From baf4d90ddcc4c220ee8a9458a3aeff174d5a91b9 Mon Sep 17 00:00:00 2001 From: carlomazzaferro Date: Mon, 16 Oct 2023 15:09:02 +0200 Subject: [PATCH] fix: sync staging ops with main --- ops/README.md | 2 +- ops/env/testnet/core/secrets.prod.json | 8 +- ops/env/testnet/core/secrets.staging.json | 16 +- ops/infra/.terraform-version | 2 +- ops/infra/outputs.tf | 5 +- ops/mainnet/prod/backend/.terraform-version | 2 +- ops/mainnet/prod/backend/main.tf | 5 - ops/mainnet/prod/core/.terraform-version | 2 +- ops/mainnet/prod/core/config.tf | 1 - ops/mainnet/prod/core/main.tf | 44 ++---- ops/mainnet/prod/core/variables.tf | 4 - ops/modules/ecr-lcp/main.tf | 77 ++++++++++ ops/modules/ecr-lcp/variables.tf | 4 + ops/modules/ecr/main.tf | 26 ---- ops/modules/ecs/variables.tf | 10 -- ops/modules/iam/outputs.tf | 4 + ops/modules/iam/vpc.tf | 39 +++++ ops/modules/lambda/main.tf | 2 +- ops/modules/lambda/variables.tf | 7 +- ops/modules/networking/main.tf | 30 ++++ ops/modules/service/main.tf | 5 +- ops/modules/service/variables.tf | 4 - ops/testnet/prod/backend/.terraform-version | 2 +- ops/testnet/prod/backend/config.tf | 4 +- ops/testnet/prod/backend/main.tf | 5 - ops/testnet/prod/core/.terraform-version | 2 +- ops/testnet/prod/core/config.tf | 86 ++++++----- ops/testnet/prod/core/main.tf | 40 ++--- ops/testnet/prod/core/variables.tf | 4 - .../staging/backend/.terraform-version | 2 +- ops/testnet/staging/backend/config.tf | 9 +- ops/testnet/staging/backend/main.tf | 60 +------- ops/testnet/staging/core/.terraform-version | 2 +- ops/testnet/staging/core/config.tf | 138 ++++++------------ ops/testnet/staging/core/main.tf | 101 +++++-------- ops/testnet/staging/core/outputs.tf | 29 ++-- ops/testnet/staging/core/variables.tf | 34 ++--- 37 files changed, 354 insertions(+), 463 deletions(-) create mode 100644 ops/modules/ecr-lcp/main.tf create mode 100644 ops/modules/ecr-lcp/variables.tf create mode 100644 ops/modules/iam/vpc.tf diff --git a/ops/README.md b/ops/README.md index 33651baedc..c079dea8c0 100644 --- a/ops/README.md +++ b/ops/README.md @@ -1,7 +1,7 @@ ## AWS Infrastructure This folder contains all the code necessary to deploy a sequencer and router server to a highly-available -ecs cluster, with required dependencies. Namely: +ecs cluster, with its required dependencies. Namely: - Fully configured load balancing, port forwarding, and TLS - Autoscaling with ECS on [Fargate](https://aws.amazon.com/fargate/) diff --git a/ops/env/testnet/core/secrets.prod.json b/ops/env/testnet/core/secrets.prod.json index 2478f63ca0..9dced95e29 100644 --- a/ops/env/testnet/core/secrets.prod.json +++ b/ops/env/testnet/core/secrets.prod.json @@ -1,9 +1,9 @@ { "goerli_alchemy_key_0": "ENC[AES256_GCM,data:Owj2W0HXZ8eT1NWQNAmg2X3lykNb4m1hcYyQ7X0TaEc=,iv:dSU2ek6pGWNHTCaYDvVKuurTDlnq+TsZtQ/2FJq/xHw=,tag:tS7e8SWcpCo7lxFckqwFMA==,type:str]", "goerli_alchemy_key_1": "ENC[AES256_GCM,data:aHBsbLDrIu2JfR13pIziTRYTE6kGMwToboIYp9K8U3c=,iv:OvM6yWKwgYzj2ChBF2BVbDUwJC/WewdntXCxR2cofzY=,tag:WZMleETIKWrZowsdzZOOsg==,type:str]", - "optgoerli_alchemy_key_0": "ENC[AES256_GCM,data:+NEFwFd97974EAwMxF3ctjUpGf4EMWRy8aXIAeCPIaw=,iv:jiz3YBLnX4wYFSCj/qj/Gep4RYYZZtb974vP/gymcDE=,tag:t/lP1O9f2Q5VYtgNtIjduw==,type:str]", + "optgoerli_alchemy_key_0": "ENC[AES256_GCM,data:Rcy+YLf1BaHp+4IdpylsX9CZN+xgHC2GotFKpXgQwys=,iv:2hti9Xi5OVcluqu5HxPrRcAx4/b2ICZHui3dWREnCbY=,tag:MSIglSjG/00za1K4XhjW6Q==,type:str]", "optgoerli_alchemy_key_1": "ENC[AES256_GCM,data:IKvEQW3u/ShLXgt90ZyvbwSgaoWSVjNKucefr1ZUOks=,iv:KNkyaDV+MoVJ4GmQDwxn/drHeTNXAtJ+IdXkh5r1UxY=,tag:7stNWMB0nmWqOrqZwsOENw==,type:str]", - "arbgoerli_alchemy_key_0": "ENC[AES256_GCM,data:FznvthayCWL5gQrBs4GSyRkZrXg1fAXTpuvHoZ0Brmw=,iv:h/Ln5MiegVXtUgCWB65hwfCVhRht9cr2Fw4QbUO4ZPg=,tag:r1ueHnIDTKcQBxVRmirvfg==,type:str]", + "arbgoerli_alchemy_key_0": "ENC[AES256_GCM,data:DzcWQbZI0vkf1VRdAZqaalCecYOedSbYyfW7livMY2g=,iv:7P9KrTDmNrD36HbALYsjTNQr3oMkZqxY57f8rzWq6PY=,tag:72I+op1utGFaLjwJHJ83pQ==,type:str]", "arbgoerli_alchemy_key_1": "ENC[AES256_GCM,data:AoJEiPuHviI14XuFJP7/GFTbEd5UfLHXq3OefHwV3BQ=,iv:tvvt76MHKvXcsVOl+Lk2t6PjazzhS/tBXbVWuJ1JL8w=,tag:KS9pom1Fz9o7DLsPuxLrRQ==,type:str]", "mumbai_alchemy_key_0": "ENC[AES256_GCM,data:VolMxEjn8+QnY13VzDpEWenyv1CBjvyjcLMb1l/xlrw=,iv:BWvw9p/3JYsLpqdszm5JIasoxjypghjaff/BJ2QIOtM=,tag:M/AN6XyOJoAL7/RNWy7SuQ==,type:str]", "blast_key": "ENC[AES256_GCM,data:aOV48KWCE0L4tjHc+Tdt4oQBFGbTRKeb+2DMFI4Y7LGjYNke,iv:wv3W/M2ZKTFpj28WAUZIvPKOc4kvsWqabDd+qoVTdg4=,tag:gWHQBWTVIjT0PymIHOROnQ==,type:str]", @@ -36,8 +36,8 @@ "azure_kv": null, "hc_vault": null, "age": null, - "lastmodified": "2023-06-20T08:53:00Z", - "mac": "ENC[AES256_GCM,data:03ff0KH7+dCzZrc/SHwl4DdInbZ5ArBveoDKQRRWStKX8r5aYxoVNGVLRv5GtJvg/sWRBodUxJfpXXr/C2N2TseMAbCcFeQz23LmJgQwljSvq9hC33Seupf5MUl0EX1+ibFkpLAmxYyhTKCiLMKNh7GvjTKxF6jt5CcOW+b1RyI=,iv:g9XXrnV7+SCwJT87RzIIGa+woRlhpLTAnUq46mCGfZk=,tag:8/1fuUCINRamsbQRpKyXTQ==,type:str]", + "lastmodified": "2023-10-12T18:16:36Z", + "mac": "ENC[AES256_GCM,data:74+Bo9rq93wtubj0aXcJUwNQB+KrSDllG4HurDeqyW2mt+kkOQckWmnZmdyK9DqNvLCp+h33dp3IiJHz+ijHWrfAku3uQCSg2x/0GNNFxEH1+/SReXriP+XaVZ81CuWYgcLEqOOi7EVWl8TTBhpwBpS3QHcP4MQ6M3xX3ebBux0=,iv:jsRaEk85OzJAtT5ArvgCdCVBlPn84PhrBkU+kujq85w=,tag:rJs0Ak7ulVgheQnoh3R+XQ==,type:str]", "pgp": null, "unencrypted_suffix": "_unencrypted", "version": "3.7.3" diff --git a/ops/env/testnet/core/secrets.staging.json b/ops/env/testnet/core/secrets.staging.json index bf9f774ba9..49eecd9baa 100644 --- a/ops/env/testnet/core/secrets.staging.json +++ b/ops/env/testnet/core/secrets.staging.json @@ -1,20 +1,18 @@ { + "optgoerli_alchemy_key_0": "ENC[AES256_GCM,data:k1qUWsq8/E0RPCsjOwdv50q36b3wch73xgxTdm8mEbI=,iv:hCcTxDpm3HGETyzZ4jLtoMlYPVotQVf2647KRQwVHes=,tag:m9LqGTMbvzQa74j2aVW1lA==,type:str]", + "optgoerli_alchemy_key_1": "ENC[AES256_GCM,data:hW5uu+SLwb50rSLv9YdCKnk79MEhyqP2vxELQPc5/zg=,iv:xHCBKpARqPGrjt5ZAJO7PJEQGLVRIKFfI90ahnOqAmI=,tag:EcTWFj2TIshthXYjNYCjYg==,type:str]", "goerli_alchemy_key_0": "ENC[AES256_GCM,data:/wISWZUmSGM3ltN4h9rxDGUnhf9kgc6VW51zl6Wu7Z8=,iv://fHe2qY8Qjl7f0qGa02lOLjccC9HyNNVeCe5NOilIM=,tag:Ei98lvqXj3MudX/dHPEfQg==,type:str]", "goerli_alchemy_key_1": "ENC[AES256_GCM,data:dMUjnDXoer4TRSR/YBQ5MIs/FUuSjRILAaLWp08hj1c=,iv:z1ZD+HYfeVdujaAmFWQTL9vmF52GAB9p8iEBna9RWHw=,tag:nQE8qQgIU3asER0b3iWmng==,type:str]", - "optgoerli_alchemy_key_0": "ENC[AES256_GCM,data:mXcL4RU5T49CD3g4jQQA6AMGSupcFO+RknKYDYI4fBo=,iv:jPPyIcLzqyibmIZWvSUBabkH16kP32QhKpbFytIrpVI=,tag:1lw7dR9FxDCvS+2PVbsZcg==,type:str]", - "optgoerli_alchemy_key_1": "ENC[AES256_GCM,data:hW5uu+SLwb50rSLv9YdCKnk79MEhyqP2vxELQPc5/zg=,iv:xHCBKpARqPGrjt5ZAJO7PJEQGLVRIKFfI90ahnOqAmI=,tag:EcTWFj2TIshthXYjNYCjYg==,type:str]", - "arbgoerli_alchemy_key_0": "ENC[AES256_GCM,data:Bqq7QPW2TUVdlppYdxdV//Vbdca9cTyIAwnhqlVduCw=,iv:tuAnhM5QSOh06zrkBPAwgNB1agAZwFhW13FCyM03/LQ=,tag:iKFPbTBTKkZUmiI6eKBBkQ==,type:str]", + "arbgoerli_alchemy_key_0": "ENC[AES256_GCM,data:68ITTHB2K4ENYUserZiFLp5spE8vqPEr7VhKAGTPQy4=,iv:5qIXaTVycbJBVCwlq768qhWv5MLoyV0RabMLqQ3KwHk=,tag:dd6ubCahF9UiAS4klBY5lQ==,type:str]", "arbgoerli_alchemy_key_1": "ENC[AES256_GCM,data:RkENJZPkuPT/Lb4sfY/1IUGdpGYWZ167acoWVWjP0ww=,iv:rznmPAbXaujoUUc/9L1Y7RwJ7TDxRKXWjiUvTRm0DBE=,tag:HFX0K5oEW88BOtHq/Na47g==,type:str]", - "mumbai_alchemy_key_0": "ENC[AES256_GCM,data:3roireSflhY69Nc7a7iN7vZl3XOlfSGUcoXXQUM6Q9o=,iv:p/vwiWYAuU/kW287lHAmzQTL/6eaUAQhbvVyhF7M+js=,tag:ta+HAca5ohMizSmD5Tapuw==,type:str]", "blast_key": "ENC[AES256_GCM,data:hpLxIagHQcTrTTGjLh92R+7/R8KvWHy45eCV1vYkfdYve4Dr,iv:tM11VtOjKc+KHpd0PEkgmcLK0lEw4fI2y7CQYLE+afY=,tag:cdhEzbUnkTd7z09DcUP01Q==,type:str]", - "infura_key": "ENC[AES256_GCM,data:SCBjO1DDN/bk8t1+ET7TXANbhgoaKYnXhkoVdXVraBY=,iv:5FkRlSFgEXa/6JKcaiU50x1s7OKmTvJ2A8E4mLiT7jw=,tag:STmv7wfTZig5Js9PtJbSGw==,type:str]", "admin_token_router": "ENC[AES256_GCM,data:0wnIxq6DHe0=,iv:Mwb4AXNF5l2mFXJZ7emfRLRg3bZZWk0j9UtgqYOyL2Q=,tag:JGBJron0GZVRIp75/Lx98A==,type:str]", "admin_token_relayer": "ENC[AES256_GCM,data:FW0wINsA/+n4+J5w,iv:TK+ajUjvRJ5dTcXcnbIc5JNh6PW9UXnHc2Pu8fYEfx8=,tag:z3PVS01IUt/2PLVEhZuYqA==,type:str]", "router_web3_signer_private_key": "ENC[AES256_GCM,data:FAhI5hUlOE9as4/tdFrI07B+MC1YvyZWn1kW5K/16+eYUWc4RhAORmWaE0gRWvoufRVt/ORHRErK8Rh09WNIDYWE,iv:DIwSCl0PeAPUEe94MI2og9x/FvFxKZKAw2VDVWkrDqw=,tag:/L09atM1jSssXig+Ar6CUA==,type:str]", "sequencer_web3_signer_private_key": "ENC[AES256_GCM,data:Pr/XG1/mYaEUjnYS93u//07l0BQhm5rYRPoora0ueLxA4i6azJcyGYDwYUR+k27vz0SkrCwwO1D+LsxUWuC5lW3D,iv:zbrZb89ONwyL0w0fCs4N58QMuK8Y4kAXE3CwpW7nxuo=,tag:Zrbtz+RfBr6vKpnIwmenFQ==,type:str]", "rmq_mgt_password": "ENC[AES256_GCM,data:7Vd3omH0cn3ucGGxmX2G,iv:iODSARAiWiJmhAc4XxsQjtj4mXmWOXYyFGX7if52zWY=,tag:qwQzyHgf6aKzXGV1Khew1g==,type:str]", "dd_api_key": "ENC[AES256_GCM,data:nxtkHnCTowSHV2Tykj/ZUgLTqo5b75BnFwFAKQwJgFc=,iv:+50W3/jCdUTdvytBMaCd4zTQ1Yj9/4B/r4scCnSG9GM=,tag:G/C8wcG7gPBG0d4TC8hHoQ==,type:str]", - "gelato_api_key": "ENC[AES256_GCM,data:V6V1pEP6dcVAaIE/0zITEbb4L+45ArJNrAHKeSnKFPRrh+jwhoKR4SL/bOE=,iv:JZF3p5R834ah+a4gjiPhX8yG4ejDKlgFlqWn7sUgb4w=,tag:aI+RW007Bgl6+Ire92G8DQ==,type:str]", + "gelato_api_key": "ENC[AES256_GCM,data:8i+pK7EdyJBD25ly8N5gmNAZP/t7pOtq/bftTooZScZJ9CfPs76b5HGiCL4=,iv:GTbSZR9jwfkC/5e44qDeQaw708hiPsE4BbWz7GOv62M=,tag:IB68U48ZaPXm80GuP6T2Hg==,type:str]", "postgres_password": "ENC[AES256_GCM,data:T5qV9VwiICMS7DxYOyTN,iv:7C9qKO7gE8RDF+F8QvXzUKr7/odpQl2Pl0PaEvE41Yc=,tag:WLVdJBudoSfR7mt7KQ38vw==,type:str]", "discord_webhook_key": "ENC[AES256_GCM,data:dapCWM7pfnOyapCFKegHj5dPBftlOjHD3QCgAaERsXiRIsTSSpT5MqOLuMJ5r/Zq7ez8JzJO536Y1QftbMZVz+NWFGOmJRqszvE9xFFjnirRLQTlVJUXNQ==,iv:CAbEIRTxkaf51G5SSmlrJcawqws7GdFiqEw46EHvBes=,tag:/TssqwqPjkHW0q2lAqKi4g==,type:str]", "telegram_api_key": "ENC[AES256_GCM,data:k4eMYvbGI27VrUDkK6oeFjeuLbRPg+9YrxfeAJJ92fbiD/HRC/1Sz//gOBkSrQ==,iv:4lYSd8V+itGRM/BRCtYaOmV8zGE3kYW35dTkQ9ijp3A=,tag:Hs8TY3QqO9+uklnxJCnvsA==,type:str]", @@ -22,8 +20,6 @@ "betteruptime_api_key": "ENC[AES256_GCM,data:xJ/0QQozmfVedcNK2ZDmgjyVWQ+HDT1b,iv:wa4oOgvLeHi8C0X6vNIhhQuqDS8r1R9wRPMxWhKTscg=,tag:7BdsxpKjtoByUv/LTslDMQ==,type:str]", "relayer_web3_signer_private_key": "ENC[AES256_GCM,data:wRSzd7JmCfXc6925dQjqyjXEIi2yACitVxKAdtNoK1vmties3LZ/7VQgHSngfneLmFDpbV43A5buU4wVnAFkTwMC,iv:OwPp02yQr3WCMGCp5fK0ksWXg8U6YmATapH529lDurA=,tag:gLg2gmT5G91325oug/nkvA==,type:str]", "watcher_web3_signer_private_key": "ENC[AES256_GCM,data:g/8wZFvwuZeCq8pnnhNVt/UTNe5Fcnf2of7Ts8yEvRwR8AgVT5sR1GIpB1XrTqsHqSN8XOOyurLvwJXyFGkpUGMY,iv:9Qbxq6FJMbJIy9BAW2pA7GRq/nq1+YCVi+v90b0+/84=,tag:xD1AuxLPSEONP5gvfTOHJQ==,type:str]", - "linea_node": "ENC[AES256_GCM,data:P0vDWrBM+SlPbtSzdC/hRcjz4ClurVRGTIU=,iv:KAMr1IRv2mvEeXNgu7qT0wL2wDLy/rUpNXeW1pomJBw=,tag:REAj5TpcoHD4I7dS1VVjaw==,type:str]", - "optgoerli_alchemy_key_for_lh": "ENC[AES256_GCM,data:rSFyCLjXeBX9eXuxCA9eZ+eXaISmCFDZwzx/LlFyWoM=,iv:AFnmspH6VWoGhzZnFebVrcQscjhkXledbPAuCGRWy4k=,tag:vWssSwP3R1ye/ja1WKHhCw==,type:str]", "sops": { "kms": [ { @@ -37,8 +33,8 @@ "azure_kv": null, "hc_vault": null, "age": null, - "lastmodified": "2023-10-12T18:10:24Z", - "mac": "ENC[AES256_GCM,data:YcLs2iBxe1D1GQb15vcy2k2LKy4gTxEYGIwxpfILIvbZApygBwqFx7sTSAdRd2fmS4BqT+mO7zqPbGCqINv+QH/bQB0KUXaQSks+2oe0G/Rs8UOq9XWi6SU15+JJY6OqQ1qoSqALyQ87ME2OZcbgMdjDRj70lT6+3zd8xV2Xoo8=,iv:cBTNs+hFCarWz9A/QJO2IFAh06E9ktTOAt/TEm4MLRc=,tag:MwrRlxqR1kOPcNHCW3T/aw==,type:str]", + "lastmodified": "2023-01-30T09:37:19Z", + "mac": "ENC[AES256_GCM,data:0gMMVf7AmF1bXwqNBcs4AprVXQ0WH8dXWN5/7Bjfvj93bwdkfpxtKmguMqMLZGPb9RvqB9KssfbuwDdwNNn4XBEoBEyhhdc+JTLEuuzUAhherK4ADrpCiNaF/qRxoKLLbxXOAiOjB47nbjajY+3Jm6MInsyPX3DPccJBxsANeqc=,iv:rl4OAIqMMHJLzIqlVO+drHcWbLRgxiBErcmczHcUIgg=,tag:0RET/h14fJ9hwV8sNmXKcg==,type:str]", "pgp": null, "unencrypted_suffix": "_unencrypted", "version": "3.7.3" diff --git a/ops/infra/.terraform-version b/ops/infra/.terraform-version index f5a0d9d92b..f01291b87f 100644 --- a/ops/infra/.terraform-version +++ b/ops/infra/.terraform-version @@ -1 +1 @@ -1.5.7 \ No newline at end of file +1.5.7 diff --git a/ops/infra/outputs.tf b/ops/infra/outputs.tf index e7eeb0640d..8551ae7f29 100644 --- a/ops/infra/outputs.tf +++ b/ops/infra/outputs.tf @@ -1,4 +1,7 @@ - output "ecr_admin_role" { value = module.iam.execution_role_arn } + +output "vpc_flow_logs_role" { + value = module.iam.vpc_flow_logs_role_arn +} diff --git a/ops/mainnet/prod/backend/.terraform-version b/ops/mainnet/prod/backend/.terraform-version index f5a0d9d92b..f01291b87f 100644 --- a/ops/mainnet/prod/backend/.terraform-version +++ b/ops/mainnet/prod/backend/.terraform-version @@ -1 +1 @@ -1.5.7 \ No newline at end of file +1.5.7 diff --git a/ops/mainnet/prod/backend/main.tf b/ops/mainnet/prod/backend/main.tf index 4f9f4abb8d..de202329b3 100755 --- a/ops/mainnet/prod/backend/main.tf +++ b/ops/mainnet/prod/backend/main.tf @@ -121,7 +121,6 @@ module "postgrest" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets lb_subnets = module.network.public_subnets internal_lb = false docker_image = "postgrest/postgrest:v10.0.0.20221011" @@ -150,7 +149,6 @@ module "sdk-server" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets lb_subnets = module.network.public_subnets internal_lb = false docker_image = var.full_image_name_sdk_server @@ -304,7 +302,4 @@ module "ecs" { environment = var.environment domain = var.domain ecs_cluster_name_prefix = "nxtp-ecs" - vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets - public_subnets = module.network.public_subnets } diff --git a/ops/mainnet/prod/core/.terraform-version b/ops/mainnet/prod/core/.terraform-version index f5a0d9d92b..f01291b87f 100644 --- a/ops/mainnet/prod/core/.terraform-version +++ b/ops/mainnet/prod/core/.terraform-version @@ -1 +1 @@ -1.5.7 \ No newline at end of file +1.5.7 diff --git a/ops/mainnet/prod/core/config.tf b/ops/mainnet/prod/core/config.tf index 02a4dd1fa7..bcc77423cb 100644 --- a/ops/mainnet/prod/core/config.tf +++ b/ops/mainnet/prod/core/config.tf @@ -337,7 +337,6 @@ locals { processor = "https://betteruptime.com/api/v1/heartbeat/${var.lighthouse_processor_heartbeat}" propagate = "https://betteruptime.com/api/v1/heartbeat/${var.lighthouse_propagate_heartbeat}" sendOutboundRoot = "https://betteruptime.com/api/v1/heartbeat/${var.lighthouse_send_outbound_root_heartbeat}" - propose = "https://betteruptime.com/api/v1/heartbeat/${var.lighthouse_propose_heartbeat}" } hubDomain = "6648936" proverBatchSize = { diff --git a/ops/mainnet/prod/core/main.tf