Merge pull request #195 from ryansurf/feat-aws-lambda

ryansurf · web-flow · commit 988f93287794 · 2026-04-09T18:45:07.000-07:00
Feat aws lambda
diff --git a/.gitignore b/.gitignore
@@ -162,4 +162,23 @@ cython_debug/
 .idea/
 
 *.cache.sqlite
-*.pyc
+*.pyc
+
+# Terraform
+**/.terraform/
+*.tfstate
+*.tfstate.backup
+*.tfplan
+*.tfvars
+!*.tfvars.example
+
+# Lambda build artifacts
+terraform/lambda.zip
+package/
+requirements.txt
+
+# macOS
+.DS_Store
+
+# IDE
+.vscode/
diff --git a/Dockerfile.lambda b/Dockerfile.lambda
@@ -0,0 +1,15 @@
+FROM public.ecr.aws/lambda/python:3.12
+
+WORKDIR /var/task
+
+COPY pyproject.toml poetry.lock ./
+COPY .env.example .env
+
+RUN pip install poetry && \
+    poetry config virtualenvs.create false && \
+    poetry install --no-interaction --no-ansi --without dev --no-root
+
+COPY src/ ./src/
+COPY help.txt ./
+
+CMD ["src/handler.handler"]
diff --git a/README.md b/README.md
@@ -34,6 +34,7 @@ Inspired by [wttr.in](https://github.com/chubin/wttr.in) · [Documentation](http
   - [MongoDB](#mongodb)
 - [GPT Surf Report](#-gpt-surf-report)
 - [Tech Stack](#-tech-stack)
+- [Architecture](#-architecture)
 - [Contributing](#-contributing)
 - [Contributors](#-contributors)
 
@@ -332,6 +333,10 @@ GPT_PROMPT="What are some good places to eat around this surf spot?"
 
 ---
 
+## 📐 Architecture
+
+[Architecture](docs/architecture.png)
+
 ## 📈 Contributing
 
 Thank you for considering contributing to cli-surf!
diff --git a/docs/architecture.png b/docs/architecture.png
diff --git a/makefile b/makefile
@@ -65,3 +65,38 @@ clean:
 
 .PHONY: all
 all: format lint test
+
+.PHONY: lambda-zip
+lambda-zip:
+	poetry export -f requirements.txt --output requirements.txt --without-hashes
+	pip install -r requirements.txt -t ./package
+	cp -r src/ ./package/src/
+	cd package && zip -r ../terraform/lambda.zip . && cd ..
+
+ECR_REGION ?= us-west-1
+ECR_ACCOUNT_ID ?= $(shell aws sts get-caller-identity --query Account --output text)
+ECR_REPO = $(ECR_ACCOUNT_ID).dkr.ecr.$(ECR_REGION).amazonaws.com/cli-surf
+
+.PHONY: ecr-login
+ecr-login:
+	aws ecr get-login-password --region $(ECR_REGION) | docker login --username AWS --password-stdin $(ECR_ACCOUNT_ID).dkr.ecr.$(ECR_REGION).amazonaws.com
+
+.PHONY: docker-build
+docker-build:
+	docker build --platform linux/amd64 --provenance=false -f Dockerfile.lambda -t cli-surf:latest .
+
+.PHONY: docker-push
+docker-push: ecr-login docker-build
+	docker tag cli-surf:latest $(ECR_REPO):latest
+	docker push $(ECR_REPO):latest
+
+.PHONY: update-lambda
+update-lambda:
+	$(eval DIGEST := $(shell aws ecr describe-images --repository-name cli-surf --region $(ECR_REGION) --query 'sort_by(imageDetails, &imagePushedAt)[-1].imageDigest' --output text))
+	aws lambda update-function-code --function-name cli-surf --region $(ECR_REGION) --image-uri $(ECR_REPO)@$(DIGEST)
+
+.PHONY: deploy
+deploy: docker-push update-lambda
+	terraform -chdir=terraform apply
+
+
diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -43,12 +43,13 @@ streamlit-folium = "^0.22.0"
 matplotlib = ">=3.9.0"
 seaborn = "^0.13.2"
 numpy = "^1.26.4"
-pymongo = {extras = ["gssapi", "snappy", "srv", "tls"], version = "^4.15.4"}
+pymongo = {extras = ["srv", "tls"], version = "^4.15.4"}
 fastapi = "^0.135.2"
 uvicorn = "^0.42.0"
 httpx = "^0.28.1"
 debugpy = "^1.8.20"
 cachetools = "^7.0.5"
+mangum = "^0.21.0"
 
 [tool.poetry.group.dev.dependencies]
 # command: `poetry add --group dev <package-name>`
@@ -66,8 +67,11 @@ build-backend = "poetry.core.masonry.api"
 [tool.pytest.ini_options]
 testpaths = 'tests'
 pythonpath = "."
-addopts = '-p no:warnings'  # disable pytest warnings
+addopts = '-p no:warnings -m "not integration"'  # disable pytest warnings; skip integration tests by default
 log_format = '%(name)s %(levelname)s: %(message)s'
+markers = [
+    "integration: tests that hit live external services (run with -m integration)",
+]
 
