Managed domains

.github/workflows/terraform-static-checks.yml

@@ -39,7 +39,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          modules=$(find . -mindepth 2 -maxdepth 2 -name versions.tf -exec dirname {} \; | sort)
+          modules=$(find . -mindepth 3 -maxdepth 3 -name versions.tf -exec dirname {} \; | sort)
 
           for module in $modules; do
             echo "Validating ${module}"
@@ -52,6 +52,13 @@ jobs:
           tofu -chdir=cdn/cloudfront init -backend=false
           tofu -chdir=cdn/cloudfront test
 
+      - name: Test ECS managed domains
+        run: |
+          tofu -chdir=compute/ecs_cluster init -backend=false
+          tofu -chdir=compute/ecs_cluster test -filter=tests/managed_domains.tftest.hcl
+          tofu -chdir=compute/ecs_service init -backend=false
+          tofu -chdir=compute/ecs_service test -filter=tests/managed_domains.tftest.hcl
+
       - name: Test CloudFront redirect function
         run: node --test cdn/cloudfront/functions/redirect.test.js
 

compute/autoscaling/outputs.tf

@@ -152,3 +152,13 @@ output "region" {
   description = "The AWS region where the resources are deployed."
   value       = local.region
 }
+
+output "mixed_instances_policy_enabled" {
+  description = "Whether the ASG uses a mixed-instances (spot) policy."
+  value       = length(aws_autoscaling_group.this.mixed_instances_policy) > 0
+}
+
+output "spot_instances_distribution" {
+  description = "The instances_distribution of the mixed-instances policy, null when spot is disabled."
+  value       = try(aws_autoscaling_group.this.mixed_instances_policy[0].instances_distribution[0], null)
+}

compute/ecs_cluster/load_balancers.tf

@@ -14,13 +14,18 @@ module "public_alb" {
   subnet_ids                     = var.public_subnet_ids
   internal_load_balancer_enabled = false
 
-  # Listener configuration
+  # Listener configuration. Keep listener ownership in the ALB module so
+  # enabling managed domains changes only the default certificate in place.
   http_listener_enabled          = true
   https_listener_enabled         = var.public_alb_https_enabled
   http_to_https_redirect_enabled = var.public_alb_https_enabled
 
   # SSL/TLS
-  certificate_arns = var.public_alb_certificate_arns
+  # Managed mode makes the Ravion wildcard the DEFAULT certificate and keeps
+  # every BYO certificate attached via SNI (the submodule attaches arns[1..]
+  # as aws_lb_listener_certificate). Toggling managed domains on therefore
+  # never drops TLS for hostnames served off existing BYO certificates.
+  certificate_arns = local.enable_ravion_domain ? concat([ravion_aws_acm_certificate.cluster[0].arn], var.public_alb_certificate_arns) : var.public_alb_certificate_arns
   ssl_policy       = var.public_alb_ssl_policy
 
   # ALB settings
@@ -55,13 +60,18 @@ module "private_alb" {
   subnet_ids                     = var.private_subnet_ids
   internal_load_balancer_enabled = true
 
-  # Listener configuration
+  # Listener configuration. Keep listener ownership in the ALB module so
+  # enabling managed domains changes only the default certificate in place.
   http_listener_enabled          = true
   https_listener_enabled         = var.private_alb_https_enabled
   http_to_https_redirect_enabled = var.private_alb_https_enabled
 
   # SSL/TLS
-  certificate_arns = var.private_alb_certificate_arns
+  # Managed mode makes the Ravion wildcard the DEFAULT certificate and keeps
+  # every BYO certificate attached via SNI (the submodule attaches arns[1..]
+  # as aws_lb_listener_certificate). Toggling managed domains on therefore
+  # never drops TLS for hostnames served off existing BYO certificates.
+  certificate_arns = local.enable_ravion_domain ? concat([ravion_aws_acm_certificate.cluster[0].arn], var.private_alb_certificate_arns) : var.private_alb_certificate_arns
   ssl_policy       = var.private_alb_ssl_policy
 
