Import rds-postgres-server and rds-postgres-db from nullplatform/services

.github/workflows/branch-validation.yml

@@ -0,0 +1,10 @@
+name: branch-validation
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  branch-validation:
+    uses: nullplatform/actions-nullplatform/.github/workflows/branch-validation.yml@main

.github/workflows/conventional-commit.yml

@@ -0,0 +1,10 @@
+name: conventional-commit
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  conventional-commit:
+    uses: nullplatform/actions-nullplatform/.github/workflows/conventional-commit.yml@main

.github/workflows/release.yml

@@ -0,0 +1,15 @@
+name: release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release:
+    uses: nullplatform/actions-nullplatform/.github/workflows/release.yml@main
+    secrets: inherit

.github/workflows/shellcheck.yml

@@ -0,0 +1,10 @@
+name: shellcheck
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  shellcheck:
+    uses: nullplatform/actions-nullplatform/.github/workflows/shellcheck.yml@main

.github/workflows/trivy.yml

@@ -0,0 +1,14 @@
+name: trivy
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy:
+    uses: nullplatform/actions-nullplatform/.github/workflows/trivy-tofu-scan.yml@main

.gitignore

@@ -1,134 +1,21 @@
-# Logs
-logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-lerna-debug.log*
-.pnpm-debug.log*
-
-# Diagnostic reports (https://nodejs.org/api/report.html)
-report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
-
-# Runtime data
-pids
-*.pid
-*.seed
-*.pid.lock
-
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
-# Coverage directory used by tools like istanbul
-coverage
-*.lcov
-
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
-# Dependency directories
-node_modules/
-jspm_packages/
-
-# Snowpack dependency directory (https://snowpack.dev/)
-web_modules/
-
-# TypeScript cache
-*.tsbuildinfo
-
-# Optional npm cache directory
-.npm
-
-# Optional eslint cache
-.eslintcache
-
-# Optional stylelint cache
-.stylelintcache
-
-# Microbundle cache
-.rpt2_cache/
-.rts2_cache_cjs/
-.rts2_cache_es/
-.rts2_cache_umd/
-
-# Optional REPL history
-.node_repl_history
-
-# Output of 'npm pack'
-*.tgz
-
-# Yarn Integrity file
-.yarn-integrity
-
-# dotenv environment variable files
-.env
-.env.development.local
-.env.test.local
-.env.production.local
-.env.local
-
-# parcel-bundler cache (https://parceljs.org/)
-.cache
-.parcel-cache
-
-# Next.js build output
-.next
+# IntelliJ project files
+.idea
+*.iml
 out
+gen
 
-# Nuxt.js build / generate output
-.nuxt
-dist
-
-# Gatsby files
-.cache/
-# Comment in the public line in if your project uses Gatsby and not Next.js
-# https://nextjs.org/blog/next-9-1#public-directory-support
-# public
+# VSCode project files
+.vscode/
 
-# vuepress build output
-.vuepress/dist
+# Terraform / OpenTofu
+*.tfstate
+*.tfstate.backup
+.terraform/
 
-# vuepress v2.x temp and cache directory
-.temp
-.cache
+# .terraform.lock.hcl is intentionally tracked (pins provider versions) —
+# do not add it here.
 
-# Docusaurus cache and generated files
-.docusaurus
+*.tfvars
+!terraform.tfvars.example
 
-# Serverless directories
-.serverless/
-
-# FuseBox cache
-.fusebox/
-
-# DynamoDB Local files
-.dynamodb/
-
-# TernJS port file
-.tern-port
-
-# Stores VSCode versions used for testing VSCode extensions
-.vscode-test
-
-# yarn v2
-.yarn/cache
-.yarn/unplugged
-.yarn/build-state.yml
-.yarn/install-state.gz
-.pnp.*
-
-# Intellij
-
-.idea
+.DS_Store

.trivyignore

@@ -0,0 +1,9 @@
+# Trivy misconfiguration suppressions for this repo.
+# Each entry is intentional and documented; revisit if the module changes.
+
+# AVD-AWS-0104 — RDS security group allows unrestricted egress (0.0.0.0/0).
+# Standard for an RDS instance's own security group (matches the AWS default
+# VPC SG behavior): the instance needs outbound access for things like CA
+# bundle/extension fetches and Secrets Manager rotation. Inbound is already
+# restricted to PostgreSQL (5432) from the VPC's own CIDR blocks.
+AVD-AWS-0104

README.md

@@ -1,18 +1,20 @@
-<h2 align="center">
-    <a href="https://httpie.io" target="blank_">
-        <img height="100" alt="nullplatform" src="https://nullplatform.com/favicon/android-chrome-192x192.png" />
-    </a>
-    <br>
-    <br>
-    Nullplatform "Any Technology" Template
-    <br>
-</h2>
+# services-postgresql-rds
 
-This is a minimalistic sample on how you can create an application on arbitrary technology.
-In particular, we're spinning up an image that contains an echo server.
-You can check *Echo Server* documentation [here](https://ealenn.github.io/Echo-Server/).
+nullplatform service definitions for AWS RDS PostgreSQL:
 
-## How do I modify this template to build my own application?
+- [`rds-postgres-server/`](rds-postgres-server/README.md) — provisions the RDS
+  PostgreSQL instance itself.
+- [`rds-postgres-db/`](rds-postgres-db/README.md) — provisions a database +
+  application user on an existing `rds-postgres-server` instance, linked via
+  the `connect` link.
 
-1. Change the Dockerfile to run the application / binary that you are building
-2. Deploy your application in nullplatform
+Each service directory is self-contained: `entrypoint/`, `workflows/`,
+`scripts/`, and `specs/` are read directly by the nullplatform agent at
+runtime. `specs/requirements/aws/` and `specs/install/aws/` are one-time
+setup Terraform, applied out-of-band by an account operator — see each
+service's own README for the full setup guide ("AssumeRole Setup Guide") and
+`specs/install/README.md`.
+
+This repository was extracted from `nullplatform/services` (the
+`databases/rds-postgres-server` and `databases/rds-postgres-db` directories),
+preserving their commit history.