-specific values at resolver time.
|
||||
|
||||
| File | Environment |
|
||||
|------|-------------|
|
||||
| `contracts/static-assets.yml` | dev (default) |
|
||||
| `contracts/static-assets.dev.yml` | dev |
|
||||
| `contracts/static-assets.qa.yml` | qa |
|
||||
| `contracts/static-assets.prod.yml` | prod |
|
||||
| `contracts/static-assets.dr.yml` | dr |
|
||||
| `contracts/microservice.yml` | dev (default) |
|
||||
| `contracts/microservice.dev.yml` | dev |
|
||||
| `contracts/microservice.qa.yml` | qa |
|
||||
| `contracts/microservice.prod.yml` | prod |
|
||||
| `contracts/microservice.dr.yml` | dr |
|
||||
|
||||
Promotion = running the pipeline against the matching variant. See the
|
||||
[Consumer Guide](../consumer-guide.md) for the end-to-end flow.
|
||||
@@ -1,104 +0,0 @@
|
||||
# Environments
|
||||
|
||||
A consumer does **not** provide an AWS account, a VPC, a subnet, or an S3
|
||||
state bucket. The platform manages environments.
|
||||
|
||||
## What an environment is
|
||||
|
||||
A named environment is a **platform-owned** bundle of:
|
||||
|
||||
- An **AWS account** (or a scoped partition of one).
|
||||
- A **network** (VPC + subnets / AZs).
|
||||
- A **state backend** (an S3 bucket + DynamoDB lock table for Terraform
|
||||
state).
|
||||
|
||||
A consumer selects an environment **by name** in their contract:
|
||||
|
||||
```yaml
|
||||
environment: dev
|
||||
```
|
||||
|
||||
The platform resolves the name to the underlying account/network/state
|
||||
backend at run time. The consumer never sees the raw credentials.
|
||||
|
||||
## Environment definition shape (D-018)
|
||||
|
||||
Each environment is a JSON file in `core/environments/`. The field set is
|
||||
reduced from the reference — the IAM role, autonomy, and confidence
|
||||
threshold fields are out of scope for v1.0.
|
||||
|
||||
`core/environments/dev.json` (the sample):
|
||||
|
||||
```json
|
||||
{
|
||||
"name": "dev",
|
||||
"description": "Sample dev environment for offline/local testing. account_id placeholder (000000000000) for offline mode.",
|
||||
"account_id": "000000000000",
|
||||
"region": "us-east-1",
|
||||
"state_backend": {
|
||||
"bucket": "nova-tfstate-dev-us-east-1",
|
||||
"lock_table": "nova-tfstate-locks"
|
||||
},
|
||||
"network": {
|
||||
"vpc_cidr": "10.0.0.0/16",
|
||||
"azs": ["us-east-1a", "us-east-1b"]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Fields
|
||||
|
||||
| Field | Type | Required | Description |
|
||||
|-------|------|----------|-------------|
|
||||
| `name` | string | yes | The environment name (`dev`/`qa`/`prod`/`dr`). |
|
||||
| `description` | string | no | Human-readable description. |
|
||||
| `account_id` | string | yes | The AWS account id (placeholder `000000000000` for offline dev). |
|
||||
| `region` | string | yes | The AWS region. |
|
||||
| `state_backend.bucket` | string | yes | The S3 state bucket name. |
|
||||
| `state_backend.lock_table` | string | yes | The DynamoDB lock table name (`nova-tfstate-locks` per D-022). |
|
||||
| `network.vpc_cidr` | string | yes | The VPC CIDR block. |
|
||||
| `network.azs` | array | yes | The availability zones. |
|
||||
|
||||
### Dropped from the reference (D-018)
|
||||
|
||||
- `runner_role_arn` — identity/authorization is out of scope.
|
||||
- `autonomy` — human-in-the-loop gates are out of scope.
|
||||
- `confidence_threshold` — the confidence signal is out of scope.
|
||||
|
||||
## State backend (D-022)
|
||||
|
||||
The Terraform state backend uses a dedicated DynamoDB lock table named
|
||||
`nova-tfstate-locks` (NOT `nova-outbox` — the audit outbox is out of scope
|
||||
for v1.0). The S3 state bucket is named `nova-tfstate-<account>-<region>`
|
||||
with versioning enabled. See
|
||||
[`terraform/bootstrap/README.md`](../../terraform/bootstrap/README.md) for
|
||||
the bootstrap runbook that creates both.
|
||||
|
||||
## Autonomy by environment
|
||||
|
||||
| Environment | Autonomy | Operator action |
|
||||
|-------------|----------|-----------------|
|
||||
| dev | Fully autonomous | None — `terraform apply -auto-approve` runs automatically. |
|
||||
| qa | Manual | An operator runs `run_platform.sh` against the `qa` contract. |
|
||||
| prod | Manual | An operator runs `run_platform.sh` against the `prod` contract. |
|
||||
| dr | Manual | An operator runs `run_platform.sh` against the `dr` contract. |
|
||||
|
||||
`dev` is the only autonomous environment. Higher environments require a
|
||||
human operator to invoke the pipeline against the environment's contract
|
||||
variant. There are no automated gates or attestation steps — those are out
|
||||
of scope for v1.0. Staging does not exist.
|
||||
|
||||
## Onboarding scaffold (current state)
|
||||
|
||||
The platform repo ships a minimal onboarding scaffold:
|
||||
|
||||
- [`core/environments/`](../../core/environments/) — environment definitions
|
||||
(a sample `dev.json`).
|
||||
- `core/environment_check.py` — checks whether an environment is defined
|
||||
for a given contract's environment name; raises `EnvironmentNotFoundError`
|
||||
when none is defined (D-019).
|
||||
- `scripts/run_platform.sh` calls the check before contract validation.
|
||||
|
||||
The scaffold is minimal: provisioning a new environment is a platform-team
|
||||
action today (bootstrap the state backend + network). Self-service
|
||||
environment provisioning is a future milestone.
|
||||
@@ -1,36 +0,0 @@
|
||||
# Module Catalog
|
||||
|
||||
Every module's full documentation lives next to its code under
|
||||
`modules/l1/<name>/README.md` or `modules/l2/<name>/README.md` (per
|
||||
D-028). This page is the index: it lists the available modules and
|
||||
links to their per-module docs.
