horkos 0.2.0

Cloud infrastructure language where insecure code won't compile
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

// Horkos Infrastructure Example
// Every resource is secure by default

// S3 bucket - automatically encrypted, versioned, access blocked
val appData = S3.createBucket("my-app-data")

// Flow logs required for VPC (security requirement)
val logBucket = S3.createBucket("vpc-logs")
val vpc = Network.createVpc("main", cidr: "10.0.0.0/16", flowLogs: logBucket)

// ============================================
// Iteration with .map() and .filter()
// ============================================

val zones = ["us-east-1a", "us-east-1b", "us-east-1c"]

// Create a subnet in each zone
val subnets = zones.map(zone => 
    Network.createSubnet(vpc: vpc, zone: zone, cidr: "auto")
)

// Filter to specific zones
val primaryZones = zones.filter(z => z != "us-east-1c")

// ============================================
// Expressions
// ============================================

val count = 1 + 2 * 3
val isValid = count > 5 && count < 100
val negated = -count
val notValid = !isValid

// ============================================
// Taint Tracking
// ============================================

// Import legacy Terraform - automatically marked as Unverified<T>
import "legacy/storage.tf" as legacy

// Using tainted values requires unsafe with justification
val legacyBucket = unsafe("MIGRATE-2024: Verified encryption, see ticket #402") {
    legacy.oldBucket
}

// ============================================
// Security Groups
// ============================================

// Secure by default (deny all ingress)
val appSg = Network.createSecurityGroup(vpc: vpc, name: "app")

// Internal traffic allowed without unsafe
val dbSg = Network.createSecurityGroup(
    vpc: vpc,
    name: "db",
    ingressRules: [
        { port: 5432, sourceSecurityGroup: appSg, description: "PostgreSQL from app" }
    ]
)