 # coverage settings
 [tool.coverage.run]
diff --git a/src/api.py b/src/api.py
@@ -38,7 +38,9 @@
 
 def _create_openmeteo_client() -> openmeteo_requests.Client:
     """Creates a cached, retry-enabled Open-Meteo API client."""
-    cache_session = requests_cache.CachedSession(".cache", expire_after=3600)
+    cache_session = requests_cache.CachedSession(
+        "/tmp/.cache", expire_after=3600
+    )
     retry_session = retry(cache_session, retries=5, backoff_factor=0.2)
     return openmeteo_requests.Client(session=retry_session)
 
diff --git a/src/handler.py b/src/handler.py
@@ -0,0 +1,5 @@
+from mangum import Mangum
+
+from src.server import app
+
+handler = Mangum(app)
diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl
diff --git a/terraform/main.tf b/terraform/main.tf
@@ -0,0 +1,112 @@
+
+data "aws_caller_identity" "current" {}
+
+# ECR repository to store the Lambda container image
+resource "aws_ecr_repository" "cli_surf" {
+    name                 = "cli-surf"
+    image_tag_mutability = "MUTABLE"
+
+    image_scanning_configuration {
+        scan_on_push = true
+    }
+}
+
+# NOTE: The ECR repository policy granting lambda.amazonaws.com access must be set
+# manually by an admin (cli-surf IAM user lacks ecr:SetRepositoryPolicy). Run:
+#
+#   aws ecr set-repository-policy --repository-name cli-surf --region us-west-1 \
+#     --policy-text file://ecr-policy.json
+#
+# where ecr-policy.json grants lambda.amazonaws.com GetDownloadUrlForLayer,
+# BatchGetImage, and BatchCheckLayerAvailability.
+
+# Grant Lambda execution role permission to pull from ECR
+resource "aws_iam_role_policy" "cli_surf_ecr" {
+    name = "cli_surf_ecr_pull"
+    role = aws_iam_role.cli_surf_exec.id
+    policy = jsonencode({
+        Version = "2012-10-17",
+        Statement = [{
+            Effect = "Allow"
+            Action = [
+                "ecr:GetDownloadUrlForLayer",
+                "ecr:BatchGetImage",
+                "ecr:BatchCheckLayerAvailability",
+                "ecr:GetAuthorizationToken"
+            ]
+            Resource = "*"
+        }]
+    })
+}
+
+# Create HTTP API Gateway
+resource "aws_apigatewayv2_api" "http_api" {
+    name = "cli-surf-api"
+    protocol_type = "HTTP"
+}
+
+# connect lambda to API gateway
+resource "aws_apigatewayv2_integration" "lambda_integration" {
+    api_id = aws_apigatewayv2_api.http_api.id
+    integration_type = "AWS_PROXY"
+    integration_uri = aws_lambda_function.cli_surf.arn
+    payload_format_version  = "2.0"
+    timeout_milliseconds    = 29000
+}
+
+# Define API route
+resource "aws_apigatewayv2_route" "lambda_route" {
+    api_id = aws_apigatewayv2_api.http_api.id
+    route_key = "$default"
+    target = "integrations/${aws_apigatewayv2_integration.lambda_integration.id}"
+}
+
+# deploy the API with default stage
+resource "aws_apigatewayv2_stage" "default" {
+    api_id = aws_apigatewayv2_api.http_api.id
+    name = "$default"
+    auto_deploy = true
+
+    default_route_settings {
+        throttling_rate_limit  = 3
+        throttling_burst_limit = 3
+    }
+}
+
+# grant api gateway permissions to call lambda
+resource "aws_lambda_permission" "apigw" {
+    statement_id = "AllowAPIGatewayInvoke"
+    action = "lambda:InvokeFunction"
+    function_name = aws_lambda_function.cli_surf.function_name
+    principal = "apigateway.amazonaws.com"
+    source_arn = "${aws_apigatewayv2_api.http_api.execution_arn}/*/*"
+}
+
+resource "aws_iam_role" "cli_surf_exec" {
+    name = "cli_surf_exec_role"
+    assume_role_policy = jsonencode({
+        Version = "2012-10-17",
+        Statement = [{
+            Action = "sts:AssumeRole"
+            Effect = "Allow"
+            Principal = {Service = "lambda.amazonaws.com"}
+        }]
+    })
+}
+
+resource "aws_iam_role_policy_attachment" "cli_surf_basic_execution" {
+    role = aws_iam_role.cli_surf_exec.name
+    policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_lambda_function" "cli_surf" {
+    function_name = "cli-surf"
+    role          = aws_iam_role.cli_surf_exec.arn
+    package_type  = "Image"
+    image_uri     = "${data.aws_caller_identity.current.account_id}.dkr.ecr.${var.aws_region}.amazonaws.com/cli-surf:latest"
+
+    timeout      = 29
+    memory_size  = 512
+
+    depends_on = [aws_ecr_repository.cli_surf, aws_iam_role_policy.cli_surf_ecr]
+}
diff --git a/terraform/outputs.tf b/terraform/outputs.tf
@@ -0,0 +1,5 @@
+
+output "api_gateway_invoke_url" {
+    value = aws_apigatewayv2_api.http_api.api_endpoint
+    description = "Invoke URL of the API Gateway vs HTTP API"
+}
diff --git a/terraform/provider.tf b/terraform/provider.tf
@@ -0,0 +1,15 @@
+
+
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+# Configure the AWS Provider
+provider "aws" {
+  region = var.aws_region
+}
diff --git a/terraform/variables.tf b/terraform/variables.tf
@@ -0,0 +1,6 @@
+
+variable "aws_region" {
+    description = "AWS region to deploy resources in"
+    type = string
+    default = "us-west-1"
+}
