| 1 | # 🤖 infra/dev-mesh — the AWS half of the two-node dev mesh |
| 2 | |
| 3 | The Dublin (`ie`) node of the relaxed, cut-off staging fleet. Design + the |
| 4 | prod per-country model it rehearses: `docs/dev-mesh.md`. Its own tofu state |
| 5 | (`dev-mesh/terraform.tfstate`) so it tears down independently of the `#550` |
| 6 | activator box in `infra/dev`. |
| 7 | |
| 8 | Manages the static skeleton only: the EC2 box + EIP, its security group, the |
| 9 | instance role, the shared `eleven-dev-mesh-*` S3 bucket, the Helsinki node's |
| 10 | scoped IAM user, the **Route53 `dev.11ch.at` hosted zone** (delegated from the |
| 11 | prod `11ch.at` DNSimple zone) and its wildcards, and the DNS-01 IAM the boxes |
| 12 | use to obtain the shared `*.dev.11ch.at` cert. The Helsinki (`fi`) node itself |
| 13 | is Hetzner, hand-provisioned like prod's Hetzner boxes. |
| 14 | |
| 15 | **DNS lives in Route53 now** (`route53.tf`): `dev.11ch.at` is its own hosted |
| 16 | zone in the dev AWS account, NS-delegated from DNSimple (`dns.tf`). That is the |
| 17 | region-neutral base domain for multi-edge Phase 1 — new spaces mint as |
| 18 | `<sqid>.dev.11ch.at` and both boxes obtain the `*.dev.11ch.at` wildcard cert |
| 19 | over Route53 DNS-01 with their AWS role/user, no DNS token on a box |
| 20 | (`route53dns.go`, `LCHAT_DNS_PROVIDER=route53`). The per-country |
| 21 | `*.ie.dev` / `*.fi.dev` wildcards moved into this zone too (the delegation makes |
| 22 | DNSimple non-authoritative below `dev.11ch.at`). DNSimple keeps only the `dev` |
| 23 | NS delegation and the `home.dev.elevenmessenger.com` A record. Cutover + |
| 24 | box-reconfig runbook: `docs/multi-edge-dev-cutover.md`. |
| 25 | |
| 26 | ```sh |
| 27 | # plan (with the AMI-replacement guard) — credentials come from your |
| 28 | # per-operator dev agent item in Bitwarden automatically (AWS_* + DNSIMPLE_*; |
| 29 | # the DNSimple token lives in the Eleven account, 176940): |
| 30 | ./deploy/ops dev plan |
| 31 | |
| 32 | # apply behind the same guard (tofu's interactive approve remains the gate): |
| 33 | ./deploy/ops dev apply |
| 34 | ``` |
| 35 | |
| 36 | The Helsinki node's scoped S3 secret is a sensitive output — seal it into the |
| 37 | vault, never commit it: |
| 38 | |
| 39 | ```sh |
| 40 | AWS_PROFILE=eleven-dev tofu output -raw fi_node_secret_key # → vault, in your terminal |
| 41 | ``` |
| 42 | |
amadan