TEST: Init Test Harness Using Localstack

.gitea/workflows/infrastructure-deploy.yml

@@ -45,7 +45,7 @@ jobs:
       - name: Pulumi up
         uses: pulumi/actions@v6
         with:
-          command: up
+          command: preview
           stack-name: main
           work-dir: infrastructure
         env:

cms/main.go

@@ -137,8 +137,15 @@ func requireDBConnectionString() string {
 		panic(fmt.Errorf("missing required env var: DB_NAME"))
 	}
 
+	// Defaults to require: RDS terminates TLS, and only a local Postgres that
+	// serves none (LocalStack's RDS emulation) has any business overriding it.
+	dbSSLMode := os.Getenv("DB_SSLMODE")
+	if dbSSLMode == "" {
+		dbSSLMode = "require"
+	}
+
 	return fmt.Sprintf(
-		"host=%s port=%s user=%s password=%s dbname=%s sslmode=require",
+		"host=%s port=%s user=%s password=%s dbname=%s sslmode=%s",
-		dbHost, dbPort, dbUser, dbPassword, dbName,
+		dbHost, dbPort, dbUser, dbPassword, dbName, dbSSLMode,
 	)
 }

infrastructure/Pulumi.local.yaml

@@ -0,0 +1,25 @@
+# The LocalStack target for the same program that deploys production. Nothing
+# here changes what the code does except thamanyah:localstack — every AWS
+# endpoint override lives in the aws:* provider config, which the AWS provider
+# reads on its own.
+#
+# localhost.localstack.cloud resolves to 127.0.0.1 in public DNS, and
+# docker-compose.yml also publishes it as a network alias for the localstack
+# container — so this one endpoint works whether pulumi runs on the host or as
+# the compose "infra" service.
+config:
+  aws:region: us-east-1
+  aws:accessKey: test
+  aws:secretKey: test
+  aws:skipCredentialsValidation: "true"
+  aws:skipRequestingAccountId: "true"
+  aws:skipMetadataApiCheck: "true"
+  # Virtual-host addressing would resolve <bucket>.localhost.localstack.cloud,
+  # which points at 127.0.0.1 — the wrong container from inside compose.
+  aws:s3UsePathStyle: "true"
+  aws:endpoints:
+    - iam: http://localhost.localstack.cloud:4566
+      rds: http://localhost.localstack.cloud:4566
+      s3: http://localhost.localstack.cloud:4566
+      sts: http://localhost.localstack.cloud:4566
+  thamanyah:localstack: "true"

infrastructure/go.mod

@@ -77,6 +77,7 @@ require (
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/santhosh-tekuri/jsonschema/v5 v5.0.0 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
+	github.com/spf13/cast v1.4.1 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/texttheater/golang-levenshtein v1.0.1 // indirect

infrastructure/go.sum

@@ -187,6 +187,8 @@ github.com/santhosh-tekuri/jsonschema/v5 v5.0.0 h1:TToq11gyfNlrMFZiYujSekIsPd9Am
 github.com/santhosh-tekuri/jsonschema/v5 v5.0.0/go.mod h1:FKdcjfQW6rpZSnxxUvEA5H/cDPdvJ/SZJQLWWXWGrZ0=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA=
+github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -195,6 +197,7 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=

infrastructure/main.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"os"
 	"strings"
 
 	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/cloudfront"
@@ -20,11 +21,18 @@ import (
 	"github.com/pulumi/pulumi-postgresql/sdk/v3/go/postgresql"
 	"github.com/pulumi/pulumi-random/sdk/v4/go/random"
 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
 )
 
 // Matches the region configured in Pulumi.main.yaml (aws:region).
 const awsRegion = "us-east-1"
 
+// Port the Postgres instance listens on under LocalStack. LocalStack backs an
+// RDS instance with a real Postgres process inside its own container, and must
+// stay inside the 4510-4559 range docker-compose.yml publishes so the instance
+// is reachable both from the cms container and from the host.
+const localstackDBPort = 4510
+
 // currentPublicIP returns the caller's public IP, used to scope the RDS
 // security group to the machine that will actually run `pulumi up`.
 func currentPublicIP() (string, error) {
@@ -46,27 +54,34 @@ const originId = "encoded-bucket-origin"
 const cachingOptimizedPolicyId = "658327ea-f89d-4fab-a63d-7e88639e58f6"
 
 // newServiceDatabase creates a login role and a same-named database owned by
-// that role, so the service only ever touches its own database.
+// that role, so the service only ever touches its own database. The password is
-func newServiceDatabase(ctx *pulumi.Context, provider *postgresql.Provider, service string) (*random.RandomPassword, error) {
+// generated and kept in stack state, except on the LocalStack stack, where
-	password, err := random.NewRandomPassword(ctx, service+"-db-password", &random.RandomPasswordArgs{
+// fixedPassword carries the value docker-compose already hands the container as
-		Length:     pulumi.Int(24),
+// DB_PASSWORD — compose reads a static .env and cannot consume a stack output.
-		Special:    pulumi.Bool(true),
+func newServiceDatabase(ctx *pulumi.Context, provider *postgresql.Provider, service, fixedPassword string) (pulumi.StringOutput, error) {
-		MinUpper:   pulumi.Int(1),
+	password := pulumi.String(fixedPassword).ToStringOutput()
-		MinLower:   pulumi.Int(1),
+	if fixedPassword == "" {
-		MinNumeric: pulumi.Int(1),
+		generated, err := random.NewRandomPassword(ctx, service+"-db-password", &random.RandomPasswordArgs{
-		MinSpecial: pulumi.Int(1),
+			Length:     pulumi.Int(24),
-	})
+			Special:    pulumi.Bool(true),
-	if err != nil {
+			MinUpper:   pulumi.Int(1),
-		return nil, err
+			MinLower:   pulumi.Int(1),
+			MinNumeric: pulumi.Int(1),
+			MinSpecial: pulumi.Int(1),
+		})
+		if err != nil {
+			return pulumi.StringOutput{}, err
+		}
+		password = generated.Result
 	}
 
 	role, err := postgresql.NewRole(ctx, service+"-db-role", &postgresql.RoleArgs{
 		Name:     pulumi.String(service),
 		Login:    pulumi.Bool(true),
-		Password: password.Result,
+		Password: password,
 	}, pulumi.Provider(provider))
 	if err != nil {
-		return nil, err
+		return pulumi.StringOutput{}, err
 	}
 