|
||||
|
||||
## L1 primitives (13)
|
||||
|
||||
| Module | Stack type | Multi-resource? | Docs |
|
||||
|-----------------|-------------------------------|-----------------|-----------------------------------------------|
|
||||
| `s3` | `aws:s3:bucket` | no | [modules/l1/s3/README.md](../../modules/l1/s3/README.md) |
|
||||
| `vpc` | `aws:ec2:vpc` | yes | [modules/l1/vpc/README.md](../../modules/l1/vpc/README.md) |
|
||||
| `ecs-cluster` | `aws:ecs:cluster` | no | [modules/l1/ecs-cluster/README.md](../../modules/l1/ecs-cluster/README.md) |
|
||||
| `ecs-service` | `aws:ecs:service` | yes | [modules/l1/ecs-service/README.md](../../modules/l1/ecs-service/README.md) |
|
||||
| `iam-role` | `aws:iam:role` | no | [modules/l1/iam-role/README.md](../../modules/l1/iam-role/README.md) |
|
||||
| `alb` | `aws:alb` | yes | [modules/l1/alb/README.md](../../modules/l1/alb/README.md) |
|
||||
| `ecr` | `aws:ecr:repository` | no | [modules/l1/ecr/README.md](../../modules/l1/ecr/README.md) |
|
||||
| `cloudfront` | `aws:cloudfront:distribution` | no | [modules/l1/cloudfront/README.md](../../modules/l1/cloudfront/README.md) |
|
||||
| `waf` | `aws:waf:web_acl` | no | [modules/l1/waf/README.md](../../modules/l1/waf/README.md) |
|
||||
| `rds` | `aws:rds:instance` | no | [modules/l1/rds/README.md](../../modules/l1/rds/README.md) |
|
||||
| `kms-key` | `aws:kms:key` | no | [modules/l1/kms-key/README.md](../../modules/l1/kms-key/README.md) |
|
||||
| `dynamodb` | `aws:dynamodb:table` | no | [modules/l1/dynamodb/README.md](../../modules/l1/dynamodb/README.md) |
|
||||
| `uptime` | `aws:uptime:monitor` | no | [modules/l1/uptime/README.md](../../modules/l1/uptime/README.md) |
|
||||
|
||||
## L2 compositions (2)
|
||||
|
||||
| Module | Composes | Docs |
|
||||
|------------------|---------------------------------------------|---------------------------------------------------|
|
||||
| `microservice` | vpc + ecs-cluster + ecs-service + alb + ecr | [modules/l2/microservice/README.md](../../modules/l2/microservice/README.md) |
|
||||
| `static-assets` | s3 + cloudfront | [modules/l2/static-assets/README.md](../../modules/l2/static-assets/README.md) |
|
||||
|
||||
## See also
|
||||
|
||||
- [modules/README.md](../../modules/README.md) — L1/L2 distinction, registry format, how to add a module.
|
||||
- [modules/README-TEMPLATE.md](../../modules/README-TEMPLATE.md) — per-module doc template.
|
||||
@@ -1,96 +0,0 @@
|
||||
# Module: `<name>`
|
||||
|
||||
> Copy this template into `modules/l1/<name>/README.md` or
|
||||
> `modules/l2/<name>/README.md` and fill in the placeholders. Sections
|
||||
> marked **DROP** are intentionally omitted from nova modules
|
||||
> (D-029): do **not** add `NFRs` or `Compliance` sections.
|
||||
|
||||
## Overview
|
||||
|
||||
One-paragraph description of what this module provisions, the stack
|
||||
type(s) it exposes, and when to reach for it. Mention whether it is L1
|
||||
(single primitive) or L2 (composition of L1s), and whether it is
|
||||
multi-resource.
|
||||
|
||||
- **Stack type:** `aws:<service>:<resource>`
|
||||
- **Kind:** `l1` (or `l2`)
|
||||
- **Version:** `1.0.0`
|
||||
|
||||
## Resources
|
||||
|
||||
List the concrete cloud resources the Terraform adapter creates. For L1
|
||||
single-resource modules this is one row; for multi-resource L1s mirror
|
||||
the `resources[]` array in `interface.json`.
|
||||
|
||||
| Stack type | Terraform resource | Notes |
|
||||
|-------------------------|------------------------------------|----------------------------------|
|
||||
| `aws:s3:bucket` | `aws_s3_bucket` | The bucket itself |
|
||||
| `aws:s3:bucket` | `aws_s3_bucket_versioning` | Versioning sibling |
|
||||
| `aws:s3:bucket` | `aws_s3_bucket_server_side_encryption_configuration` | SSE config sibling |
|
||||
|
||||
For L2 modules, list the L1 modules composed via `module` blocks in
|
||||
`terraform/main.tf` instead.
|
||||
|
||||
## Inputs
|
||||
|
||||
Mirror `interface.json` → `inputs`. Mark required inputs with **yes**.
|
||||
|
||||
| Name | Type | Required | Default | Description |
|
||||
|----------------|---------|----------|---------------|-----------------------------------|
|
||||
| `bucket_name` | string | yes | — | Globally-unique S3 bucket name |
|
||||
| `region` | string | yes | — | AWS region |
|
||||
| `kms_key_arn` | string | no | `null` | CMK ARN for SSE-KMS |
|
||||
| `enabled` | boolean | no | `true` | Feature flag |
|
||||
| `tags` | map | no | `{}` | Tags merged with module defaults |
|
||||
|
||||
## Outputs
|
||||
|
||||
Mirror `interface.json` → `outputs`.
|
||||
|
||||
| Name | Type | Description |
|
||||
|---------------------------------|--------|----------------------------------------------|
|
||||
| `bucket_arn` | arn | The S3 bucket ARN |
|
||||
| `bucket_name` | string | The bucket name |
|
||||
| `bucket_regional_domain_name` | string | The bucket regional domain name |
|
||||
|
||||
## Usage
|
||||
|
||||
```hcl
|
||||
module "bucket" {
|
||||
source = "modules/l1/s3/terraform"
|
||||
|
||||
bucket_name = "nova-prod-assets"
|
||||
region = "us-east-1"
|
||||
|
||||
tags = {
|
||||
"nova:owner" = "team-platform"
|
||||
"nova:environment" = "prod"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Or as a flat-stack contract entry:
|
||||
|
||||
```json
|
||||
{
|
||||
"module": "s3",
|
||||
"version": "1.0.0",
|
||||
"inputs": {
|
||||
"bucket_name": "nova-prod-assets",
|
||||
"region": "us-east-1"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Versioning
|
||||
|
||||
This module follows the registry semver contract: bump the patch/minor
|
||||
version in `interface.json` and `modules/registry.json` for any
|
||||
input/output/behavior change. Breaking changes (renamed inputs,
|
||||
removed outputs, changed defaults) require a major bump and a new
|
||||
registry entry; the previous version is marked `deprecated: true` and
|
||||
remains selectable by pinned contracts. See `modules/README.md` for
|
||||
the registry format and the resolver's version-selection rules.
|
||||
|
||||
<!-- DROP: NFRs — out of scope for nova v1 (D-029) -->
|
||||
<!-- DROP: Compliance / attestation — out of scope for nova v1 (D-029) -->
|
||||
@@ -1,127 +0,0 @@
|
||||
# Nova Modules
|
||||
|
||||
Nova ships a two-tier module library. Modules are **engine-agnostic**:
|
||||
their contract is declared in `interface.json` (stack types like
|
||||
`aws:s3:bucket`), and an adapter translates the contract to a concrete
|
||||
IaC engine (Terraform today; Pulumi/CDK possible later). All L1 modules
|
||||
in this repo ship a Terraform adapter under `terraform/`.
|
||||
|
||||
## L1 vs L2
|
||||
|
||||
| Tier | What it is | Composes | Examples |
|
||||
|------|----------------------------------------------------------------------------|---------------------|-----------------------------------|
|
||||
| L1 | A single primitive resource (or tightly-coupled resource group) on a cloud | One stack resource | `s3`, `vpc`, `ecs-cluster`, `alb` |
|
||||
| L2 | A composition of L1s expressing an architectural pattern | Multiple L1 modules | `microservice`, `static-assets` |
|
||||
|
||||
- **L1** = one entry in the flat stack. Even multi-resource L1s (e.g.
|
||||
`vpc`, `ecs-service`, `alb`) emit a single stack entry; their
|
||||
`interface.json` lists the child resources in a `resources[]` array
|
||||
for documentation, but the resolver does **not** expand them
|
||||
(D-012).
|
||||
- **L2** = also one opaque entry in the flat stack. The L2's
|
||||
`terraform/main.tf` composes L1 modules internally via `module` blocks
|
||||
(D-012). The L2 exposes its own L2-level `inputs`/`outputs`; children
|
||||
and wiring live in terraform, not in the interface.
