Migrate OWASP Nest to Zappa for serverless deployment

.gitignore

@@ -17,15 +17,21 @@ __pycache__
 .python_history
 .python-version
 .ruff_cache
+**/.terraform/
+*.tfstate
+*.tfstate.*
 .venv/
 .vscode
 *.code-workspace
 *.key
 *.log
 *.pdf
 *.pem
+backend/*nest-backend-staging*.zip
+backend/*nest-backend-staging*.tar.gz
 backend/data/backup*
 backend/staticfiles
+backend/zappa_settings.json
 frontend/blob-report/
 frontend/coverage
 frontend/dist
@@ -36,6 +42,7 @@ frontend/pnpm-debug.log*
 frontend/test-results/
 frontend/yarn-debug.log*
 frontend/yarn-error.log*
+infrastructure/terraform.tfvars
 logs
 node_modules/
 TODO

backend/pyproject.toml

@@ -48,6 +48,7 @@ strawberry-graphql = { extras = [ "django" ], version = "^0.283.2" }
 strawberry-graphql-django = "^0.66.0"
 thefuzz = "^0.22.1"
 pyparsing = "^3.2.3"
+zappa = "^0.60.2"
 
 [tool.poetry.group.dev.dependencies]
 djlint = "^1.36.4"

backend/zappa_settings.example.json

@@ -0,0 +1,35 @@
+{
+  "staging": {
+    "app_function": "wsgi.application",
+    "django_settings": "settings.staging",
+    "environment_variables": {
+      "DJANGO_ALGOLIA_APPLICATION_ID": "${DJANGO_ALGOLIA_APPLICATION_ID}",
+      "DJANGO_ALGOLIA_WRITE_API_KEY": "${DJANGO_ALGOLIA_WRITE_API_KEY}",
+      "DJANGO_ALLOWED_HOSTS": "${DJANGO_ALLOWED_HOSTS}",
+      "DJANGO_AWS_ACCESS_KEY_ID": "${DJANGO_AWS_ACCESS_KEY_ID}",
+      "DJANGO_AWS_SECRET_ACCESS_KEY": "${DJANGO_AWS_SECRET_ACCESS_KEY}",
+      "DJANGO_CONFIGURATION": "Staging",
+      "DJANGO_DB_HOST": "${DJANGO_DB_HOST}",
+      "DJANGO_DB_NAME": "${DJANGO_DB_NAME}",
+      "DJANGO_DB_USER": "${DJANGO_DB_USER}",
+      "DJANGO_DB_PORT": "${DJANGO_DB_PORT}",
+      "DJANGO_DB_PASSWORD": "${DJANGO_DB_PASSWORD}",
+      "DJANGO_OPEN_AI_SECRET_KEY": "${DJANGO_OPEN_AI_SECRET_KEY}",
+      "DJANGO_REDIS_HOST": "${DJANGO_REDIS_HOST}",
+      "DJANGO_REDIS_PASSWORD": "${DJANGO_REDIS_PASSWORD}",
+      "DJANGO_SECRET_KEY": "${DJANGO_SECRET_KEY}",
+      "DJANGO_SENTRY_DSN": "${DJANGO_SENTRY_DSN}",
+      "DJANGO_SLACK_BOT_TOKEN": "${DJANGO_SLACK_BOT_TOKEN}",
+      "DJANGO_SLACK_SIGNING_SECRET": "${DJANGO_SLACK_SIGNING_SECRET}"
+    },
+    "manage_roles": true,
+    "project_name": "nest-backend",
+    "runtime": "python3.13",
+    "s3_bucket": "${ZAPPA_S3_BUCKET}",
+    "slim_handler": true,
+    "vpc_config": {
+      "SecurityGroupIds": ["${VPC_SECURITY_GROUP}"],
+      "SubnetIds": ["${VPC_SUBNET_A}", "${VPC_SUBNET_B}"]
+    }
+  }
+}

