static-scope-setup.tf.example

# =============================================================================
# Static Scope - Complete Setup Reference
#
# This file contains all the configuration needed to enable static scopes
# in a nullplatform AWS implementation. Copy each section to the corresponding
# file in your repository.
# =============================================================================


# =============================================================================
# 1. nullplatform/main.tf - Scope Definition
# =============================================================================

module "scope_definition_static_scope" {
  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v1.39.0"

  nrn        = var.nrn
  np_api_key = var.np_api_key

  service_path             = var.service_path_static_scope
  service_spec_name        = var.service_spec_name_static_scope
  service_spec_description = var.service_spec_description_static_scope
  action_spec_names        = var.action_spec_names_static_scope

  repository_service_spec            = "https://raw.githubusercontent.com/nullplatform/scopes-static-files/refs/heads"
  repository_service_spec_branch     = "main"
  repository_scope_template          = "https://raw.githubusercontent.com/nullplatform/scopes-static-files/refs/heads"
  repository_scope_template_branch   = "main"
  repository_action_templates        = "https://raw.githubusercontent.com/nullplatform/scopes-static-files/refs/heads"
  repository_action_templates_branch = "main"
}


# =============================================================================
# 2. nullplatform/variables.tf - Scope Definition Variables
# =============================================================================

variable "service_path_static_scope" {
  description = "Path to the static scope service directory"
  type        = string
  default     = "static-files"
}

variable "service_spec_name_static_scope" {
  description = "Name of the static scope service specification"
  type        = string
  default     = "Static Scope"
}

variable "service_spec_description_static_scope" {
  description = "Description of the static scope service specification"
  type        = string
  default     = "Allows you to deploy static content to S3"
}

variable "action_spec_names_static_scope" {
  description = "List of action specification names for static scopes"
  type        = list(string)
  default = [
    "create-scope",
    "delete-scope",
    "start-initial",
    "start-blue-green",
    "finalize-blue-green",
    "rollback-deployment",
    "delete-deployment"
  ]
}


# =============================================================================
# 3. nullplatform/outputs.tf - Scope Definition Outputs
# =============================================================================

output "scope_specification_id_static_scope" {
  description = "Scope specification ID for static scope"
  value       = module.scope_definition_static_scope.service_specification_id
}

output "scope_specification_slug_static_scope" {
  description = "Scope specification slug for static scope"
  value       = module.scope_definition_static_scope.service_slug
}


# =============================================================================
# 4. nullplatform-bindings/locals.tf - Add these locals
# =============================================================================

# scope_specification_id_static_scope   = data.terraform_remote_state.nullplatform.outputs.scope_specification_id_static_scope
# scope_specification_slug_static_scope = data.terraform_remote_state.nullplatform.outputs.scope_specification_slug_static_scope


# =============================================================================
# 5. nullplatform-bindings/main.tf - API Key + Channel Association
# =============================================================================

module "scope_notification_api_key_static_scope" {
  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v1.39.0"

  type               = "scope_notification"
  nrn                = var.nrn
  specification_slug = local.scope_specification_slug_static_scope
}

module "scope_definition_channel_association_static_scope" {
  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v1.39.0"

  nrn                      = var.nrn
  api_key                  = module.scope_notification_api_key_static_scope.api_key
  scope_specification_id   = local.scope_specification_id_static_scope
  scope_specification_slug = local.scope_specification_slug_static_scope
  tags_selectors           = var.tags_selectors
  service_path             = "static-files"
  repo_path                = "/root/.np/nullplatform/scopes-static-files"

  repository_notification_channel        = "https://raw.githubusercontent.com/nullplatform/scopes-static-files/refs/heads"
  repository_notification_channel_branch = "main"
}


# =============================================================================
# 6. infrastructure/aws/main.tf - Agent: add scopes-static-files repo
# =============================================================================

# In module "agent", add this to agent_repos_extra:
#   agent_repos_extra = ["https://github.com/nullplatform/scopes-static-files.git#main"]


# =============================================================================
# 7. infrastructure/aws/main.tf - Agent IAM: attach static scopes policy
# =============================================================================

# In module "agent_iam", add to additional_policies:
#   additional_policies = {
#     "static_scopes_policy" = aws_iam_policy.agent_static_scopes.arn
#   }


# =============================================================================
# 8. infrastructure/aws/iam_policies.tf - Agent IAM Policy
# =============================================================================

resource "aws_iam_policy" "agent_static_scopes" {
  name        = "nullplatform_${module.eks.eks_cluster_name}_static_scopes_policy"
  description = "Policy for static scopes (S3, CloudFront, ACM, Route53)"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "S3StaticAssets"
        Effect = "Allow"
        Action = [
          "s3:GetObject",
          "s3:PutObject",
          "s3:DeleteObject",
          "s3:ListBucket",
          "s3:GetBucketLocation",
          "s3:GetBucketPolicy",
          "s3:PutBucketPolicy",
          "s3:DeleteBucketPolicy"
        ]
        Resource = "*"
      },
      {
        Sid    = "CloudFrontDistribution"
        Effect = "Allow"
        Action = [
          "cloudfront:CreateDistribution",
          "cloudfront:UpdateDistribution",
          "cloudfront:DeleteDistribution",
          "cloudfront:GetDistribution",
          "cloudfront:ListDistributions",
          "cloudfront:TagResource",
          "cloudfront:UntagResource",
          "cloudfront:ListTagsForResource",
          "cloudfront:CreateInvalidation",
          "cloudfront:CreateOriginAccessControl",
          "cloudfront:GetOriginAccessControl",
          "cloudfront:UpdateOriginAccessControl",
          "cloudfront:DeleteOriginAccessControl"
        ]
        Resource = "*"
      },
      {
        Sid    = "ACMCertificates"
        Effect = "Allow"
        Action = [
          "acm:ListCertificates",
          "acm:DescribeCertificate",
          "acm:GetCertificate",
          "acm:ListTagsForCertificate"
        ]
        Resource = "*"
      },
      {
        Sid    = "Route53DNS"
        Effect = "Allow"
        Action = [
          "route53:ListHostedZones",
          "route53:GetHostedZone",
          "route53:ChangeResourceRecordSets",
          "route53:ListResourceRecordSets",
          "route53:GetChange"
        ]
        Resource = "*"
      }
    ]
  })
}


# =============================================================================
# 9. infrastructure/aws/variables.tf - Agent image tag
# =============================================================================

variable "image_tag" {
  description = "Docker image tag for the Nullplatform agent"
  type        = string
  default     = "aws"
}