Managed domains

[siddhsuresh]

Greptile Summary

This PR introduces opt-in Ravion-managed domains across three modules (ecs_cluster, ecs_service, static_site). The core architectural change is moving HTTPS listener ownership from the alb submodule into ecs_cluster so that toggling use_ravion_managed_domains becomes an in-place certificate swap rather than a destroy+create across different Terraform addresses.

• ecs_cluster: New ravion_domains.tf provisions a cluster-scoped wildcard ACM cert; new listeners.tf owns both public/private HTTPS listeners with moved blocks for BYO and Ravion-mode state migration. networking/alb gains a force_http_to_https_redirect variable so the submodule can still redirect HTTP without owning the 443 listener.
• ecs_service: New ravion_domains.tf classifies service domains as wildcard-covered (ride the cluster cert) or custom (get a per-service cert), derives sha256-based listener-rule priorities, and chunks host-header conditions to stay within ALB's 5-value per-condition limit.
• static_site: New ravion_domains.tf attaches a Ravion instance cert to the CloudFront distribution ARN (always us-east-1 per CloudFront requirement).

Confidence Score: 3/5

Safe to merge after fixing the missing moved block and the two validation gaps; the core architectural change is well-reasoned with good test coverage.

The missing moved block for the private ALB IPv6 SG rule will cause a destroy+recreate on every existing Ravion-mode cluster that has a private ALB, creating a brief window without IPv6 coverage on port 443. The missing preconditions in ecs_service for cluster_alb_dns_name/cluster_alb_zone_id mean users providing custom domains without those variables will receive a cryptic provider error. Both issues affect the primary apply path for the features being introduced.

compute/ecs_cluster/listeners.tf (missing moved block) and compute/ecs_service/ravion_domains.tf (incomplete validation on ravion_certificate.svc)

Important Files Changed

Filename	Overview
compute/ecs_cluster/listeners.tf	New file: moves HTTPS listener ownership from the alb submodule to ecs_cluster. Has 5 moved blocks for state migration but is missing the moved block for ravion_https_private_ipv6 → private_https_ipv6, which will cause a destroy+recreate of that SG rule on existing Ravion-mode clusters.
compute/ecs_cluster/ravion_domains.tf	New file: provisions the cluster wildcard Ravion certificate and collision/dependent checks. Logic is sound — preconditions for ravion_aws_account_id, ALB requirement, and collision check are all present.
compute/ecs_service/ravion_domains.tf	New file: per-service domain classification, wildcard routing, and listener rules. Missing preconditions on ravion_certificate.svc for cluster_alb_dns_name and cluster_alb_zone_id when custom domains are present, leading to null values passed to ravion_domain.custom without a helpful error.
hosting/static_site/ravion_domains.tf	New file: CloudFront Ravion cert for static sites. ravion_distribution_arn/ravion_distribution_domain can silently be null if no CDN distribution is configured; no precondition guards this before it propagates to target_arn and target_dns_name.
compute/ecs_cluster/load_balancers.tf	Disables HTTPS listener in the alb submodule and adds force_http_to_https_redirect; cert_arns set to []. Clean change consistent with the architectural intent.
networking/alb/listeners.tf	Introduces force_http_to_https_redirect to allow parent modules to own the 443 listener while still redirecting HTTP. Change is minimal and correct.
compute/ecs_cluster/tests/listeners.tftest.hcl	New test file with comprehensive coverage: BYO single/multi-cert, Ravion managed mode, no-cert precondition failure, and HTTP-only slice guard. Well structured and hermetic.
compute/ecs_service/listener_rules.tf	Skips caller-supplied listener rules when in Ravion-managed mode to avoid priority collisions with the chunked Ravion rules. Correct guard.

Prompt To Fix All With AI

Fix the following 3 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 3
compute/ecs_cluster/listeners.tf:185-188
The private IPv6 SG rule rename is missing a `moved` block. Three of the four symmetrical SG rule renames have `moved` blocks (`ravion_https_ipv4`, `ravion_https_ipv6`, `ravion_https_private_ipv4`), but `ravion_https_private_ipv6` → `private_https_ipv6` is absent. For any cluster already in Ravion mode with a private ALB, Terraform will destroy the old rule and create a new one, creating a brief window where IPv6 traffic on port 443 to the private ALB is not covered.

```suggestion
moved {
  from = aws_vpc_security_group_ingress_rule.ravion_https_private_ipv4
  to   = aws_vpc_security_group_ingress_rule.private_https_ipv4
}

moved {
  from = aws_vpc_security_group_ingress_rule.ravion_https_private_ipv6
  to   = aws_vpc_security_group_ingress_rule.private_https_ipv6
}
```