   # ALB settings

compute/ecs_cluster/outputs.tf

@@ -250,3 +250,37 @@ output "region" {
   description = "The AWS region where the resources are deployed."
   value       = local.region
 }
+
+################################################################################
+# Ravion-managed domains
+################################################################################
+
+output "ravion_cluster_certificate_id" {
+  description = "Ravion managed-certificate id for the cluster wildcard (null unless use_ravion_managed_domains)."
+  value       = local.enable_ravion_domain ? ravion_aws_acm_certificate.cluster[0].id : null
+}
+
+output "ravion_cluster_domain_fqdn" {
+  description = "Cluster wildcard apex FQDN. Pass to ecs_service as cluster_parent_fqdn."
+  value       = local.enable_ravion_domain ? ravion_aws_acm_certificate.cluster[0].domain_name : null
+}
+
+output "ravion_cluster_cert_arn" {
+  description = "ACM ARN of the cluster wildcard cert."
+  value       = local.enable_ravion_domain ? ravion_aws_acm_certificate.cluster[0].arn : null
+}
+
+output "ravion_aws_account_id" {
+  description = "Pass-through Ravion AwsAccount row id for ecs_service Mode B."
+  value       = var.ravion_aws_account_id
+}
+
+output "ravion_aws_region" {
+  description = "Pass-through Ravion cert region for ecs_service Mode B."
+  value       = local.enable_ravion_domain ? coalesce(var.ravion_aws_region, local.region) : null
+}
+
+output "ravion_managed_domains_enabled" {
+  description = "True when the cluster owns a Ravion wildcard certificate for its selected HTTPS-enabled ALB. Services read this to show/hide managed-domain fields."
+  value       = local.enable_ravion_domain
+}

compute/ecs_cluster/ravion_domains.tf

@@ -0,0 +1,69 @@
+################################################################################
+# Ravion-managed cluster domain (opt-in)
+################################################################################
+# When var.use_ravion_managed_domains = true, Ravion issues ONE wildcard cert
+# `*.<name>-<hash>.<ravion-apex>` (+ apex). That cert becomes the default cert
+# on the selected cluster ALB's existing HTTPS listener. The cert also publishes
+# a `*.<apex>` ALIAS to that ALB so service auto-FQDNs (<svc>.<apex>) resolve.
+# When the flag is off, this resource is absent and the listener keeps using the
+# customer-supplied certificate ARNs.
+
+locals {
+  enable_ravion_domain = var.use_ravion_managed_domains
+  ravion_alb_count     = (var.public_alb_enabled ? 1 : 0) + (var.private_alb_enabled ? 1 : 0)
+}
+
+# Plan-time guards (wildcard-apex collision against another cluster, and
+# dependents on teardown) run automatically inside the provider's ModifyPlan —
+# no data source + precondition wiring needed. The allocator enforces the same
+# rules server-side as an apply-time backstop.
+resource "ravion_aws_acm_certificate" "cluster" {
+  count = local.enable_ravion_domain ? 1 : 0
+
+  wildcard           = true
+  name               = coalesce(var.ravion_cluster_name, var.module_instance_given_id, var.name)
+  module_instance_id = var.module_instance_id
+  aws_account_id     = var.ravion_aws_account_id
+  aws_region         = coalesce(var.ravion_aws_region, local.region)
+
+  # Ravion publishes a *.<apex> ALIAS to this ALB so service auto-FQDNs
+  # (<svc>.<apex>) resolve under the cluster wildcard. Managed mode intentionally
+  # supports exactly one ALB because a wildcard DNS record can target only one
+  # load balancer.
+  target_dns_name = var.public_alb_enabled ? module.public_alb[0].alb_dns_name : try(module.private_alb[0].alb_dns_name, null)
+  target_zone_id  = var.public_alb_enabled ? module.public_alb[0].alb_zone_id : try(module.private_alb[0].alb_zone_id, null)
+
+  lifecycle {
+    # Rotating the cluster wildcard cert (any RequiresReplace change, e.g. a
+    # renamed apex) must issue the new cert and swap it onto the HTTPS
+    # listener(s) BEFORE the old one is torn down. Without this, terraform
+    # destroys the old cert first while it is still the listener's default —
+    # ACM returns ResourceInUse and the rotation deadlocks. create_before_destroy
+    # makes it new -> listener in-place swap -> delete old (now detached).
+    create_before_destroy = true
+
+    # A wildcard DNS record can target only one ALB. Supporting simultaneous
+    # public/private managed domains requires distinct apexes and certificates.
+    precondition {
+      condition     = !var.use_ravion_managed_domains || local.ravion_alb_count == 1
+      error_message = "use_ravion_managed_domains requires exactly one ALB. Enable either the public ALB or the private ALB, not both. Supporting both requires separate managed apexes and certificates."
+    }
+    # HTTPS is not optional for the selected managed ALB: its existing listener
+    # serves the wildcard certificate as the default certificate.
+    precondition {
+      condition = (
+        !var.use_ravion_managed_domains
+        || (var.public_alb_enabled ? var.public_alb_https_enabled : var.private_alb_https_enabled)
+      )
+      error_message = "use_ravion_managed_domains requires HTTPS on the selected ALB. Enable public_alb_https_enabled or private_alb_https_enabled to serve the wildcard certificate."
+    }
+    precondition {
+      condition     = !var.use_ravion_managed_domains || (var.ravion_aws_account_id != null && var.ravion_aws_account_id != "")
+      error_message = "ravion_aws_account_id (aws_*) is required when use_ravion_managed_domains = true."
+    }
+    precondition {
+      condition     = !var.use_ravion_managed_domains || (var.module_instance_id != null && var.module_instance_id != "")
+      error_message = "module_instance_id (minst_*) is required when use_ravion_managed_domains = true. Inside a stack run the runner injects TF_VAR_module_instance_id; set it explicitly for external runs."
+    }
+  }
+}