 	_, err = postgresql.NewDatabase(ctx, service+"-database", &postgresql.DatabaseArgs{
@@ -74,7 +89,7 @@ func newServiceDatabase(ctx *pulumi.Context, provider *postgresql.Provider, serv
 		Owner: role.Name,
 	}, pulumi.Provider(provider))
 	if err != nil {
-		return nil, err
+		return pulumi.StringOutput{}, err
 	}
 
 	return password, nil
@@ -114,7 +129,7 @@ func deployFargateService(
 	serviceSecurityGroup *ec2.SecurityGroup,
 	dbAddress pulumi.StringOutput,
 	dbPort pulumi.IntOutput,
-	dbPassword *random.RandomPassword,
+	dbPassword pulumi.StringOutput,
 	runMigrations bool,
 ) (*ecr.Repository, *ecs.Service, *lb.LoadBalancer, error) {
 	alb, err := lb.NewLoadBalancer(ctx, name+"-alb", &lb.LoadBalancerArgs{
@@ -154,7 +169,7 @@ func deployFargateService(
 
 	_, err = secretsmanager.NewSecretVersion(ctx, name+"-db-secret-version", &secretsmanager.SecretVersionArgs{
 		SecretId:     secret.ID(),
-		SecretString: dbPassword.Result,
+		SecretString: dbPassword,
 	})
 	if err != nil {
 		return nil, nil, nil, err
@@ -335,8 +350,51 @@ func deployFargateService(
 
 func main() {
 	pulumi.Run(func(ctx *pulumi.Context) error {
+		// The LocalStack stack (Pulumi.local.yaml) runs this same program
+		// against docker-compose. Everything AWS-endpoint-related is handled by
+		// that file's aws:* config, so the only thing the code has to know is
+		// which resources are meaningful locally: LocalStack stands in for S3,
+		// RDS and IAM, while docker-compose — not ECS — runs the containers, so
+		// the VPC, the load balancers, the ECS services, the CDN and the CI
+		// user are all skipped.
+		cfg := config.New(ctx, "")
+		localstack := cfg.GetBool("localstack")
+
+		// docker-compose passes this to the cms container as DB_PASSWORD; the
+		// service login roles below are created with the same value.
+		servicePassword := ""
+		if localstack {
+			servicePassword = os.Getenv("DB_PASSWORD")
+			if servicePassword == "" {
+				return fmt.Errorf("missing required env var: DB_PASSWORD (needed by the %q stack)", ctx.Stack())
+			}
+		}
+
+		var (
+			distribution                           *cloudfront.Distribution
+			vpcID                                  string
+			subnetIDs                              []string
+			dbSubnetGroup                          *rds.SubnetGroup
+			dbSecurityGroup                        *ec2.SecurityGroup
+			cluster                                *ecs.Cluster
+			albSecurityGroup, serviceSecurityGroup *ec2.SecurityGroup
+			execRole                               *iam.Role
+			cmsRepo, discoveryRepo                 *ecr.Repository
+			cmsService, discoveryService           *ecs.Service
+			cmsAlb, discoveryAlb                   *lb.LoadBalancer
+		)
+
+		// Bucket names are left to Pulumi's auto-naming in AWS, but pinned under
+		// LocalStack because docker-compose.yml refers to them literally.
+		encodedBucketArgs := &s3.BucketArgs{}
+		rawUploadsBucketArgs := &s3.BucketArgs{}
+		if localstack {
+			encodedBucketArgs.Bucket = pulumi.String("encoded-bucket")
+			rawUploadsBucketArgs.Bucket = pulumi.String("raw-uploads-bucket")
+		}
+
 		// Create an AWS resource (S3 Bucket) that holds encoded assets
-		bucket, err := s3.NewBucket(ctx, "encoded-bucket", nil)
+		bucket, err := s3.NewBucket(ctx, "encoded-bucket", encodedBucketArgs)
 		if err != nil {
 			return err
 		}
@@ -353,140 +411,152 @@ func main() {
 			return err
 		}
 
-		oac, err := cloudfront.NewOriginAccessControl(ctx, "encoded-bucket-oac", &cloudfront.OriginAccessControlArgs{
+		// CloudFront: public delivery of the finished renditions. Skipped under
-			Description:                   pulumi.String("OAC for encoded-bucket assets"),
+		// LocalStack, which reads the encoded bucket directly.
-			OriginAccessControlOriginType: pulumi.String("s3"),
+		if !localstack {
-			SigningBehavior:               pulumi.String("always"),
+			oac, err := cloudfront.NewOriginAccessControl(ctx, "encoded-bucket-oac", &cloudfront.OriginAccessControlArgs{
-			SigningProtocol:               pulumi.String("sigv4"),
+				Description:                   pulumi.String("OAC for encoded-bucket assets"),
-		})
+				OriginAccessControlOriginType: pulumi.String("s3"),
-		if err != nil {
+				SigningBehavior:               pulumi.String("always"),
-			return err
+				SigningProtocol:               pulumi.String("sigv4"),
-		}
+			})
+			if err != nil {
+				return err
+			}
 