### Issue 2 of 3
compute/ecs_service/ravion_domains.tf:136-139
`ravion_domain.custom` uses `var.cluster_alb_dns_name` and `var.cluster_alb_zone_id` as `target_dns_name`/`target_zone_id`, but there are no preconditions validating that these are non-null when custom domains are present. The sibling `ravion_certificate.svc` resource guards `ravion_aws_account_id` and `cluster_https_listener_arn`, but the two ALB variables are left unchecked. A user who provides custom domains and forgets these variables will get a cryptic provider-side null error instead of a clear Terraform message.

```suggestion
    precondition {
      condition     = length(local.custom_domains) == 0 || (var.cluster_https_listener_arn != null && var.cluster_https_listener_arn != "")
      error_message = "cluster_https_listener_arn is required when the domains list includes a custom (non-wildcard) domain."
    }
    precondition {
      condition     = length(local.custom_domains) == 0 || (var.cluster_alb_dns_name != null && var.cluster_alb_dns_name != "")
      error_message = "cluster_alb_dns_name is required when the domains list includes a custom (non-wildcard) domain."
    }
    precondition {
      condition     = length(local.custom_domains) == 0 || (var.cluster_alb_zone_id != null && var.cluster_alb_zone_id != "")
      error_message = "cluster_alb_zone_id is required when the domains list includes a custom (non-wildcard) domain."
    }
```

### Issue 3 of 3
hosting/static_site/ravion_domains.tf:34-43
`ravion_distribution_arn` and `ravion_distribution_domain` both use `try(...[0], null)`, which silently returns `null` if the `module.cdn` distribution maps are empty (i.e., no distributions are configured). These null values are then passed as `target_arn` to `ravion_certificate.site` and as `target_dns_name` to `ravion_domain.custom` with no guard, producing a cryptic provider-side error instead of a clear Terraform message. A precondition on `ravion_certificate.site` would surface this early.

```suggestion
  lifecycle {
    precondition {
      condition     = !var.use_ravion_managed_domains || (var.ravion_aws_account_id != null && var.ravion_aws_account_id != "")
      error_message = "ravion_aws_account_id (aws_*) is required when use_ravion_managed_domains = true."
    }
    precondition {
      condition     = length(var.domains) <= 10
      error_message = "A static site may declare at most 10 custom domains."
    }
    precondition {
      condition     = !var.use_ravion_managed_domains || local.ravion_distribution_arn != null
      error_message = "use_ravion_managed_domains = true requires at least one CloudFront distribution in var.distributions."
    }
  }
```

_{Reviews (1): Last reviewed commit: "docs(ecs_service): parent-apex guard wor..." | Re-trigger Greptile}

Greptile also left 3 inline comments on this PR.

[greptile-apps]

The private IPv6 SG rule rename is missing a moved block. Three of the four symmetrical SG rule renames have moved blocks (ravion_https_ipv4, ravion_https_ipv6, ravion_https_private_ipv4), but ravion_https_private_ipv6 → private_https_ipv6 is absent. For any cluster already in Ravion mode with a private ALB, Terraform will destroy the old rule and create a new one, creating a brief window where IPv6 traffic on port 443 to the private ALB is not covered.

Suggested change

	moved {
	from = aws_vpc_security_group_ingress_rule.ravion_https_private_ipv4
	to = aws_vpc_security_group_ingress_rule.private_https_ipv4
	}
	moved {
	from = aws_vpc_security_group_ingress_rule.ravion_https_private_ipv4
	to = aws_vpc_security_group_ingress_rule.private_https_ipv4
	}
	moved {
	from = aws_vpc_security_group_ingress_rule.ravion_https_private_ipv6
	to = aws_vpc_security_group_ingress_rule.private_https_ipv6
	}

Prompt To Fix With AI

This is a comment left during a code review.
Path: compute/ecs_cluster/listeners.tf
Line: 185-188

Comment:
The private IPv6 SG rule rename is missing a `moved` block. Three of the four symmetrical SG rule renames have `moved` blocks (`ravion_https_ipv4`, `ravion_https_ipv6`, `ravion_https_private_ipv4`), but `ravion_https_private_ipv6` → `private_https_ipv6` is absent. For any cluster already in Ravion mode with a private ALB, Terraform will destroy the old rule and create a new one, creating a brief window where IPv6 traffic on port 443 to the private ALB is not covered.

```suggestion
moved {
  from = aws_vpc_security_group_ingress_rule.ravion_https_private_ipv4
  to   = aws_vpc_security_group_ingress_rule.private_https_ipv4
}

moved {
  from = aws_vpc_security_group_ingress_rule.ravion_https_private_ipv6
  to   = aws_vpc_security_group_ingress_rule.private_https_ipv6
}
```

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

ravion_domain.custom uses var.cluster_alb_dns_name and var.cluster_alb_zone_id as target_dns_name/target_zone_id, but there are no preconditions validating that these are non-null when custom domains are present. The sibling ravion_certificate.svc resource guards ravion_aws_account_id and cluster_https_listener_arn, but the two ALB variables are left unchecked. A user who provides custom domains and forgets these variables will get a cryptic provider-side null error instead of a clear Terraform message.

