public/infrastructure
6
0
Fork 0
Code Issues Pull requests 3 Projects Releases Packages Wiki Activity Actions

WIP: feat(aws): add staged development platform bootstrap #5

Draft
anton wants to merge 6 commits from feat/aws-platform-bootstrap into main
pull from: feat/aws-platform-bootstrap
merge into: public:main
Conversation 5 Commits 6 Files changed 36 +4219 -11
anton commented 2026-10-12 03:05:42 +00:00
Owner
Copy link

Automatic DNS default — eedf46f80e4c9a0ebbed2e2337e8a7cb804b54c0

  • New short-form configs default to automatic DNS: derive names from environment, select the established aposdw.space parent references in memory, and publish parent NS delegation during approved install/update. The example no longer repeats dns_mode.
  • Preserve legacy explicit-name configurations and explicit manual/delegated/deferred behavior. Host-only is now an explicit override. Custom automatic domains require their own complete parent_dns settings.
  • Update README/runbook, including fresh-plan/receipt migration guidance. Identity, immediate-public-parent, conflict and CREATE-only safeguards remain intact. No encrypted-file format changes.

Verification

Exact commit eedf46f80e4c9a0ebbed2e2337e8a7cb804b54c0: 14 offline behavioral checks passed, plus Python syntax/example JSON, CLI help, OpenTofu formatting, Make dry-runs, DNS protection and synthetic encrypted-schema/filtering checks. Scratch probes remain outside the repository; no test framework was added.

docker run --rm --network none --read-only --tmpfs /tmp \
  --mount type=bind,src=/home/tuna/git/infrastructure-dns-names,dst=/repo,readonly \
  --mount type=bind,src=/tmp/infrastructure-dns-checks,dst=/checks,readonly \
  --entrypoint /bin/sh \
  sha256:16cfcebf27906476bcf393ae3c999879e7fe946c7182dcc9c77766afefb464eb \
  -c 'set -eu; python3 -B /checks/check_auto_dns.py -v; sh /checks/verify.sh; python3 -B /checks/check_cleanup.py'
git diff --check

Independent final review passed with no security/logic findings, including supplemental comparisons against the immediate pre-change HEAD and receipt-resume/publication-order probes. The committed diff matches the frozen reviewed source manifest. Follow-up size: four files, +65/−33 (net +32).

Deferred/live prerequisites: no cloud plan/apply, live IAM/DNS, installation or E2E acceptance was performed. Verify that the DNS user's deployed permissions cover the default parent zone; the checked-in policy does not establish that. Normal SOPS access is required. This publication does not merge or deploy anything.

Previous implementation notes

Cleanup follow-up

Commit: a30e9ba7d9b0f33a3b243a3d990c386ebf29ad8c.

  • Remove dev02-dns-replacement.patch, an unreferenced one-off patch disabling DNS prevent_destroy safeguards. The actual modules retain all three protections.
  • Inspected the PR's complete added-file inventory and references for scratch, generated, redundant or unused artifacts. No further obsolete files identified; keep the source/template modules, provider lockfiles and encrypted environment inputs used by the bootstrap.
  • aws/environments/example.json was already converted to environment-based naming in 985688a: no stored dns_zone_name, dashboard_hostname or apps_dns_zone_name.
  • No encrypted-file format migration is required. The two per-environment SOPS dotenv files retain their credential/state-passphrase schema. Shared defaults filter out old deployment-specific DNS/identity values; bootstrap continues to require normal SOPS decryption access. Operator-owned older JSON inputs outside this checkout still need the documented short-form conversion, not a secret-file rewrite.

Exact-commit offline verification

Existing tools image sha256:16cfcebf27906476bcf393ae3c999879e7fe946c7182dcc9c77766afefb464eb, no network, read-only repository/scratch mounts; no decryption/cloud calls:

  • python3 -B /checks/check_dns.py -v: all 8 behavioral checks passed.
  • python3 -B /checks/check_cleanup.py: patch absence, retained DNS protections, migrated example, encrypted credential schema and synthetic legacy-domain filtering checks passed.
  • python3 -B scripts/bootstrap-platform.py --help, all 3 Python script ASTs and example JSON parsing: passed.
  • tofu fmt -check -recursive aws: passed.
  • make -n PROVIDER=aws ENVIRONMENT=dev03 DOCKER=0 bootstrap-preflight bootstrap-plan-state bootstrap-apply-state bootstrap-plan bootstrap-apply bootstrap-install bootstrap-update-config bootstrap-verify bootstrap-platform: passed (dry-run only).
  • git diff HEAD^ HEAD --check and complete previous/current tree comparison: only the requested patch was deleted; all other tracked blobs/modes unchanged.

Publication only; no merge, infrastructure apply, DNS mutation or deployment. Offline checks are not live deployment acceptance.

Latest update: derive DNS names from the environment

Published correction: 985688ac2265d3893e2d0a6e667577a797b80e00.

  • Environment configs store environment, not redundant dns_zone_name, dashboard_hostname, or apps_dns_zone_name values. The shared config loader derives those names in memory before planning, installing, or verifying; it does not write them back to the source file.
  • With the example's manual DNS mode, dev03 produces dev03.aposdw.space, dashboard.dev03.aposdw.space, and apps.dev03.aposdw.space. Delegated mode uses the same names. Optional dns_base_domain preserves other parent domains.
  • Convert the checked-in environment example and update the README/runbook, including existing-file migration. No additional deployment .local.json files were present in the inspected infrastructure worktrees; no claim is made that external dev01/dev02 files were edited. Preserve environment/state identity and existing effective addresses when converting; nonstandard addresses require a reviewed migration.
  • Preserve bare host-only/deferred modes, existing internal DNS-name validation, parent-delegation binding, and saved-plan checks. Equivalent short-form configurations produce the same canonical runtime inputs; changed effective inputs invalidate saved plans.

Verification of this correction

At 985688ac2265d3893e2d0a6e667577a797b80e00, in the existing tools image sha256:16cfcebf27906476bcf393ae3c999879e7fe946c7182dcc9c77766afefb464eb, with networking disabled, a read-only source mount, synthetic inputs and no credentials:

  • python3 /checks/check_dns.py -v: 8 temporary behavioral checks passed. Covers generated OpenTofu variables, unchanged source-file bytes, normalization idempotence, all config stages, manual/delegated/parent DNS, custom domains, invalid/ambiguous inputs, host-only/deferred behavior and saved-plan invalidation. Migration fixtures match the exact previous revision's validator. The new-behavior probes fail against the previous PR head and pass against this correction. The probes remain local-only; no test suite is added to the PR.

  • Python AST parsing for all three scripts and example JSON parsing: passed.

  • python3 scripts/bootstrap-platform.py --help: passed.

  • tofu fmt -check -recursive aws: passed.