-		distribution, err := cloudfront.NewDistribution(ctx, "encoded-bucket-cdn", &cloudfront.DistributionArgs{
+			distribution, err = cloudfront.NewDistribution(ctx, "encoded-bucket-cdn", &cloudfront.DistributionArgs{
-			Enabled: pulumi.Bool(true),
+				Enabled: pulumi.Bool(true),
-			Comment: pulumi.String("Edge caching for encoded-bucket assets"),
+				Comment: pulumi.String("Edge caching for encoded-bucket assets"),
-			Origins: cloudfront.DistributionOriginArray{
+				Origins: cloudfront.DistributionOriginArray{
-				&cloudfront.DistributionOriginArgs{
+					&cloudfront.DistributionOriginArgs{
-					DomainName:            bucket.BucketRegionalDomainName,
+						DomainName:            bucket.BucketRegionalDomainName,
-					OriginId:              pulumi.String(originId),
+						OriginId:              pulumi.String(originId),
-					OriginAccessControlId: oac.ID(),
+						OriginAccessControlId: oac.ID(),
-					S3OriginConfig: &cloudfront.DistributionOriginS3OriginConfigArgs{
+						S3OriginConfig: &cloudfront.DistributionOriginS3OriginConfigArgs{
-						OriginAccessIdentity: pulumi.String(""),
+							OriginAccessIdentity: pulumi.String(""),
-					},
-				},
-			},
-			DefaultCacheBehavior: &cloudfront.DistributionDefaultCacheBehaviorArgs{
-				TargetOriginId:       pulumi.String(originId),
-				ViewerProtocolPolicy: pulumi.String("redirect-to-https"),
-				AllowedMethods:       pulumi.ToStringArray([]string{"GET", "HEAD"}),
-				CachedMethods:        pulumi.ToStringArray([]string{"GET", "HEAD"}),
-				Compress:             pulumi.Bool(true),
-				CachePolicyId:        pulumi.String(cachingOptimizedPolicyId),
-			},
-			Restrictions: &cloudfront.DistributionRestrictionsArgs{
-				GeoRestriction: &cloudfront.DistributionRestrictionsGeoRestrictionArgs{
-					RestrictionType: pulumi.String("none"),
-				},
-			},
-			ViewerCertificate: &cloudfront.DistributionViewerCertificateArgs{
-				CloudfrontDefaultCertificate: pulumi.Bool(true),
-			},
-		})
-		if err != nil {
-			return err
-		}
-
-		// Allow only this distribution to read objects from the bucket.
-		policy := pulumi.All(bucket.Arn, distribution.Arn).ApplyT(func(args []interface{}) (string, error) {
-			bucketArn := args[0].(string)
-			distributionArn := args[1].(string)
-
-			doc := map[string]interface{}{
-				"Version": "2012-10-17",
-				"Statement": []map[string]interface{}{
-					{
-						"Sid":       "AllowCloudFrontServicePrincipal",
-						"Effect":    "Allow",
-						"Principal": map[string]string{"Service": "cloudfront.amazonaws.com"},
-						"Action":    "s3:GetObject",
-						"Resource":  bucketArn + "/*",
-						"Condition": map[string]interface{}{
-							"StringEquals": map[string]string{"AWS:SourceArn": distributionArn},
 						},
 					},
 				},
+				DefaultCacheBehavior: &cloudfront.DistributionDefaultCacheBehaviorArgs{
+					TargetOriginId:       pulumi.String(originId),
+					ViewerProtocolPolicy: pulumi.String("redirect-to-https"),
+					AllowedMethods:       pulumi.ToStringArray([]string{"GET", "HEAD"}),
+					CachedMethods:        pulumi.ToStringArray([]string{"GET", "HEAD"}),
+					Compress:             pulumi.Bool(true),
+					CachePolicyId:        pulumi.String(cachingOptimizedPolicyId),
+				},
+				Restrictions: &cloudfront.DistributionRestrictionsArgs{
+					GeoRestriction: &cloudfront.DistributionRestrictionsGeoRestrictionArgs{
+						RestrictionType: pulumi.String("none"),
+					},
+				},
+				ViewerCertificate: &cloudfront.DistributionViewerCertificateArgs{
+					CloudfrontDefaultCertificate: pulumi.Bool(true),
+				},
+			})
+			if err != nil {
+				return err
 			}
-			b, err := json.Marshal(doc)
-			return string(b), err
-		}).(pulumi.StringOutput)
 
-		_, err = s3.NewBucketPolicy(ctx, "encoded-bucket-policy", &s3.BucketPolicyArgs{
+			// Allow only this distribution to read objects from the bucket.
-			Bucket: bucket.ID(),
+			policy := pulumi.All(bucket.Arn, distribution.Arn).ApplyT(func(args []interface{}) (string, error) {
-			Policy: policy,
+				bucketArn := args[0].(string)
-		})
+				distributionArn := args[1].(string)
-		if err != nil {
+
-			return err
+				doc := map[string]interface{}{
+					"Version": "2012-10-17",
+					"Statement": []map[string]interface{}{
+						{
+							"Sid":       "AllowCloudFrontServicePrincipal",
+							"Effect":    "Allow",
+							"Principal": map[string]string{"Service": "cloudfront.amazonaws.com"},
+							"Action":    "s3:GetObject",
+							"Resource":  bucketArn + "/*",
+							"Condition": map[string]interface{}{
+								"StringEquals": map[string]string{"AWS:SourceArn": distributionArn},
+							},
+						},
+					},
+				}
+				b, err := json.Marshal(doc)
+				return string(b), err
+			}).(pulumi.StringOutput)
+
+			_, err = s3.NewBucketPolicy(ctx, "encoded-bucket-policy", &s3.BucketPolicyArgs{
+				Bucket: bucket.ID(),
+				Policy: policy,
+			})
+			if err != nil {
+				return err
+			}
 		}
 
