guardian/infra/terraform.tfvars.example at df8d8120c5f8977994946bd3d3fe3379cf649f5a · OpenZeppelin/guardian · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
# Required: AWS region
aws_region = "us-east-1"

# Optional: ECS/image architecture
# cpu_architecture = "X86_64"
# cpu_architecture = "ARM64"

# Optional: Base stack name used to derive AWS resource names
# stack_name = "guardian"
# stack_name = "psm"

# Required: ECR image URI for the server image
# After pushing to ECR, set this to the full image URI
server_image_uri = "123456789012.dkr.ecr.us-east-1.amazonaws.com/guardian-server:latest"

# Optional: Miden network for the deployed GUARDIAN server
# server_network_type = "MidenTestnet"

# Optional: Falcon public keys allowed to log in as dashboard operators.
# When set, Terraform creates <stack_name>/server/operator-public-keys.
# guardian_operator_public_keys = [
#   "0x<alice-falcon-public-key>",
#   "0x<bob-falcon-public-key>",
# ]

# Optional: existing Secrets Manager secret ARN containing a JSON array of Falcon public keys.
# When set, this takes precedence over guardian_operator_public_keys.
# guardian_operator_public_keys_secret_arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:guardian/operators"

# Optional: EVM runtime configuration when using Terraform directly.
# scripts/aws-deploy.sh derives these from config/evm/chains.json by default.
# guardian_evm_allowed_chain_ids = "1,11155111"
# guardian_evm_rpc_urls = "1=https://ethereum-rpc.publicnode.com,11155111=https://ethereum-sepolia-rpc.publicnode.com"
# guardian_evm_entrypoint_address = "0x433709009b8330fda32311df1c2afa402ed8d009"
# guardian_cors_allowed_origins = "https://accounts.openzeppelin.com"
# Signature schemes NEW accounts may register with (falcon, ecdsa). The
# production checklist recommends "ecdsa"; empty keeps every scheme. Existing
# accounts are never affected and the Falcon ACK key stays required.
# guardian_allowed_account_schemes = "ecdsa"

# Optional: VPC and subnet configuration
# If not specified, uses the default VPC and all its subnets
# vpc_id     = "vpc-xxxxxxxx"
# subnet_ids = ["subnet-xxxxxxxx", "subnet-yyyyyyyy"]
# rds_proxy_subnet_ids = ["subnet-xxxxxxxx", "subnet-yyyyyyyy"]
# In us-east-1, avoid subnets in us-east-1e/use1-az3 for RDS Proxy.

# Optional: Postgres credentials
# Defaults derive from stack_name when omitted
# postgres_db       = "guardian"
# postgres_user     = "guardian"
# postgres_password = "guardian_dev_password"

# Optional: Managed RDS sizing overrides
# Stage defaults:
# - dev  -> db.t3.micro, 20 GiB allocated
# - prod -> db.r6g.large, 50 GiB allocated, 200 GiB max allocated
# rds_instance_class = "db.r6g.large"
# rds_allocated_storage = 50
# rds_max_allocated_storage = 200

# Optional: Managed RDS durability overrides
# Stage defaults:
# - dev  -> deletion protection off, final snapshot skipped on destroy
# - prod -> deletion protection on, final snapshot taken on destroy
# Multi-AZ is off in every stage unless enabled here.
# rds_backup_retention_days = 7
# rds_deletion_protection = true
# rds_skip_final_snapshot = false
# rds_multi_az = true

# Optional: Route 53 hosted zone ID
# route53_zone_id = "Z1234567890ABC"

# One-time hostname migration only; see ../docs/runbooks/guardian-domain-migration.md.
# Leave alias_subdomain empty for normal deployments.
# subdomain = "guardian-new"
# alias_subdomain = "guardian-old"
# alias_acm_certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"

# Optional: Restrict ALB ingress (defaults to 0.0.0.0/0)
# alb_ingress_cidrs = ["203.0.113.0/24"]

# Optional: CloudWatch log retention
# log_retention_days = 7

# Optional: application metrics (ADOT sidecar + CloudWatch dashboard/alarms).
# Enabled by default; the metrics endpoint stays private to the ECS task.
# guardian_metrics_enabled = true   # server Prometheus endpoint (loopback-only)
# cloudwatch_metrics_enabled = true # ADOT sidecar + dashboard + alarms
# metrics_namespace = "Guardian/Server"
# alarm_actions = ["arn:aws:sns:us-east-1:123456789012:guardian-alerts"]
# Managed alarm notifications: an SNS topic (<stack>-alarms) every alarm
# notifies on ALARM/OK, optionally delivered to a per-environment Slack
# channel via Amazon Q Developer in chat applications. The workspace must be
# authorized once in the console; see "Metrics, Dashboard, And Alarms".
# alarm_notifications_enabled = true
# alarm_slack_workspace_id = "T0123456789"
# alarm_slack_channel_id = "C0123456789" # e.g. #guardian-alerts-devnet
# alarm_error_rate_threshold_percent = 5
# alarm_latency_threshold_seconds = 1
# alarm_cpu_threshold_percent = 85
# alarm_memory_threshold_percent = 90
# cloudwatch_log_alarms_enabled = true # ERROR log metric filter + log-errors alarm, WARN filter with the dashboard (needs guardian_log_format = "json")
# alarm_log_error_threshold = 0        # ERROR lines per 5 min tolerated before the alarm counts a period as breaching

# Optional: Task resource configuration
# server_cpu    = 512
# server_memory = 1024

# Optional: rate limiting (HTTP and gRPC) and DB pool overrides
# guardian_rate_limit_enabled = false
# guardian_rate_burst_per_sec = 200
# guardian_rate_per_min = 5000
# guardian_db_pool_max_size = 32
# guardian_metadata_db_pool_max_size = 32
# guardian_canonicalization_fast_promotion_enabled = false

# Optional: Log format (text, json, compact) — json for CloudWatch Logs Insights
# guardian_log_format = "json"

# Optional: Resource naming (defaults match the original bash script)
# cluster_name                 = "guardian-cluster"
# server_service_name          = "guardian-server"
# alb_name                     = "guardian-alb"
# target_group_name            = "guardian-server-tg"
# alb_security_group_name      = "guardian-alb-sg"
# server_security_group_name   = "guardian-server-sg"
# postgres_security_group_name = "guardian-postgres-sg"
# task_execution_role_name     = "guardian-ecs-task-execution"
# task_role_name               = "guardian-ecs-task"
# server_task_family           = "guardian-server"
# server_container_name        = "guardian-server"
# server_log_group_name        = "/ecs/guardian-server"

# Optional: GitHub Actions OIDC roles for .github/workflows/aws-deploy.yml.
# Shared by every stack in the account; enable on exactly one stack.
# github_oidc_enabled               = true
# github_oidc_provider_arn          = "arn:aws:iam::<root-account>:oidc-provider/token.actions.githubusercontent.com"
# github_oidc_root_account_profile  = "<aws-cli-profile-for-the-root-account>"   # or:
# github_oidc_root_account_role_arn = "arn:aws:iam::<root-account>:role/Terraform"
# github_oidc_subjects = [
#   "repo:OpenZeppelin/guardian:environment:devnet",
#   "repo:OpenZeppelin/guardian:environment:testnet",
# ]
# github_deploy_stack_names = ["guardian", "guardian-prod"]