Promote dev to main

.bedrock/.terragrunt/00_bedrock.tf

@@ -0,0 +1,111 @@
+################################################################################
+# VERSIONS
+################################################################################
+terraform {
+  required_version = ">= 1.2.7"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.37.0" # Latest version as of 2026-01-15
+    }
+  }
+}
+
+################################################################################
+# Profiles - Interpolation is not supported for the 'version' input
+################################################################################
+# Default profile - used for global configs and where a provider is not defined
+provider "aws" {
+  region  = "us-east-1"
+  profile = var.provider_profile
+  ignore_tags {
+    key_prefixes = ["kubernetes.io/"] # all resources will ignore any addition of tags with the kubernetes.io/ prefix
+  }
+}
+
+##########################
+# Region-specific profiles
+##########################
+# titanio-net 
+provider "aws" {
+  alias   = "titanio-net"
+  region  = "us-east-1"
+  profile = "titanio-net"
+  ignore_tags {
+    key_prefixes = ["kubernetes.io/"]
+  }
+}
+# titanio-prd 
+provider "aws" {
+  alias   = "titanio-prd"
+  region  = "us-east-1"
+  profile = "titanio-prd"
+  ignore_tags {
+    key_prefixes = ["kubernetes.io/"]
+  }
+}
+
+# Virginia 
+provider "aws" {
+  alias   = "use1"
+  region  = "us-east-1"
+  profile = var.provider_profile
+  ignore_tags {
+    key_prefixes = ["kubernetes.io/"]
+  }
+}
+# Ohio 
+provider "aws" {
+  alias   = "use2"
+  region  = "us-east-2"
+  profile = var.provider_profile
+  ignore_tags {
+    key_prefixes = ["kubernetes.io/"]
+  }
+}
+# California  
+provider "aws" {
+  alias   = "usw1"
+  region  = "us-west-1"
+  profile = var.provider_profile
+  ignore_tags {
+    key_prefixes = ["kubernetes.io/"]
+  }
+}
+# Oregon 
+provider "aws" {
+  alias   = "usw2"
+  region  = "us-west-2"
+  profile = var.provider_profile
+  ignore_tags {
+    key_prefixes = ["kubernetes.io/"]
+  }
+}
+
+# Frankfurt
+provider "aws" {
+  alias   = "euc1"
+  region  = "eu-central-1"
+  profile = var.provider_profile
+  ignore_tags {
+    key_prefixes = ["kubernetes.io/"]
+  }
+}
+# Singapore 
+provider "aws" {
+  alias   = "apse1"
+  region  = "ap-southeast-1"
+  profile = var.provider_profile
+  ignore_tags {
+    key_prefixes = ["kubernetes.io/"]
+  }
+}
+# Hong Kong 
+provider "aws" {
+  alias   = "ape1"
+  region  = "ap-east-1"
+  profile = var.provider_profile
+  ignore_tags {
+    key_prefixes = ["kubernetes.io/"]
+  }
+}

.bedrock/.terragrunt/00_data_global.tf

@@ -0,0 +1,103 @@
+################################################################################
+# APP-SPECIFIC GLOBAL LOOKUPS (data files, dns, iam, etc...)
+################################################################################
+
+################################################################################
+# DEVOPS/BEDROCK SOURCE INFO
+################################################################################
+
+################################
+# WAF Protection - for Cloudfront (Global Scope)
+################################
+data "aws_wafv2_web_acl" "bedrock_waf_cloudfront" {
+  provider = aws.use1
+  name     = "waf-bedrock-cloudfront"
+  scope    = "CLOUDFRONT"
+}
+################################################################################
+# ECS CLUSTER LOOKUP
+################################################################################
+# The ECS cluster is owned by the derivatives-marketplace repo (resource
+# aws_ecs_cluster.derivatives_marketplace). We share the cluster across
+# both repos to avoid running two Fargate clusters per account.
+#
+# Coupling note: if derivatives-marketplace destroys the cluster, the
+# services defined in this repo will stop. Coordinate cluster-level
+# changes between the two repos.
+################################################################################
+
+data "aws_ecs_cluster" "derivatives" {
+  provider     = aws.use1
+  cluster_name = local.derivatives_ecs_cluster_name
+}
+
+
+################################
+# Hashpower DNS & ACM Lookups
+#
+# Conditional: lmn resolves root domains, dev/stg resolve env subdomains.
+# Dependent code uses the same local reference regardless of account.
+#
+# Usage:
+#   DNS zone:
+#     local.hp_dns["exc"].zone_id
+#     local.hp_dns["exc"].name   # "hashpower.exchange" (lmn) or "dev.hashpower.exchange" (dev)
+#     local.hp_dns["tok"].zone_id
+#
+#   ACM cert:
+#     local.hp_acm["exc"].arn
+#     local.hp_acm["tok"].arn
+#
+#   Keys: exc = hashpower.exchange, tok = hpow.io, com = hashpower.io (when acquired)
+################################
+locals {
+  env_prefix = substr(var.account_shortname, 8, 3)
+  is_lmn     = local.env_prefix == "lmn"
+
+  hashpower_domains = {
+    exc = "hashpower.exchange"
+    tok = "hpow.io"
+    # com = "hashpower.io"  # uncomment when domain is acquired
+  }
+}
+
+# DNS: root zones in titanio-net (lmn only)
+data "aws_route53_zone" "hp_root" {
+  for_each     = local.is_lmn ? local.hashpower_domains : {}
+  provider     = aws.titanio-net
+  name         = each.value
+  private_zone = false
+}
+
+# DNS: env subdomain zones in local account (dev, stg)
+data "aws_route53_zone" "hp_env" {
+  for_each     = local.is_lmn ? {} : local.hashpower_domains
+  provider     = aws.use1
+  name         = "${local.env_prefix}.${each.value}"
+  private_zone = false
+}
+
+# ACM: always in local account, domain conditional on env
+data "aws_acm_certificate" "hp" {
+  for_each = local.hashpower_domains
+  provider = aws.use1
+  domain   = local.is_lmn ? each.value : "${local.env_prefix}.${each.value}"
+  statuses = ["ISSUED"]
+}
+
+locals {
+  hp_dns = local.is_lmn ? data.aws_route53_zone.hp_root : data.aws_route53_zone.hp_env
+  hp_acm = data.aws_acm_certificate.hp
+}
+
+output "hp_dns" {
+  value = { for k, v in local.hp_dns : k => { zone_id = v.zone_id, name = v.name } }
+}
+
+output "hp_acm" {
+  value = { for k, v in local.hp_acm : k => {
+    arn    = v.arn
+    domain = local.is_lmn ? local.hashpower_domains[k] : "${local.env_prefix}.${local.hashpower_domains[k]}"
+  } }
+}
+