|
||||
|
||||
## Registry format
|
||||
|
||||
`modules/registry.json` maps `module_name -> version -> entry`:
|
||||
|
||||
```json
|
||||
{
|
||||
"s3": {
|
||||
"1.0.0": {
|
||||
"interface": "modules/l1/s3/interface.json",
|
||||
"terraform_dir": "modules/l1/s3/terraform",
|
||||
"published_at": "2026-08-20T00:00:00Z",
|
||||
"deprecated": false,
|
||||
"kind": "l1"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
- `interface` — path to the `interface.json` declaring the contract.
|
||||
- `terraform_dir` — path to the adapter's Terraform module directory
|
||||
(the flat stack's `source` field).
|
||||
- `kind` — `"l1"` or `"l2"`.
|
||||
- `deprecated` — when `true`, the resolver warns and selects the latest
|
||||
non-deprecated version unless the caller pins a version.
|
||||
|
||||
## interface.json shape (D-014)
|
||||
|
||||
```json
|
||||
{
|
||||
"name": "s3",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:s3:bucket",
|
||||
"description": "...",
|
||||
"inputs": { "<name>": { "type": "...", "required": true, "description": "..." } },
|
||||
"outputs": { "<name>": { "type": "...", "description": "..." } },
|
||||
"resources": [ { "type": "aws:ec2:vpc", "inputs": [...], "outputs": [...] } ]
|
||||
}
|
||||
```
|
||||
|
||||
- `type` is **stack-typed** — `aws:<service>:<resource>` (e.g.
|
||||
`aws:s3:bucket`), **not** the Terraform resource name
|
||||
(`aws_s3_bucket`). The adapter performs the translation.
|
||||
- `resources[]` is present only on multi-resource L1s (`vpc`,
|
||||
`ecs-service`, `alb`); it documents the child stack types but does not
|
||||
drive resolution.
|
||||
- **Dropped** per D-014: `nfrs` (confidence signal, out of scope) and
|
||||
`intra_refs` (wire engine, eliminated by D-012). Do not re-add them.
|
||||
|
||||
## Conventions shared by all L1 Terraform adapters
|
||||
|
||||
- `terraform/versions.tf` pins `required_version = ">= 1.9, < 1.10"` and
|
||||
`aws ~> 5.0`.
|
||||
- Every resource is guarded by `count = var.enabled ? 1 : 0`; the
|
||||
`enabled` input defaults to `true`.
|
||||
- `locals.tf` merges module-default tags with caller-supplied `var.tags`:
|
||||
```hcl
|
||||
tags = merge({ "nova:owner" = "nova", "nova:environment" = "dev" }, var.tags)
|
||||
```
|
||||
- Every `interface.json` input has a matching `variable` block; every
|
||||
output has a matching `output` block. Outputs return `null` (or `[]`)
|
||||
when `enabled = false`.
|
||||
|
||||
## How to add a module
|
||||
|
||||
1. Pick the tier. New primitive → L1. New pattern composing existing
|
||||
L1s → L2.
|
||||
2. Create `modules/l1/<name>/` (or `modules/l2/<name>/`).
|
||||
3. Author `interface.json` (L1) or `interface.json` + L2 terraform that
|
||||
composes L1s via `module` blocks. Use `modules/README-TEMPLATE.md`
|
||||
as the per-module doc template.
|
||||
4. Author `terraform/{main,variables,outputs,versions,locals}.tf`
|
||||
following the conventions above.
|
||||
5. Add an entry to `modules/registry.json` and a row to the catalog at
|
||||
`docs/modules/index.md`.
|
||||
6. Verify: `python3 -c "import json; json.load(open('modules/l1/<name>/interface.json'))"`
|
||||
and `terraform validate` inside `terraform/`.
|
||||
|
||||
## L1 primitives (13)
|
||||
|
||||
| Module | Stack type | Multi-resource? | Description |
|
||||
|-----------------|-------------------------------|-----------------|----------------------------------------------------------|
|
||||
| `s3` | `aws:s3:bucket` | no | S3 bucket with versioning + SSE-KMS |
|
||||
| `vpc` | `aws:ec2:vpc` | yes | VPC + subnets + route table + IGW |
|
||||
| `ecs-cluster` | `aws:ecs:cluster` | no | ECS cluster |
|
||||
| `ecs-service` | `aws:ecs:service` | yes | ECS task definition + service |
|
||||
| `iam-role` | `aws:iam:role` | no | IAM role with assume-role policy |
|
||||
| `alb` | `aws:alb` | yes | ALB + target group + listener |
|
||||
| `ecr` | `aws:ecr:repository` | no | ECR repository with scan-on-push |
|
||||
| `cloudfront` | `aws:cloudfront:distribution` | no | CloudFront distribution with a single origin |
|
||||
| `waf` | `aws:waf:web_acl` | no | WAFv2 web ACL (regional, default allow) |
|
||||
| `rds` | `aws:rds:instance` | no | RDS Postgres DB instance |
|
||||
| `kms-key` | `aws:kms:key` | no | KMS CMK with alias |
|
||||
| `dynamodb` | `aws:dynamodb:table` | no | DynamoDB table (PAY_PER_REQUEST default) |
|
||||
| `uptime` | `aws:uptime:monitor` | no | Uptime monitor (CloudWatch alarm stand-in) |
|
||||
|
||||
## L2 compositions (2)
|
||||
|
||||
| Module | Composes | Description |
|
||||
|------------------|-------------------------------------------|----------------------------------------------|
|
||||
| `microservice` | vpc + ecs-cluster + ecs-service + iam-role + ecr + alb | Container microservice with public ALB (D-038) |
|
||||
| `static-assets` | s3 + cloudfront + kms-key | Static site fronted by CloudFront (D-038) |
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: alb
|
||||
|
||||
Application Load Balancer primitive (multi-resource: LB + target group + listener; stack type `aws:alb`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,68 +0,0 @@
|
||||
{
|
||||
"name": "alb",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:alb",
|
||||
"description": "Application Load Balancer primitive (multi-resource: LB + target group + listener). Engine-agnostic stack types aws:alb + aws:alb:targetgroup + aws:alb:listener; the Terraform adapter translates to aws_lb/aws_lb_target_group/aws_lb_listener.",
|
||||
"inputs": {
|
||||
"lb_name": {
|
||||
"type": "string",
|
||||
"description": "Name of the load balancer.",
|
||||
"required": true
|
||||
},
|
||||
"subnet_ids": {
|
||||
"type": "list",
|
||||
"description": "List of subnet ids the LB is deployed into.",
|
||||
"required": true
|
||||
},
|
||||
"target_group_port": {
|
||||
"type": "integer",
|
||||
"default": 80,
|
||||
"description": "Port the target group forwards to."