infrastructure/main.tf

@@ -0,0 +1,58 @@
+module "networking" {
+  source = "./modules/networking"
+
+  vpc_cidr             = var.vpc_cidr
+  public_subnet_cidrs  = var.public_subnet_cidrs
+  private_subnet_cidrs = var.private_subnet_cidrs
+  availability_zones   = var.availability_zones
+  project_name         = var.project_name
+  environment          = var.environment
+}
+
+module "security" {
+  source = "./modules/security"
+
+  vpc_id       = module.networking.vpc_id
+  db_port      = var.db_port
+  redis_port   = var.redis_port
+  project_name = var.project_name
+  environment  = var.environment
+}
+
+module "storage" {
+  source = "./modules/storage"
+
+  zappa_s3_bucket = var.zappa_s3_bucket
+  project_name    = var.project_name
+  environment     = var.environment
+}
+
+
+
+module "database" {
+  source = "./modules/database"
+
+  db_allocated_storage = var.db_allocated_storage
+  db_engine_version    = var.db_engine_version
+  db_instance_class    = var.db_instance_class
+  db_name              = var.db_name
+  db_password          = var.db_password
+  db_username          = var.db_username
+  db_subnet_ids        = module.networking.private_subnet_ids
+  security_group_ids   = [module.security.rds_sg_id]
+  project_name         = var.project_name
+  environment          = var.environment
+}
+
+module "cache" {
+  source = "./modules/cache"
+
+  redis_engine_version  = var.redis_engine_version
+  redis_node_type       = var.redis_node_type
+  redis_num_cache_nodes = var.redis_num_cache_nodes
+  redis_port            = var.redis_port
+  subnet_ids            = module.networking.private_subnet_ids
+  security_group_ids    = [module.security.redis_sg_id]
+  project_name          = var.project_name
+  environment           = var.environment
+}

infrastructure/modules/cache/main.tf

@@ -0,0 +1,58 @@
+# ElastiCache Subnet Group
+resource "aws_elasticache_subnet_group" "main" {
+  name       = "${var.project_name}-${var.environment}-cache-subnet-group"
+  subnet_ids = var.subnet_ids
+
+  tags = {
+    Name = "${var.project_name}-${var.environment}-cache-subnet-group"
+  }
+}
+
+# Random auth token for Redis (if not provided)
+resource "random_password" "redis_auth_token" {
+  count = var.redis_auth_token == null || var.redis_auth_token == "" ? 1 : 0
+
+  length  = 32
+  special = true
+  # Redis auth token has specific requirements
+  override_special = "!&#$^<>-"
+}
+
+# ElastiCache Redis Replication Group
+resource "aws_elasticache_replication_group" "main" {
+  replication_group_id       = "${var.project_name}-${var.environment}-cache"
+  description = "${var.project_name} ${var.environment} Redis cache"
+
+  engine               = "redis"
+  engine_version       = var.redis_engine_version
+  node_type            = var.redis_node_type
+  port                 = var.redis_port
+  parameter_group_name = "default.redis7"
+
+  # Cluster configuration
+  num_cache_clusters = var.redis_num_cache_nodes
+
+  # Network configuration
+  subnet_group_name  = aws_elasticache_subnet_group.main.name
+  security_group_ids = var.security_group_ids
+
+  # Security
+  at_rest_encryption_enabled = true
+  transit_encryption_enabled = true
+  auth_token                 = var.redis_auth_token != null && var.redis_auth_token != "" ? var.redis_auth_token : random_password.redis_auth_token[0].result
+
+  # Maintenance and backups
+  snapshot_retention_limit = 5
+  snapshot_window         = "03:00-05:00"
+  maintenance_window      = "mon:05:00-mon:07:00"
+
+  # Automatic failover (requires at least 2 nodes)
+  automatic_failover_enabled = var.redis_num_cache_nodes > 1
+
+  # Enable automatic minor version upgrades
+  auto_minor_version_upgrade = true
+
+  tags = {
+    Name = "${var.project_name}-${var.environment}-redis"
+  }
+}

