Added Single-Instance Invite Bot ECS Service (#1)

yulmwu · web-flow · commit 529df60ab902 · 2026-06-25T15:34:55.000+09:00
* feat: add invite_bot ecs service

* docs: update architecture diagram
diff --git a/assets/architecture.drawio b/assets/architecture.drawio
@@ -1,6 +1,6 @@
 <mxfile host="Electron">
   <diagram name="페이지-1" id="0xCIYineUgVJ7Auf2_G3">
-    <mxGraphModel dx="972" dy="740" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="3300" pageHeight="4681" math="0" shadow="0">
+    <mxGraphModel dx="1169" dy="836" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="3300" pageHeight="4681" math="0" shadow="0">
       <root>
         <mxCell id="0" />
         <mxCell id="1" parent="0" />
@@ -224,6 +224,9 @@
         <mxCell id="dFDLIWHxTieYANeZmimu-5" parent="1" style="text;html=1;whiteSpace=wrap;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;rounded=0;fontSize=10;" value="(ASG : Optional)" vertex="1">
           <mxGeometry height="30" width="120" x="617.5" y="201" as="geometry" />
         </mxCell>
+        <mxCell id="p5icJqS1yuqV0pEGQa0l-1" parent="1" style="sketch=0;points=[[0,0,0],[0.25,0,0],[0.5,0,0],[0.75,0,0],[1,0,0],[0,1,0],[0.25,1,0],[0.5,1,0],[0.75,1,0],[1,1,0],[0,0.25,0],[0,0.5,0],[0,0.75,0],[1,0.25,0],[1,0.5,0],[1,0.75,0]];outlineConnect=0;fontColor=#232F3E;fillColor=#ED7100;strokeColor=#ffffff;dashed=0;verticalLabelPosition=bottom;verticalAlign=top;align=center;html=1;fontSize=11;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.ecs;labelBackgroundColor=default;" value="ECS Fargate&lt;div&gt;Invite Bot&lt;/div&gt;" vertex="1">
+          <mxGeometry height="30" width="30" x="560" y="380" as="geometry" />
+        </mxCell>
       </root>
     </mxGraphModel>
   </diagram>
diff --git a/assets/architecture.png b/assets/architecture.png
diff --git a/example.tfvars b/example.tfvars
@@ -31,6 +31,20 @@ backend_health_check_interval_seconds    = 20
 backend_health_check_timeout_seconds     = 5
 backend_health_check_healthy_threshold   = 2
 backend_health_check_unhealthy_threshold = 2
+
+# Invite bot (Discord). Deployed as a single ECS task (no sharding); see
+# modules/ecs/invite_bot.tf. When invite_bot_enabled = true, the backend's
+# DISCORD_BOT_BASE_URL is auto-set to the invite-bot Cloud Map DNS name.
+invite_bot_enabled = false
+invite_bot_image   = "123456789012.dkr.ecr.ap-northeast-2.amazonaws.com/invite-bot:latest"
+invite_bot_cpu     = 256
+invite_bot_memory  = 512
+invite_bot_environment = {
+  DISCORD_BOT_TOKEN        = ""
+  DISCORD_GUILD_ID         = ""
+  DISCORD_VERIFIED_ROLE_ID = ""
+  DISCORD_INTERNAL_SECRET  = "change-me"
+}
 backend_environment = {
   APP_ENV                   = "local"
   HTTP_ADDR                 = ":8080"
@@ -81,9 +95,24 @@ backend_environment = {
   VMS_MAX_SCOPE             = "team"
   VMS_MAX_PER               = "2"
   VMS_ORCHESTRATOR_BASE_URL = "http://10.10.0.1:8082"
+  VMS_ORCHESTRATOR_SECRET   = "change-me"
   VMS_ORCHESTRATOR_TIMEOUT  = "5s"
   VMS_CREATE_WINDOW         = "1m"
   VMS_CREATE_MAX            = "1"
+
+  DISCORD_ENABLED          = "false"
+  DISCORD_CLIENT_ID        = ""
+  DISCORD_CLIENT_SECRET    = "change-me"
+  DISCORD_REDIRECT_URI     = "https://api.example.com/api/discord/callback"
+  DISCORD_OAUTH_SCOPES     = "identify guilds.join"
+  DISCORD_STATE_TTL        = "5m"
+  DISCORD_OAUTH_TIMEOUT    = "10s"
+  DISCORD_SUCCESS_REDIRECT = "https://ctf.example.com/profile"
+  DISCORD_INVITE_URL       = ""
+  DISCORD_AUTO_JOIN        = "true"
+  DISCORD_BOT_BASE_URL     = "http://10.10.0.1:8083"
+  DISCORD_BOT_SECRET       = "change-me"
+  DISCORD_BOT_TIMEOUT      = "5s"
 }
 backend_log_retention_days = 14
 
