From d20e1174d62c11643a2f135559285b7b32a622a8 Mon Sep 17 00:00:00 2001
From: Kevin Codex <kevin@gitlawb.com>
Date: Wed, 1 Jul 2026 09:04:47 +0800
Subject: [PATCH] chore(aws): codify iCaptcha enforce in the EC2 node Terraform
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The AWS EC2 node (manila) was upgraded to v0.4.0 and enabled iCaptcha
enforce by hand-editing its running /opt/gitlawb/compose.yaml — which would
be lost on instance replacement or a user-data re-run. Codify it so rebuilds
stay enforced:

- variables.tf: add icaptcha_mode (default "enforce"), icaptcha_pubkey
  (default the pinned live icaptcha.gitlawb.com Ed25519 key), and
  icaptcha_required_level (default 3).
- main.tf: pass the three vars into the compose templatefile render.
- compose.yaml.tftpl: set ICAPTCHA_MODE / ICAPTCHA_PUBKEY /
  ICAPTCHA_REQUIRED_LEVEL on the node service environment.

Operators can override per-deployment via terraform.tfvars.
---
 infra/aws/compose.yaml.tftpl |  4 ++++
 infra/aws/main.tf            | 23 +++++++++++++----------
 infra/aws/variables.tf       | 22 ++++++++++++++++++++++
 3 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/infra/aws/compose.yaml.tftpl b/infra/aws/compose.yaml.tftpl
index c18d1e6a..ad4123de 100644
--- a/infra/aws/compose.yaml.tftpl
+++ b/infra/aws/compose.yaml.tftpl
@@ -58,6 +58,10 @@ services:
       GITLAWB_P2P_PORT: "${p2p_port}"
       GITLAWB_REPOS_DIR: /data/repos
       GITLAWB_KEY: /data/keys/identity.pem
+      # iCaptcha proof-of-intelligence gate (spam protection on create/fork/register)
+      ICAPTCHA_MODE: ${icaptcha_mode}
+      ICAPTCHA_PUBKEY: ${icaptcha_pubkey}
+      ICAPTCHA_REQUIRED_LEVEL: "${icaptcha_required_level}"
       GITLAWB_PUBLIC_URL: $${GITLAWB_PUBLIC_URL}
       GITLAWB_BOOTSTRAP_PEERS: $${GITLAWB_BOOTSTRAP_PEERS}
       GITLAWB_AUTO_SYNC: $${GITLAWB_AUTO_SYNC}
diff --git a/infra/aws/main.tf b/infra/aws/main.tf
index b6413f92..1316d36b 100644
--- a/infra/aws/main.tf
+++ b/infra/aws/main.tf
@@ -290,16 +290,19 @@ locals {
   )
 
   compose_yaml = templatefile("${path.module}/compose.yaml.tftpl", {
-    image_repo     = local.image_repo
-    image_tag      = var.image_tag
-    domain_name    = var.domain_name
-    db_host        = var.use_rds ? aws_db_instance.node[0].address : ""
-    gitlawb_port   = var.gitlawb_port
-    p2p_port       = var.gitlawb_p2p_port
-    metrics_port   = var.metrics_port
-    expose_metrics = local.expose_metrics
-    pg_user        = var.postgres_user
-    pg_db          = var.postgres_db
+    image_repo              = local.image_repo
+    image_tag               = var.image_tag
+    domain_name             = var.domain_name
+    db_host                 = var.use_rds ? aws_db_instance.node[0].address : ""
+    gitlawb_port            = var.gitlawb_port
+    p2p_port                = var.gitlawb_p2p_port
+    metrics_port            = var.metrics_port
+    expose_metrics          = local.expose_metrics
+    pg_user                 = var.postgres_user
+    pg_db                   = var.postgres_db
+    icaptcha_mode           = var.icaptcha_mode
+    icaptcha_pubkey         = var.icaptcha_pubkey
+    icaptcha_required_level = var.icaptcha_required_level
   })
 
   user_data = templatefile("${path.module}/user-data.sh.tftpl", {
diff --git a/infra/aws/variables.tf b/infra/aws/variables.tf
index db944def..c7f2057f 100644
--- a/infra/aws/variables.tf
+++ b/infra/aws/variables.tf
@@ -81,6 +81,28 @@ variable "image_tag" {
   default     = "latest"
 }
 
+# ---------------------------------------------------------------------------
+# iCaptcha proof-of-intelligence gate (spam protection on writes)
+# ---------------------------------------------------------------------------
+
+variable "icaptcha_mode" {
+  description = "iCaptcha gate mode: off | shadow | enforce. The live gitlawb network enforces."
+  type        = string
+  default     = "enforce"
+}
+
+variable "icaptcha_pubkey" {
+  description = "base64url Ed25519 public key of the iCaptcha service, pinned so startup doesn't depend on fetching it. This is the live icaptcha.gitlawb.com key."
+  type        = string
+  default     = "xjyPNqIbvc9U-kwXW6u9mDqRJ7E2UUMOaJdUWhpEXq8"
+}
+
+variable "icaptcha_required_level" {
+  description = "Minimum iCaptcha proof level required to pass the gate."
+  type        = number
+  default     = 3
+}
+
 # ---------------------------------------------------------------------------
 # Networking / ingress
 # ---------------------------------------------------------------------------