  • make -n PROVIDER=aws ENVIRONMENT=dev03 DOCKER=0 bootstrap-preflight bootstrap-plan-state bootstrap-apply-state bootstrap-plan bootstrap-apply bootstrap-install bootstrap-update-config bootstrap-verify bootstrap-platform: passed (dry-runs only).

  • git diff --check, changed-file allowlist and added-lines credential/injection scan: passed. IaC resources, Make targets and installer are unchanged.

  • Two independent read-only reviews found no blocking defects; the final reviewer also ran all eight offline checks. Review evidence covers the focused correction, not live deployment acceptance.

Publication only: no merge, cloud calls, infrastructure plan/apply, DNS changes, installation or deployment. Offline normalization checks do not establish live deployment acceptance.

Previous PR description

Latest update: component S3 IAM parity

Published correction: 05a8cf75caa5.

  • Restore components/v1/* ListBucket prefixes for the platform deployment principal and builder.
  • Separate unconditional component reads from publication. Only PutObject to the existing blob, build-index and manifest namespaces is granted, with s3:if-none-match = "*"; remove the overlapping unrestricted component write grant.
  • Preserve builder read-only component access and existing writes to builds/* / eifs/*; other runtime resources and IAM statements are unchanged.
  • Verification: OpenTofu validation/formatting and independent review passed. The two offline policy checks remain local-only; no test files are included in this commit.
  • Resolves the managed-bucket component IAM prerequisite recorded in Platform cleanup PR #490. Alternate-source permissions and existing-state adoption remain separate reviewed work.
  • Publication only: no merge, AWS API calls, infrastructure apply, live IAM changes or deployment. Existing accounts need a fresh reviewed plan/apply before the new policy takes effect.

Previous update: existing DNS IAM user

Published correction: 34abcf30d3b3cd8b3abd2ea5d99829e2c905c0ea on feat/aws-platform-bootstrap.

  • Correct the parent publisher to use the existing arn:aws:iam::902883118030:user/dns declared by aws_iam_user.dns, not an assumed role. Configuration now takes zone_id, user_arn, and an explicit repository-relative credentials_file pointing at an existing SOPS YAML Secret. No role, trust policy, new IAM key or credential store is created.
  • Decrypt the selected existing Secret in memory and verify its exact STS caller ARN before any Route53 request. Dedicated explicit-key SDK clients leave dev-account administrator credentials untouched. No DNS keys enter command arguments, logs, configuration files or the platform installer.
  • Retain applied-output binding, immediate-public-parent validation, matching-record no-op, conflict refusal, CREATE-only publication and INSYNC/public-DNS gates. Resume behavior is unchanged. Direct IAM-user keys retain their existing policy permissions; this is not an attenuated role session.
  • Verification: 14 temporary configuration/credential/DNS checks and 4 installation-order/recovery checks passed with networking disabled; syntax, CLI help, exact patch application, Make dry-runs, added-lines security scan and independent review passed. No committed test suite was reintroduced.
  • Local SOPS decryption of the existing secret failed; none of its five PGP recipients matches an available local secret-key fingerprint. Live key ownership and parent-zone permissions were therefore not verified here. The runbook now explicitly notes that the checked-in DNS policy does not grant zone-specific access to the example parent zone; deployed permissions must be verified separately. Runtime STS verification fails closed. No AWS mutations, IAM edits, merge or host installation were performed.

Previous update: remove added tests

Published infrastructure revision: 41236e3aae9af7da7790512b6e0201e2a21dd9b5.

  • Remove all 18 test/support files added by this PR: 13 Python files and 5 native OpenTofu test files. The base branch had no test suite. Remove the obsolete test target, its documentation and test-only references as well: 7,006 net lines removed in this commit.
  • Preserve the source-only installation workflow through ordinary upstream make setup / make up; optional bundle packaging and installation remain removed.
  • Installer code, Terraform resources, account/identity binding, persistent-data and secret protections, recovery, DNS/TLS and mail/Paddle safeguards are unchanged by this test removal.
  • No bootstrap directory restructuring is included.

Verification of this update

  • The published diff matches the independently reviewed candidate; retained runtime files are byte-identical to the verified source. Independent removal review passed without security or logic findings.
  • Existing tools container, no network and read-only source mounts: Python syntax checks for all three scripts, bootstrap CLI help, all bootstrap Make-target dry-runs, and OpenTofu formatting passed. The deleted test target is absent.
  • Both bootstrap roots passed offline tofu init -backend=false -input=false -lockfile=readonly and tofu validate in disposable copies with a local provider mirror. No credentials, remote backend initialization or cloud calls.
  • git diff --check and the added-lines security scan passed; no dangling deleted-test references remain.
  • Publication only: no merge, infrastructure apply, host installation, directory move or live AWS change. These checks are not new live-deployment acceptance evidence.

The current head adds no test files or test suite. Historical test counts and commands below describe earlier revisions.

Historical updates (superseded where noted above)

Source-on-EC2 bootstrap update

Latest infrastructure commit: b0a8e68c27cbf8a9022fac36689d5759181041b8.

  • Default installation now clones a pinned platform source commit on EC2, supplies configuration, and invokes its existing make setup / make up workflow. A local application-image bundle is no longer required; explicit legacy bundles remain supported.
  • Companion platform PR: public/platform#485. For dev01 testing, set platform_revision in aws/environments/dev01.local.json to c332167adbea46ea8755c6decccc268531001bef. That PR need not be merged: the published commit is fetched directly.
  • Preserve the existing SOPS/tools-shell and state flow. After pulling this change or editing the platform pin, generate and review a fresh plan before applying; saved plans bind configuration and source hashes.
  • Verification: final canonical infrastructure suite 229/229 passed; real Debian dependency smoke, cross-repository source-install fixture, platform bootstrap/hosted/component tests and real PostgreSQL 10/10 passed. Independent reviews passed with final source hashes verified.
  • Full platform Rust make test remains blocked by a toolchain/dependency MSRV mismatch. Live fresh-EC2 build/start, DNS/TLS, reboot/retry and terminal/server deployment acceptance remain outstanding.
  • Publication only: no merge, AWS/dev01 apply, secret/state mutation or existing-service changes performed.

Earlier implementation history

The source-on-EC2 workflow above supersedes earlier instructions that required a local platform bundle.

Latest Debian bootstrap correction

Published commit: 899fffc564979ce837597e7c45cef21d5857957b.

