nntrivi2001
57dc91585d
Internal SmartGift build of a Claude Code monitoring dashboard. Lanes: a durable unit of parallel agent work, one per working directory, tracked across session restarts. Managed lanes are git worktrees the dashboard provisions and can reset or remove behind a three-check destroy guard and a counted preflight; adopted lanes are directories you already own and are never destroyable. Pipelines: a lane moves through pipeline stages. A stage the agent declares with evidence renders green; a stage inferred from the tool-event stream renders dashed amber and never counts as done. Detection is forward-only within a 30-minute window, and never writes the declared stage. Workspace: one page at /run with a lane grid, the selected lane's pipeline, and a full Claude console behind a disclosure.
143 lines
5.6 KiB
Terraform
143 lines
5.6 KiB
Terraform
# ─────────────────────────────────────────────────────────────────────────────
|
||
# Database module – Persistent storage for SQLite
|
||
#
|
||
# Creates a managed network file system (EFS on AWS) with:
|
||
# - Encryption at rest and in transit
|
||
# - Automated backup policy
|
||
# - Mount targets in each private subnet
|
||
# - Performance mode optimised for SQLite workloads
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
locals {
|
||
name_prefix = lower(replace("${var.project_name}-${var.environment}", "_", "-"))
|
||
|
||
common_tags = merge(
|
||
{
|
||
module = "database"
|
||
},
|
||
var.tags,
|
||
)
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# EFS file system
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
resource "aws_efs_file_system" "main" {
|
||
creation_token = "${local.name_prefix}-data"
|
||
encrypted = true
|
||
|
||
# General Purpose is optimal for SQLite (latency-sensitive small I/O)
|
||
performance_mode = "generalPurpose"
|
||
throughput_mode = "elastic"
|
||
|
||
lifecycle_policy {
|
||
transition_to_ia = "AFTER_30_DAYS"
|
||
}
|
||
|
||
lifecycle_policy {
|
||
transition_to_primary_storage_class = "AFTER_1_ACCESS"
|
||
}
|
||
|
||
tags = merge(local.common_tags, {
|
||
Name = "${local.name_prefix}-efs"
|
||
})
|
||
|
||
lifecycle {
|
||
prevent_destroy = true
|
||
}
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# EFS backup policy
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
resource "aws_efs_backup_policy" "main" {
|
||
file_system_id = aws_efs_file_system.main.id
|
||
|
||
backup_policy {
|
||
status = var.enable_backup ? "ENABLED" : "DISABLED"
|
||
}
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# EFS mount targets (one per private subnet / AZ)
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
resource "aws_efs_mount_target" "main" {
|
||
count = length(var.private_subnet_ids)
|
||
|
||
file_system_id = aws_efs_file_system.main.id
|
||
subnet_id = var.private_subnet_ids[count.index]
|
||
security_groups = var.allowed_security_group_ids
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# EFS access point – scoped to /app/data for the container workload
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
resource "aws_efs_access_point" "app_data" {
|
||
file_system_id = aws_efs_file_system.main.id
|
||
|
||
posix_user {
|
||
uid = 1000
|
||
gid = 1000
|
||
}
|
||
|
||
root_directory {
|
||
path = "/app-data"
|
||
|
||
creation_info {
|
||
owner_uid = 1000
|
||
owner_gid = 1000
|
||
permissions = "0755"
|
||
}
|
||
}
|
||
|
||
tags = merge(local.common_tags, {
|
||
Name = "${local.name_prefix}-app-data-ap"
|
||
})
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# EFS file system policy – enforce encryption in transit
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
resource "aws_efs_file_system_policy" "main" {
|
||
file_system_id = aws_efs_file_system.main.id
|
||
|
||
policy = jsonencode({
|
||
Version = "2012-10-17"
|
||
Statement = [
|
||
{
|
||
Sid = "EnforceEncryptInTransit"
|
||
Effect = "Deny"
|
||
Principal = { AWS = "*" }
|
||
Action = "*"
|
||
Resource = aws_efs_file_system.main.arn
|
||
Condition = {
|
||
Bool = {
|
||
"aws:SecureTransport" = "false"
|
||
}
|
||
}
|
||
},
|
||
{
|
||
Sid = "AllowMountViaAccessPoint"
|
||
Effect = "Allow"
|
||
Principal = { AWS = "*" }
|
||
Action = [
|
||
"elasticfilesystem:ClientMount",
|
||
"elasticfilesystem:ClientWrite",
|
||
"elasticfilesystem:ClientRootAccess",
|
||
]
|
||
Resource = aws_efs_file_system.main.arn
|
||
Condition = {
|
||
Bool = {
|
||
"elasticfilesystem:AccessedViaMountTarget" = "true"
|
||
}
|
||
}
|
||
}
|
||
]
|
||
})
|
||
}
|