b/ops/mainnet/prod/core/main.tf index 09d5186f51..ce96035080 100755 --- a/ops/mainnet/prod/core/main.tf +++ b/ops/mainnet/prod/core/main.tf @@ -34,7 +34,6 @@ module "router_subscriber" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets lb_subnets = module.network.public_subnets internal_lb = false docker_image = var.full_image_name_router_subscriber @@ -64,7 +63,6 @@ module "router_publisher" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets lb_subnets = module.network.public_subnets internal_lb = false docker_image = var.full_image_name_router_publisher @@ -94,7 +92,6 @@ module "router_executor" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets lb_subnets = module.network.public_subnets internal_lb = false docker_image = var.full_image_name_router_executor @@ -124,8 +121,7 @@ module "router_web3signer" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets - lb_subnets = module.network.public_subnets + lb_subnets = module.network.private_subnets docker_image = "ghcr.io/connext/web3signer:latest" container_family = "router-web3signer" health_check_path = "/upcheck" @@ -167,7 +163,6 @@ module "sequencer_server" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets lb_subnets = module.network.public_subnets docker_image = var.full_image_name_sequencer_server container_family = "sequencer" @@ -196,7 +191,6 @@ module "sequencer_publisher" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets lb_subnets = module.network.public_subnets docker_image = var.full_image_name_sequencer_publisher container_family = "sequencer-publisher" @@ -236,7 +230,6 @@ module "sequencer_subscriber" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets lb_subnets = module.network.public_subnets internal_lb = false docker_image = var.full_image_name_sequencer_subscriber @@ -278,8 +271,7 @@ module "sequencer_web3signer" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets - lb_subnets = module.network.public_subnets + lb_subnets = module.network.private_subnets docker_image = "ghcr.io/connext/web3signer:latest" container_family = "sequencer-web3signer" health_check_path = "/upcheck" @@ -311,7 +303,7 @@ module "lighthouse_prover_cron" { timeout = 300 memory_size = 10240 lambda_in_vpc = true - private_subnets = module.network.private_subnets + subnet_ids = module.network.private_subnets lambda_security_groups = flatten([module.network.allow_all_sg, module.network.ecs_task_sg]) } @@ -327,7 +319,6 @@ module "lighthouse_prover_subscriber" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets lb_subnets = module.network.public_subnets internal_lb = false docker_image = var.full_image_name_lighthouse_prover_subscriber @@ -395,19 +386,6 @@ module "lighthouse_sendoutboundroot_cron" { memory_size = 2048 } -module "lighthouse_propose_cron" { - source = "../../../modules/lambda" - ecr_repository_name = "nxtp-lighthouse" - docker_image_tag = var.lighthouse_image_tag - container_family = "lighthouse-propose" - environment = var.environment - stage = var.stage - container_env_vars = merge(local.lighthouse_env_vars, { LIGHTHOUSE_SERVICE = "propose" }) - schedule_expression = "rate(30 minutes)" - memory_size = 512 -} - - module "relayer" { source = "../../../modules/service" @@ -420,7 +398,6 @@ module "relayer" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets lb_subnets = module.network.public_subnets docker_image = var.full_image_name_relayer container_family = "relayer" @@ -450,8 +427,7 @@ module "relayer_web3signer" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets - lb_subnets = module.network.public_subnets + lb_subnets = module.network.private_subnets docker_image = "ghcr.io/connext/web3signer:latest" container_family = "relayer-web3signer" health_check_path = "/upcheck" @@ -480,7 +456,6 @@ module "watcher" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets lb_subnets = module.network.public_subnets docker_image = var.full_image_name_watcher container_family = "watcher" @@ -510,8 +485,7 @@ module "watcher_web3signer" { execution_role_arn = data.aws_iam_role.ecr_admin_role.arn cluster_id = module.ecs.ecs_cluster_id vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets - lb_subnets = module.network.public_subnets + lb_subnets = module.network.private_subnets docker_image = "ghcr.io/connext/web3signer:latest" container_family = "watcher-web3signer" health_check_path = "/upcheck" @@ -555,9 +529,6 @@ module "ecs" { environment = var.environment domain = var.domain ecs_cluster_name_prefix = "nxtp-ecs" - vpc_id = module.network.vpc_id - private_subnets = module.network.private_subnets - public_subnets = module.network.public_subnets } module "sequencer_cache" { @@ -606,3 +577,8 @@ module "lighthouse_cache" { cache_subnet_group_subnet_ids = module.network.public_subnets node_type = "cache.r4.large" } + +module "ecr-lcp" { + source = "../../../modules/ecr-lcp" + repository_names = ["nxtp-cartographer", "nxtp-lighthouse", "postgrest"] +} diff --git a/ops/mainnet/prod/core/variables.tf b/ops/mainnet/prod/core/variables.tf index c660be6e4b..0f5b042619 100755 --- a/ops/mainnet/prod/core/variables.tf +++ b/ops/mainnet/prod/core/variables.tf @@ -188,10 +188,6 @@ variable "lighthouse_send_outbound_root_heartbeat" { type = string } -variable "lighthouse_propose_heartbeat" { - type = string -} - variable "full_image_name_relayer" { type = string description = "relayer image name" diff --git a/ops/modules/ecr-lcp/main.tf b/ops/modules/ecr-lcp/main.tf new file mode 100644 index 0000000000..eee1523c9c --- /dev/null +++ b/ops/modules/ecr-lcp/main.tf @@ -0,0 +1,77 @@ +resource "aws_ecr_lifecycle_policy" "remove_old_images" { + for_each = toset(var.repository_names) + repository = each.value + + policy = <