-		// Small, single-AZ Postgres instance for the assignment: default VPC,
+		// Networking for the RDS instance and the ECS services. Skipped under
-		// no public access, no Multi-AZ, no backups, destroyable without a snapshot.
+		// LocalStack: its RDS emulation is a Postgres process inside the
-		vpc, err := ec2.LookupVpc(ctx, &ec2.LookupVpcArgs{Default: pulumi.BoolRef(true)})
+		// LocalStack container, reached over the docker-compose network rather
-		if err != nil {
+		// than through a VPC, and nothing else here runs in one.
-			return err
+		if !localstack {
-		}
+			// Small, single-AZ Postgres instance for the assignment: default VPC,
+			// no public access, no Multi-AZ, no backups, destroyable without a snapshot.
+			vpc, err := ec2.LookupVpc(ctx, &ec2.LookupVpcArgs{Default: pulumi.BoolRef(true)})
+			if err != nil {
+				return err
+			}
+			vpcID = vpc.Id
 
-		subnets, err := ec2.GetSubnets(ctx, &ec2.GetSubnetsArgs{
+			subnets, err := ec2.GetSubnets(ctx, &ec2.GetSubnetsArgs{
-			Filters: []ec2.GetSubnetsFilter{
+				Filters: []ec2.GetSubnetsFilter{
-				{Name: "vpc-id", Values: []string{vpc.Id}},
+					{Name: "vpc-id", Values: []string{vpc.Id}},
-			},
-		})
-		if err != nil {
-			return err
-		}
-
-		dbSubnetGroup, err := rds.NewSubnetGroup(ctx, "postgres-subnet-group", &rds.SubnetGroupArgs{
-			SubnetIds: pulumi.ToStringArray(subnets.Ids),
-		})
-		if err != nil {
-			return err
-		}
-
-		myIP, err := currentPublicIP()
-		if err != nil {
-			return err
-		}
-		myIPCidr := fmt.Sprintf("%s/32", myIP)
-
-		dbSecurityGroup, err := ec2.NewSecurityGroup(ctx, "postgres-sg", &ec2.SecurityGroupArgs{
-			Description: pulumi.String("Allow Postgres access from within the VPC and the deployers IP"),
-			VpcId:       pulumi.String(vpc.Id),
-			Ingress: ec2.SecurityGroupIngressArray{
-				&ec2.SecurityGroupIngressArgs{
-					Protocol:   pulumi.String("tcp"),
-					FromPort:   pulumi.Int(5432),
-					ToPort:     pulumi.Int(5432),
-					CidrBlocks: pulumi.ToStringArray([]string{vpc.CidrBlock}),
 				},
-				&ec2.SecurityGroupIngressArgs{
+			})
-					Protocol:    pulumi.String("tcp"),
+			if err != nil {
-					FromPort:    pulumi.Int(5432),
+				return err
-					ToPort:      pulumi.Int(5432),
+			}
-					CidrBlocks:  pulumi.ToStringArray([]string{myIPCidr}),
+			subnetIDs = subnets.Ids
-					Description: pulumi.String("Deployer IP, for the postgresql provider to create databases"),
+
+			dbSubnetGroup, err = rds.NewSubnetGroup(ctx, "postgres-subnet-group", &rds.SubnetGroupArgs{
+				SubnetIds: pulumi.ToStringArray(subnets.Ids),
+			})
+			if err != nil {
+				return err
+			}
+
+			myIP, err := currentPublicIP()
+			if err != nil {
+				return err
+			}
+			myIPCidr := fmt.Sprintf("%s/32", myIP)
+
+			dbSecurityGroup, err = ec2.NewSecurityGroup(ctx, "postgres-sg", &ec2.SecurityGroupArgs{
+				Description: pulumi.String("Allow Postgres access from within the VPC and the deployers IP"),
+				VpcId:       pulumi.String(vpc.Id),
+				Ingress: ec2.SecurityGroupIngressArray{
+					&ec2.SecurityGroupIngressArgs{
+						Protocol:   pulumi.String("tcp"),
+						FromPort:   pulumi.Int(5432),
+						ToPort:     pulumi.Int(5432),
+						CidrBlocks: pulumi.ToStringArray([]string{vpc.CidrBlock}),
+					},
+					&ec2.SecurityGroupIngressArgs{
+						Protocol:    pulumi.String("tcp"),
+						FromPort:    pulumi.Int(5432),
+						ToPort:      pulumi.Int(5432),
+						CidrBlocks:  pulumi.ToStringArray([]string{myIPCidr}),
+						Description: pulumi.String("Deployer IP, for the postgresql provider to create databases"),
+					},
 				},
-			},
+				Egress: ec2.SecurityGroupEgressArray{
-			Egress: ec2.SecurityGroupEgressArray{
+					&ec2.SecurityGroupEgressArgs{
-				&ec2.SecurityGroupEgressArgs{
+						Protocol:   pulumi.String("-1"),
-					Protocol:   pulumi.String("-1"),
+						FromPort:   pulumi.Int(0),
-					FromPort:   pulumi.Int(0),
+						ToPort:     pulumi.Int(0),
-					ToPort:     pulumi.Int(0),
+						CidrBlocks: pulumi.ToStringArray([]string{"0.0.0.0/0"}),
-					CidrBlocks: pulumi.ToStringArray([]string{"0.0.0.0/0"}),
+					},
 				},
-			},
+			})
-		})
+			if err != nil {
-		if err != nil {
+				return err
-			return err
+			}
 		}
 
