FEAT: Media Convert + s3 Integration

infrastructure/main.go

@@ -98,7 +98,7 @@ func deployFargateService(
 	dbAddress pulumi.StringOutput,
 	dbPort pulumi.IntOutput,
 	dbPassword *random.RandomPassword,
-) (*ecr.Repository, *lb.LoadBalancer, error) {
+) (*ecr.Repository, *ecs.Service, *lb.LoadBalancer, error) {
 	alb, err := lb.NewLoadBalancer(ctx, name+"-alb", &lb.LoadBalancerArgs{
 		LoadBalancerType: pulumi.String("application"),
 		Internal:         pulumi.Bool(false),
@@ -106,7 +106,7 @@ func deployFargateService(
 		Subnets:          pulumi.ToStringArray(subnetIDs),
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
 	repo, err := ecr.NewRepository(ctx, name+"-repo", &ecr.RepositoryArgs{
@@ -115,7 +115,7 @@ func deployFargateService(
 		ForceDelete:        pulumi.Bool(true),
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
 	logGroup, err := cloudwatch.NewLogGroup(ctx, name+"-logs", &cloudwatch.LogGroupArgs{
@@ -123,7 +123,7 @@ func deployFargateService(
 		RetentionInDays: pulumi.Int(7),
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
 	secret, err := secretsmanager.NewSecret(ctx, name+"-db-secret", &secretsmanager.SecretArgs{
@@ -131,7 +131,7 @@ func deployFargateService(
 		RecoveryWindowInDays: pulumi.Int(0),
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
 	_, err = secretsmanager.NewSecretVersion(ctx, name+"-db-secret-version", &secretsmanager.SecretVersionArgs{
@@ -139,7 +139,7 @@ func deployFargateService(
 		SecretString: dbPassword.Result,
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
 	secretPolicy := secret.Arn.ApplyT(func(secretArn string) (string, error) {
@@ -162,7 +162,7 @@ func deployFargateService(
 		Policy: secretPolicy,
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
 	targetGroup, err := lb.NewTargetGroup(ctx, name+"-tg", &lb.TargetGroupArgs{
@@ -176,7 +176,7 @@ func deployFargateService(
 		},
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
 	listener, err := lb.NewListener(ctx, name+"-listener", &lb.ListenerArgs{
@@ -191,7 +191,7 @@ func deployFargateService(
 		},
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
 	containerDefinitions := pulumi.All(repo.RepositoryUrl, logGroup.Name, secret.Arn, dbAddress, dbPort).ApplyT(
@@ -243,10 +243,10 @@ func deployFargateService(
 		ContainerDefinitions:    containerDefinitions,
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
-	_, err = ecs.NewService(ctx, name+"-service", &ecs.ServiceArgs{
+	service, err := ecs.NewService(ctx, name+"-service", &ecs.ServiceArgs{
 		Cluster:        cluster.Arn,
 		TaskDefinition: taskDefinition.Arn,
 		DesiredCount:   pulumi.Int(1),
@@ -265,10 +265,10 @@ func deployFargateService(
 		},
 	}, pulumi.DependsOn([]pulumi.Resource{listener}))
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
-	return repo, alb, nil
+	return repo, service, alb, nil
 }
 
 func main() {
@@ -579,20 +579,91 @@ func main() {
 			return err
 		}
 
-		cmsRepo, cmsAlb, err := deployFargateService(ctx, "cms", 8081,
+		cmsRepo, cmsService, cmsAlb, err := deployFargateService(ctx, "cms", 8081,
 			cluster, execRole, vpc.Id, subnets.Ids, albSecurityGroup, serviceSecurityGroup,
 			db.Address, db.Port, cmsPassword)
 		if err != nil {
 			return err
 		}
 