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"lb_arn": {
|
||||
"type": "arn",
|
||||
"description": "The load balancer ARN."
|
||||
},
|
||||
"dns_name": {
|
||||
"type": "string",
|
||||
"description": "The load balancer DNS name."
|
||||
},
|
||||
"target_group_arn": {
|
||||
"type": "arn",
|
||||
"description": "The target group ARN."
|
||||
}
|
||||
},
|
||||
"resources": [
|
||||
{
|
||||
"type": "aws:alb",
|
||||
"description": "The Application Load Balancer.",
|
||||
"inputs": ["lb_name", "subnet_ids"],
|
||||
"outputs": ["lb_arn", "dns_name"]
|
||||
},
|
||||
{
|
||||
"type": "aws:alb:targetgroup",
|
||||
"description": "Target group on the LB port.",
|
||||
"inputs": ["lb_name", "target_group_port"],
|
||||
"outputs": ["target_group_arn"]
|
||||
},
|
||||
{
|
||||
"type": "aws:alb:listener",
|
||||
"description": "Listener forwarding to the target group.",
|
||||
"inputs": ["target_group_port", "target_group_arn"],
|
||||
"outputs": []
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,16 +0,0 @@
|
||||
locals {
|
||||
tags = merge(
|
||||
{
|
||||
"nova:owner" = "nova"
|
||||
"nova:environment" = "dev"
|
||||
},
|
||||
var.tags,
|
||||
)
|
||||
|
||||
# Target group requires a vpc_id. The L1 interface does not expose it as
|
||||
# an input by design (kept minimal per D-014); the caller is expected to
|
||||
# supply subnets in a single VPC. When a vpc_id input is added later, this
|
||||
# local can be removed. For now, null forces the caller to set it via a
|
||||
# provider-level default or an extension.
|
||||
vpc_id = null
|
||||
}
|
||||
@@ -1,36 +0,0 @@
|
||||
resource "aws_lb" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
name = var.lb_name
|
||||
load_balancer_type = "application"
|
||||
subnets = var.subnet_ids
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_lb_target_group" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
name_prefix = "${var.lb_name}-"
|
||||
port = var.target_group_port
|
||||
protocol = "HTTP"
|
||||
target_type = "ip"
|
||||
vpc_id = local.vpc_id
|
||||
|
||||
lifecycle {
|
||||
create_before_destroy = true
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_lb_listener" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
load_balancer_arn = aws_lb.this[0].id
|
||||
port = var.target_group_port
|
||||
protocol = "HTTP"
|
||||
|
||||
default_action {
|
||||
type = "forward"
|
||||
target_group_arn = aws_lb_target_group.this[0].arn
|
||||
}
|
||||
|
||||
depends_on = [aws_lb_target_group.this]
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
output "lb_arn" {
|
||||
value = var.enabled ? aws_lb.this[0].arn : null
|
||||
description = "The load balancer ARN."
|
||||
}
|
||||
|
||||
output "dns_name" {
|
||||
value = var.enabled ? aws_lb.this[0].dns_name : null
|
||||
description = "The load balancer DNS name."
|
||||
}
|
||||
|
||||
output "target_group_arn" {
|
||||
value = var.enabled ? aws_lb_target_group.this[0].arn : null
|
||||
description = "The target group ARN."
|
||||
}
|
||||
@@ -1,27 +0,0 @@
|
||||
variable "lb_name" {
|
||||
type = string
|
||||
description = "Name of the load balancer."
|
||||
}
|
||||
|
||||
variable "subnet_ids" {
|
||||
type = list(string)
|
||||
description = "List of subnet ids the LB is deployed into."
|
||||
}
|
||||
|
||||
variable "target_group_port" {
|
||||
type = number
|
||||
description = "Port the target group forwards to."
|
||||
default = 80
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
type = map(string)
|
||||
description = "Additional tags to merge with the module defaults."
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "enabled" {
|
||||
type = bool
|
||||
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
default = true
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.9, < 1.10"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: cloudfront
|
||||
|
||||
CloudFront distribution primitive (stack type `aws:cloudfront:distribution`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,39 +0,0 @@
|
||||
{
|
||||
"name": "cloudfront",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:cloudfront:distribution",
|
||||
"description": "CloudFront distribution primitive (engine-agnostic stack type aws:cloudfront:distribution; the Terraform adapter translates to aws_cloudfront_distribution).",
|
||||
"inputs": {
|
||||
"distribution_name": {
|
||||
"type": "string",
|
||||
"description": "Name (comment) of the CloudFront distribution.",
|
||||
"required": true
|
||||
},
|
||||
"origin_domain": {
|
||||
"type": "string",
|
||||
"description": "Domain name of the origin (e.g. an S3 bucket regional domain or ALB DNS).",
|
||||
"required": true
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"distribution_arn": {
|
||||
"type": "arn",
|
||||
"description": "The CloudFront distribution ARN."
|
||||
},
|
||||
"domain_name": {
|
||||
"type": "string",
|
||||
"description": "The CloudFront distribution domain name."
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,11 +0,0 @@
|
||||
locals {
|
||||
tags = merge(
|
||||
{
|
||||
"nova:owner" = "nova"
|
||||
"nova:environment" = "dev"
|
||||
},
|
||||
var.tags,
|
||||
)
|
||||
|
||||
origin_id = "${var.distribution_name}-origin"
|
||||
}
|
||||
@@ -1,41 +0,0 @@
|
||||
resource "aws_cloudfront_distribution" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
comment = var.distribution_name
|
||||
enabled = true
|
||||
price_class = "PriceClass_100"
|
||||
tags = local.tags
|
||||
|
||||
origin {
|
||||
domain_name = var.origin_domain
|
||||
origin_id = local.origin_id
|
||||
}
|
||||
|
||||
default_cache_behavior {
|
||||
allowed_methods = ["GET", "HEAD", "OPTIONS"]
|
||||
cached_methods = ["GET", "HEAD"]
|
||||
target_origin_id = local.origin_id
|
||||
|
||||
forwarded_values {
|
||||
query_string = false
|
||||
|
||||
cookies {
|
||||
forward = "none"
|
||||
}
|
||||
}
|
||||
|
||||
viewer_protocol_policy = "redirect-to-https"
|
||||
min_ttl = 0
|
||||
default_ttl = 3600
|
||||
max_ttl = 86400
|
||||
}
|
||||
|
||||
restrictions {
|
||||
geo_restriction {
|
||||
restriction_type = "none"
|
||||
}
|
||||
}
|
||||
|
||||
viewer_certificate {
|
||||
cloudfront_default_certificate = true
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
output "distribution_arn" {
|
||||
value = var.enabled ? aws_cloudfront_distribution.this[0].arn : null
|
||||
description = "The CloudFront distribution ARN."
|
||||
}
|
||||
|
||||
output "domain_name" {
|
||||
value = var.enabled ? aws_cloudfront_distribution.this[0].domain_name : null
|
||||
description = "The CloudFront distribution domain name."
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
variable "distribution_name" {
|
||||
type = string
|
||||
description = "Name (comment) of the CloudFront distribution."
|
||||
}
|
||||
|
||||
variable "origin_domain" {
|
||||
type = string
|
||||
description = "Domain name of the origin (e.g. an S3 bucket regional domain or ALB DNS)."
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
type = map(string)
|
||||
description = "Additional tags to merge with the module defaults."
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "enabled" {
|
||||
type = bool
|
||||
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
default = true
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.9, < 1.10"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: dynamodb
|
||||
|
||||
DynamoDB table primitive (stack type `aws:dynamodb:table`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,44 +0,0 @@
|
||||
{
|
||||
"name": "dynamodb",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:dynamodb:table",
|
||||
"description": "DynamoDB table primitive (engine-agnostic stack type aws:dynamodb:table; the Terraform adapter translates to aws_dynamodb_table).",
|
||||
"inputs": {
|
||||
"table_name": {
|
||||
"type": "string",
|
||||
"description": "Name of the DynamoDB table.",
|
||||
"required": true
|
||||
},
|
||||
"hash_key": {
|
||||
"type": "string",
|
||||
"description": "Name of the partition (hash) key.",
|
||||
"required": true
|
||||
},
|
||||
"billing_mode": {
|
||||
"type": "string",
|
||||
"default": "PAY_PER_REQUEST",
|
||||
"description": "Billing mode: PAY_PER_REQUEST or PROVISIONED."
