How I Built This

terraform/
├── tf-modules/
│   ├── aws-vpc/           # VPC, public subnet, Internet Gateway
│   └── aws-k3s/           # EC2 instance, k3s, ArgoCD (cloud-init)
├── main.tf                # Module composition
├── providers.tf           # AWS provider configuration
├── backend.tf             # S3 state with DynamoDB locking
├── budget.tf              # AWS budget alert ($25/mo)
└── variables.tf           # Configuration variables

name: Build and Deploy
on:
  push:
    branches: [main]

permissions:
  contents: read           # Least-privilege security

jobs:
  lint:                     # Gate: code quality + dependency audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd7190...  # Pinned SHA
      - uses: actions/setup-node@49933ea...
      - run: npm ci
      - run: npm audit --audit-level=critical
      - run: npm run lint

  build-and-deploy:
    needs: lint             # Only runs if lint passes
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd7190...
      - run: echo "tag=ga-$(date +'%Y.%m.%d-%H%M')" >> $GITHUB_OUTPUT

      - uses: docker/login-action@74a5d142...
      - uses: docker/setup-buildx-action@b5ca5143...

      - uses: docker/build-push-action@26343531...
        with:
          push: true
          tags: furryman/fuhriman-website:${{ steps.tag.outputs.tag }},latest

      # Trivy CVE scan — fails on CRITICAL/HIGH
      - uses: aquasecurity/trivy-action@6c175e9c...
        with:
          severity: CRITICAL,HIGH
          exit-code: 1

      # Update Helm chart to trigger ArgoCD
      - uses: actions/checkout@11bd7190...
        with:
          repository: furryman/eks-helm-charts
          token: ${{ secrets.GH_PAT }}
      - run: yq -i '.image.tag = "..."' fuhriman-chart/values.yaml
      - run: git commit -am "Update image" && git push

# Wait for ArgoCD to deploy ingress-nginx
until kubectl get svc -n ingress-nginx ingress-nginx-controller &>/dev/null; do
  sleep 5
done

# Race condition fix: wait for kube-proxy to create LoadBalancer rules
# (lags behind service creation)
until iptables -t nat -L KUBE-SERVICES -n 2>/dev/null \
  | grep -q "ingress-nginx-controller:http loadbalancer"; do
  sleep 2
done

# Discover kube-proxy's KUBE-EXT chain names
HTTP_CHAIN=$(iptables -t nat -L KUBE-SERVICES -n \
  | grep "ingress-nginx-controller:http loadbalancer" | awk '{print $1}')
HTTPS_CHAIN=$(iptables -t nat -L KUBE-SERVICES -n \
  | grep "ingress-nginx-controller:https loadbalancer" | awk '{print $1}')

# Jump pod traffic to the public IP into kube-proxy's chains
iptables -t nat -A PREROUTING -s 10.42.0.0/16 -d $PUBLIC_IP \
  -p tcp --dport 80 -j $HTTP_CHAIN
iptables -t nat -A PREROUTING -s 10.42.0.0/16 -d $PUBLIC_IP \
  -p tcp --dport 443 -j $HTTPS_CHAIN