# variables.tf — generated by `autumn release init --target aws-app-runner`
variable "app_name" {
description = "Name used to prefix every provisioned AWS resource."
type = string
default = "{{project_name}}"
}
variable "region" {
description = "AWS region for all resources."
type = string
default = "us-east-1"
}
variable "image_tag" {
description = "Tag of the {{project_name}} image in ECR to deploy. Documents the tag scheme used by the deploy walkthrough after bootstrap — Terraform itself only ever sets `bootstrap_image` (see below) and never manages the image after the first apply."
type = string
default = "latest"
}
# App Runner must pull an image to create the service's first revision, but
# a brand-new private ECR repository has none yet — so Terraform points at
# this public ECR Public Gallery placeholder (which needs no access role) on
# the first apply, then ignores further source_configuration drift (see the
# `lifecycle.ignore_changes` block in main.tf) once the deploy walkthrough
# takes over managing the real image. Deliberately plain nginx, not e.g. AWS's
# own hello-app-runner quickstart image: App Runner's health check blocks
# `terraform apply` until the service is stable, and nginx's listening port
# (80) and default "/" response (200) are well-known constants main.tf's
# image_configuration.port/health_check_configuration.path are set to match
# — an image whose actual listening port/response isn't a documented,
# stable fact you can rely on risks apply hanging until it times out.
variable "bootstrap_image" {
description = "Public ECR Public Gallery placeholder image App Runner uses to create the service before any real image has been pushed to your own ECR repository. Must actually listen on port 80 and return 200 for \"/\" — see main.tf's image_configuration/health_check_configuration comments — if you change this."
type = string
default = "public.ecr.aws/nginx/nginx:latest"
}
variable "instance_cpu" {
description = "App Runner instance vCPU allocation (e.g. \"1 vCPU\", \"2 vCPU\", \"4 vCPU\")."
type = string
default = "1 vCPU"
}
variable "instance_memory" {
description = "App Runner instance memory allocation (e.g. \"2 GB\", \"4 GB\", \"8 GB\")."
type = string
default = "2 GB"
}
variable "db_instance_class" {
description = "RDS instance class for the Postgres database."
type = string
default = "db.t4g.micro"
}
variable "vpc_cidr" {
description = "CIDR block for the VPC provisioned for RDS and the App Runner VPC connector."
type = string
default = "10.0.0.0/16"
}
# ── Scale config defaults ────────────────────────────────────────────────────
# Min instances: 1, Max: 10. App Runner scales within these bounds on
# concurrent request volume (max_concurrency = 100 per instance, main.tf);
# it will not scale to zero while min_size > 0.
variable "min_size" {
description = "Minimum number of App Runner instances kept running."
type = number
default = 1
}
variable "max_size" {
description = "Maximum number of App Runner instances under load."
type = number
default = 10
}
# ── Secrets — no default. Supply via TF_VAR_* env vars or your CI's secret
# store. Never commit real values in terraform.tfvars. ──────────────────────
#
# Note: there is no `database_url` variable. A single `terraform apply` must
# succeed without a second, targeted apply to fill in a value that depends on
# a resource the same apply is about to create — so main.tf derives the full
# connection string from `aws_db_instance.this`'s address plus this password,
# rather than requiring the operator to pre-compute it.
variable "database_admin_password" {
description = "Master password for the RDS PostgreSQL instance."
type = string
sensitive = true
}
variable "signing_secret" {
description = "Signing secret stored in Secrets Manager as AUTUMN_SECURITY__SIGNING_SECRET; generate with `openssl rand -hex 32`."
type = string
sensitive = true
}