feat(oci): multi-cloud provider seam with a working Oracle Cloud target

bin/render_harness.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+#
+# Deterministic-render diff harness.
+#
+# Renders the AWS terraform + ansible set into <out_dir> with every random input
+# pinned, so two renders of the SAME revision are byte-identical and any diff
+# between two revisions is a real output change.
+#
+# Two-revision recipe:
+#
+#   git checkout <commit-A> && bash bin/render_harness.sh /tmp/base
+#   git checkout <commit-B> && bash bin/render_harness.sh /tmp/head
+#   diff -r /tmp/base /tmp/head    # empty == no AWS output change
+#
+# The operator (or CI) supplies the two commits; this script renders one.
+set -euo pipefail
+
+OUT_DIR="${1:?usage: render_harness.sh <out_dir>}"
+
+PINNED_PEM_APP_NAME="render-harness-pinned"
+PINNED_DB_PASSWORD="RenderHarnessPinnedPassword"
+
+# Never rm -rf the caller's argument. An earlier version did, behind a guard that only
+# rejected relative paths and directories containing .git/mix.exs — so `/`, `$HOME`, `/opt`
+# and any other absolute path all sailed through it. Instead, refuse to touch anything that
+# already exists and delete only the two subdirectories this script creates itself.
+case "$OUT_DIR" in
+  /*) ;;
+  *) echo "render_harness.sh: <out_dir> must be an absolute path, got '$OUT_DIR'" >&2; exit 2 ;;
+esac
+
+if [ -e "$OUT_DIR" ] && [ ! -d "$OUT_DIR/terraform" ] && [ ! -d "$OUT_DIR/ansible" ]; then
+  echo "render_harness.sh: '$OUT_DIR' already exists and is not a previous render dir." >&2
+  echo "  Refusing to touch it. Pass a fresh path." >&2
+  exit 2
+fi
+
+mkdir -p "$OUT_DIR"
+rm -rf "${OUT_DIR:?}/terraform" "${OUT_DIR:?}/ansible"
+
+mix terraform.build \
+  --render-dir "$OUT_DIR/terraform" \
+  --pem-app-name "$PINNED_PEM_APP_NAME" \
+  --db-password "$PINNED_DB_PASSWORD" \
+  --quiet < /dev/null
+
+mix ansible.build --render-dir "$OUT_DIR/ansible" --quiet < /dev/null