  • Official Debian 13 amd64 AMI validation and admin SSH provisioning; checksum-pinned SSM Agent installation with a host-readiness marker.
  • Debian Docker CLI/daemon paths, persistent Docker/containerd storage guards, safe reinstall receipt invalidation, and trusted local bundle validation before provisioning. Rebuild existing bundles to include the current installer.
  • Normal and deferred verification check the selected instance, saved configuration/receipt, mounted data UUID, Docker storage, every required service and loopback health. Normal mode additionally requires local and public TLS health; stale success is discarded on failure.
  • Canonical no-network tools/SOPS suite: 202 tests passed, zero skips, with opt-in tools, real SOPS/GPG, OpenTofu mock/transition, pinned platform source and isolated real PostgreSQL migration/rollback checks enabled. Independent final review passed after fixing the cloud-init test fixture and narrowing the preflight documentation to its actual contract.
  • The real rebuilt pinned bundle passed the current repository validator. This is artifact validation, not fresh application-image rebuilding or live Debian qualification.
  • Existing-environment runbook preserves original account/principal/state, requires a fresh reviewed replacement plan, and explicitly blocks ordinary adoption of populated Docker storage after root replacement.
  • Publication only: no AWS/dev01 apply. Fresh-host installation, retry/reboot persistence, DNS/TLS and terminal/server application build/deploy/attestation remain live acceptance gates. Do not reuse an old saved plan or treat this push as blanket apply approval.

Earlier updates (historical; superseded where noted above)

Latest developer SSH access update

  • Public TCP/22 from 0.0.0.0/0 is explicit, including host-only and DNS-deferred modes. Existing application-port behavior remains unchanged.
  • Add optional ssh_public_key to aws/environments/<environment>.local.json: the complete single-line OpenSSH Ed25519 or RSA public key, not a private key, path or authorized_keys options. Empty/omitted skips provisioning.
  • After an approved platform apply, SSM waits for the agent/cloud-init and additively installs the key in /home/ubuntu/.ssh/authorized_keys, with Ubuntu ownership and modes 0700/0600. Existing keys/restrictions are preserved, repeated keys are not duplicated, and clearing/changing the field does not revoke old keys.
  • Key provisioning does not change launch keys or cloud-init, so adding a key does not replace an existing EC2 host. State-only apply does not touch SSH. Failed/unknown SSM completion reports the already-consumed infrastructure plan and leaves application-install receipts untouched; inspect diagnostics, then create a fresh plan/apply to retry.
  • Verification at 480651012ae3ef65e0412ca3b5e2a7661b40dc48: 177 tests run, 14 conditional skips, including enabled offline OpenTofu mocks/transitions; formatting, diff and credential-pattern checks passed. The generated shell also ran in an isolated root filesystem fixture with actual root-to-UID-1000 ownership changes, correct modes, byte preservation and idempotence. The two opt-in SOPS/GPG integration tests, all ten tools-container smoke tests, and the real pinned-source contract test also passed separately with isolated fixtures: 176 tests exercised successfully. The only unrun check is the optional real PostgreSQL integration. Independent review completed with no blocking findings.
  • Publication only: not applied to AWS. No live SSH login or EC2/SSM acceptance is claimed; the live firewall and authorized keys are unchanged by this push.

Latest development-host sizing update

  • Default platform host is now m7i.2xlarge (8 vCPUs, 32 GiB RAM) for platform services plus co-located agent/development workloads. The 100 GiB data-volume default is unchanged; explicit instance-type overrides remain supported.
  • Updated wrapper and OpenTofu defaults, example configuration, runbook and behavioral regression tests.
  • Verification at d95dbbe6c25f26b565e79adb9ce0a6e9fed0de27: tools-container suite 158 tests run, 14 conditional skips, including enabled offline OpenTofu mock/transition checks; OpenTofu formatting, staged-byte verification and diff checks passed.
  • Publication only: no infrastructure apply, live resize or AWS/DNS mutation. Existing saved plans and explicitly configured smaller hosts are not changed automatically.

Latest dev-environment and manual-DNS updates

  • Import only SMTP and explicitly selected Paddle sandbox settings from a SOPS-encrypted development environment; destination webhook secrets and target identity remain separate.
  • Add explicit mail/Paddle updates with durable same-target interruption recovery, preserved local secrets/invite codes, and refusal to format or adopt an unmanaged volume during updates.
  • Add dns_mode: manual for a dashboard A record pointing to the platform Elastic IP. Installation rejects missing/wrong/extra A answers, stale AAAA answers and lookup failures. Omitted mode retains delegated DNS.
  • Expose the nonsecret public_ip output and update the example/runbook. Existing Route53/runtime resources remain; application domains still need separate DNS records.
  • Verification of the unchanged reviewed candidate: Python suite 127 run, 2 optional skips (including real SOPS/tools-container/DNS-client checks); OpenTofu validation and 20 mock-provider tests passed. Both change sets passed independent review; all 14 staged paths were matched to reviewed source hashes before publication.
  • Publication only: no AWS/DNS mutations or live platform installation. Fresh EC2/SSM, public TLS, email delivery, Paddle routing and application deployment acceptance remain outstanding.

Summary

Bootstrap a development Caution platform inside an existing, manually created AWS account without changing the existing DigitalOcean workflow or adopting a live environment.

  • Split encrypted bootstrap-state foundation from platform infrastructure and host installation.
  • Generate bootstrap targets under the configured AWS account ID, using reusable stage roots and separate state/infrastructure stages. Relocate complete legacy workspaces without changing backend keys or resource identities; reject conflicting or symlinked roots.
  • Provision an m7i.2xlarge EC2 host (8 vCPUs, 32 GiB RAM), with SSM administration and persistent encrypted EBS.
  • State setup and domain-free host tests need only account ID, environment and region. Omit DNS fields for host infrastructure without Route53 or runtime/builder resources. Public TCP/22 for key-based developer SSH is independent of application ingress; application installation remains separate.
  • Keep installation credentials out of Terraform state/variables; permit shared dev SMTP and optional Paddle sandbox settings while retaining per-environment hostnames, databases, local secrets and webhook destination secrets.
  • Build gateway assets with the actual Vite sandbox build argument; validate sandbox gateway image provenance rather than relying on a runtime-only flag.
  • Preserve immutable platform revision, artifact checksums, account/principal guards, encrypted saved plans, interrupted-state-migration protection and idempotent host installation.
  • Use the existing Docker tools-shell/SOPS workflow: make PROVIDER=aws ENVIRONMENT=dev01 DOCKER=0 secrets, then make PROVIDER=aws ENVIRONMENT=dev01 shell. Credentials live in secrets/aws/dev01.enc.env, not plaintext configuration or manual exports. Inner Make retains the selected provider/environment.
  • Complete the pinned tools image's Python/AWS CLI dependency closure; use its BusyBox DNS client. Build static Docker CLI/Buildx clients from checksum-verified, vendored sources with the pinned StageX toolchain. Published dynamic clients intermittently crashed during startup; retries, privilege relaxation and CPU caps are not the fix.
  • Preserve SOPS failures through forwarded-agent cleanup and permit secret creation before the encrypted file exists. Exclude local state, credentials and build artifacts from Docker context.