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"table_arn": {
|
||||
"type": "arn",
|
||||
"description": "The DynamoDB table ARN."
|
||||
},
|
||||
"table_name": {
|
||||
"type": "string",
|
||||
"description": "The DynamoDB table name (echoes the input)."
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
locals {
|
||||
tags = merge(
|
||||
{
|
||||
"nova:owner" = "nova"
|
||||
"nova:environment" = "dev"
|
||||
},
|
||||
var.tags,
|
||||
)
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
resource "aws_dynamodb_table" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
name = var.table_name
|
||||
billing_mode = var.billing_mode
|
||||
hash_key = var.hash_key
|
||||
tags = local.tags
|
||||
|
||||
attribute {
|
||||
name = var.hash_key
|
||||
type = "S"
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
output "table_arn" {
|
||||
value = var.enabled ? aws_dynamodb_table.this[0].arn : null
|
||||
description = "The DynamoDB table ARN."
|
||||
}
|
||||
|
||||
output "table_name" {
|
||||
value = var.enabled ? aws_dynamodb_table.this[0].name : null
|
||||
description = "The DynamoDB table name (echoes the input)."
|
||||
}
|
||||
@@ -1,27 +0,0 @@
|
||||
variable "table_name" {
|
||||
type = string
|
||||
description = "Name of the DynamoDB table."
|
||||
}
|
||||
|
||||
variable "hash_key" {
|
||||
type = string
|
||||
description = "Name of the partition (hash) key."
|
||||
}
|
||||
|
||||
variable "billing_mode" {
|
||||
type = string
|
||||
description = "Billing mode: PAY_PER_REQUEST or PROVISIONED."
|
||||
default = "PAY_PER_REQUEST"
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
type = map(string)
|
||||
description = "Additional tags to merge with the module defaults."
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "enabled" {
|
||||
type = bool
|
||||
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
default = true
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.9, < 1.10"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: ecr
|
||||
|
||||
ECR repository primitive (stack type `aws:ecr:repository`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,34 +0,0 @@
|
||||
{
|
||||
"name": "ecr",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:ecr:repository",
|
||||
"description": "ECR repository primitive (engine-agnostic stack type aws:ecr:repository; the Terraform adapter translates to aws_ecr_repository).",
|
||||
"inputs": {
|
||||
"repository_name": {
|
||||
"type": "string",
|
||||
"description": "Name of the ECR repository.",
|
||||
"required": true
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"repository_url": {
|
||||
"type": "string",
|
||||
"description": "The ECR repository URL."
|
||||
},
|
||||
"repository_arn": {
|
||||
"type": "arn",
|
||||
"description": "The ECR repository ARN."
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
locals {
|
||||
tags = merge(
|
||||
{
|
||||
"nova:owner" = "nova"
|
||||
"nova:environment" = "dev"
|
||||
},
|
||||
var.tags,
|
||||
)
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
resource "aws_ecr_repository" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
name = var.repository_name
|
||||
image_tag_mutability = "MUTABLE"
|
||||
tags = local.tags
|
||||
|
||||
image_scanning_configuration {
|
||||
scan_on_push = true
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
output "repository_url" {
|
||||
value = var.enabled ? aws_ecr_repository.this[0].repository_url : null
|
||||
description = "The ECR repository URL."
|
||||
}
|
||||
|
||||
output "repository_arn" {
|
||||
value = var.enabled ? aws_ecr_repository.this[0].arn : null
|
||||
description = "The ECR repository ARN."
|
||||
}
|
||||
@@ -1,16 +0,0 @@
|
||||
variable "repository_name" {
|
||||
type = string
|
||||
description = "Name of the ECR repository."
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
type = map(string)
|
||||
description = "Additional tags to merge with the module defaults."
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "enabled" {
|
||||
type = bool
|
||||
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
default = true
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.9, < 1.10"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: ecs-cluster
|
||||
|
||||
ECS cluster primitive (stack type `aws:ecs:cluster`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,34 +0,0 @@
|
||||
{
|
||||
"name": "ecs-cluster",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:ecs:cluster",
|
||||
"description": "ECS cluster primitive (engine-agnostic stack type aws:ecs:cluster; the Terraform adapter translates to aws_ecs_cluster).",
|
||||
"inputs": {
|
||||
"cluster_name": {
|
||||
"type": "string",
|
||||
"description": "Name of the ECS cluster.",
|
||||
"required": true
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"cluster_arn": {
|
||||
"type": "arn",
|
||||
"description": "The ECS cluster ARN."
|
||||
},
|
||||
"cluster_name": {
|
||||
"type": "string",
|
||||
"description": "The ECS cluster name (echoes the input)."
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
locals {
|
||||
tags = merge(
|
||||
{
|
||||
"nova:owner" = "nova"
|
||||
"nova:environment" = "dev"
|
||||
},
|
||||
var.tags,
|
||||
)
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
resource "aws_ecs_cluster" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
name = var.cluster_name
|
||||
tags = local.tags
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
output "cluster_arn" {
|
||||
value = var.enabled ? aws_ecs_cluster.this[0].arn : null
|
||||
description = "The ECS cluster ARN."
|
||||
}
|
||||
|
||||
output "cluster_name" {
|
||||
value = var.enabled ? aws_ecs_cluster.this[0].name : null
|
||||
description = "The ECS cluster name (echoes the input)."
|
||||
}
|
||||
@@ -1,16 +0,0 @@
|
||||
variable "cluster_name" {
|
||||
type = string
|
||||
description = "Name of the ECS cluster."
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
type = map(string)
|
||||
description = "Additional tags to merge with the module defaults."
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "enabled" {
|
||||
type = bool
|
||||
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
default = true
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.9, < 1.10"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: ecs-service
|
||||
|
||||
ECS service primitive (multi-resource: task definition + service; stack type `aws:ecs:service`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,63 +0,0 @@
|
||||
{
|
||||
"name": "ecs-service",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:ecs:service",
|
||||
"description": "ECS service primitive (multi-resource: task definition + service). Engine-agnostic stack types aws:ecs:taskdef + aws:ecs:service; the Terraform adapter translates to aws_ecs_task_definition/aws_ecs_service.",
|
||||
"inputs": {
|
||||
"service_name": {
|
||||
"type": "string",
|
||||
"description": "Name of the ECS service (also used as the task definition family).",
|
||||
"required": true
|
||||
},
|
||||
"cluster_arn": {
|
||||
"type": "arn",
|
||||
"description": "ARN of the ECS cluster the service runs in.",
|
||||
"required": true
|
||||
},
|
||||
"task_definition": {
|
||||
"type": "string",
|
||||
"description": "Task definition ARN or family:revision to run. If supplied as a path/string JSON, the module creates an aws_ecs_task_definition.",
|
||||
"required": true
|
||||
},
|
||||
"desired_count": {
|
||||
"type": "integer",
|
||||
"default": 1,
|
||||
"description": "Number of tasks to run."
