Conan Scott
fba56bf8f3
Add var.ui_gateway_url so config.js can target the Fusion listener instead of the backend /demo. Set to the Fusion /tokenize endpoint; the browser now runs the full flow through the gateway (guardrail -> tokenize -> agent -> restore). Requires Fusion to return CORS for the CloudFront origin (done). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
91 lines
2.9 KiB
HCL
91 lines
2.9 KiB
HCL
# ---------------------------------------------------------------------------
|
|
# T6: host the advisor UI on S3 + CloudFront. The bucket is private; CloudFront
|
|
# reaches it via Origin Access Control. index.html is static and committed; the
|
|
# live endpoint is injected via a generated config.js so we never bake an
|
|
# ephemeral URL into the repo.
|
|
# ---------------------------------------------------------------------------
|
|
|
|
resource "aws_s3_bucket" "ui" {
|
|
bucket_prefix = "${local.name}-ui-"
|
|
force_destroy = true
|
|
tags = local.onprem_tag
|
|
}
|
|
|
|
resource "aws_cloudfront_origin_access_control" "ui" {
|
|
name = "${local.name}-ui-oac"
|
|
origin_access_control_origin_type = "s3"
|
|
signing_behavior = "always"
|
|
signing_protocol = "sigv4"
|
|
}
|
|
|
|
resource "aws_cloudfront_distribution" "ui" {
|
|
enabled = true
|
|
default_root_object = "index.html"
|
|
comment = "${local.name} advisor UI"
|
|
|
|
origin {
|
|
domain_name = aws_s3_bucket.ui.bucket_regional_domain_name
|
|
origin_id = "ui-s3"
|
|
origin_access_control_id = aws_cloudfront_origin_access_control.ui.id
|
|
}
|
|
|
|
default_cache_behavior {
|
|
allowed_methods = ["GET", "HEAD"]
|
|
cached_methods = ["GET", "HEAD"]
|
|
target_origin_id = "ui-s3"
|
|
viewer_protocol_policy = "redirect-to-https"
|
|
forwarded_values {
|
|
query_string = false
|
|
cookies { forward = "none" }
|
|
}
|
|
}
|
|
|
|
restrictions {
|
|
geo_restriction { restriction_type = "none" }
|
|
}
|
|
|
|
viewer_certificate {
|
|
cloudfront_default_certificate = true
|
|
}
|
|
|
|
tags = local.cloud_tag
|
|
}
|
|
|
|
resource "aws_s3_bucket_policy" "ui" {
|
|
bucket = aws_s3_bucket.ui.id
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [{
|
|
Effect = "Allow"
|
|
Principal = { Service = "cloudfront.amazonaws.com" }
|
|
Action = "s3:GetObject"
|
|
Resource = "${aws_s3_bucket.ui.arn}/*"
|
|
Condition = { StringEquals = { "AWS:SourceArn" = aws_cloudfront_distribution.ui.arn } }
|
|
}]
|
|
})
|
|
}
|
|
|
|
resource "aws_s3_object" "index" {
|
|
bucket = aws_s3_bucket.ui.id
|
|
key = "index.html"
|
|
source = "${path.module}/../ui/index.html"
|
|
etag = filemd5("${path.module}/../ui/index.html")
|
|
content_type = "text/html"
|
|
}
|
|
|
|
# Injected config: the endpoint the UI posts to. Defaults to the backend /demo
|
|
# round trip; set var.ui_gateway_url to point the browser at Fusion instead.
|
|
locals {
|
|
ui_endpoint = var.ui_gateway_url != "" ? var.ui_gateway_url : "${trimsuffix(aws_apigatewayv2_stage.default.invoke_url, "/")}/demo"
|
|
}
|
|
|
|
resource "aws_s3_object" "config" {
|
|
bucket = aws_s3_bucket.ui.id
|
|
key = "config.js"
|
|
content = "window.DEMO_ENDPOINT = \"${local.ui_endpoint}\";\n"
|
|
content_type = "application/javascript"
|
|
etag = md5(local.ui_endpoint)
|
|
}
|
|
|
|
output "ui_url" { value = "https://${aws_cloudfront_distribution.ui.domain_name}" }
|