Latest tools-container verification

  • Canonical BUILDX_BUILDER=default make PROVIDER=aws PROGRESS=plain out/image/tools.digest load-tools: successful OCI build/load.

  • BOOTSTRAP_TOOLS_IMAGE=git.internal.caution.co/public/tools:latest python3 -m unittest discover -s tests -p test_tools_container.py -v: 9 passed. Uses disposable GPG keys, synthetic secrets, no network except a loopback DNS fixture, no published ports and no daemon socket. Covers missing/wrong-key failures, new-secret creation, forwarded-agent cleanup, upstream license/notice retention, real DNS-client parsing, real local encrypted OpenTofu state and 100 consecutive Docker/Buildx starts. The repeated-start test failed before the static-client correction.

  • Preservation coverage includes existing Unix sockets, live symlinks and dangling symlinks. A disposable mutant entrypoint with destructive cleanup was rejected in all three cases; the real entrypoint passed. The license test failed on the previous image, then passed after adding upstream Docker CLI LICENSE/NOTICE and Buildx LICENSE under /usr/share/licenses/.

  • Actual make secrets / make shell exercised through a PTY with disposable home/key/repository fixtures: ciphertext creation, decryption and inherited AWS environment selection passed.

  • Canonical tools-container Docker/Buildx clients completed a real FROM scratch build through the existing host socket and exported byte-identical fixture content. No daemon was installed or started; no application service or cloud resource was changed.

  • make test-bootstrap inside the canonical tools container: 82 tests, successful suite, 11 conditional skips. Nine skipped container tests ran separately above; the other skips are the optional pinned-source fixture and opt-in real PostgreSQL integration. Includes real local OpenTofu encrypted saved-plan/apply/state verification. Executable ephemeral test scratch is required for generated command fixtures (--tmpfs /tmp:exec,mode=1777).

  • Containerized OpenTofu mock-provider tests against isolated temporary copies: platform 20 passed, state foundation 7 passed. No AWS credentials/API calls.

  • Containerized tofu fmt -check -recursive aws, git diff --check, syntax checks and added-diff credential-pattern scan passed. No disposable tools-test containers remained.

  • Account-target relocation: initialized legacy roots and provider/module caches were relocated and reinitialized offline. A real encrypted local-state fixture preserved encrypted bytes and decrypted lineage/serial. Regression coverage includes all five rejected symlink locations and resuming interruption between stage renames. Existing test-account workspaces were not modified.

Earlier bootstrap verification

Before the tools-container correction:

  • Dedicated testing-account state-only plan returned no changes against the established remote foundation.
  • Dedicated-account host-only plan contained 21 create-only resources, a t3.xlarge, zero DNS resources, zero configured inbound rules and no application runtime. The plan was inspected but not applied; the EC2 inventory was empty at that check.

Explicit limits

  • No AWS changes or fresh live AWS verification occurred during this correction. No EC2 host was launched. Manual DNS and full installation remain separate.
  • Full EC2/SSM installation, DNS/ACME, registration, deployment/attestation, reboot persistence and Paddle checkout lifecycle have not been verified live.
  • Tools-container and scratch-build fixtures are not platform deployment or application end-to-end evidence. Real database integration remains opt-in on an explicitly approved isolated test host, never the shared development server.
  • Gateway provenance labels are local builder assertions, not signed attestations.
  • Shared Paddle destinations do not inherently isolate account events; foreign-event routing and overlapping customer identities need separate validation before event fan-out.
  • This is development-account infrastructure, not a production IAM-hardening or billing-isolation claim.

Review and follow-ups

The account-target layout changes passed two independent reviews with no blocking correctness or security findings. Both nonblocking suggestions were addressed: symlink/interruption tests and the runbook verification warning. The final tested tree is unchanged by the history squash.

The independent Docker/SOPS correction review found no blockers. Its two non-blocking suggestions are addressed: static-client upstream license/notice files are retained, and cleanup preservation now has socket/live-link/dangling-link regression coverage. Required current-image smoke and 100-start gates passed.

The earlier staged-bootstrap and domain-free fresh-host reviews found no blockers. The host-only ingress omission is superseded by this SSH change: it declares explicit public TCP/22 and tests the exact host-only rule. The remaining non-blocking follow-up is:

  • The wrapper enforces sandbox gateway provenance. Repeating that check inside the host installer would add defense in depth for callers bypassing the wrapper.
## Automatic DNS default — `eedf46f80e4c9a0ebbed2e2337e8a7cb804b54c0` - New short-form configs default to automatic DNS: derive names from `environment`, select the established `aposdw.space` parent references in memory, and publish parent NS delegation during approved install/update. The example no longer repeats `dns_mode`. - Preserve legacy explicit-name configurations and explicit manual/delegated/deferred behavior. Host-only is now an explicit override. Custom automatic domains require their own complete `parent_dns` settings. - Update README/runbook, including fresh-plan/receipt migration guidance. Identity, immediate-public-parent, conflict and CREATE-only safeguards remain intact. No encrypted-file format changes. ### Verification Exact commit `eedf46f80e4c9a0ebbed2e2337e8a7cb804b54c0`: **14 offline behavioral checks passed**, plus Python syntax/example JSON, CLI help, OpenTofu formatting, Make dry-runs, DNS protection and synthetic encrypted-schema/filtering checks. Scratch probes remain outside the repository; no test framework was added. ```sh docker run --rm --network none --read-only --tmpfs /tmp \ --mount type=bind,src=/home/tuna/git/infrastructure-dns-names,dst=/repo,readonly \ --mount type=bind,src=/tmp/infrastructure-dns-checks,dst=/checks,readonly \ --entrypoint /bin/sh \ sha256:16cfcebf27906476bcf393ae3c999879e7fe946c7182dcc9c77766afefb464eb \ -c 'set -eu; python3 -B /checks/check_auto_dns.py -v; sh /checks/verify.sh; python3 -B /checks/check_cleanup.py' git diff --check ``` Independent final review passed with no security/logic findings, including supplemental comparisons against the immediate pre-change HEAD and receipt-resume/publication-order probes. The committed diff matches the frozen reviewed source manifest. Follow-up size: four files, +65/−33 (net +32). **Deferred/live prerequisites:** no cloud plan/apply, live IAM/DNS, installation or E2E acceptance was performed. Verify that the DNS user's deployed permissions cover the default parent zone; the checked-in policy does not establish that. Normal SOPS access is required. This publication does not merge or deploy anything. --- ## Previous implementation notes ## Cleanup follow-up Commit: `a30e9ba7d9b0f33a3b243a3d990c386ebf29ad8c`. - Remove `dev02-dns-replacement.patch`, an unreferenced one-off patch disabling DNS `prevent_destroy` safeguards. The actual modules retain all three protections. - Inspected the PR's complete added-file inventory and references for scratch, generated, redundant or unused artifacts. No further obsolete files identified; keep the source/template modules, provider lockfiles and encrypted environment inputs used by the bootstrap. - `aws/environments/example.json` was already converted to environment-based naming in `985688a`: no stored `dns_zone_name`, `dashboard_hostname` or `apps_dns_zone_name`. - No encrypted-file format migration is required. The two per-environment SOPS dotenv files retain their credential/state-passphrase schema. Shared defaults filter out old deployment-specific DNS/identity values; bootstrap continues to require normal SOPS decryption access. Operator-owned older JSON inputs outside this checkout still need the documented short-form conversion, not a secret-file rewrite. ### Exact-commit offline verification Existing tools image `sha256:16cfcebf27906476bcf393ae3c999879e7fe946c7182dcc9c77766afefb464eb`, no network, read-only repository/scratch mounts; no decryption/cloud calls: - `python3 -B /checks/check_dns.py -v`: all 8 behavioral checks passed. - `python3 -B /checks/check_cleanup.py`: patch absence, retained DNS protections, migrated example, encrypted credential schema and synthetic legacy-domain filtering checks passed. - `python3 -B scripts/bootstrap-platform.py --help`, all 3 Python script ASTs and example JSON parsing: passed. - `tofu fmt -check -recursive aws`: passed. - `make -n PROVIDER=aws ENVIRONMENT=dev03 DOCKER=0 bootstrap-preflight bootstrap-plan-state bootstrap-apply-state bootstrap-plan bootstrap-apply bootstrap-install bootstrap-update-config bootstrap-verify bootstrap-platform`: passed (dry-run only). - `git diff HEAD^ HEAD --check` and complete previous/current tree comparison: only the requested patch was deleted; all other tracked blobs/modes unchanged. Publication only; no merge, infrastructure apply, DNS mutation or deployment. Offline checks are not live deployment acceptance. --- ## Latest update: derive DNS names from the environment Published correction: `985688ac2265d3893e2d0a6e667577a797b80e00`. - Environment configs store `environment`, not redundant `dns_zone_name`, `dashboard_hostname`, or `apps_dns_zone_name` values. The shared config loader derives those names in memory before planning, installing, or verifying; it does not write them back to the source file. - With the example's manual DNS mode, `dev03` produces `dev03.aposdw.space`, `dashboard.dev03.aposdw.space`, and `apps.dev03.aposdw.space`. Delegated mode uses the same names. Optional `dns_base_domain` preserves other parent domains. - Convert the checked-in environment example and update the README/runbook, including existing-file migration. No additional deployment `.local.json` files were present in the inspected infrastructure worktrees; no claim is made that external dev01/dev02 files were edited. Preserve environment/state identity and existing effective addresses when converting; nonstandard addresses require a reviewed migration. - Preserve bare host-only/deferred modes, existing internal DNS-name validation, parent-delegation binding, and saved-plan checks. Equivalent short-form configurations produce the same canonical runtime inputs; changed effective inputs invalidate saved plans. ### Verification of this correction At `985688ac2265d3893e2d0a6e667577a797b80e00`, in the existing tools image `sha256:16cfcebf27906476bcf393ae3c999879e7fe946c7182dcc9c77766afefb464eb`, with networking disabled, a read-only source mount, synthetic inputs and no credentials: - `python3 /checks/check_dns.py -v`: **8 temporary behavioral checks passed**. Covers generated OpenTofu variables, unchanged source-file bytes, normalization idempotence, all config stages, manual/delegated/parent DNS, custom domains, invalid/ambiguous inputs, host-only/deferred behavior and saved-plan invalidation. Migration fixtures match the exact previous revision's validator. The new-behavior probes fail against the previous PR head and pass against this correction. The probes remain local-only; no test suite is added to the PR. - Python AST parsing for all three scripts and example JSON parsing: passed. - `python3 scripts/bootstrap-platform.py --help`: passed. - `tofu fmt -check -recursive aws`: passed. - `make -n PROVIDER=aws ENVIRONMENT=dev03 DOCKER=0 bootstrap-preflight bootstrap-plan-state bootstrap-apply-state bootstrap-plan bootstrap-apply bootstrap-install bootstrap-update-config bootstrap-verify bootstrap-platform`: passed (dry-runs only). - `git diff --check`, changed-file allowlist and added-lines credential/injection scan: passed. IaC resources, Make targets and installer are unchanged. - Two independent read-only reviews found no blocking defects; the final reviewer also ran all eight offline checks. Review evidence covers the focused correction, not live deployment acceptance. **Publication only:** no merge, cloud calls, infrastructure plan/apply, DNS changes, installation or deployment. Offline normalization checks do not establish live deployment acceptance. --- ## Previous PR description ## Latest update: component S3 IAM parity Published correction: [`05a8cf75caa5`](https://git.caution.co/public/infrastructure/commit/05a8cf75caa510e9f1093c0ed4a4bfed13120571). - Restore `components/v1/*` ListBucket prefixes for the platform deployment principal and builder. - Separate unconditional component reads from publication. Only PutObject to the existing blob, build-index and manifest namespaces is granted, with `s3:if-none-match = "*"`; remove the overlapping unrestricted component write grant. - Preserve builder read-only component access and existing writes to `builds/*` / `eifs/*`; other runtime resources and IAM statements are unchanged. - Verification: OpenTofu validation/formatting and independent review passed. The two offline policy checks remain local-only; no test files are included in this commit. - Resolves the managed-bucket component IAM prerequisite recorded in [Platform cleanup PR #490](https://git.caution.co/public/platform/pulls/490). Alternate-source permissions and existing-state adoption remain separate reviewed work. - **Publication only:** no merge, AWS API calls, infrastructure apply, live IAM changes or deployment. Existing accounts need a fresh reviewed plan/apply before the new policy takes effect. ## Previous update: existing DNS IAM user Published correction: `34abcf30d3b3cd8b3abd2ea5d99829e2c905c0ea` on `feat/aws-platform-bootstrap`. - Correct the parent publisher to use the existing `arn:aws:iam::902883118030:user/dns` declared by `aws_iam_user.dns`, not an assumed role. Configuration now takes `zone_id`, `user_arn`, and an explicit repository-relative `credentials_file` pointing at an existing