Migrate OWASP Nest to Zappa for serverless deployment

.github/workflows/run-ci-cd.yaml

@@ -55,6 +55,11 @@ jobs:
           restore-keys: |
             pre-commit-${{ runner.os }}-
 
+      - name: Setup TFLint
+        uses: terraform-linters/setup-tflint@dfcb455ed8d56b55edf6447a37379108181a6707
+        with:
+          tflint_version: v0.59.1
+
       - name: Run pre-commit
         uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
 

.gitignore

@@ -17,15 +17,23 @@ __pycache__
 .python_history
 .python-version
 .ruff_cache
+**/.terraform/
+*.tfstate
+*.tfstate.*
 .venv/
 .vscode
 *.code-workspace
 *.key
 *.log
 *.pdf
 *.pem
+backend/*nest-backend-dev*.zip
+backend/*nest-backend-dev*.tar.gz
+backend/*nest-backend-staging*.zip
+backend/*nest-backend-staging*.tar.gz
 backend/data/backup*
 backend/staticfiles
+backend/zappa_settings.json
 design/
 frontend/blob-report/
 frontend/coverage
@@ -37,6 +45,7 @@ frontend/pnpm-debug.log*
 frontend/test-results/
 frontend/yarn-debug.log*
 frontend/yarn-error.log*
+infrastructure/terraform.tfvars
 logs
 node_modules/
 TODO

.pre-commit-config.yaml

@@ -9,6 +9,14 @@ repos:
           - --strict
         exclude: (.github|pnpm-lock.yaml)
 
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.92.0
+    hooks:
+      - id: terraform_fmt
+        files: ^infrastructure/.*\.tf$
+      - id: terraform_tflint
+        files: ^infrastructure/.*\.tf$
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.14.1
     hooks:

backend/pyproject.toml

@@ -48,6 +48,7 @@ strawberry-graphql = { extras = [ "django" ], version = "^0.284.1" }
 strawberry-graphql-django = "^0.67.0"
 thefuzz = "^0.22.1"
 pyparsing = "^3.2.3"
+zappa = "^0.60.2"
 
 [tool.poetry.group.dev.dependencies]
 djlint = "^1.36.4"

backend/zappa_settings.example.json

@@ -0,0 +1,39 @@
+{
+  "staging": {
+    "app_function": "wsgi.application",
+    "django_settings": "settings.staging",
+    "environment_variables": {
+      "DJANGO_ALGOLIA_APPLICATION_ID": "${DJANGO_ALGOLIA_APPLICATION_ID}",
+      "DJANGO_ALGOLIA_WRITE_API_KEY": "${DJANGO_ALGOLIA_WRITE_API_KEY}",
+      "DJANGO_ALLOWED_HOSTS": "${DJANGO_ALLOWED_HOSTS}",
+      "DJANGO_AWS_ACCESS_KEY_ID": "${DJANGO_AWS_ACCESS_KEY_ID}",
+      "DJANGO_AWS_SECRET_ACCESS_KEY": "${DJANGO_AWS_SECRET_ACCESS_KEY}",
+      "DJANGO_CONFIGURATION": "Staging",
+      "DJANGO_DB_HOST": "${DJANGO_DB_HOST}",
+      "DJANGO_DB_NAME": "${DJANGO_DB_NAME}",
+      "DJANGO_DB_USER": "${DJANGO_DB_USER}",
+      "DJANGO_DB_PORT": "${DJANGO_DB_PORT}",
+      "DJANGO_DB_PASSWORD": "${DJANGO_DB_PASSWORD}",
+      "DJANGO_OPEN_AI_SECRET_KEY": "${DJANGO_OPEN_AI_SECRET_KEY}",
+      "DJANGO_REDIS_HOST": "${DJANGO_REDIS_HOST}",
+      "DJANGO_REDIS_PASSWORD": "${DJANGO_REDIS_PASSWORD}",
+      "DJANGO_SECRET_KEY": "${DJANGO_SECRET_KEY}",
+      "DJANGO_SENTRY_DSN": "${DJANGO_SENTRY_DSN}",
+      "DJANGO_SLACK_BOT_TOKEN": "${DJANGO_SLACK_BOT_TOKEN}",
+      "DJANGO_SLACK_SIGNING_SECRET": "${DJANGO_SLACK_SIGNING_SECRET}"
+    },
+    "manage_roles": true,
+    "project_name": "nest-backend",
+    "runtime": "python3.13",
+    "s3_bucket": "${ZAPPA_S3_BUCKET}",
+    "slim_handler": true,
+    "vpc_config": {
+      "SecurityGroupIds": ["${AWS_LAMBDA_VPC_SECURITY_GROUP_ID}"],
+      "SubnetIds": [
+        "${AWS_PRIVATE_SUBNET_A}",
+        "${AWS_PRIVATE_SUBNET_B}",
+        "${AWS_PRIVATE_SUBNET_C}"
+      ]
+    }
+  }
+}

cspell/cspell.json

@@ -34,6 +34,7 @@
     "python",
     "rust",
     "software-terms",
+    "terraform",
     "win32"
   ],
   "enabled": true,
@@ -59,6 +60,7 @@
     "@cspell/dict-k8s/cspell-ext.json",
     "@cspell/dict-people-names/cspell-ext.json",
     "@cspell/dict-software-terms/cspell-ext.json",
+    "@cspell/dict-terraform/cspell-ext.json",
     "@cspell/dict-win32/cspell-ext.json"
   ],
   "useGitignore": true

cspell/custom-dict.txt

@@ -54,6 +54,7 @@ csrftoken
 cva
 demojize
 dismissable
+dkr
 dsn
 env
 facebookexternalhit
@@ -66,6 +67,7 @@ gunicorn
 heroui
 hsl
 igoat
+igw
 inlinehilite
 isanori
 jumpstart

cspell/package.json

@@ -8,6 +8,7 @@
     "@cspell/dict-k8s": "^1.0.12",
     "@cspell/dict-people-names": "^1.1.14",
     "@cspell/dict-software-terms": "^4.2.5",
+    "@cspell/dict-terraform": "^1.1.3",
     "@cspell/dict-win32": "^2.0.9",
     "cspell": "^8.19.4"
   }