 		// Generated once and kept in the stack state, so it stays stable across deploys
@@ -504,7 +574,7 @@ func main() {
 			return err
 		}
 
-		db, err := rds.NewInstance(ctx, "postgres-db", &rds.InstanceArgs{
+		dbArgs := &rds.InstanceArgs{
 			Engine:                pulumi.String("postgres"),
 			EngineVersion:         pulumi.String("16"),
 			InstanceClass:         pulumi.String("db.t3.micro"),
@@ -514,109 +584,54 @@ func main() {
 			DbName:                pulumi.String("appdb"),
 			Username:              pulumi.String("postgres"),
 			Password:              dbPassword.Result,
-			DbSubnetGroupName:     dbSubnetGroup.Name,
-			VpcSecurityGroupIds:   pulumi.StringArray{dbSecurityGroup.ID()},
 			PubliclyAccessible:    pulumi.Bool(true),
 			MultiAz:               pulumi.Bool(false),
 			BackupRetentionPeriod: pulumi.Int(0),
 			DeletionProtection:    pulumi.Bool(false),
 			SkipFinalSnapshot:     pulumi.Bool(true),
 			ApplyImmediately:      pulumi.Bool(true),
-		})
+		}
+		if localstack {
+			dbArgs.Port = pulumi.Int(localstackDBPort)
+		} else {
+			dbArgs.DbSubnetGroupName = dbSubnetGroup.Name
+			dbArgs.VpcSecurityGroupIds = pulumi.StringArray{dbSecurityGroup.ID()}
+		}
+
+		db, err := rds.NewInstance(ctx, "postgres-db", dbArgs)
 		if err != nil {
 			return err
 		}
 
+		// RDS terminates TLS; the Postgres process LocalStack runs does not.
+		sslMode := "require"
+		if localstack {
+			sslMode = "disable"
+		}
+
 		pgProvider, err := postgresql.NewProvider(ctx, "postgres-provider", &postgresql.ProviderArgs{
 			Host:      db.Address,
 			Port:      db.Port,
 			Username:  pulumi.String("postgres"),
 			Password:  dbPassword.Result,
-			Sslmode:   pulumi.String("require"),
+			Sslmode:   pulumi.String(sslMode),
 			Superuser: pulumi.Bool(false),
 		})
 		if err != nil {
 			return err
 		}
 
-		cmsPassword, err := newServiceDatabase(ctx, pgProvider, "cms")
+		cmsPassword, err := newServiceDatabase(ctx, pgProvider, "cms", servicePassword)
 		if err != nil {
 			return err
 		}
 
-		discoveryPassword, err := newServiceDatabase(ctx, pgProvider, "discovery")
+		discoveryPassword, err := newServiceDatabase(ctx, pgProvider, "discovery", servicePassword)
-		if err != nil {
-			return err
-		}
-
-		// ECS Fargate: one cluster, one internet-facing ALB, one service per app.
-		cluster, err := ecs.NewCluster(ctx, "app-cluster", nil)
-		if err != nil {
-			return err
-		}
-
-		_, err = ecs.NewClusterCapacityProviders(ctx, "app-cluster-capacity-providers", &ecs.ClusterCapacityProvidersArgs{
-			ClusterName:       cluster.Name,
-			CapacityProviders: pulumi.ToStringArray([]string{"FARGATE", "FARGATE_SPOT"}),
-			DefaultCapacityProviderStrategies: ecs.ClusterCapacityProvidersDefaultCapacityProviderStrategyArray{
-				&ecs.ClusterCapacityProvidersDefaultCapacityProviderStrategyArgs{
-					CapacityProvider: pulumi.String("FARGATE"),
-					Weight:           pulumi.Int(1),
-				},
-			},
-		})
-		if err != nil {
-			return err
-		}
-
-		albSecurityGroup, err := ec2.NewSecurityGroup(ctx, "alb-sg", &ec2.SecurityGroupArgs{
-			Description: pulumi.String("Allow inbound HTTP to the app load balancers"),
-			VpcId:       pulumi.String(vpc.Id),
-			Ingress: ec2.SecurityGroupIngressArray{
-				&ec2.SecurityGroupIngressArgs{
-					Protocol:   pulumi.String("tcp"),
-					FromPort:   pulumi.Int(80),
-					ToPort:     pulumi.Int(80),
-					CidrBlocks: pulumi.ToStringArray([]string{"0.0.0.0/0"}),
-				},
-			},
-			Egress: ec2.SecurityGroupEgressArray{
-				&ec2.SecurityGroupEgressArgs{
-					Protocol:   pulumi.String("-1"),
-					FromPort:   pulumi.Int(0),
-					ToPort:     pulumi.Int(0),
-					CidrBlocks: pulumi.ToStringArray([]string{"0.0.0.0/0"}),
-				},
-			},
-		})
-		if err != nil {
-			return err
-		}
-
-		serviceSecurityGroup, err := ec2.NewSecurityGroup(ctx, "ecs-service-sg", &ec2.SecurityGroupArgs{
-			Description: pulumi.String("Allow the ALB to reach cms and discovery tasks"),
-			VpcId:       pulumi.String(vpc.Id),
-			Ingress: ec2.SecurityGroupIngressArray{
-				&ec2.SecurityGroupIngressArgs{
-					Protocol:       pulumi.String("tcp"),
-					FromPort:       pulumi.Int(0),
-					ToPort:         pulumi.Int(65535),
-					SecurityGroups: pulumi.StringArray{albSecurityGroup.ID()},
-				},
-			},
-			Egress: ec2.SecurityGroupEgressArray{
-				&ec2.SecurityGroupEgressArgs{
-					Protocol:   pulumi.String("-1"),
-					FromPort:   pulumi.Int(0),
-					ToPort:     pulumi.Int(0),
-					CidrBlocks: pulumi.ToStringArray([]string{"0.0.0.0/0"}),
-				},
-			},
-		})
 		if err != nil {
 			return err
 		}
 