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"service_arn": {
|
||||
"type": "arn",
|
||||
"description": "The ECS service ARN."
|
||||
},
|
||||
"service_name": {
|
||||
"type": "string",
|
||||
"description": "The ECS service name (echoes the input)."
|
||||
}
|
||||
},
|
||||
"resources": [
|
||||
{
|
||||
"type": "aws:ecs:taskdef",
|
||||
"description": "The ECS task definition (registered from task_definition input).",
|
||||
"inputs": ["service_name", "task_definition"],
|
||||
"outputs": []
|
||||
},
|
||||
{
|
||||
"type": "aws:ecs:service",
|
||||
"description": "The ECS service running the task definition on the cluster.",
|
||||
"inputs": ["service_name", "cluster_arn", "desired_count"],
|
||||
"outputs": ["service_arn", "service_name"]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
locals {
|
||||
tags = merge(
|
||||
{
|
||||
"nova:owner" = "nova"
|
||||
"nova:environment" = "dev"
|
||||
},
|
||||
var.tags,
|
||||
)
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
resource "aws_ecs_task_definition" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
family = var.service_name
|
||||
container_definitions = var.task_definition
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_ecs_service" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
name = var.service_name
|
||||
cluster = var.cluster_arn
|
||||
task_definition = aws_ecs_task_definition.this[0].arn
|
||||
desired_count = var.desired_count
|
||||
tags = local.tags
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
output "service_arn" {
|
||||
value = var.enabled ? aws_ecs_service.this[0].id : null
|
||||
description = "The ECS service ARN."
|
||||
}
|
||||
|
||||
output "service_name" {
|
||||
value = var.enabled ? aws_ecs_service.this[0].name : null
|
||||
description = "The ECS service name (echoes the input)."
|
||||
}
|
||||
@@ -1,32 +0,0 @@
|
||||
variable "service_name" {
|
||||
type = string
|
||||
description = "Name of the ECS service (also used as the task definition family)."
|
||||
}
|
||||
|
||||
variable "cluster_arn" {
|
||||
type = string
|
||||
description = "ARN of the ECS cluster the service runs in."
|
||||
}
|
||||
|
||||
variable "task_definition" {
|
||||
type = string
|
||||
description = "Task definition JSON string (container definitions). The module registers an aws_ecs_task_definition with family = service_name."
|
||||
}
|
||||
|
||||
variable "desired_count" {
|
||||
type = number
|
||||
description = "Number of tasks to run."
|
||||
default = 1
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
type = map(string)
|
||||
description = "Additional tags to merge with the module defaults."
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "enabled" {
|
||||
type = bool
|
||||
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
default = true
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.9, < 1.10"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: iam-role
|
||||
|
||||
IAM role primitive (stack type `aws:iam:role`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,39 +0,0 @@
|
||||
{
|
||||
"name": "iam-role",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:iam:role",
|
||||
"description": "IAM role primitive (engine-agnostic stack type aws:iam:role; the Terraform adapter translates to aws_iam_role).",
|
||||
"inputs": {
|
||||
"role_name": {
|
||||
"type": "string",
|
||||
"description": "Name of the IAM role.",
|
||||
"required": true
|
||||
},
|
||||
"policy_document": {
|
||||
"type": "string",
|
||||
"description": "Assume-role policy document JSON string.",
|
||||
"required": true
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"role_arn": {
|
||||
"type": "arn",
|
||||
"description": "The IAM role ARN."
|
||||
},
|
||||
"role_name": {
|
||||
"type": "string",
|
||||
"description": "The IAM role name (echoes the input)."
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
locals {
|
||||
tags = merge(
|
||||
{
|
||||
"nova:owner" = "nova"
|
||||
"nova:environment" = "dev"
|
||||
},
|
||||
var.tags,
|
||||
)
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
resource "aws_iam_role" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
name = var.role_name
|
||||
assume_role_policy = var.policy_document
|
||||
tags = local.tags
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
output "role_arn" {
|
||||
value = var.enabled ? aws_iam_role.this[0].arn : null
|
||||
description = "The IAM role ARN."
|
||||
}
|
||||
|
||||
output "role_name" {
|
||||
value = var.enabled ? aws_iam_role.this[0].name : null
|
||||
description = "The IAM role name (echoes the input)."
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
variable "role_name" {
|
||||
type = string
|
||||
description = "Name of the IAM role."
|
||||
}
|
||||
|
||||
variable "policy_document" {
|
||||
type = string
|
||||
description = "Assume-role policy document JSON string."
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
type = map(string)
|
||||
description = "Additional tags to merge with the module defaults."
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "enabled" {
|
||||
type = bool
|
||||
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
default = true
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.9, < 1.10"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: kms-key
|
||||
|
||||
KMS customer master key primitive (stack type `aws:kms:key`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,34 +0,0 @@
|
||||
{
|
||||
"name": "kms-key",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:kms:key",
|
||||
"description": "KMS customer master key primitive (engine-agnostic stack type aws:kms:key; the Terraform adapter translates to aws_kms_key).",
|
||||
"inputs": {
|
||||
"key_name": {
|
||||
"type": "string",
|
||||
"description": "Name (alias) of the KMS key.",
|
||||
"required": true
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"key_arn": {
|
||||
"type": "arn",
|
||||
"description": "The KMS key ARN."
|
||||
},
|
||||
"key_id": {
|
||||
"type": "string",
|
||||
"description": "The KMS key id."
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
locals {
|
||||
tags = merge(
|
||||
{
|
||||
"nova:owner" = "nova"
|
||||
"nova:environment" = "dev"
|
||||
},
|
||||
var.tags,
|
||||
)
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
resource "aws_kms_key" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
description = "KMS key managed by nova L1 kms-key primitive."
|
||||
deletion_window_in_days = 30
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_kms_alias" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
name = "alias/${var.key_name}"
|
||||
target_key_id = aws_kms_key.this[0].key_id
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
output "key_arn" {
|
||||
value = var.enabled ? aws_kms_key.this[0].arn : null
|
||||
description = "The KMS key ARN."
|
||||
}
|
||||
|
||||
output "key_id" {
|
||||
value = var.enabled ? aws_kms_key.this[0].key_id : null
|
||||
description = "The KMS key id."
|
||||
}
|
||||
@@ -1,16 +0,0 @@
|
||||
variable "key_name" {
|
||||
type = string
|
||||
description = "Name (alias) of the KMS key."
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
type = map(string)
|
||||
description = "Additional tags to merge with the module defaults."
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "enabled" {
|
||||
type = bool
|
||||
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
default = true
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.9, < 1.10"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: rds
|
||||
|
||||
RDS DB instance primitive (stack type `aws:rds:instance`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,44 +0,0 @@
|
||||
{
|
||||
"name": "rds",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:rds:instance",
|
||||
"description": "RDS DB instance primitive (engine-agnostic stack type aws:rds:instance; the Terraform adapter translates to aws_db_instance).",
|
||||
"inputs": {
|
||||
"instance_name": {
|
||||
"type": "string",
|
||||
"description": "Name (identifier) of the RDS DB instance.",
|
||||
"required": true
|
||||
},
|
||||
"instance_class": {
|
||||
"type": "string",
|
||||
"default": "db.t3.micro",
|
||||
"description": "DB instance class."
|
||||
},
|
||||
"allocated_storage": {
|
||||
"type": "integer",
|
||||
"default": 20,
|
||||
"description": "Allocated storage in GiB."
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"instance_endpoint": {
|
||||
"type": "string",
|
||||
"description": "The RDS DB instance endpoint (host:port)."
|
||||
},
|
||||
"instance_arn": {
|
||||
"type": "arn",
|
||||
"description": "The RDS DB instance ARN."