.bedrock/.terragrunt/00_data_use1_1.tf

@@ -0,0 +1,88 @@
+################################
+# Regional DATA LOOKUPS 
+################################
+
+data "aws_vpc" "use1_1" {
+  provider = aws.use1
+  tags = {
+    Name = "vpc-${var.region_shortname}-${var.vpc_index}-${var.account_shortname}"
+  }
+}
+data "aws_internet_gateway" "use1_1" {
+  provider = aws.use1
+  filter {
+    name   = "attachment.vpc-id"
+    values = [data.aws_vpc.use1_1.id]
+  }
+}
+
+data "aws_subnet" "edge_use1_1" {
+  provider = aws.use1
+  count    = 3
+  filter {
+    name   = "tag:Name"
+    values = ["sn-use1-1-${var.account_shortname}-edge-${count.index + 1}"]
+  }
+  # in code for sgs, use the following: subnet_ids = [for n in data.aws_subnet.edge_use1_1 : n.id]
+}
+
+data "aws_subnet" "middle_use1_1" {
+  provider = aws.use1
+  count    = 3
+  filter {
+    name   = "tag:Name"
+    values = ["sn-use1-1-${var.account_shortname}-middle-${count.index + 1}"]
+  }
+  # in code for sgs, use the following: subnet_ids = [for n in data.aws_subnet.middle_use1_1 : n.id]
+}
+
+data "aws_subnet" "private_use1_1" {
+  provider = aws.use1
+  count    = 3
+  filter {
+    name   = "tag:Name"
+    values = ["sn-use1-1-${var.account_shortname}-private-${count.index + 1}"]
+  }
+  # in code for sgs, use the following: subnet_ids = [for n in data.aws_subnet.private_use1_1 : n.id]
+}
+
+data "aws_subnet" "edge_use1_1a" {
+  provider = aws.use1
+  filter {
+    name   = "tag:Name"
+    values = ["sn-use1-1-${var.account_shortname}-edge-1"]
+  }
+}
+
+data "aws_subnet" "middle_use1_1a" {
+  provider = aws.use1
+  filter {
+    name   = "tag:Name"
+    values = ["sn-use1-1-${var.account_shortname}-middle-1"]
+  }
+}
+
+# Regional ALB: ACM for the env public zone (hashpower.exchange or dev/stg.hashpower.exchange)
+data "aws_acm_certificate" "lumerin_marketplace_ext" {
+  provider    = aws.use1
+  domain      = local.hp_dns["exc"].name
+  types       = ["AMAZON_ISSUED"]
+  most_recent = true
+}
+
+# CloudFront / website (if used): same zone as hp_acm["exc"]
+data "aws_acm_certificate" "lumerin_marketplace_website" {
+  provider    = aws.use1
+  domain      = local.hp_dns["exc"].name
+  types       = ["AMAZON_ISSUED"]
+  most_recent = true
+}
+
+################################
+# WAF Protection 
+################################
+data "aws_wafv2_web_acl" "bedrock_waf_use1_1" {
+  provider = aws.use1
+  name     = "waf-bedrock-use1-1"
+  scope    = "REGIONAL"
+}

.bedrock/.terragrunt/00_outputs.tf

@@ -0,0 +1,32 @@
+################################################################################
+# OUTPUTS - # Usage: terragrunt output <name>
+################################################################################
+
+output "github_actions_role_arn" {
+  description = "ARN of the IAM role for GitHub Actions"
+  value       = var.create_core ? aws_iam_role.github_actions_collateral_margin[0].arn : null
+}
+
+output "github_actions_role_name" {
+  description = "Name of the IAM role for GitHub Actions"
+  value       = var.create_core ? aws_iam_role.github_actions_collateral_margin[0].name : null
+}
+
+################################################################################
+# SERVICE ENDPOINTS (internal ALB, reachable via VPN)
+################################################################################
+
+output "perps_mm_endpoint" {
+  description = "Perps Market Maker health endpoint (internal ALB via VPN)"
+  value       = var.perps_mm_service.create ? "https://perpsmm.${local.hp_dns["exc"].name}/health" : null
+}
+
+output "futures_mm_endpoint" {
+  description = "Futures Market Maker health endpoint (internal ALB via VPN)"
+  value       = var.futures_mm_service.create ? "https://futuresmm.${local.hp_dns["exc"].name}/health" : null
+}
+
+output "col_mar_keeper_endpoint" {
+  description = "Unified margin keeper health endpoint (internal ALB via VPN)"
+  value       = var.keeper_service.create ? "https://keeper.${local.hp_dns["exc"].name}/health" : null
+}