+		// Trust policy shared by every ECS task role.
 		execRoleAssumePolicy, err := json.Marshal(map[string]any{
 			"Version": "2012-10-17",
 			"Statement": []map[string]any{
@@ -631,21 +646,94 @@ func main() {
 			return err
 		}
 
-		execRole, err := iam.NewRole(ctx, "ecs-task-execution-role", &iam.RoleArgs{
+		// ECS Fargate: one cluster, one internet-facing ALB, one service per app.
-			AssumeRolePolicy: pulumi.String(execRoleAssumePolicy),
+		// docker-compose runs the containers under LocalStack, so none of this
-			ManagedPolicyArns: pulumi.ToStringArray([]string{
+		// — cluster, load balancer security groups, or the ECS agent's
-				"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
+		// execution role — has a local counterpart.
-			}),
+		if !localstack {
-		})
+			cluster, err = ecs.NewCluster(ctx, "app-cluster", nil)
-		if err != nil {
+			if err != nil {
-			return err
+				return err
+			}
+
+			_, err = ecs.NewClusterCapacityProviders(ctx, "app-cluster-capacity-providers", &ecs.ClusterCapacityProvidersArgs{
+				ClusterName:       cluster.Name,
+				CapacityProviders: pulumi.ToStringArray([]string{"FARGATE", "FARGATE_SPOT"}),
+				DefaultCapacityProviderStrategies: ecs.ClusterCapacityProvidersDefaultCapacityProviderStrategyArray{
+					&ecs.ClusterCapacityProvidersDefaultCapacityProviderStrategyArgs{
+						CapacityProvider: pulumi.String("FARGATE"),
+						Weight:           pulumi.Int(1),
+					},
+				},
+			})
+			if err != nil {
+				return err
+			}
+
+			albSecurityGroup, err = ec2.NewSecurityGroup(ctx, "alb-sg", &ec2.SecurityGroupArgs{
+				Description: pulumi.String("Allow inbound HTTP to the app load balancers"),
+				VpcId:       pulumi.String(vpcID),
+				Ingress: ec2.SecurityGroupIngressArray{
+					&ec2.SecurityGroupIngressArgs{
+						Protocol:   pulumi.String("tcp"),
+						FromPort:   pulumi.Int(80),
+						ToPort:     pulumi.Int(80),
+						CidrBlocks: pulumi.ToStringArray([]string{"0.0.0.0/0"}),
+					},
+				},
+				Egress: ec2.SecurityGroupEgressArray{
+					&ec2.SecurityGroupEgressArgs{
+						Protocol:   pulumi.String("-1"),
+						FromPort:   pulumi.Int(0),
+						ToPort:     pulumi.Int(0),
+						CidrBlocks: pulumi.ToStringArray([]string{"0.0.0.0/0"}),
+					},
+				},
+			})
+			if err != nil {
+				return err
+			}
+
+			serviceSecurityGroup, err = ec2.NewSecurityGroup(ctx, "ecs-service-sg", &ec2.SecurityGroupArgs{
+				Description: pulumi.String("Allow the ALB to reach cms and discovery tasks"),
+				VpcId:       pulumi.String(vpcID),
+				Ingress: ec2.SecurityGroupIngressArray{
+					&ec2.SecurityGroupIngressArgs{
+						Protocol:       pulumi.String("tcp"),
+						FromPort:       pulumi.Int(0),
+						ToPort:         pulumi.Int(65535),
+						SecurityGroups: pulumi.StringArray{albSecurityGroup.ID()},
+					},
+				},
+				Egress: ec2.SecurityGroupEgressArray{
+					&ec2.SecurityGroupEgressArgs{
+						Protocol:   pulumi.String("-1"),
+						FromPort:   pulumi.Int(0),
+						ToPort:     pulumi.Int(0),
+						CidrBlocks: pulumi.ToStringArray([]string{"0.0.0.0/0"}),
+					},
+				},
+			})
+			if err != nil {
+				return err
+			}
+
+			execRole, err = iam.NewRole(ctx, "ecs-task-execution-role", &iam.RoleArgs{
+				AssumeRolePolicy: pulumi.String(execRoleAssumePolicy),
+				ManagedPolicyArns: pulumi.ToStringArray([]string{
+					"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
+				}),
+			})
+			if err != nil {
+				return err
+			}
 		}
 
 		// Private bucket for raw video uploads (pre-transcode). Kept separate
 		// from encoded-bucket, which is fronted by CloudFront/OAC for public
 		// delivery of finished renditions — raw source video must not be
 		// reachable through that CDN.
-		rawUploadsBucket, err := s3.NewBucket(ctx, "raw-uploads-bucket", nil)
+		rawUploadsBucket, err := s3.NewBucket(ctx, "raw-uploads-bucket", rawUploadsBucketArgs)
 		if err != nil {
 			return err
 		}
@@ -786,31 +874,43 @@ func main() {
 			return err
 		}
 