SOPS YAML Secret. No role, trust policy, new IAM key or credential store is created. - Decrypt the selected existing Secret in memory and verify its exact STS caller ARN before any Route53 request. Dedicated explicit-key SDK clients leave dev-account administrator credentials untouched. No DNS keys enter command arguments, logs, configuration files or the platform installer. - Retain applied-output binding, immediate-public-parent validation, matching-record no-op, conflict refusal, CREATE-only publication and INSYNC/public-DNS gates. Resume behavior is unchanged. Direct IAM-user keys retain their existing policy permissions; this is not an attenuated role session. - Verification: 14 temporary configuration/credential/DNS checks and 4 installation-order/recovery checks passed with networking disabled; syntax, CLI help, exact patch application, Make dry-runs, added-lines security scan and independent review passed. No committed test suite was reintroduced. - Local SOPS decryption of the existing secret failed; none of its five PGP recipients matches an available local secret-key fingerprint. Live key ownership and parent-zone permissions were therefore not verified here. The runbook now explicitly notes that the checked-in DNS policy does not grant zone-specific access to the example parent zone; deployed permissions must be verified separately. Runtime STS verification fails closed. No AWS mutations, IAM edits, merge or host installation were performed. ## Previous update: remove added tests Published infrastructure revision: `41236e3aae9af7da7790512b6e0201e2a21dd9b5`. - Remove all 18 test/support files added by this PR: 13 Python files and 5 native OpenTofu test files. The base branch had no test suite. Remove the obsolete test target, its documentation and test-only references as well: **7,006 net lines removed** in this commit. - Preserve the source-only installation workflow through ordinary upstream `make setup` / `make up`; optional bundle packaging and installation remain removed. - Installer code, Terraform resources, account/identity binding, persistent-data and secret protections, recovery, DNS/TLS and mail/Paddle safeguards are unchanged by this test removal. - No bootstrap directory restructuring is included. ### Verification of this update - The published diff matches the independently reviewed candidate; retained runtime files are byte-identical to the verified source. Independent removal review passed without security or logic findings. - Existing tools container, no network and read-only source mounts: Python syntax checks for all three scripts, bootstrap CLI help, all bootstrap Make-target dry-runs, and OpenTofu formatting passed. The deleted test target is absent. - Both bootstrap roots passed offline `tofu init -backend=false -input=false -lockfile=readonly` and `tofu validate` in disposable copies with a local provider mirror. No credentials, remote backend initialization or cloud calls. - `git diff --check` and the added-lines security scan passed; no dangling deleted-test references remain. - **Publication only: no merge, infrastructure apply, host installation, directory move or live AWS change.** These checks are not new live-deployment acceptance evidence. **The current head adds no test files or test suite. Historical test counts and commands below describe earlier revisions.** ## Historical updates (superseded where noted above) ## Source-on-EC2 bootstrap update Latest infrastructure commit: `b0a8e68c27cbf8a9022fac36689d5759181041b8`. - Default installation now clones a pinned platform source commit on EC2, supplies configuration, and invokes its existing `make setup` / `make up` workflow. A local application-image bundle is no longer required; explicit legacy bundles remain supported. - Companion platform PR: https://git.caution.co/public/platform/pulls/485. For dev01 testing, set `platform_revision` in `aws/environments/dev01.local.json` to `c332167adbea46ea8755c6decccc268531001bef`. That PR need not be merged: the published commit is fetched directly. - Preserve the existing SOPS/tools-shell and state flow. After pulling this change or editing the platform pin, generate and review a **fresh plan** before applying; saved plans bind configuration and source hashes. - Verification: final canonical infrastructure suite **229/229 passed**; real Debian dependency smoke, cross-repository source-install fixture, platform bootstrap/hosted/component tests and real PostgreSQL **10/10** passed. Independent reviews passed with final source hashes verified. - Full platform Rust `make test` remains blocked by a toolchain/dependency MSRV mismatch. Live fresh-EC2 build/start, DNS/TLS, reboot/retry and terminal/server deployment acceptance remain outstanding. - **Publication only: no merge, AWS/dev01 apply, secret/state mutation or existing-service changes performed.** ## Earlier implementation history The source-on-EC2 workflow above supersedes earlier instructions that required a local platform bundle. ## Latest Debian bootstrap correction Published commit: `899fffc564979ce837597e7c45cef21d5857957b`. - Official Debian 13 amd64 AMI validation and `admin` SSH provisioning; checksum-pinned SSM Agent installation with a host-readiness marker. - Debian Docker CLI/daemon paths, persistent Docker/containerd storage guards, safe reinstall receipt invalidation, and trusted local bundle validation before provisioning. Rebuild existing bundles to include the current installer. - Normal and deferred verification check the selected instance, saved configuration/receipt, mounted data UUID, Docker storage, every required service and loopback health. Normal mode additionally requires local and public TLS health; stale success is discarded on failure. - Canonical no-network tools/SOPS suite: **202 tests passed, zero skips**, with opt-in tools, real SOPS/GPG, OpenTofu mock/transition, pinned platform source and isolated real PostgreSQL migration/rollback checks enabled. Independent final review passed after fixing the cloud-init test fixture and narrowing the preflight documentation to its actual contract. - The real rebuilt pinned bundle passed the current repository validator. This is artifact validation, not fresh application-image rebuilding or live Debian qualification. - Existing-environment runbook preserves original account/principal/state, requires a fresh reviewed replacement plan, and explicitly blocks ordinary adoption of populated Docker storage after root replacement. - **Publication only: no AWS/dev01 apply.** Fresh-host installation, retry/reboot persistence, DNS/TLS and terminal/server application build/deploy/attestation remain live acceptance gates. Do not reuse an old saved plan or treat this push as blanket apply approval. ## Earlier updates (historical; superseded where noted above) ## Latest developer SSH access update - Public TCP/22 from `0.0.0.0/0` is explicit, including host-only and DNS-deferred modes. Existing application-port behavior remains unchanged. - Add optional `ssh_public_key` to `aws/environments/<environment>.local.json`: the complete single-line OpenSSH Ed25519 or RSA public key, not a private key, path or authorized_keys options. Empty/omitted skips provisioning. - After an approved platform apply, SSM waits for the agent/cloud-init and additively installs the key in `/home/ubuntu/.ssh/authorized_keys`, with Ubuntu ownership and modes 0700/0600. Existing keys/restrictions are preserved, repeated keys are not duplicated, and clearing/changing the field does not revoke old keys. - Key provisioning does not change launch keys or cloud-init, so adding a key does not replace an existing EC2 host. State-only apply does not touch SSH. Failed/unknown SSM completion reports the already-consumed infrastructure plan and leaves application-install receipts untouched; inspect diagnostics, then create a fresh plan/apply to retry. - Verification at `480651012ae3ef65e0412ca3b5e2a7661b40dc48`: **177 tests run, 14 conditional skips**, including enabled offline OpenTofu mocks/transitions; formatting, diff and credential-pattern checks passed. The generated shell also ran in an isolated root filesystem fixture with actual root-to-UID-1000 ownership changes, correct modes, byte preservation and idempotence. The two opt-in SOPS/GPG integration tests, all ten tools-container smoke tests, and the real pinned-source contract test also passed separately with isolated fixtures: **176 tests exercised successfully**. The only unrun check is the optional real PostgreSQL integration. Independent review completed with no blocking findings. - Publication only: **not applied to AWS**. No live SSH login or EC2/SSM acceptance is claimed; the live firewall and authorized keys are unchanged by this push. ## Latest development-host sizing update - Default platform host is now `m7i.2xlarge` (8 vCPUs, 32 GiB RAM) for platform services plus co-located agent/development workloads. The 100 GiB data-volume default is unchanged; explicit instance-type overrides remain supported. - Updated wrapper and OpenTofu defaults, example configuration, runbook and behavioral regression tests. - Verification at `d95dbbe6c25f26b565e79adb9ce0a6e9fed0de27`: tools-container suite **158 tests run, 14 conditional skips**, including enabled offline OpenTofu mock/transition checks; OpenTofu formatting, staged-byte