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
locals {
|
||||
tags = merge(
|
||||
{
|
||||
"nova:owner" = "nova"
|
||||
"nova:environment" = "dev"
|
||||
},
|
||||
var.tags,
|
||||
)
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
resource "aws_db_instance" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
identifier = var.instance_name
|
||||
instance_class = var.instance_class
|
||||
allocated_storage = var.allocated_storage
|
||||
engine = "postgres"
|
||||
engine_version = "14"
|
||||
username = "nova"
|
||||
password = "changeme-rotate-me"
|
||||
skip_final_snapshot = true
|
||||
tags = local.tags
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
output "instance_endpoint" {
|
||||
value = var.enabled ? aws_db_instance.this[0].endpoint : null
|
||||
description = "The RDS DB instance endpoint (host:port)."
|
||||
}
|
||||
|
||||
output "instance_arn" {
|
||||
value = var.enabled ? aws_db_instance.this[0].arn : null
|
||||
description = "The RDS DB instance ARN."
|
||||
}
|
||||
@@ -1,28 +0,0 @@
|
||||
variable "instance_name" {
|
||||
type = string
|
||||
description = "Name (identifier) of the RDS DB instance."
|
||||
}
|
||||
|
||||
variable "instance_class" {
|
||||
type = string
|
||||
description = "DB instance class."
|
||||
default = "db.t3.micro"
|
||||
}
|
||||
|
||||
variable "allocated_storage" {
|
||||
type = number
|
||||
description = "Allocated storage in GiB."
|
||||
default = 20
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
type = map(string)
|
||||
description = "Additional tags to merge with the module defaults."
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "enabled" {
|
||||
type = bool
|
||||
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
default = true
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.9, < 1.10"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: s3
|
||||
|
||||
S3 bucket primitive (stack type `aws:s3:bucket`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,48 +0,0 @@
|
||||
{
|
||||
"name": "s3",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:s3:bucket",
|
||||
"description": "S3 bucket primitive (engine-agnostic stack type aws:s3:bucket; the Terraform adapter translates to aws_s3_bucket).",
|
||||
"inputs": {
|
||||
"bucket_name": {
|
||||
"type": "string",
|
||||
"description": "Globally-unique S3 bucket name.",
|
||||
"required": true
|
||||
},
|
||||
"region": {
|
||||
"type": "string",
|
||||
"description": "AWS region the bucket is created in (provider-level; not a resource arg).",
|
||||
"required": true
|
||||
},
|
||||
"kms_key_arn": {
|
||||
"type": "string",
|
||||
"description": "ARN of the CMK for SSE-KMS; if absent, uses managed key (SSE-S3).",
|
||||
"required": false
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"bucket_arn": {
|
||||
"type": "arn",
|
||||
"description": "The S3 bucket ARN."
|
||||
},
|
||||
"bucket_name": {
|
||||
"type": "string",
|
||||
"description": "The bucket name (echoes the input)."
|
||||
},
|
||||
"bucket_regional_domain_name": {
|
||||
"type": "string",
|
||||
"description": "The bucket regional domain name (e.g. nova-bucket.s3.us-east-1.amazonaws.com)."
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
locals {
|
||||
# SSE algorithm: KMS when a CMK ARN is supplied, else AES256 (SSE-S3).
|
||||
sse_algorithm = var.kms_key_arn != null ? "aws:kms" : "AES256"
|
||||
|
||||
# Tags: merge caller-supplied tags with the module defaults.
|
||||
tags = merge(
|
||||
{
|
||||
"nova:owner" = "nova"
|
||||
"nova:environment" = "dev"
|
||||
},
|
||||
var.tags,
|
||||
)
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
resource "aws_s3_bucket" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
bucket = var.bucket_name
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_s3_bucket_versioning" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
bucket = aws_s3_bucket.this[0].id
|
||||
|
||||
versioning_configuration {
|
||||
status = "Enabled"
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
bucket = aws_s3_bucket.this[0].id
|
||||
|
||||
rule {
|
||||
apply_server_side_encryption_by_default {
|
||||
sse_algorithm = local.sse_algorithm
|
||||
kms_master_key_id = var.kms_key_arn
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
output "bucket_arn" {
|
||||
value = var.enabled ? aws_s3_bucket.this[0].arn : null
|
||||
description = "The S3 bucket ARN."
|
||||
}
|
||||
|
||||
output "bucket_name" {
|
||||
value = var.enabled ? aws_s3_bucket.this[0].id : null
|
||||
description = "The bucket name (echoes the input)."
|
||||
}
|
||||
|
||||
output "bucket_regional_domain_name" {
|
||||
value = var.enabled ? aws_s3_bucket.this[0].bucket_regional_domain_name : null
|
||||
description = "The bucket regional domain name (e.g. nova-bucket.s3.us-east-1.amazonaws.com)."
|
||||
}
|
||||
@@ -1,28 +0,0 @@
|
||||
variable "bucket_name" {
|
||||
type = string
|
||||
description = "Globally-unique S3 bucket name."
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
type = string
|
||||
description = "AWS region the bucket is created in (provider-level; not a resource arg)."
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "kms_key_arn" {
|
||||
type = string
|
||||
description = "ARN of the CMK for SSE-KMS; if absent, uses managed key (SSE-S3)."
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
type = map(string)
|
||||
description = "Additional tags to merge with the module defaults."
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "enabled" {
|
||||
type = bool
|
||||
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
default = true
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.9, < 1.10"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: uptime
|
||||
|
||||
Uptime monitor primitive (simplified stand-in: a CloudWatch alarm; stack type `aws:uptime:monitor`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,35 +0,0 @@
|
||||
{
|
||||
"name": "uptime",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:uptime:monitor",
|
||||
"description": "Uptime monitor primitive (simplified stand-in: a CloudWatch alarm watching the target resource). Engine-agnostic stack type aws:uptime:monitor; the Terraform adapter translates to aws_cloudwatch_metric_alarm.",
|
||||
"inputs": {
|
||||
"monitor_name": {
|
||||
"type": "string",
|
||||
"description": "Name of the uptime monitor (CloudWatch alarm).",
|
||||
"required": true
|
||||
},
|
||||
"target_arn": {
|
||||
"type": "arn",
|
||||
"description": "ARN of the target resource being monitored.",
|
||||
"required": true
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"monitor_arn": {
|
||||
"type": "arn",
|
||||
"description": "The CloudWatch alarm ARN (stand-in for the monitor ARN)."
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
locals {
|
||||
tags = merge(
|
||||
{
|
||||
"nova:owner" = "nova"
|
||||
"nova:environment" = "dev"
|
||||
},
|
||||
var.tags,
|
||||
)
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
# Uptime monitor stand-in: a CloudWatch metric alarm referencing the
|
||||
# target resource ARN via dimensions. A future revision may swap this
|
||||
# for a Route 53 health check or CloudWatch composite alarm.
|
||||
resource "aws_cloudwatch_metric_alarm" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
alarm_name = var.monitor_name
|
||||
comparison_operator = "LessThanThreshold"
|
||||
evaluation_periods = 2
|
||||
metric_name = "RequestCount"
|
||||
namespace = "AWS/ApplicationELB"
|
||||
period = 60
|
||||
statistic = "Sum"
|
||||
threshold = 1
|
||||
alarm_description = "Uptime monitor (CloudWatch alarm stand-in) for target ${var.target_arn}."
|
||||
|
||||
dimensions = {
|
||||
LoadBalancer = var.target_arn
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
output "monitor_arn" {
|
||||
value = var.enabled ? aws_cloudwatch_metric_alarm.this[0].arn : null
|
||||
description = "The CloudWatch alarm ARN (stand-in for the monitor ARN)."
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
variable "monitor_name" {
|
||||
type = string
|
||||
description = "Name of the uptime monitor (CloudWatch alarm)."
|
||||
}
|
||||
|
||||
variable "target_arn" {
|
||||
type = string
|
||||
description = "ARN of the target resource being monitored."
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
type = map(string)
|
||||
description = "Additional tags to merge with the module defaults."