diff --git a/main.tf b/main.tf
@@ -117,6 +117,13 @@ module "ecs" {
   backend_health_check_unhealthy_threshold = var.backend_health_check_unhealthy_threshold
   ecs_task_execution_role_arn              = module.policy.ecs_task_execution_role_arn
   ecs_task_role_arn                        = module.policy.ecs_task_role_arn
+
+  invite_bot_enabled            = var.invite_bot_enabled
+  invite_bot_image              = var.invite_bot_image
+  invite_bot_cpu                = var.invite_bot_cpu
+  invite_bot_memory             = var.invite_bot_memory
+  invite_bot_environment        = var.invite_bot_environment
+  invite_bot_log_retention_days = var.invite_bot_log_retention_days
 }
 
 module "sbxcluster" {
diff --git a/modules/ecs/invite_bot.tf b/modules/ecs/invite_bot.tf
@@ -0,0 +1,134 @@
+locals {
+  invite_bot_count          = var.invite_bot_enabled ? 1 : 0
+  invite_bot_container_name = "invite-bot"
+
+  backend_environment_effective = merge(
+    var.backend_environment,
+    var.invite_bot_enabled ? {
+      DISCORD_BOT_BASE_URL = "http://${aws_service_discovery_service.invite_bot[0].name}.${aws_service_discovery_private_dns_namespace.internal[0].name}:8083"
+    } : {}
+  )
+}
+
+resource "aws_service_discovery_private_dns_namespace" "internal" {
+  count       = local.invite_bot_count
+  name        = "${var.name_prefix}.internal"
+  description = "Internal service discovery namespace for ${var.name_prefix}"
+  vpc         = var.vpc_id
+  tags        = var.tags
+}
+
+resource "aws_service_discovery_service" "invite_bot" {
+  count = local.invite_bot_count
+  name  = "invite-bot"
+
+  dns_config {
+    namespace_id = aws_service_discovery_private_dns_namespace.internal[0].id
+
+    dns_records {
+      type = "A"
+      ttl  = 10
+    }
+
+    routing_policy = "MULTIVALUE"
+  }
+
+  health_check_custom_config {}
+
+  tags = var.tags
+}
+
+resource "aws_security_group" "invite_bot" {
+  count       = local.invite_bot_count
+  name        = "${var.name_prefix}-invite-bot"
+  description = "Invite bot ECS service security group"
+  vpc_id      = var.vpc_id
+
+  ingress {
+    description     = "Internal API from backend"
+    from_port       = 8083
+    to_port         = 8083
+    protocol        = "tcp"
+    security_groups = [aws_security_group.backend.id]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = merge(var.tags, { Name = "${var.name_prefix}-invite-bot" })
+}
+
+resource "aws_cloudwatch_log_group" "invite_bot" {
+  count             = local.invite_bot_count
+  name              = "/aws/ecs/${var.name_prefix}/invite-bot"
+  retention_in_days = var.invite_bot_log_retention_days
+  tags              = var.tags
+}
+
+resource "aws_ecs_task_definition" "invite_bot" {
+  count                    = local.invite_bot_count
+  family                   = "${var.name_prefix}-invite-bot"
+  requires_compatibilities = ["FARGATE"]
+  network_mode             = "awsvpc"
+  cpu                      = tostring(var.invite_bot_cpu)
+  memory                   = tostring(var.invite_bot_memory)
+  execution_role_arn       = var.ecs_task_execution_role_arn
+  task_role_arn            = var.ecs_task_role_arn
+
+  container_definitions = jsonencode([
+    {
+      name      = local.invite_bot_container_name
+      image     = var.invite_bot_image
+      essential = true
+      portMappings = [{
+        containerPort = 8083
+        hostPort      = 8083
+        protocol      = "tcp"
+      }]
+      environment = [
+        for k, v in merge({ HTTP_ADDR = ":8083" }, var.invite_bot_environment) : {
+          name  = k
+          value = v
+        }
+      ]
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = aws_cloudwatch_log_group.invite_bot[0].name
+          awslogs-region        = data.aws_region.current.region
+          awslogs-stream-prefix = "invite-bot"
+        }
+      }
+    }
+  ])
+
+  tags = var.tags
+}
+
+resource "aws_ecs_service" "invite_bot" {
+  count           = local.invite_bot_count
+  name            = "invite-bot"
+  cluster         = aws_ecs_cluster.backend.id
+  task_definition = aws_ecs_task_definition.invite_bot[0].arn
+  desired_count   = 1
+  launch_type     = "FARGATE"
+
+  deployment_minimum_healthy_percent = 0
+  deployment_maximum_percent         = 100
+
+  network_configuration {
+    assign_public_ip = false
+    security_groups  = [aws_security_group.invite_bot[0].id]
+    subnets          = var.private_subnet_ids
+  }
+
+  service_registries {
+    registry_arn = aws_service_discovery_service.invite_bot[0].arn
+  }
+
+  tags = var.tags
+}
diff --git a/modules/ecs/main.tf b/modules/ecs/main.tf
@@ -149,7 +149,7 @@ resource "aws_ecs_task_definition" "backend" {
         protocol      = "tcp"
       }]
       environment = [
-        for k, v in var.backend_environment : {
+        for k, v in local.backend_environment_effective : {
           name  = k
           value = v
         }
diff --git a/modules/ecs/outputs.tf b/modules/ecs/outputs.tf
@@ -17,3 +17,11 @@ output "backend_ecs_cluster_name" {
 output "backend_ecs_service_name" {
   value = aws_ecs_service.backend.name
 }
+
+output "invite_bot_service_name" {
+  value = var.invite_bot_enabled ? aws_ecs_service.invite_bot[0].name : null
+}
+
+output "invite_bot_internal_url" {
+  value = var.invite_bot_enabled ? "http://${aws_service_discovery_service.invite_bot[0].name}.${aws_service_discovery_private_dns_namespace.internal[0].name}:8083" : null
+}
diff --git a/modules/ecs/variables.tf b/modules/ecs/variables.tf
@@ -25,5 +25,30 @@ variable "backend_health_check_timeout_seconds" { type = number }
 variable "backend_health_check_healthy_threshold" { type = number }
 variable "backend_health_check_unhealthy_threshold" { type = number }
 