guides/reference/terraform_variables.md

@@ -88,12 +88,20 @@ my_app_project = {
 
 ### `load_balancer`
 
+Listener and forwarded ports are **fixed at 80 (and 443 when `enable_https = true`) on both
+providers** — there is no key that changes them. AWS declares `port` / `instance_port` in its
+schema but never reads them (dead keys, kept only for backward compatibility); OCI's schema has
+no such keys at all.
+
+`enable_https` defaults to `true` on both providers — the examples below set it `false`
+deliberately (no TLS cert wired up yet).
+
+**AWS**
+
 ```hcl
 load_balancer = {
   enable        = true
   enable_https  = false
-  port          = 80
-  instance_port = 4000
 
   health_check = {
     path                = "/health"
@@ -111,16 +119,49 @@ load_balancer = {
 | Field | Default | Notes |
 |-------|---------|-------|
 | `enable` | `false` | Required when `instance_count > 1` or autoscaling |
-| `enable_https` | `false` | Adds a 443 listener; needs an ACM cert (set up separately) |
-| `port` | `80` | LB listener port (the URL clients hit) |
-| `instance_port` | `4000` | Forwarded port on the instance |
+| `enable_https` | `true` | Set `false` to skip the 443 listener; needs an ACM cert (set up separately) |
 | `health_check.path` | `/` | Endpoint hit by the LB |
 | `health_check.matcher` | `200-299,301` | HTTP status codes considered healthy |
 | `health_check.unhealthy_threshold` | `2` | Failed checks before unhealthy |
 | `health_check.healthy_threshold` | `2` | Successful checks before healthy |
 | `health_check.timeout` | `5` | Seconds per check |
 | `health_check.interval` | `20` | Seconds between checks |
 
+**OCI**
+
+```hcl
+load_balancer = {
+  enable            = true
+  enable_https      = false
+  reserved_ip_ocid  = null
+
+  health_check = {
+    path                = "/health"
+    return_code         = 200
+    https_return_code   = 200
+    unhealthy_threshold = 3
+    timeout             = 3
+    interval            = 10
+  }
+}
+```
+
+| Field | Default | Notes |
+|-------|---------|-------|
+| `enable` | `false` | Gates on this alone — OCI has no autoscaling and no `instance_count > 1` requirement the way AWS does |
+| `enable_https` | `true` | Set `false` to skip the 443 listener/backend set/NSG rule |
+| `reserved_ip_ocid` | `null` | OCI-only. Pins the NLB's public IP to a pre-created reserved IP; unset leaves it ephemeral |
+| `health_check.path` | `""` | Empty performs a TCP connect-only check; set performs an HTTP/HTTPS check |
+| `health_check.return_code` / `https_return_code` | `200` | OCI-only — a single expected status code, not a range like AWS's `matcher` |
+| `health_check.unhealthy_threshold` | `3` | Retries before a backend flips unhealthy (and before recovering it — OCI has one threshold, not two) |
+| `health_check.timeout` | `3` | Seconds per check |
+| `health_check.interval` | `10` | Seconds between checks |
+
+AWS keys ignored on OCI: `port`, `instance_port`, `health_check.protocol`, `health_check.matcher`,
+`health_check.https_matcher`, `health_check.healthy_threshold` — see
+`priv/terraform/providers/oci/README.md` for the full AWS-key-to-OCI mapping, the reason each is
+ignored, and the per-app NSG security posture.
+
 ### `autoscaling`
 