-		discoveryRepo, discoveryAlb, err := deployFargateService(ctx, "discovery", 8080,
+		discoveryRepo, discoveryService, discoveryAlb, err := deployFargateService(ctx, "discovery", 8080,
 			cluster, execRole, vpc.Id, subnets.Ids, albSecurityGroup, serviceSecurityGroup,
 			db.Address, db.Port, discoveryPassword)
 		if err != nil {
 			return err
 		}
 
+		// Gitea Actions CI: one IAM user, scoped to just what the build/deploy
+		// pipeline needs — push images to the two ECR repos and force a new
+		// deployment on the two ECS services. Credentials are exported as
+		// stack secrets for the pipeline to consume (e.g. as Gitea Actions
+		// secrets); nothing broader like ecr:*, ecs:*, or task-def changes.
+		giteaCIPolicyDocument := pulumi.All(cmsRepo.Arn, discoveryRepo.Arn, cmsService.Arn, discoveryService.Arn).ApplyT(
+			func(args []any) (string, error) {
+				cmsRepoArn := args[0].(string)
+				discoveryRepoArn := args[1].(string)
+				cmsServiceArn := args[2].(string)
+				discoveryServiceArn := args[3].(string)
+
+				doc := map[string]any{
+					"Version": "2012-10-17",
+					"Statement": []map[string]any{
+						{
+							"Sid":      "ECRAuth",
+							"Effect":   "Allow",
+							"Action":   "ecr:GetAuthorizationToken",
+							"Resource": "*",
+						},
+						{
+							"Sid":    "ECRPush",
+							"Effect": "Allow",
+							"Action": []string{
+								"ecr:BatchCheckLayerAvailability",
+								"ecr:PutImage",
+								"ecr:InitiateLayerUpload",
+								"ecr:UploadLayerPart",
+								"ecr:CompleteLayerUpload",
+							},
+							"Resource": []string{cmsRepoArn, discoveryRepoArn},
+						},
+						{
+							"Sid":    "ECSDeploy",
+							"Effect": "Allow",
+							"Action": []string{
+								"ecs:UpdateService",
+								"ecs:DescribeServices",
+							},
+							"Resource": []string{cmsServiceArn, discoveryServiceArn},
+						},
+					},
+				}
+				b, err := json.Marshal(doc)
+				return string(b), err
+			},
+		).(pulumi.StringOutput)
+
+		giteaCIUser, err := iam.NewUser(ctx, "gitea-ci-user", &iam.UserArgs{
+			Name: pulumi.String("gitea-ci"),
+		})
+		if err != nil {
+			return err
+		}
+
+		_, err = iam.NewUserPolicy(ctx, "gitea-ci-policy", &iam.UserPolicyArgs{
+			User:   giteaCIUser.Name,
+			Policy: giteaCIPolicyDocument,
+		})
+		if err != nil {
+			return err
+		}
+
+		giteaCIAccessKey, err := iam.NewAccessKey(ctx, "gitea-ci-access-key", &iam.AccessKeyArgs{
+			User: giteaCIUser.Name,
+		})
+		if err != nil {
+			return err
+		}
+
 		// Export the name of the bucket
 		ctx.Export("bucketName", bucket.ID())
 		ctx.Export("cdnDomainName", distribution.DomainName)
@@ -602,6 +673,11 @@ func main() {
 		ctx.Export("discoveryUrl", pulumi.Sprintf("http://%s", discoveryAlb.DnsName))
 		ctx.Export("cmsRepoUrl", cmsRepo.RepositoryUrl)
 		ctx.Export("discoveryRepoUrl", discoveryRepo.RepositoryUrl)
+		ctx.Export("ecsClusterArn", cluster.Arn)
+		ctx.Export("cmsServiceArn", cmsService.Arn)
+		ctx.Export("discoveryServiceArn", discoveryService.Arn)
+		ctx.Export("giteaCiAccessKeyId", giteaCIAccessKey.ID())
+		ctx.Export("giteaCiSecretAccessKey", giteaCIAccessKey.Secret)
 		return nil
 	})
 }