chore(ci): deploy server via cdk (#86)

## What I'm changing

Use CDK to handle deploying server

## How I did it

Add construct for ECS cluster & service

Author: alukach

.dockerignore

@@ -1,6 +1,53 @@
+# Rust build artifacts
 target/
-.github/
-LICENSE
-README.md
-Dockerfile
+**/*.rs.bk
+Cargo.lock
+
+# Git and version control
+.git/
+.gitignore
+
+# IDE and editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS generated files
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Documentation and scripts
+docs/
+*.md
 scripts/
+deploy/
+
+# CI/CD
+.github/
+.github/workflows/
+
+# AWS CDK
+cdk.out/
+*.d.ts
+*.js.map
+
+# Node modules (if any)
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Logs
+*.log
+
+# Environment files
+.env
+.env.local
+.env.*.local

.github/workflows/dev-deploy.yaml

@@ -15,45 +15,11 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  deploy-proxy:
-    runs-on: ubuntu-latest
-    environment: development
-    steps:
-      - uses: actions/[email protected]
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-region: us-east-1
-          role-to-assume: ${{ vars.DEPLOY_ROLE_ARN }}
-      - name: Login to Amazon ECR
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v2
-      - name: Build, tag, and push docker image to Amazon ECR
-        env:
-          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
-          REPOSITORY: source-data-proxy
-          IMAGE_TAG: ${{ github.sha }}
-        run: |
-          docker buildx build -t $REGISTRY/$REPOSITORY:$IMAGE_TAG --push .
-      - name: Render Amazon ECS task definition
-        id: render-data-proxy-container
-        uses: aws-actions/amazon-ecs-render-task-definition@v1
-        with:
-          task-definition-family: source-data-proxy
-          container-name: source-data-proxy
-          image: 417712557820.dkr.ecr.us-east-1.amazonaws.com/source-data-proxy:${{ github.sha }}
-      - name: Deploy to Amazon ECS service
-        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
-        with:
-          task-definition: ${{ steps.render-data-proxy-container.outputs.task-definition }}
-          service: source-data-proxy
-          cluster: SourceCooperative-Dev
-
   deploy-cdk:
     runs-on: ubuntu-latest
     environment: development
+    env:
+      STAGE: dev
     defaults:
       run:
         working-directory: ./deploy

.github/workflows/prod-deploy.yaml

@@ -14,51 +14,11 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  deploy-proxy:
-    runs-on: ubuntu-latest
-    environment: production
-    steps:
-      - id: latest
-        uses: thebritican/fetch-latest-release@a36ee8ee464da77ba3e499ed6b75e3530e10f9bc # v2.0.0
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
-        with:
-          ref: ${{ steps.latest.outputs.tag_name }}
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-region: us-west-2
-          role-to-assume: ${{ vars.DEPLOY_ROLE_ARN }}
-      - name: Login to Amazon ECR
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v2
-      - name: Build, tag, and push docker image to Amazon ECR
-        env:
-          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
-          REPOSITORY: source-data-proxy
-          IMAGE_TAG: ${{ steps.latest.outputs.tag_name }}
-        run: |
-          docker buildx build -t $REGISTRY/$REPOSITORY:$IMAGE_TAG --push .
-      - name: Render Amazon ECS task definition
-        id: render-data-proxy-container
-        uses: aws-actions/amazon-ecs-render-task-definition@v1
-        with:
-          task-definition-family: source-data-proxy
-          container-name: source-data-proxy
-          image: 417712557820.dkr.ecr.us-west-2.amazonaws.com/source-data-proxy:${{ steps.latest.outputs.tag_name }}
-      - name: Deploy to Amazon ECS service
-        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
-        with:
-          task-definition: ${{ steps.render-data-proxy-container.outputs.task-definition }}
-          service: source-data-proxy
-          cluster: SourceCooperative-Prod
-
   deploy-cdk:
     runs-on: ubuntu-latest
     environment: production
+    env:
+      STAGE: prod
     defaults:
       run:
         working-directory: ./deploy