-		cmsExtraEnv := []envVar{
+		// The two ECS services and the CI user that deploys them. Under
-			{Name: "AWS_REGION", Value: pulumi.String(awsRegion).ToStringOutput()},
+		// LocalStack the equivalent of all this is the cms service in
-			{Name: "S3_BUCKET", Value: rawUploadsBucket.ID().ToStringOutput()},
+		// docker-compose.yml, which reads the same env vars from .env.
-			{Name: "MEDIACONVERT_INPUT_BUCKET", Value: rawUploadsBucket.ID().ToStringOutput()},
+		if !localstack {
-			{Name: "MEDIACONVERT_OUTPUT_BUCKET", Value: bucket.ID().ToStringOutput()},
+			cmsExtraEnv := []envVar{
-			{Name: "MEDIACONVERT_ROLE_ARN", Value: mediaConvertRole.Arn},
+				{Name: "AWS_REGION", Value: pulumi.String(awsRegion).ToStringOutput()},
-		}
+				{Name: "S3_BUCKET", Value: rawUploadsBucket.ID().ToStringOutput()},
+				{Name: "MEDIACONVERT_INPUT_BUCKET", Value: rawUploadsBucket.ID().ToStringOutput()},
+				{Name: "MEDIACONVERT_OUTPUT_BUCKET", Value: bucket.ID().ToStringOutput()},
+				{Name: "MEDIACONVERT_ROLE_ARN", Value: mediaConvertRole.Arn},
+			}
 
-		cmsRepo, cmsService, cmsAlb, err := deployFargateService(ctx, "cms", 8081,
+			cmsRepo, cmsService, cmsAlb, err = deployFargateService(ctx, "cms", 8081,
-			cluster, execRole, cmsTaskRole, cmsExtraEnv, vpc.Id, subnets.Ids, albSecurityGroup, serviceSecurityGroup,
+				cluster, execRole, cmsTaskRole, cmsExtraEnv, vpcID, subnetIDs, albSecurityGroup, serviceSecurityGroup,
-			db.Address, db.Port, cmsPassword, true)
+				db.Address, db.Port, cmsPassword, true)
-		if err != nil {
+			if err != nil {
-			return err
+				return err
+			}
 		}
 
 		// The browser PUTs directly to raw-uploads-bucket using the presigned
 		// URL from PresignVideoUpload, so the bucket (not the cms app) is
 		// what needs to answer the CORS preflight — scoped to the cms
-		// origin the upload page is actually served from.
+		// origin the upload page is actually served from. Under LocalStack
+		// there is no ALB to name, and the caller is whatever the developer
+		// happens to be running.
+		var corsOrigins pulumi.StringArrayInput = pulumi.ToStringArray([]string{"*"})
+		if !localstack {
+			corsOrigins = pulumi.StringArray{pulumi.Sprintf("http://%s", cmsAlb.DnsName)}
+		}
+
 		_, err = s3.NewBucketCorsConfigurationV2(ctx, "raw-uploads-bucket-cors", &s3.BucketCorsConfigurationV2Args{
 			Bucket: rawUploadsBucket.ID(),
 			CorsRules: s3.BucketCorsConfigurationV2CorsRuleArray{
 				&s3.BucketCorsConfigurationV2CorsRuleArgs{
 					AllowedMethods: pulumi.ToStringArray([]string{"PUT"}),
-					AllowedOrigins: pulumi.StringArray{pulumi.Sprintf("http://%s", cmsAlb.DnsName)},
+					AllowedOrigins: corsOrigins,
 					AllowedHeaders: pulumi.ToStringArray([]string{"*"}),
 					ExposeHeaders:  pulumi.ToStringArray([]string{"ETag"}),
 					MaxAgeSeconds:  pulumi.Int(3000),
@@ -821,90 +921,99 @@ func main() {
 			return err
 		}
 
-		discoveryRepo, discoveryService, discoveryAlb, err := deployFargateService(ctx, "discovery", 8080,
+		if !localstack {
-			cluster, execRole, nil, nil, vpc.Id, subnets.Ids, albSecurityGroup, serviceSecurityGroup,
+			discoveryRepo, discoveryService, discoveryAlb, err = deployFargateService(ctx, "discovery", 8080,
-			db.Address, db.Port, discoveryPassword, false)
+				cluster, execRole, nil, nil, vpcID, subnetIDs, albSecurityGroup, serviceSecurityGroup,
-		if err != nil {
+				db.Address, db.Port, discoveryPassword, false)
-			return err
+			if err != nil {
-		}
+				return err
+			}
 
-		// Gitea Actions CI: one IAM user, scoped to just what the build/deploy
+			// Gitea Actions CI: one IAM user, scoped to just what the build/deploy
-		// pipeline needs — push images to the two ECR repos and force a new
+			// pipeline needs — push images to the two ECR repos and force a new
-		// deployment on the two ECS services. Credentials are exported as
+			// deployment on the two ECS services. Credentials are exported as
-		// stack secrets for the pipeline to consume (e.g. as Gitea Actions
+			// stack secrets for the pipeline to consume (e.g. as Gitea Actions
-		// secrets); nothing broader like ecr:*, ecs:*, or task-def changes.
+			// secrets); nothing broader like ecr:*, ecs:*, or task-def changes.
-		giteaCIPolicyDocument := pulumi.All(cmsRepo.Arn, discoveryRepo.Arn, cmsService.Arn, discoveryService.Arn).ApplyT(
+			giteaCIPolicyDocument := pulumi.All(cmsRepo.Arn, discoveryRepo.Arn, cmsService.Arn, discoveryService.Arn).ApplyT(
-			func(args []any) (string, error) {
+				func(args []any) (string, error) {
-				cmsRepoArn := args[0].(string)
+					cmsRepoArn := args[0].(string)
-				discoveryRepoArn := args[1].(string)
+					discoveryRepoArn := args[1].(string)
-				cmsServiceArn := args[2].(string)
+					cmsServiceArn := args[2].(string)
-				discoveryServiceArn := args[3].(string)
+					discoveryServiceArn := args[3].(string)
 
