| 1 | # 🤖 infra/ — the Eleven Cloud IaC skeleton |
| 2 | |
| 3 | OpenTofu for the AWS side of the planet-scale plan (issue #550). This layer |
| 4 | manages the **static skeleton only** — buckets, IAM, and (later) VPC/NLB/ASG. |
| 5 | All intelligence lives in the `lchat` binary; the boundary test from the plan |
| 6 | holds for every change here: **if the IaC needs to know an instance hostname, |
| 7 | the design is wrong.** |
| 8 | |
| 9 | ## Environments |
| 10 | |
| 11 | - `dev/` — the proof-of-concept environment in the dev account |
| 12 | (`427880590669`, eu-west-1, AWS profile `eleven-dev`). Test data only: |
| 13 | nothing in this account is production, and the production fleet stays on |
| 14 | the router box until #550's build triggers fire. |
| 15 | |
| 16 | ## Running |
| 17 | |
| 18 | ```sh |
| 19 | cd infra/dev |
| 20 | AWS_PROFILE=eleven-dev tofu init |
| 21 | AWS_PROFILE=eleven-dev tofu plan |
| 22 | AWS_PROFILE=eleven-dev tofu apply |
| 23 | ``` |
| 24 | |
| 25 | State lives in S3 (`eleven-tofu-state-427880590669`, versioned, private) with |
| 26 | native lockfile locking — no DynamoDB lock table needed. That bucket is the |
| 27 | one imperatively-created resource (chicken and egg); everything else is |
| 28 | declared here. Being hand-managed, its hardening is hand-applied too: full |
| 29 | Block Public Access, and a `DenyInsecureTransport` bucket policy (deny on |
| 30 | `aws:SecureTransport=false`, applied 2026-07-15) matching the TLS-only |
| 31 | policy every declared bucket carries — reapply both if the bucket is ever |
| 32 | recreated. |
| 33 | |
| 34 | ## What exists (dev) |
| 35 | |
| 36 | - `eleven-dev-instances-…` — the instance-state bucket: Litestream replication |
| 37 | targets, one prefix per instance. Versioning on, lifecycle keeps the last 5 |
| 38 | noncurrent versions, Block Public Access. Instance DBs are opaque ciphertext |
| 39 | plus routing metadata the server already sees, so replicating them here is |
| 40 | threat-model-free (the E2EE rule did the hard part). |
| 41 | - `eleven-dev-home-…` — the home vault bucket for the `s3Store` backend work |
| 42 | (#550 Part 1): same posture. |
| 43 | - A scoped `litestream-canary` IAM user/policy confined to the canary's prefix |
| 44 | — the shape per-instance credentials will take; the admin `dev-agent` and |
| 45 | `dev-agent-james` users (one per operator; James's key is sealed in the |
| 46 | secrets vault) are console-made and not managed here. |
| 47 | |
amadan