|
| 1 | +# Infrastructure |
| 2 | + |
| 3 | +Terraform configurations for provisioning the fullstack-starter stack. Each cloud target lives in its own self-contained root module — pick one (or run several side by side for different environments). |
| 4 | + |
| 5 | +## Stacks |
| 6 | + |
| 7 | +| Directory | Target | Best for | |
| 8 | +|-----------|--------|----------| |
| 9 | +| [`gcp/`](./gcp/) | GCP — Cloud Run, Cloud SQL, Memorystore, Cloud Tasks, Pub/Sub, GCS, Cloud CDN | Serverless-first, scale-to-zero workloads | |
| 10 | +| [`aws/`](./aws/) | AWS — ECS Fargate, Aurora PostgreSQL, ElastiCache, SQS/SNS, S3, CloudFront, SES | Container-first, AWS-native shops | |
| 11 | +| [`az/`](./az/) | Azure — Container Apps, PostgreSQL Flexible Server, Azure Cache for Redis, Service Bus, Blob Storage, Front Door | Azure-native shops, KEDA-based scaling | |
| 12 | +| [`freemium/`](./freemium/) | Vercel + Supabase + Backblaze B2 | Zero-cost prototypes and side projects | |
| 13 | + |
| 14 | +### Service mapping |
| 15 | + |
| 16 | +| Component | `gcp/` | `aws/` | `az/` | |
| 17 | +|-----------|--------|--------|-------| |
| 18 | +| API / Web / Worker | Cloud Run | ECS Fargate | Container Apps | |
| 19 | +| Container registry | Artifact Registry | ECR | ACR | |
| 20 | +| Database (PostgreSQL 16) | Cloud SQL | Aurora | PostgreSQL Flexible Server | |
| 21 | +| Cache (Redis 7) | Memorystore | ElastiCache | Azure Cache for Redis | |
| 22 | +| Task queues | Cloud Tasks (default / high / low priority) | SQS (default / high-priority / low-priority + DLQ) | Service Bus subscriptions (SQL filter + DLQ) | |
| 23 | +| Event bus | Pub/Sub | SNS → SQS fan-out | Service Bus topic fan-out | |
| 24 | +| Scheduled jobs | Cloud Scheduler → Pub/Sub (`schedules` var) | EventBridge Scheduler → SNS (`schedules` var) | Container Apps Jobs cron (`schedules` var) | |
| 25 | +| Uploads / static assets | GCS + Cloud CDN | S3 + CloudFront (OAC) | Blob Storage + Front Door | |
| 26 | +| WAF / rate limiting | Cloud Armor | WAFv2 (rate limit + AWS managed rules) | Front Door WAF (rate limit; managed rules need Premium) | |
| 27 | +| Email | — | SES (opt-in via `ses_domain`) | — | |
| 28 | +| CI/CD auth | Workload Identity Federation | GitHub Actions OIDC role | Entra ID federated credential | |
| 29 | + |
| 30 | +## Shared conventions |
| 31 | + |
| 32 | +- **Secrets via Infisical.** Every `plan`/`apply` task is wrapped with `infisical run --env=<env> --path=/infra`, which injects secrets as `TF_VAR_*` environment variables (`DATABASE_PASSWORD`, `JWT_SECRET`, `BETTER_AUTH_SECRET`, OAuth and AI keys). Nothing sensitive is committed; `*.tfvars` is gitignored. |
| 33 | +- **Remote state.** GCS backend for `gcp/`, S3 + DynamoDB locking for `aws/`, Azure Storage (`azurerm` backend) for `az/`. All are configured at `terraform init` time via `-backend-config`. |
| 34 | +- **Naming.** Resources are prefixed with `${app_name}-${environment}` (default `fullstack-starter-dev`). |
| 35 | +- **Environment sizing.** `terraform.tfvars` for dev, `terraform.prod.tfvars` for production. Copy from the `.example` files in each stack. |
| 36 | +- **API availability.** The API service keeps a minimum of 1 instance/task in every stack (no cold starts). |
| 37 | +- **Cron via scheduler services.** Recurring jobs are declared in the `schedules` variable (Cloud Scheduler / EventBridge Scheduler) and flow through the task queue, so each tick runs exactly once regardless of worker count — workers never run in-process cron. |
| 38 | + |
| 39 | +## Usage |
| 40 | + |
| 41 | +All stacks expose the same mise tasks: |
| 42 | + |
| 43 | +```bash |
| 44 | +# GCP |
| 45 | +mise //apps/infra/gcp:init |
| 46 | +mise //apps/infra/gcp:plan |
| 47 | +mise //apps/infra/gcp:apply |
| 48 | +mise //apps/infra/gcp:plan:prod |
| 49 | +mise //apps/infra/gcp:apply:prod |
| 50 | + |
| 51 | +# AWS |
| 52 | +mise //apps/infra/aws:init |
| 53 | +mise //apps/infra/aws:plan |
| 54 | +mise //apps/infra/aws:apply |
| 55 | +mise //apps/infra/aws:plan:prod |
| 56 | +mise //apps/infra/aws:apply:prod |
| 57 | + |
| 58 | +# Azure |
| 59 | +mise //apps/infra/az:init |
| 60 | +mise //apps/infra/az:plan |
| 61 | +mise //apps/infra/az:apply |
| 62 | +mise //apps/infra/az:plan:prod |
| 63 | +mise //apps/infra/az:apply:prod |
| 64 | + |
| 65 | +# Formatting / validation (either stack) |
| 66 | +mise //apps/infra/gcp:fmt |
| 67 | +mise //apps/infra/aws:validate |
| 68 | +``` |
| 69 | + |
| 70 | +See each stack's README for prerequisites (API enablement, state bucket setup, certificates) and stack-specific notes. |
0 commit comments