verification and diff checks passed. - Publication only: no infrastructure apply, live resize or AWS/DNS mutation. Existing saved plans and explicitly configured smaller hosts are not changed automatically. ## Latest dev-environment and manual-DNS updates - Import only SMTP and explicitly selected Paddle sandbox settings from a SOPS-encrypted development environment; destination webhook secrets and target identity remain separate. - Add explicit mail/Paddle updates with durable same-target interruption recovery, preserved local secrets/invite codes, and refusal to format or adopt an unmanaged volume during updates. - Add `dns_mode: manual` for a dashboard A record pointing to the platform Elastic IP. Installation rejects missing/wrong/extra A answers, stale AAAA answers and lookup failures. Omitted mode retains delegated DNS. - Expose the nonsecret `public_ip` output and update the example/runbook. Existing Route53/runtime resources remain; application domains still need separate DNS records. - Verification of the unchanged reviewed candidate: Python suite **127 run, 2 optional skips** (including real SOPS/tools-container/DNS-client checks); OpenTofu validation and **20 mock-provider tests passed**. Both change sets passed independent review; all 14 staged paths were matched to reviewed source hashes before publication. - Publication only: no AWS/DNS mutations or live platform installation. Fresh EC2/SSM, public TLS, email delivery, Paddle routing and application deployment acceptance remain outstanding. ## Summary Bootstrap a development Caution platform inside an existing, manually created AWS account without changing the existing DigitalOcean workflow or adopting a live environment. - Split encrypted bootstrap-state foundation from platform infrastructure and host installation. - Generate bootstrap targets under the configured AWS account ID, using reusable stage roots and separate state/infrastructure stages. Relocate complete legacy workspaces without changing backend keys or resource identities; reject conflicting or symlinked roots. - Provision an `m7i.2xlarge` EC2 host (8 vCPUs, 32 GiB RAM), with SSM administration and persistent encrypted EBS. - State setup and domain-free host tests need only account ID, environment and region. Omit DNS fields for host infrastructure without Route53 or runtime/builder resources. Public TCP/22 for key-based developer SSH is independent of application ingress; application installation remains separate. - Keep installation credentials out of Terraform state/variables; permit shared dev SMTP and optional Paddle sandbox settings while retaining per-environment hostnames, databases, local secrets and webhook destination secrets. - Build gateway assets with the actual Vite sandbox build argument; validate sandbox gateway image provenance rather than relying on a runtime-only flag. - Preserve immutable platform revision, artifact checksums, account/principal guards, encrypted saved plans, interrupted-state-migration protection and idempotent host installation. - Use the existing Docker tools-shell/SOPS workflow: `make PROVIDER=aws ENVIRONMENT=dev01 DOCKER=0 secrets`, then `make PROVIDER=aws ENVIRONMENT=dev01 shell`. Credentials live in `secrets/aws/dev01.enc.env`, not plaintext configuration or manual exports. Inner Make retains the selected provider/environment. - Complete the pinned tools image's Python/AWS CLI dependency closure; use its BusyBox DNS client. Build static Docker CLI/Buildx clients from checksum-verified, vendored sources with the pinned StageX toolchain. Published dynamic clients intermittently crashed during startup; retries, privilege relaxation and CPU caps are not the fix. - Preserve SOPS failures through forwarded-agent cleanup and permit secret creation before the encrypted file exists. Exclude local state, credentials and build artifacts from Docker context. ## Latest tools-container verification - Canonical `BUILDX_BUILDER=default make PROVIDER=aws PROGRESS=plain out/image/tools.digest load-tools`: successful OCI build/load. - `BOOTSTRAP_TOOLS_IMAGE=git.internal.caution.co/public/tools:latest python3 -m unittest discover -s tests -p test_tools_container.py -v`: **9 passed**. Uses disposable GPG keys, synthetic secrets, no network except a loopback DNS fixture, no published ports and no daemon socket. Covers missing/wrong-key failures, new-secret creation, forwarded-agent cleanup, upstream license/notice retention, real DNS-client parsing, real local encrypted OpenTofu state and **100 consecutive Docker/Buildx starts**. The repeated-start test failed before the static-client correction. - Preservation coverage includes existing Unix sockets, live symlinks and dangling symlinks. A disposable mutant entrypoint with destructive cleanup was rejected in all three cases; the real entrypoint passed. The license test failed on the previous image, then passed after adding upstream Docker CLI LICENSE/NOTICE and Buildx LICENSE under `/usr/share/licenses/`. - Actual `make secrets` / `make shell` exercised through a PTY with disposable home/key/repository fixtures: ciphertext creation, decryption and inherited AWS environment selection passed. - Canonical tools-container Docker/Buildx clients completed a real `FROM scratch` build through the existing host socket and exported byte-identical fixture content. No daemon was installed or started; no application service or cloud resource was changed. - `make test-bootstrap` inside the canonical tools container: **82 tests, successful suite, 11 conditional skips**. Nine skipped container tests ran separately above; the other skips are the optional pinned-source fixture and opt-in real PostgreSQL integration. Includes real local OpenTofu encrypted saved-plan/apply/state verification. Executable ephemeral test scratch is required for generated command fixtures (`--tmpfs /tmp:exec,mode=1777`). - Containerized OpenTofu mock-provider tests against isolated temporary copies: platform **20 passed**, state foundation **7 passed**. No AWS credentials/API calls. - Containerized `tofu fmt -check -recursive aws`, `git diff --check`, syntax checks and added-diff credential-pattern scan passed. No disposable tools-test containers remained. - Account-target relocation: initialized legacy roots and provider/module caches were relocated and reinitialized offline. A real encrypted local-state fixture preserved encrypted bytes and decrypted lineage/serial. Regression coverage includes all five rejected symlink locations and resuming interruption between stage renames. Existing test-account workspaces were not modified. ## Earlier bootstrap verification Before the tools-container correction: - Dedicated testing-account state-only plan returned **no changes** against the established remote foundation. - Dedicated-account host-only plan contained **21 create-only resources**, a `t3.xlarge`, zero DNS resources, zero configured inbound rules and no application runtime. The plan was inspected but **not applied**; the EC2 inventory was empty at that check. ## Explicit limits - No AWS changes or fresh live AWS verification occurred during this correction. No EC2 host was launched. Manual DNS and full installation remain separate. - Full EC2/SSM installation, DNS/ACME, registration, deployment/attestation, reboot persistence and Paddle checkout lifecycle have **not** been verified live. - Tools-container and scratch-build fixtures are not platform deployment or application end-to-end evidence. Real database integration remains opt-in on an explicitly approved isolated test host, never the shared development server. - Gateway provenance labels are local builder assertions, not signed attestations. - Shared Paddle destinations do not inherently isolate account events; foreign-event routing and overlapping customer identities need separate validation before event fan-out. - This is development-account infrastructure, not a production IAM-hardening or billing-isolation claim. ## Review and follow-ups The account-target layout changes passed two independent reviews with no blocking correctness or security findings. Both nonblocking suggestions were addressed: symlink/interruption tests and the runbook verification warning. The final tested tree is unchanged by the history squash. The independent Docker/SOPS correction review found no blockers. Its two non-blocking suggestions are addressed: static-client upstream license/notice files are retained, and cleanup preservation now has socket/live-link/dangling-link regression coverage. Required current-image smoke and 100-start gates passed. The earlier staged-bootstrap and domain-free fresh-host reviews found no blockers. The host-only ingress omission is superseded by this SSH change: it declares explicit public TCP/22 and tests the exact host-only rule. The remaining non-blocking follow-up is: - The wrapper enforces sandbox gateway provenance. Repeating that check inside the host installer would add defense in depth for callers bypassing the wrapper. 
Add encrypted bootstrap state, isolated AWS infrastructure, pinned artifacts and host installation. Support domain-free SSM-only host tests, a four-vCPU default, and optional shared development SMTP/Paddle sandbox configuration.
drgrove reviewed 2026-10-12 21:52:00 +00:00
drgrove left a comment
Owner
Copy link