Dockerfile

@@ -1,5 +1,48 @@
-FROM rust:1.80.1
-ADD . /app
+# Build stage - target x86_64 for ECS Fargate compatibility
+FROM --platform=linux/amd64 rust:1.82.0 AS builder
+
+# Set environment variables for consistent builds
+ENV CARGO_TARGET_DIR=/app/target
+ENV RUSTFLAGS="-C target-cpu=x86-64"
+
+# Copy source code
+COPY . /app
 WORKDIR /app
-RUN cargo build --release
-ENTRYPOINT ["cargo", "run", "--release"]
+
+# Add x86_64 target and build
+RUN rustup target add x86_64-unknown-linux-gnu
+RUN cargo build --release --target x86_64-unknown-linux-gnu
+
+# Runtime stage - minimal Debian image
+FROM --platform=linux/amd64 debian:bookworm-slim AS runtime
+
+# Install runtime dependencies (ca-certificates for HTTPS requests)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        && rm -rf /var/lib/apt/lists/*
+
+# Create app user for security
+RUN groupadd -r appuser && useradd -r -g appuser appuser
+
+# Copy the built binary from builder stage
+COPY --from=builder /app/target/x86_64-unknown-linux-gnu/release/source-data-proxy /app/source-data-proxy
+
+# Set proper permissions
+RUN chown appuser:appuser /app/source-data-proxy && \
+    chmod +x /app/source-data-proxy
+
+# Switch to non-root user
+USER appuser
+
+# Set working directory and expose port
+WORKDIR /app
+EXPOSE 8080
+
+# Health check endpoint
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+    CMD curl -f http://localhost:8080/health || exit 1
+
+# Run the binary directly
+ENTRYPOINT ["/app/source-data-proxy"]

deploy/bin/deploy.ts

@@ -1,20 +1,33 @@
 #!/usr/bin/env node
 import * as cdk from "aws-cdk-lib";
 import { DataProxyStack } from "../lib/data-proxy-stack";
+import { Tags } from "aws-cdk-lib";
 
 const stage = process.env.STAGE || "dev";
-
 const vpcId = process.env.VPC_ID;
 if (!vpcId) {
   throw new Error("VPC_ID is not set");
 }
+const certificateArn = process.env.CERTIFICATE_ARN;
+if (!certificateArn) {
+  throw new Error("CERTIFICATE_ARN is not set");
+}
+const taskCount = process.env.TASK_COUNT || 1;
+const sourceApiUrl = process.env.SOURCE_API_URL || "https://s2.source.coop";
 
 const app = new cdk.App();
-new DataProxyStack(app, `DataProxy-${stage}`, {
+const stack = new DataProxyStack(app, `DataProxy-${stage}`, {
   vpcId,
   proxyDomain: `vercel-api-${stage}.internal`,
+  proxyDesiredCount: Number(taskCount),
+  sourceApiUrl,
   env: {
     account: process.env.AWS_ACCOUNT_ID,
     region: process.env.AWS_REGION,
   },
+  certificateArn,
+});
+
+Tags.of(stack).add("Cfn-Stack", stack.stackName, {
+  applyToLaunchedInstances: true,
 });

deploy/lib/data-proxy-stack.ts

@@ -2,10 +2,15 @@ import * as cdk from "aws-cdk-lib";
 import { aws_ec2 as ec2 } from "aws-cdk-lib";
 import { Construct } from "constructs";
 import { VercelApiProxy } from "./vercel-api-proxy";
+import { SourceDataProxy } from "./source-data-proxy";
+import { VpcEndpoints } from "./vpc-endpoints";
 
 interface DataProxyStackProps extends cdk.StackProps {
   vpcId: string;
   proxyDomain: string;
+  sourceApiUrl: string;
+  proxyDesiredCount: number;
+  certificateArn: string;
 }
 
 export class DataProxyStack extends cdk.Stack {
@@ -14,9 +19,21 @@ export class DataProxyStack extends cdk.Stack {
 
     const vpc = ec2.Vpc.fromLookup(this, "vpc", { vpcId: props.vpcId });
 
-    new VercelApiProxy(this, "vercel-api-proxy", {
+    // Create Vercel API proxy (existing functionality)
+    const vercelApiProxy = new VercelApiProxy(this, "vercel-api-proxy", {
       vpc,
       proxyDomain: props.proxyDomain,
     });
+
+    new SourceDataProxy(this, "source-data-proxy", {
+      vpc,
+      environment: {
+        RUST_LOG: "info",
+        SOURCE_API_PROXY_URL: vercelApiProxy.url,
+        SOURCE_API_URL: props.sourceApiUrl,
+      },
+      desiredCount: props.proxyDesiredCount,
+      certificateArn: props.certificateArn,
+    });
   }
 }