 ```hcl
@@ -280,8 +321,6 @@ my_app = {
   instance_count = 2                # bump capacity first
   load_balancer = {
     enable        = true
-    port          = 80
-    instance_port = 4000
     health_check  = { path = "/health" }
   }
 }
@@ -308,7 +347,7 @@ my_app = {
     desired_capacity   = 3
     cpu_target_percent = 60
   }
-  load_balancer = { enable = true, port = 80, instance_port = 4000 }
+  load_balancer = { enable = true }
 }
 ```
 

lib/deploy_ex/aws_bucket.ex

@@ -1,105 +1,44 @@
 defmodule DeployEx.AwsBucket do
-  alias ExAws.S3
+  @moduledoc """
+  Region-first bucket helpers for the terraform state-bucket tasks.
 
-  @type bucket_res :: %{name: String.t, creation_date: String.t}
+  The S3 calls now live in `DeployEx.Cloud.S3ObjectStore`, which implements
+  `DeployEx.Cloud.ObjectStore`. This module stays because its call sites pass the region as the
+  FIRST argument, which the provider-neutral behaviour does not — it takes region in opts.
+  """
+
+  alias DeployEx.Cloud.S3ObjectStore
+
+  @type bucket_res :: %{name: String.t(), creation_date: String.t()}
 
   @spec create_bucket(String.t()) :: ErrorMessage.t_res(any)
   @spec create_bucket(String.t(), String.t()) :: ErrorMessage.t_res(any)
   def create_bucket(region \\ DeployEx.Config.aws_region(), bucket_name) do
-    case ExAws.request(S3.put_bucket(bucket_name, region), region: region) do
-      {:ok, _} -> :ok
-      {:error, {:http_error, code, message}} ->
-        {:error, handle_error(code, message, %{bucket: bucket_name})}
-    end
+    S3ObjectStore.create_container(bucket_name, region: region)
   end
 
   @spec list_buckets() :: ErrorMessage.t_res(bucket_res)
   @spec list_buckets(String.t()) :: ErrorMessage.t_res(bucket_res)
   def list_buckets(region \\ DeployEx.Config.aws_region()) do
-    case ExAws.request(S3.list_buckets(), region: region) do
-      {:ok, %{body: %{buckets: buckets}}} -> {:ok, buckets}
-      {:error, {:http_error, code, message}} ->
-        {:error, handle_error(code, message, %{region: region})}
-    end
+    S3ObjectStore.list_containers(region: region)
   end
 
   def list_objects(region \\ DeployEx.Config.aws_region(), bucket_name) do
-    case ExAws.request(S3.list_objects(bucket_name), region: region) do
-      {:ok, _} = res -> res
-      {:error, {:http_error, code, message}} ->
-        {:error, handle_error(code, message, %{region: region, bucket: bucket_name})}
-    end
+    S3ObjectStore.list_objects(bucket_name, region: region)
   end
 
-  def delete_all_objects(region \\ DeployEx.Config.aws_region(), bucket_name, continuation_token \\ nil) do
-    list_opts = if continuation_token, do: [continuation_token: continuation_token], else: []
-
-    case ExAws.request(S3.list_objects_v2(bucket_name, list_opts), region: region) do
-      {:ok, %{body: %{contents: objects, is_truncated: is_truncated, next_continuation_token: next_token}}} when objects !== [] ->
-        object_keys = Enum.map(objects, & &1.key)
-
-        case ExAws.request(S3.delete_multiple_objects(bucket_name, object_keys), region: region) do
-          {:ok, _} ->
-            if is_truncated do
-              delete_all_objects(region, bucket_name, next_token)
-            else
-              :ok
-            end
-          {:error, {:http_error, code, message}} ->
-            {:error, handle_error(code, message, %{region: region, bucket: bucket_name})}
-        end
+  @doc """
+  Empties a bucket entirely.
 
-      {:ok, %{body: %{contents: [], is_truncated: is_truncated, next_continuation_token: next_token}}} ->
-        if is_truncated do
-          delete_all_objects(region, bucket_name, next_token)
-        else
-          :ok
-        end
-
-      {:ok, %{body: %{contents: objects}}} when objects !== [] ->
-        object_keys = Enum.map(objects, & &1.key)
-
-        case ExAws.request(S3.delete_multiple_objects(bucket_name, object_keys), region: region) do
-          {:ok, _} -> :ok
-          {:error, {:http_error, code, message}} ->
-            {:error, handle_error(code, message, %{region: region, bucket: bucket_name})}
-        end
-
-      {:ok, _} -> :ok
-      {:error, {:http_error, code, message}} ->
-        {:error, handle_error(code, message, %{region: region, bucket: bucket_name})}
-    end
+  `all: true` is passed deliberately — the object store refuses an unscoped delete, and emptying
+  the bucket is exactly what this function is for. Its only caller drops the terraform state
+  bucket, whose name comes from config rather than an argument.
+  """
+  def delete_all_objects(region \\ DeployEx.Config.aws_region(), bucket_name, continuation_token \\ nil) do
+    S3ObjectStore.delete_all_objects(bucket_name, [region: region, all: true], continuation_token)
   end
 
   def delete_bucket(region \\ DeployEx.Config.aws_region(), bucket_name) do
-    case ExAws.request(S3.delete_bucket(bucket_name), region: region) do
-      {:ok, _} -> :ok
-      {:error, {:http_error, code, message}} ->
-        {:error, handle_error(code, message, %{region: region, bucket: bucket_name})}
-    end
-  end
-
-  defp handle_error(409, message, %{bucket: bucket_name}) do
-    ErrorMessage.conflict("bucket already exists", %{bucket: bucket_name, message: message})
-  end
-
-  defp handle_error(404, message, %{bucket: bucket_name}) do
-    ErrorMessage.not_found("bucket not found", %{bucket: bucket_name, message: message})
-  end
-
-  defp handle_error(code, message, %{region: region, bucket: bucket_name}) do
-    %ErrorMessage{
-      code: ErrorMessage.http_code_reason_atom(code),
-      message: message,
-      details: %{region: region, bucket: bucket_name}
-    }
-  end
-
-  defp handle_error(code, message, %{region: region}) do
-    %ErrorMessage{
-      code: ErrorMessage.http_code_reason_atom(code),
-      message: message,
-      details: %{region: region}
-    }
+    S3ObjectStore.delete_container(bucket_name, region: region)
   end
 end