Target in AWS should be the account that you want to deploy to

Target in AWS should be the account that you want to deploy to
anton force-pushed feat/aws-platform-bootstrap from 667600c64c to cffd2531a7 2026-10-15 18:22:52 +00:00 Compare
anton changed title from feat(aws): add staged development platform bootstrap to WIP: feat(aws): add staged development platform bootstrap 2026-10-15 19:05:06 +00:00
anton force-pushed feat/aws-platform-bootstrap from cffd2531a7 to 7174832c6b 2026-10-15 19:09:22 +00:00 Compare 
Import allowlisted SMTP and opt-in Paddle sandbox configuration from SOPS. Add explicit mail/billing updates with durable same-target recovery and preserved host identity, local secrets and invite codes.

Support a manual dashboard A record with fail-closed A/AAAA validation against the platform Elastic IP, expose the nonsecret public_ip output, and document the operator workflow.

Verified unchanged candidates against independent reviews; Python suite: 127 run, 2 optional skips. OpenTofu platform mock-provider suite: 20 passed. No live AWS deployment claimed.
Replace the mail-only fallback with a full SOPS-encrypted development base dotenv. Preserve reusable defaults while destination overrides, runtime identity and persisted local secrets remain authoritative.

Verification: canonical isolated tools-container suite ran 240 tests (224 passed, 16 skipped), including 3 real disposable-key SOPS/GPG tests. Independent review passed; malformed generic-setting coverage was mutation-verified. Actual recipient-key decryption and live installation were not performed.
Allow the runtime publisher GET/PUT and dedicated builders GET under components/v1/* in the EIF bucket. Keep existing object and listing permissions unchanged.

Regression assertions reproduced both missing grants before the fixes. Verified with the pinned tools image: make test-bootstrap (224 passed, 19 opt-in skips), opt-in Terraform tests (4 passed), tofu fmt, and independent review. Live IAM apply and installation retry remain operator actions.
Resolve main once per source installation and retain exact revision receipts.
Use ordinary setup/up, preserve source-update state, and bind failed
configuration-update retries to the original commit and request.

Verified: 269 tests run, 19 conditional skips; independent reviews passed.
anton reviewed 2026-10-19 23:40:28 +00:00
README.md Outdated
@ -24,0 +33,4 @@
Like other operations, run this in the Docker tools shell with SOPS-managed secrets:
```sh
make PROVIDER=aws ENVIRONMENT=dev01 DOCKER=0 secrets
anton commented 2026-10-19 23:40:28 +00:00
Author
Owner
Copy link

replace dev01 with <your_env_name(e.g dev01)>

replace dev01 with <your_env_name(e.g dev01)>
anton reviewed 2026-10-19 23:41:02 +00:00
README.md Outdated
@ -24,0 +35,4 @@
```sh
make PROVIDER=aws ENVIRONMENT=dev01 DOCKER=0 secrets
make PROVIDER=aws ENVIRONMENT=dev01 shell
# Inside the container, after creating aws/environments/dev01.local.json:
anton commented 2026-10-19 23:41:02 +00:00
Author
Owner
Copy link

link to example.json to make it easier to figure out what the file looks like

link to example.json to make it easier to figure out what the file looks like
anton reviewed 2026-10-19 23:46:04 +00:00
aws/src/platform_runtime/README.md Outdated
@ -0,0 +1,37 @@
# Development-only runtime compatibility boundary
anton commented 2026-10-19 23:46:04 +00:00
Author
Owner
Copy link

i don't think we need this file aws/src/platform_runtime/README.md

i don't think we need this file aws/src/platform_runtime/README.md
anton reviewed 2026-10-19 23:46:48 +00:00
runbooks/bootstrap-aws-platform.md Outdated
@ -0,0 +1,634 @@
# Bootstrap an isolated AWS development platform
anton commented 2026-10-19 23:46:48 +00:00
Author
Owner
Copy link

this file is way too long, make it more succinct

this file is way too long, make it more succinct
Retain pinned source-checkout installation through upstream make setup/up,
including jq and the existing secret, data, DNS and retry safeguards.

Remove bundle packaging/install machinery, redundant tests and docs, and
unused runtime aliases. Share retained test fixtures and exercise both
native OpenTofu roots.

Verification: 251 unique retained tests passed across the stable offline
SOPS/OpenTofu suite and separate tools-container checks. Independent
quality review passed; the late documentation finding is corrected.
anton force-pushed feat/aws-platform-bootstrap from 9ce4ce1beb to 43a3c4470b 2026-10-20 05:39:20 +00:00 Compare
anton force-pushed feat/aws-platform-bootstrap from 9f091f25e6 to 05a8cf75ca 2026-10-20 18:07:13 +00:00 Compare
This pull request is marked as a work in progress.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/aws-platform-bootstrap:feat/aws-platform-bootstrap
git switch feat/aws-platform-bootstrap
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
public/infrastructure!5
No description provided.