infrastructure/modules/cache/outputs.tf

@@ -0,0 +1,10 @@
+output "redis_primary_endpoint" {
+  description = "The primary endpoint of the Redis replication group"
+  value       = aws_elasticache_replication_group.main.primary_endpoint_address
+}
+
+output "redis_auth_token" {
+  description = "The auth token for Redis"
+  value       = random_password.redis_auth_token[0].result
+  sensitive   = true
+}

infrastructure/modules/cache/variables.tf

@@ -0,0 +1,46 @@
+variable "environment" {
+  description = "The environment (e.g., staging, production)"
+  type        = string
+}
+
+variable "project_name" {
+  description = "The name of the project"
+  type        = string
+}
+
+variable "redis_auth_token" {
+  description = "The auth token for Redis"
+  type        = string
+  sensitive   = true
+  default     = null
+}
+
+variable "redis_engine_version" {
+  description = "The version of the Redis engine"
+  type        = string
+}
+
+variable "redis_node_type" {
+  description = "The node type for the Redis cache"
+  type        = string
+}
+
+variable "redis_num_cache_nodes" {
+  description = "The number of cache nodes in the Redis cluster"
+  type        = number
+}
+
+variable "redis_port" {
+  description = "The port for the Redis cache"
+  type        = number
+}
+
+variable "security_group_ids" {
+  description = "A list of security group IDs to associate with the Redis cache"
+  type        = list(string)
+}
+
+variable "subnet_ids" {
+  description = "A list of subnet IDs for the cache subnet group"
+  type        = list(string)
+}

infrastructure/modules/database/main.tf

@@ -0,0 +1,60 @@
+# DB Subnet Group
+resource "aws_db_subnet_group" "main" {
+  name       = "${var.project_name}-${var.environment}-db-subnet-group"
+  subnet_ids = var.db_subnet_ids
+
+  tags = {
+    Name = "${var.project_name}-${var.environment}-db-subnet-group"
+  }
+}
+
+# Random password for RDS (if not provided)
+resource "random_password" "db_password" {
+  count = var.db_password == null || var.db_password == "" ? 1 : 0
+
+  length  = 32
+  special = true
+  # Avoid special characters that might cause issues
+  override_special = "!#$%&*()-_=+[]{}<>:?"
+}
+
+# RDS PostgreSQL Instance
+resource "aws_db_instance" "main" {
+  identifier           = "${var.project_name}-${var.environment}-db"
+  engine               = "postgres"
+  engine_version       = var.db_engine_version
+  instance_class       = var.db_instance_class
+  allocated_storage    = var.db_allocated_storage
+  storage_type         = "gp3"
+  storage_encrypted    = true
+
+  db_name  = var.db_name
+  username = var.db_username
+  password = var.db_password != null && var.db_password != "" ? var.db_password : random_password.db_password[0].result
+
+  db_subnet_group_name   = aws_db_subnet_group.main.name
+  vpc_security_group_ids = var.security_group_ids
+  publicly_accessible    = false
+
+  backup_retention_period = 7
+  backup_window          = "03:00-04:00"
+  maintenance_window     = "mon:04:00-mon:05:00"
+
+  # Enable automated backups
+  skip_final_snapshot       = true
+  final_snapshot_identifier = "${var.project_name}-${var.environment}-final-snapshot-${formatdate("YYYY-MM-DD-hhmm", timestamp())}"
+  copy_tags_to_snapshot     = true
+
+  # Performance Insights
+  enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"]
+
+  tags = {
+    Name = "${var.project_name}-${var.environment}-postgres"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      final_snapshot_identifier
+    ]
+  }
+}

infrastructure/modules/database/outputs.tf

@@ -0,0 +1,10 @@
+output "db_instance_endpoint" {
+  description = "The endpoint of the RDS instance"
+  value       = aws_db_instance.main.endpoint
+}
+
+output "db_password" {
+  description = "The password for the RDS database"
+  value       = random_password.db_password[0].result
+  sensitive   = true
+}