mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-10-01 10:53:14 +00:00
aef6b26912
Create the per-env config surface the EC2 box reads at boot via
fetch-config.sh / seed_store.sh:
- ConfigStore construct (infra/lib/constructs/config-store.ts):
- 28 value-LESS Secrets Manager shells open-swe-<env>/<VAR>
(RemovalPolicy.RETAIN, no SecretString/generateSecretString — real
values are set out-of-band by put-config.sh, never in IaC/state).
- 8 IaC-managed SSM params /open-swe-<env>/<VAR> with real,
stable/derivable values (SANDBOX_TYPE, DEFAULT_REPO_OWNER/NAME,
ALLOWED_GITHUB_ORGS, DASHBOARD_*_URL/ORIGINS, LLM_MODEL_ID).
- OUT_OF_BAND_SSM documents the ~30 params CDK intentionally does NOT
own (operationally-variable / env-specific-unknown).
- Wire ConfigStore into OpenSwe<Env>Stack.
- KebabNamingAspect: exempt Secrets Manager + SSM names, which carry the
literal UPPER_SNAKE env-var segment (open-swe-dev/DASHBOARD_JWT_SECRET).
- deploy/seahaven/put-config.sh: out-of-band populator (placeholders only,
OPENSWE_PUT_<VAR> env indirection; no real values committed).
Synth-only; not deployed. Instance-role read grants on open-swe-<env>/*
already exist from T6 — no IAM/trust changes here.
66 lines
2.6 KiB
TypeScript
66 lines
2.6 KiB
TypeScript
import * as cdk from "aws-cdk-lib";
|
|
import { Construct } from "constructs";
|
|
import { EnvName, prefix } from "./config";
|
|
import { ConfigStore } from "./constructs/config-store";
|
|
import { InstanceRole } from "./constructs/instance-role";
|
|
import {
|
|
AL2023_ARM64_SSM_CONTEXT_KEY,
|
|
cachedArm64AmazonLinux2023,
|
|
} from "./constructs/ami-cache";
|
|
|
|
export interface OpenSweStackProps extends cdk.StackProps {
|
|
/** open-swe environment — drives the `open-swe-<env>-*` resource naming. */
|
|
readonly envName: EnvName;
|
|
}
|
|
|
|
/**
|
|
* Per-env open-swe stack (`open-swe-dev` / `open-swe-prod`). Resource names are
|
|
* prefixed `open-swe-<env>-*`.
|
|
*
|
|
* T3 scope: the per-env EC2 instance role + the wired-but-not-yet-instantiated
|
|
* AMI cache helper. The EC2 instance, ALB target groups, listener rules, SG,
|
|
* Route53 and NAT come at T12 — this stack is the synth-able shell they plug
|
|
* into.
|
|
*/
|
|
export class OpenSweStack extends cdk.Stack {
|
|
public readonly instanceRole: InstanceRole;
|
|
public readonly configStore: ConfigStore;
|
|
|
|
constructor(scope: Construct, id: string, props: OpenSweStackProps) {
|
|
super(scope, id, props);
|
|
|
|
const envName = props.envName;
|
|
const p = prefix(envName);
|
|
|
|
cdk.Tags.of(this).add("project", "open-swe");
|
|
cdk.Tags.of(this).add("env", envName);
|
|
cdk.Tags.of(this).add("ManagedBy", "cdk");
|
|
|
|
// Per-env least-privilege EC2 instance role (open-swe-<env>-instance-role).
|
|
this.instanceRole = new InstanceRole(this, "Instance", envName);
|
|
|
|
// Secrets Manager + SSM Parameter Store shells the boot hook reads
|
|
// (deploy/seahaven/fetch-config.sh). Secret shells are value-less and
|
|
// populated out-of-band; IaC-managed SSM params carry real derivable values.
|
|
// The instance role already grants read on open-swe-<env>/* + /open-swe-<env>/*.
|
|
this.configStore = new ConfigStore(this, "Config", { envName });
|
|
|
|
// AMI cache discipline (see lib/constructs/ami-cache.ts). T3 is synth-only:
|
|
// resolve + surface the pinned AMI id ONLY when it is already cached in
|
|
// cdk.context.json, so synth never makes a live SSM call. T12 consumes
|
|
// `cachedArm64AmazonLinux2023()` for the actual ec2.Instance.
|
|
if (this.node.tryGetContext(AL2023_ARM64_SSM_CONTEXT_KEY) !== undefined) {
|
|
const amiId = cachedArm64AmazonLinux2023().getImage(this).imageId;
|
|
new cdk.CfnOutput(this, "PinnedAmiId", {
|
|
value: amiId,
|
|
description:
|
|
"Cached AL2023 ARM64 AMI id (pinned in cdk.context.json; consumed by the T12 EC2 instance).",
|
|
});
|
|
}
|
|
|
|
new cdk.CfnOutput(this, "InstanceRoleArn", {
|
|
value: this.instanceRole.role.roleArn,
|
|
description: `${p} EC2 instance role ARN.`,
|
|
});
|
|
}
|
|
}
|