+variable "invite_bot_enabled" {
+  type    = bool
+  default = false
+}
+variable "invite_bot_image" {
+  type    = string
+  default = ""
+}
+variable "invite_bot_cpu" {
+  type    = number
+  default = 256
+}
+variable "invite_bot_memory" {
+  type    = number
+  default = 512
+}
+variable "invite_bot_environment" {
+  type    = map(string)
+  default = {}
+}
+variable "invite_bot_log_retention_days" {
+  type    = number
+  default = 14
+}
+
 variable "ecs_task_execution_role_arn" { type = string }
 variable "ecs_task_role_arn" { type = string }
diff --git a/variables.tf b/variables.tf
@@ -139,6 +139,36 @@ variable "backend_environment" {
   default     = {}
 }
 
+variable "invite_bot_enabled" {
+  type    = bool
+  default = false
+}
+
+variable "invite_bot_image" {
+  type    = string
+  default = ""
+}
+
+variable "invite_bot_cpu" {
+  type    = number
+  default = 256
+}
+
+variable "invite_bot_memory" {
+  type    = number
+  default = 512
+}
+
+variable "invite_bot_environment" {
+  type    = map(string)
+  default = {}
+}
+
+variable "invite_bot_log_retention_days" {
+  type    = number
+  default = 14
+}
+
 variable "backend_log_retention_days" {
   type        = number
   description = "CloudWatch log retention days for backend ECS logs."

Original file line number	Diff line number	Diff line change
`@@ -149,7 +149,7 @@ resource "aws_ecs_task_definition" "backend" {`
`149`	`149`	`protocol = "tcp"`
`150`	`150`	`}]`
`151`	`151`	`environment = [`
`152`		`- for k, v in var.backend_environment : {`
	`152`	`+ for k, v in local.backend_environment_effective : {`
`153`	`153`	`name = k`
`154`	`154`	`value = v`
`155`	`155`	`}`