Suggested change

	precondition {
	condition = length(local.custom_domains) == 0 || (var.cluster_https_listener_arn != null && var.cluster_https_listener_arn != "")
	error_message = "cluster_https_listener_arn is required when the domains list includes a custom (non-wildcard) domain."
	}
	precondition {
	condition = length(local.custom_domains) == 0 || (var.cluster_https_listener_arn != null && var.cluster_https_listener_arn != "")
	error_message = "cluster_https_listener_arn is required when the domains list includes a custom (non-wildcard) domain."
	}
	precondition {
	condition = length(local.custom_domains) == 0 || (var.cluster_alb_dns_name != null && var.cluster_alb_dns_name != "")
	error_message = "cluster_alb_dns_name is required when the domains list includes a custom (non-wildcard) domain."
	}
	precondition {
	condition = length(local.custom_domains) == 0 || (var.cluster_alb_zone_id != null && var.cluster_alb_zone_id != "")
	error_message = "cluster_alb_zone_id is required when the domains list includes a custom (non-wildcard) domain."
	}

Prompt To Fix With AI

This is a comment left during a code review.
Path: compute/ecs_service/ravion_domains.tf
Line: 136-139

Comment:
`ravion_domain.custom` uses `var.cluster_alb_dns_name` and `var.cluster_alb_zone_id` as `target_dns_name`/`target_zone_id`, but there are no preconditions validating that these are non-null when custom domains are present. The sibling `ravion_certificate.svc` resource guards `ravion_aws_account_id` and `cluster_https_listener_arn`, but the two ALB variables are left unchecked. A user who provides custom domains and forgets these variables will get a cryptic provider-side null error instead of a clear Terraform message.

```suggestion
    precondition {
      condition     = length(local.custom_domains) == 0 || (var.cluster_https_listener_arn != null && var.cluster_https_listener_arn != "")
      error_message = "cluster_https_listener_arn is required when the domains list includes a custom (non-wildcard) domain."
    }
    precondition {
      condition     = length(local.custom_domains) == 0 || (var.cluster_alb_dns_name != null && var.cluster_alb_dns_name != "")
      error_message = "cluster_alb_dns_name is required when the domains list includes a custom (non-wildcard) domain."
    }
    precondition {
      condition     = length(local.custom_domains) == 0 || (var.cluster_alb_zone_id != null && var.cluster_alb_zone_id != "")
      error_message = "cluster_alb_zone_id is required when the domains list includes a custom (non-wildcard) domain."
    }
```

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

ravion_distribution_arn and ravion_distribution_domain both use try(...[0], null), which silently returns null if the module.cdn distribution maps are empty (i.e., no distributions are configured). These null values are then passed as target_arn to ravion_certificate.site and as target_dns_name to ravion_domain.custom with no guard, producing a cryptic provider-side error instead of a clear Terraform message. A precondition on ravion_certificate.site would surface this early.

Suggested change

	lifecycle {
	precondition {
	condition = !var.use_ravion_managed_domains || (var.ravion_aws_account_id != null && var.ravion_aws_account_id != "")
	error_message = "ravion_aws_account_id (aws_*) is required when use_ravion_managed_domains = true."
	}
	precondition {
	condition = length(var.domains) <= 10
	error_message = "A static site may declare at most 10 custom domains."
	}
	}
	lifecycle {
	precondition {
	condition = !var.use_ravion_managed_domains || (var.ravion_aws_account_id != null && var.ravion_aws_account_id != "")
	error_message = "ravion_aws_account_id (aws_*) is required when use_ravion_managed_domains = true."
	}
	precondition {
	condition = length(var.domains) <= 10
	error_message = "A static site may declare at most 10 custom domains."
	}
	precondition {
	condition = !var.use_ravion_managed_domains || local.ravion_distribution_arn != null
	error_message = "use_ravion_managed_domains = true requires at least one CloudFront distribution in var.distributions."
	}
	}

Prompt To Fix With AI

This is a comment left during a code review.
Path: hosting/static_site/ravion_domains.tf
Line: 34-43

Comment:
`ravion_distribution_arn` and `ravion_distribution_domain` both use `try(...[0], null)`, which silently returns `null` if the `module.cdn` distribution maps are empty (i.e., no distributions are configured). These null values are then passed as `target_arn` to `ravion_certificate.site` and as `target_dns_name` to `ravion_domain.custom` with no guard, producing a cryptic provider-side error instead of a clear Terraform message. A precondition on `ravion_certificate.site` would surface this early.

```suggestion
  lifecycle {
    precondition {
      condition     = !var.use_ravion_managed_domains || (var.ravion_aws_account_id != null && var.ravion_aws_account_id != "")
      error_message = "ravion_aws_account_id (aws_*) is required when use_ravion_managed_domains = true."
    }
    precondition {
      condition     = length(var.domains) <= 10
      error_message = "A static site may declare at most 10 custom domains."
    }
    precondition {
      condition     = !var.use_ravion_managed_domains || local.ravion_distribution_arn != null
      error_message = "use_ravion_managed_domains = true requires at least one CloudFront distribution in var.distributions."
    }
  }
```

How can I resolve this? If you propose a fix, please make it concise.