Set up Superblocks Database

# Step 1 of 2: IAM roles and S3 state bucket.
# Run once per region. All data planes in this region share one S3 state bucket.
module "app_db_prereqs" {
  source  = "superblocksteam/superblocks/aws//modules/app-db-prereqs"
  version = ">= 1.5.3, < 2.0.0"

  deployment_type = "fargate"
  region          = "<REGION>"

  # One entry per data plane in this region. The map key is <AGENT_NAME>.
  agents = {
    "<AGENT_NAME>" = {
      agent_tags = ["<DATA_TAG_1>"]
      vpc_id     = "<VPC_ID>"
    }
  }

  # Inventory tags only. ManagedBy, superblocks:owned, and aws-apn-id are
  # reserved and always enforced.
  tags = {
    "<TAG_KEY>" = "<TAG_VALUE>"
  }
}

# Step 2 of 2: data plane database config. One module call per data plane.
# Generates ecs_env_vars in the expected format.
module "app_db" {
  source  = "superblocksteam/superblocks/aws//modules/app-db"
  version = ">= 1.5.3, < 2.0.0"

  # Must equal the agents map key above (<AGENT_NAME>). This is the data plane's
  # stable identity for the database pool and the AgentName IAM tag. See the
  # setup decisions above.
  agent_name = "<AGENT_NAME>"

  # Wired from the agents["<AGENT_NAME>"] entry above, so the two cannot diverge.
  agent_tags         = module.app_db_prereqs.agents["<AGENT_NAME>"].agent_tags
  connector_role_arn = module.app_db_prereqs.agents["<AGENT_NAME>"].connector_role_arn

  # All data planes in this region share one bucket.
  state_bucket_name = module.app_db_prereqs.state_bucket_name

  region = "<REGION>"

  # Namespaces this data plane's OpenTofu state within the shared S3 bucket.
  # Must match the IAM-granted prefix from app_db_prereqs (default
  # app-db/<AGENT_NAME>). Wire the output — a hand-typed value that differs
  # fails every state read/write with AccessDenied.
  key_prefix = module.app_db_prereqs.agents["<AGENT_NAME>"].key_prefix

  # Databases per cluster before another cluster joins the pool.
  # Fargate default is 100, with no proactive floor. Helm defaults to 5 and a
  # 20% proactive floor; set both Helm fields explicitly in the EKS tab.
  pool = {
    max_databases = 100
  }

  # Recommended settings for every Aurora cluster this data plane provisions.
  physical_module_inputs = {
    monitoring_interval = 60
    monitoring_role_arn = module.app_db_prereqs.enhanced_monitoring_role_arn

    backup_retention_period  = 7
    delete_automated_backups = false
    deletion_protection      = true
    skip_final_snapshot      = false

    # Always-on capacity, ACUs per instance. Matches the module default
    # (2 instances, 2-32 ACUs), which never pauses.
    deployment = {
      serverless_v2 = {
        instance_count = 2
        max_acu        = 32
        min_acu        = 2
      }
    }

    source_security_group_ids = ["<SECURITY_GROUP_ID>"]

    subnet_ids = [
      "<SUBNET_ID_1>",
      "<SUBNET_ID_2>",
      "<SUBNET_ID_3>",
    ]

    tags = module.app_db_prereqs.tags

    # Must match the vpc_id declared in the agents map above.
    vpc_id = "<VPC_ID>"
  }
}

module "terraform_aws_superblocks" {
  source  = "superblocksteam/superblocks/aws"
  version = ">= 1.5.3, < 2.0.0"

  vpc_id         = "<VPC_ID>"
  lb_subnet_ids  = ["<LB_SUBNET_ID_1>", "<LB_SUBNET_ID_2>"]
  ecs_subnet_ids = ["<ECS_SUBNET_ID_1>", "<ECS_SUBNET_ID_2>"]
  domain         = "<DOMAIN>"
  subdomain      = "superblocks"

  superblocks_agent_key = "<AGENT_KEY>"

  # Pin v1.49.0.
  superblocks_agent_image = "ghcr.io/superblocksteam/agent:v1.49.0"

  # Comma-separated profile:<DATA_TAG> string, not a list. The app-db
  # module derives it from its own agent_tags, so wire it from there rather than
  # writing it out. See the warning below.
  superblocks_agent_tags = module.app_db.superblocks_agent_tags

  # Run the ECS task as the lifecycle worker role. This is required and separate
  # from the env vars below: environment variables cannot change the task role,
  # so without this the data plane keeps its previous role and every AWS call the
  # lifecycle worker makes fails with AccessDenied.
  superblocks_agent_role_arn = module.app_db_prereqs.agents["<AGENT_NAME>"].lifecycle_worker_role_arn

  # Wire the generated database env vars into the ECS task definition.
  superblocks_agent_environment_variables = module.app_db.ecs_env_vars

  # Attach the same pre-created task SG you passed as source_security_group_ids
  # above. Do not reference this module's auto-created ECS SG from app-db —
  # that is a dependency cycle.
  ecs_security_group_ids = ["<SECURITY_GROUP_ID>"]
}

CLUSTER_NAME="<CLUSTER_NAME>"
REGION="<REGION>"