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "enabled" {
|
||||
type = bool
|
||||
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
default = true
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.9, < 1.10"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: vpc
|
||||
|
||||
VPC primitive (multi-resource: VPC + subnets + route table + IGW; stack type `aws:ec2:vpc`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,69 +0,0 @@
|
||||
{
|
||||
"name": "vpc",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:ec2:vpc",
|
||||
"description": "VPC primitive (multi-resource: VPC + subnets + route table + internet gateway). Engine-agnostic stack types aws:ec2:vpc + aws:ec2:subnet + aws:ec2:routetable + aws:ec2:igw; the Terraform adapter translates to aws_vpc/aws_subnet/aws_route_table/aws_internet_gateway.",
|
||||
"inputs": {
|
||||
"cidr": {
|
||||
"type": "string",
|
||||
"description": "VPC CIDR block, e.g. 10.0.0.0/16.",
|
||||
"required": true
|
||||
},
|
||||
"azs": {
|
||||
"type": "list",
|
||||
"description": "List of availability zones, e.g. [\"us-east-1a\", \"us-east-1b\"]. One subnet is created per AZ.",
|
||||
"required": true
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"vpc_id": {
|
||||
"type": "string",
|
||||
"description": "The VPC id."
|
||||
},
|
||||
"subnet_ids": {
|
||||
"type": "list",
|
||||
"description": "List of subnet ids (one per AZ)."
|
||||
},
|
||||
"igw_id": {
|
||||
"type": "string",
|
||||
"description": "The internet gateway id."
|
||||
}
|
||||
},
|
||||
"resources": [
|
||||
{
|
||||
"type": "aws:ec2:vpc",
|
||||
"description": "The VPC itself.",
|
||||
"inputs": ["cidr"],
|
||||
"outputs": ["vpc_id"]
|
||||
},
|
||||
{
|
||||
"type": "aws:ec2:subnet",
|
||||
"description": "One subnet per availability zone (azs).",
|
||||
"inputs": ["cidr", "az", "vpc_id"],
|
||||
"outputs": ["subnet_ids"]
|
||||
},
|
||||
{
|
||||
"type": "aws:ec2:routetable",
|
||||
"description": "Route table bound to the VPC with a default route via the IGW.",
|
||||
"inputs": ["vpc_id"],
|
||||
"outputs": []
|
||||
},
|
||||
{
|
||||
"type": "aws:ec2:igw",
|
||||
"description": "Internet gateway attached to the VPC.",
|
||||
"inputs": ["vpc_id"],
|
||||
"outputs": ["igw_id"]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,16 +0,0 @@
|
||||
locals {
|
||||
# Tags: merge caller-supplied tags with the module defaults.
|
||||
tags = merge(
|
||||
{
|
||||
"nova:owner" = "nova"
|
||||
"nova:environment" = "dev"
|
||||
},
|
||||
var.tags,
|
||||
)
|
||||
|
||||
# Derive /24 subnet CIDRs from the VPC /16 by slicing the 3rd octet.
|
||||
# Works for /16 VPC CIDRs; for other sizes the caller should pass
|
||||
# pre-computed subnet CIDRs (future input).
|
||||
vpc_octets = split(".", cidrhost(var.cidr, 0))
|
||||
subnet_cidrs = [for i in range(length(var.azs)) : "${local.vpc_octets[0]}.${local.vpc_octets[1]}.${i}.0/24"]
|
||||
}
|
||||
@@ -1,57 +0,0 @@
|
||||
resource "aws_vpc" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
cidr_block = var.cidr
|
||||
tags = merge(
|
||||
{
|
||||
Name = "nova-vpc"
|
||||
},
|
||||
local.tags,
|
||||
)
|
||||
}
|
||||
|
||||
resource "aws_subnet" "this" {
|
||||
count = var.enabled ? length(var.azs) : 0
|
||||
vpc_id = aws_vpc.this[0].id
|
||||
cidr_block = local.subnet_cidrs[count.index]
|
||||
availability_zone = var.azs[count.index]
|
||||
tags = merge(
|
||||
{
|
||||
Name = "nova-subnet-${count.index}"
|
||||
},
|
||||
local.tags,
|
||||
)
|
||||
}
|
||||
|
||||
resource "aws_internet_gateway" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
vpc_id = aws_vpc.this[0].id
|
||||
tags = merge(
|
||||
{
|
||||
Name = "nova-igw"
|
||||
},
|
||||
local.tags,
|
||||
)
|
||||
}
|
||||
|
||||
resource "aws_route_table" "this" {
|
||||
count = var.enabled ? 1 : 0
|
||||
vpc_id = aws_vpc.this[0].id
|
||||
|
||||
route {
|
||||
cidr_block = "0.0.0.0/0"
|
||||
gateway_id = aws_internet_gateway.this[0].id
|
||||
}
|
||||
|
||||
tags = merge(
|
||||
{
|
||||
Name = "nova-rt"
|
||||
},
|
||||
local.tags,
|
||||
)
|
||||
}
|
||||
|
||||
resource "aws_route_table_association" "this" {
|
||||
count = var.enabled ? length(var.azs) : 0
|
||||
subnet_id = aws_subnet.this[count.index].id
|
||||
route_table_id = aws_route_table.this[0].id
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
output "vpc_id" {
|
||||
value = var.enabled ? aws_vpc.this[0].id : null
|
||||
description = "The VPC id."
|
||||
}
|
||||
|
||||
output "subnet_ids" {
|
||||
value = var.enabled ? aws_subnet.this[*].id : []
|
||||
description = "List of subnet ids (one per AZ)."
|
||||
}
|
||||
|
||||
output "igw_id" {
|
||||
value = var.enabled ? aws_internet_gateway.this[0].id : null
|
||||
description = "The internet gateway id."
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
variable "cidr" {
|
||||
type = string
|
||||
description = "VPC CIDR block, e.g. 10.0.0.0/16."
|
||||
}
|
||||
|
||||
variable "azs" {
|
||||
type = list(string)
|
||||
description = "List of availability zones, e.g. [\"us-east-1a\", \"us-east-1b\"]. One subnet is created per AZ."
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
type = map(string)
|
||||
description = "Additional tags to merge with the module defaults."
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "enabled" {
|
||||
type = bool
|
||||
description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
default = true
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
terraform {
|
||||
required_version = ">= 1.9, < 1.10"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
# L1: waf
|
||||
|
||||
WAFv2 web ACL primitive (stack type `aws:waf:web_acl`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
|
||||
@@ -1,34 +0,0 @@
|
||||
{
|
||||
"name": "waf",
|
||||
"version": "1.0.0",
|
||||
"kind": "l1",
|
||||
"type": "aws:waf:web_acl",
|
||||
"description": "WAFv2 web ACL primitive (engine-agnostic stack type aws:waf:web_acl; the Terraform adapter translates to aws_wafv2_web_acl).",
|
||||
"inputs": {
|
||||
"acl_name": {
|
||||
"type": "string",
|
||||
"description": "Name of the WAF web ACL.",
|
||||
"required": true
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
|
||||
},
|
||||
"tags": {
|
||||
"type": "map",
|
||||
"default": {},
|
||||
"description": "Additional tags to merge with the module defaults."
|
||||
}
|
||||
},
|
||||
"outputs": {
|
||||
"acl_arn": {
|
||||
"type": "arn",
|
||||
"description": "The WAF web ACL ARN."
|
||||
},
|
||||
"acl_id": {
|
||||
"type": "string",
|
||||
"description": "The WAF web ACL id."
|
||||
}
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user