Skip to content

Releases

Release 1.0.1

Release 1.0.1 Latest
Latest

Choose a tag to compare

View all tags
@AlexSergey AlexSergey released this 09 Nov 08:33
v1.0.1
1da0923

Fixes

  • Security: clear the 48 Checkov findings CI failed on, covered by new terraform test cases (default security group,
    KMS key policy, force_ssl, assets bucket versioning).
  • S3: deny non-TLS requests to the web client and assets buckets.
  • Client VPN: derive the DNS server from the VPC CIDR, use split tunnel and log connections for 30 days.
  • ECS: stop passing the unused REDIS_ENABLED variable to the backend task.
  • The initial image serves /health/live, so a fresh environment passes the ECS container health check.
  • The app port, VPC CIDR and GitHub owner are variables instead of hard-coded values.

Tooling

  • AWS provider locked to 6.72.0, Terraform 1.17.1 in CI, workflow actions bumped.
  • Git hooks for fmt, validate, commit messages and tests (git config core.hooksPath .githooks).
  • Agent reference docs in docs/, the human guide in guide/.

Apply notes

The next terraform apply updates the Client VPN endpoint in place (clients reconnect), adds the
DenyInsecureTransport bucket policies and registers a new backend task definition revision.

Assets 2
Loading

v1.0.0

v1.0.0

Choose a tag to compare

View all tags
@AlexSergey AlexSergey released this 04 Nov 17:26
v1.0.0
2b2e0c1

First published version of the Prod Forge infrastructure: Terraform for the backend, the frontend and the observability
stack on AWS, laid out as a shared stack module with dev and prod environment roots. There are no earlier tags.

Infrastructure

  • Environments layout: bootstrap for the state backend, a shared stack module and environments/dev and
    environments/prod roots, default tags, S3 lockfile only.
  • RDS PostgreSQL: multi-AZ, encryption, automated backups, deletion protection, custom parameter group.
  • ElastiCache Redis: replication group with automatic failover, TLS, AUTH token and snapshots.
  • ECS: private networking with NAT and VPC endpoints, autoscaling, deployment circuit breaker, container insights,
    every backend config variable passed to the app and migration tasks.
  • Edge: HTTPS with ACM and redirect when a domain is set, WAF, hardened ALB and CloudFront, DNS records.
  • Frontend: S3 buckets for the web client and assets, CloudFront with a security response headers policy that serves
    the full Content Security Policy.
  • Outputs expose the names the backend and frontend deploy workflows need.

Observability

  • Prometheus, Grafana, Loki, Promtail and Tempo provisioned on a hardened SSM-only monitoring host with Cloud Map
    service discovery; alerts, dashboards and Promtail config synced from the backend.
  • CloudWatch alarms, SNS notifications and an account-wide budget owned by prod.

Security

  • CloudTrail, GuardDuty and IAM Access Analyzer baseline.
  • Separate scoped GitHub OIDC roles per repository that trust only the prod environment subject; immutable, scanned
    ECR; SSO-based developer access.
  • Secrets Manager entries ordered before their consumers; TLS-only config bucket policy.

CI

  • terraform fmt, validate, tflint, checkov and a terraform-docs check on pull requests and pushes to main;
    versions aligned with local tooling.

Documentation

  • Infrastructure guide with renumbered chapters, a blue/green design note and a mixed-content caveat for the
    no-domain API origin, aligned with the code.
  • cspell dictionary, roadmap, contributing guide, MIT license.
Loading