compute/ecs_cluster/rvn-ecs-cluster-definition.yml

@@ -3,8 +3,8 @@ definition:
   name: ECS Cluster
   description: Production-ready AWS ECS cluster with Fargate, Fargate Spot, optional EC2 capacity, and shared load balancers.
 release:
-  version: 0.5.0
-  description: "BREAKING: Rename ec2_managed_termination_protection to ec2_managed_termination_protection_enabled and ec2_managed_scaling_status to ec2_managed_scaling_enabled; both inputs now accept booleans instead of ENABLED or DISABLED strings."
+  version: 0.6.2
+  description: "Managed domains keeps every BYO certificate attached via SNI when the Ravion wildcard takes over as the default certificate, so enabling it never drops TLS for existing custom hostnames."
 module:
   inputs:
     - id: network
@@ -51,6 +51,25 @@ module:
           value: enabled
         - label: Disabled
           value: disabled
+    - id: section_managed_domains
+      label: Managed domains
+      type: section
+    - default: false
+      description: Have Ravion issue and manage a shared wildcard TLS certificate and DNS for this cluster. The selected ALB HTTPS listener serves the wildcard certificate, and services get automatic domains under the cluster apex. Requires exactly one HTTPS-enabled ALB.
+      id: use_ravion_managed_domains
+      label: Ravion-managed domains
+      type: boolean
+    - description: Subdomain for the cluster's wildcard domain. Defaults to the module given ID when empty.
+      id: ravion_cluster_name
+      label: Cluster subdomain
+      patterns:
+        - message: The subdomain must contain only lowercase letters, numbers, and hyphens, and start and end with a letter or number.
+          pattern: ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$
+      required: false
+      show_when:
+        use_ravion_managed_domains: true
+      suffix: ".<< platform.apex >>"
+      type: string
     - id: section_capacity
       label: Capacity providers
       type: section
@@ -245,6 +264,7 @@ module:
         show_when:
           public_alb_enabled: true
           public_alb_https_enabled: true
+          use_ravion_managed_domains: false
     - collapsible: true
       description: SSL policy for public ALB HTTPS.
       id: public_alb_ssl_policy
@@ -315,6 +335,7 @@ module:
         show_when:
           private_alb_enabled: true
           private_alb_https_enabled: true
+          use_ravion_managed_domains: false
     - collapsible: true
       description: SSL policy for private ALB HTTPS.
       id: private_alb_ssl_policy
@@ -696,6 +717,10 @@ module:
         public_nlb_security_group_ids: << module.input.public_nlb_security_group_ids >>
         public_subnet_ids: << module.input.public_subnet_ids || [] >>
         region: << module.input.aws_region >>
+        use_ravion_managed_domains: << module.input.use_ravion_managed_domains >>
+        ravion_cluster_name: << module.input.ravion_cluster_name >>
+        ravion_aws_account_id: << module.input.aws_account_id >>
+        ravion_aws_region: << module.input.aws_region >>
         tags:
           $include: ../stack/ravion-tags.yml
         vpc_id: << module.input.vpc_id >>