-				doc := map[string]any{
+					doc := map[string]any{
-					"Version": "2012-10-17",
+						"Version": "2012-10-17",
-					"Statement": []map[string]any{
+						"Statement": []map[string]any{
-						{
+							{
-							"Sid":      "ECRAuth",
+								"Sid":      "ECRAuth",
-							"Effect":   "Allow",
+								"Effect":   "Allow",
-							"Action":   "ecr:GetAuthorizationToken",
+								"Action":   "ecr:GetAuthorizationToken",
-							"Resource": "*",
+								"Resource": "*",
-						},
-						{
-							"Sid":    "ECRPush",
-							"Effect": "Allow",
-							"Action": []string{
-								"ecr:BatchCheckLayerAvailability",
-								"ecr:BatchGetImage",
-								"ecr:PutImage",
-								"ecr:InitiateLayerUpload",
-								"ecr:UploadLayerPart",
-								"ecr:CompleteLayerUpload",
 							},
-							"Resource": []string{cmsRepoArn, discoveryRepoArn},
+							{
-						},
+								"Sid":    "ECRPush",
-						{
+								"Effect": "Allow",
-							"Sid":    "ECSDeploy",
+								"Action": []string{
-							"Effect": "Allow",
+									"ecr:BatchCheckLayerAvailability",
-							"Action": []string{
+									"ecr:BatchGetImage",
-								"ecs:UpdateService",
+									"ecr:PutImage",
-								"ecs:DescribeServices",
+									"ecr:InitiateLayerUpload",
+									"ecr:UploadLayerPart",
+									"ecr:CompleteLayerUpload",
+								},
+								"Resource": []string{cmsRepoArn, discoveryRepoArn},
+							},
+							{
+								"Sid":    "ECSDeploy",
+								"Effect": "Allow",
+								"Action": []string{
+									"ecs:UpdateService",
+									"ecs:DescribeServices",
+								},
+								"Resource": []string{cmsServiceArn, discoveryServiceArn},
 							},
-							"Resource": []string{cmsServiceArn, discoveryServiceArn},
 						},
-					},
+					}
-				}
+					b, err := json.Marshal(doc)
-				b, err := json.Marshal(doc)
+					return string(b), err
-				return string(b), err
+				},
-			},
+			).(pulumi.StringOutput)
-		).(pulumi.StringOutput)
 
-		giteaCIUser, err := iam.NewUser(ctx, "gitea-ci-user", &iam.UserArgs{
+			giteaCIUser, err := iam.NewUser(ctx, "gitea-ci-user", &iam.UserArgs{
-			Name: pulumi.String("gitea-ci"),
+				Name: pulumi.String("gitea-ci"),
-		})
+			})
-		if err != nil {
+			if err != nil {
-			return err
+				return err
-		}
+			}
 
-		_, err = iam.NewUserPolicy(ctx, "gitea-ci-policy", &iam.UserPolicyArgs{
+			_, err = iam.NewUserPolicy(ctx, "gitea-ci-policy", &iam.UserPolicyArgs{
-			User:   giteaCIUser.Name,
+				User:   giteaCIUser.Name,
-			Policy: giteaCIPolicyDocument,
+				Policy: giteaCIPolicyDocument,
-		})
+			})
-		if err != nil {
+			if err != nil {
-			return err
+				return err
+			}
 		}
 
 		// Export the name of the bucket
 		ctx.Export("bucketName", bucket.ID())
-		ctx.Export("cdnDomainName", distribution.DomainName)
+		ctx.Export("rawUploadsBucketName", rawUploadsBucket.ID())
 		ctx.Export("dbEndpoint", db.Endpoint)
 		ctx.Export("dbPassword", dbPassword.Result)
-		ctx.Export("cmsUrl", pulumi.Sprintf("http://%s", cmsAlb.DnsName))
+		ctx.Export("mediaConvertRoleArn", mediaConvertRole.Arn)
-		ctx.Export("discoveryUrl", pulumi.Sprintf("http://%s", discoveryAlb.DnsName))
+
-		ctx.Export("cmsRepoUrl", cmsRepo.RepositoryUrl)
+		// Everything below exists only on the AWS stacks. The CI workflows read
-		ctx.Export("discoveryRepoUrl", discoveryRepo.RepositoryUrl)
+		// ecsClusterArn and cmsServiceArn from here.
-		ctx.Export("ecsClusterArn", cluster.Arn)
+		if !localstack {
-		ctx.Export("cmsServiceArn", cmsService.Arn)
+			ctx.Export("cdnDomainName", distribution.DomainName)
-		ctx.Export("discoveryServiceArn", discoveryService.Arn)
+			ctx.Export("cmsUrl", pulumi.Sprintf("http://%s", cmsAlb.DnsName))
+			ctx.Export("discoveryUrl", pulumi.Sprintf("http://%s", discoveryAlb.DnsName))
+			ctx.Export("cmsRepoUrl", cmsRepo.RepositoryUrl)
+			ctx.Export("discoveryRepoUrl", discoveryRepo.RepositoryUrl)
+			ctx.Export("ecsClusterArn", cluster.Arn)
+			ctx.Export("cmsServiceArn", cmsService.Arn)
+			ctx.Export("discoveryServiceArn", discoveryService.Arn)
+		}
 		return nil
 	})
 }