ISSUER="$(aws eks describe-cluster \
  --name "${CLUSTER_NAME}" \
  --region "${REGION}" \
  --query "cluster.identity.oidc.issuer" \
  --output text)"

if [[ -z "${ISSUER}" || "${ISSUER}" == "None" ]]; then
  echo "No OIDC issuer found for cluster ${CLUSTER_NAME} in ${REGION}" >&2
else
  # Prints the matching IAM OIDC provider ARN, or nothing if none exists yet
  aws iam list-open-id-connect-providers \
    --query "OpenIDConnectProviderList[].Arn" --output text \
    | tr '\t' '\n' \
    | grep -F "${ISSUER#https://}"
fi

module "app_db_prereqs" {
  source  = "superblocksteam/superblocks/aws//modules/app-db-prereqs"
  version = ">= 1.5.3, < 2.0.0"

  deployment_type = "eks"
  region          = "<REGION>"

  # One entry per data plane in this region. The map key is <AGENT_NAME>.
  agents = {
    "<AGENT_NAME>" = {
      agent_tags = ["<DATA_TAG_1>"]
      vpc_id     = "<VPC_ID>"

      # ARN of the EKS cluster's IAM OIDC provider, required for IRSA. See
      # "EKS-only prerequisite: OIDC provider ARN" above.
      oidc_provider_arn = "<OIDC_PROVIDER_ARN>"
    }
  }

  # Inventory tags only. ManagedBy, superblocks:owned, and aws-apn-id are
  # reserved and always enforced.
  tags = {
    "<TAG_KEY>" = "<TAG_VALUE>"
  }
}

superblocks:
  # Must equal the agents map key in app_db_prereqs.
  # Also becomes the AgentName tag on every Aurora resource this data plane creates.
  # Required when Superblocks Database is enabled.
  agentName: <AGENT_NAME>

  # Comma-separated string, each data tag prefixed with profile:.
  # Must cover the same data tags as agent_tags above. See the warning below.
  agentTags: profile:<DATA_TAG_1>,profile:<DATA_TAG_2>

serviceAccount:
  annotations:
    # Lifecycle worker role, assumed by the data plane pod through IRSA.
    # From: module.app_db_prereqs.agents["<AGENT_NAME>"].lifecycle_worker_role_arn
    eks.amazonaws.com/role-arn: "<LIFECYCLE_WORKER_ROLE_ARN>"

postgres:
  # Connector role, used at query time to authenticate to app databases with
  # RDS IAM tokens.
  # From: module.app_db_prereqs.agents["<AGENT_NAME>"].connector_role_arn
  appDbConnectorRoleArn: "<CONNECTOR_ROLE_ARN>"

  # The data plane refuses to authenticate as any IAM role outside this list.
  # It must cover appDbConnectorRoleArn above, or the chart rejects the upgrade.
  iamAllowedRoleArnPrefixes:
    - "<CONNECTOR_ROLE_ARN>"

databaseLifecycle:
  enabled: true

  # OpenTofu state. The bucket is shared across every data plane in this account
  # and region; keyPrefix namespaces this data plane's state inside it and must
  # be unique per data plane. Copy the IAM-granted prefix from
  # module.app_db_prereqs.agents["<AGENT_NAME>"].key_prefix (default
  # app-db/<AGENT_NAME>). A hand-typed value that differs fails every state
  # read/write with AccessDenied.
  backend:
    stateBackend: s3
    # From: module.app_db_prereqs.state_bucket_name
    bucket: "<BUCKET_NAME>"
    region: "<REGION>"
    # From: module.app_db_prereqs.agents["<AGENT_NAME>"].key_prefix
    keyPrefix: "<KEY_PREFIX>"
    useLockfile: true

  # Secrets Manager ARNs the data plane may read, used to fetch the AWS-managed
  # Aurora master credential during provisioning. Scope this to RDS-managed
  # secrets in your account and region. An empty list denies resolution, which
  # makes every provision fail. Use the rds!db- prefix instead for standalone RDS.
  allowedRefPrefixes:
    - arn:aws:secretsmanager:<REGION>:<ACCOUNT_ID>:secret:rds!cluster-

  # Databases per cluster before another cluster joins the pool.
  # Helm defaults are maxDatabases: 5 and minAvailableCapacityPercent: 20, so
  # omitting this block can add a cluster before the current one is full.
  # Set both explicitly. This walkthrough uses 100 to match the Fargate default.
  pool:
    maxDatabases: 100
    minAvailableCapacityPercent: 20

  # Optional inventory tags only (cost center, team, and similar). Do not set
  # ManagedBy, AgentName, Vpc, superblocks:owned, or aws-apn-id - the lifecycle
  # worker and physical OpenTofu modules stamp those on every runtime resource.
  # The chart merges physicalModuleTags over physicalModuleInputs.tags when both
  # are present.
  # physicalModuleTags:
  #   <TAG_KEY>: "<TAG_VALUE>"

  # Recommended settings for every Aurora cluster this data plane provisions.
  physicalModuleInputs:
    # From: module.app_db_prereqs.enhanced_monitoring_role_arn
    monitoring_interval: 60
    monitoring_role_arn: "<enhanced_monitoring_role_arn>"

    backup_retention_period: 7
    delete_automated_backups: false
    deletion_protection: true
    skip_final_snapshot: false

    # Always-on capacity, ACUs per instance. Matches the module default
    # (2 instances, 2-32 ACUs), which never pauses.
    deployment:
      serverless_v2:
        instance_count: 2
        max_acu: 32
        min_acu: 2

    source_security_group_ids:
      - "<SECURITY_GROUP_ID>"

    subnet_ids:
      - "<SUBNET_ID_1>"
      - "<SUBNET_ID_2>"
      - "<SUBNET_ID_3>"

    # Must match the vpc_id declared in the agents map above.
    vpc_id: "<VPC_ID>"

helm upgrade superblocks-agent superblocksteam/superblocks-agent \
  -f values.yaml \
  --namespace superblocks