feat: make the terraform module more user-friendly

.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+- The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+- Trolling, insulting/derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at [email protected]. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "actions-update"
+      - "bot"

.github/workflows/build.yml

@@ -38,9 +38,11 @@ jobs:
       -
         name: Set application version
         id: set_version
-        uses: kvendingoldo/semver-action@v1.10
+        uses: kvendingoldo/semver-action@v1.19
         with:
-          primary_branch: 'main'
+          primary_branch: main
+          enable_github_releases: false
+          github_token: "${{ secrets.GITHUB_TOKEN }}"
       -
         name: Build and push
         uses: docker/build-push-action@v3

.github/workflows/golangci-lint.yml

@@ -25,4 +25,4 @@ jobs:
         name: golangci-lint
         uses: golangci/golangci-lint-action@v3
         with:
-          version: v1.48
+          version: v1.48

.gitignore

@@ -19,4 +19,4 @@
 files/terraform/module/terraform.tfstate*
 files/terraform/module/.terraform.*
 files/terraform/module/.terraform
-files/terraform/misc
+files/terraform/misc

.pre-commit-config.yaml

@@ -0,0 +1,29 @@
+repos:
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.77.0
+    hooks:
+      - id: terraform_fmt
+      - id: terraform_validate
+      - id: terraform_docs
+        args:
+          - '--args=--lockfile=false'
+      - id: terraform_tflint
+        args:
+          - '--args=--only=terraform_deprecated_interpolation'
+          - '--args=--only=terraform_deprecated_index'
+          - '--args=--only=terraform_unused_declarations'
+          - '--args=--only=terraform_comment_syntax'
+          - '--args=--only=terraform_documented_outputs'
+          - '--args=--only=terraform_documented_variables'
+          - '--args=--only=terraform_typed_variables'
+          - '--args=--only=terraform_module_pinned_source'
+          - '--args=--only=terraform_naming_convention'
+          - '--args=--only=terraform_required_version'
+          - '--args=--only=terraform_required_providers'
+          - '--args=--only=terraform_standard_module_structure'
+          - '--args=--only=terraform_workspace_remote'
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.4.0
+    hooks:
+      - id: check-merge-conflict
+      - id: end-of-file-fixer

Makefile

@@ -20,4 +20,4 @@ lint: ## Run Go linter
 	golangci-lint run ./...
 
 test: ## Run Go tests
-	go test ./...
+	go test ./...

README.md

@@ -1,5 +1,8 @@
 # aws-letsencrypt-lambda
 
+[![Github release](https://img.shields.io/github/v/release/kvendingoldo/aws-letsencrypt-lambda?style=for-the-badge)](https://github.com/kvendingoldo/aws-letsencrypt-lambda/releases) [![Contributors](https://img.shields.io/github/contributors/kvendingoldo/aws-letsencrypt-lambda?style=for-the-badge)](https://github.com/kvendingoldo/aws-letsencrypt-lambda/graphs/contributors) ![maintenance status](https://img.shields.io/maintenance/yes/2024.svg?style=for-the-badge)
+[![support opentofu](https://img.shields.io/badge/supports-opentofu-green?style=for-the-badge)](https://opentofu.org/)
+
 ## Overview
 It's common for people to desire having valid TLS certificates without wanting to pay for them.
 This is where the [Let's Encrypt](https://letsencrypt.org) project can help. Although it offers an excellent service, issuing and renewing certifications is not made simple. It is particularly visible in cloudy environments.
@@ -11,4 +14,4 @@ You can review the following documents on the Lambda to learn more:
 * [How to use the Lambda inside of AWS](docs/how_to_use_aws.md)
 * [How to use the Lambda locally](docs/how_to_use_locally.md)
 * [How to use Terraform automation](docs/how_to_use_terraform.md)
-* [Labmda's environment variables](docs/environment_variables.md)
+* [Lambda's environment variables](docs/environment_variables.md)

docs/how_to_use_aws.md

@@ -29,4 +29,4 @@
    "reImportThreshold": 10,
    "issueType": "default"
 }
-```
+```

docs/how_to_use_locally.md

@@ -18,4 +18,3 @@ export ISSUE_TYPE="default"
 ```sh
 go run main.go
 ```
-

docs/how_to_use_terraform.md

@@ -49,4 +49,4 @@ variable "letsencrypt_lambda_events" {
     }
   ]
 }
-```
+```

docs/sd_cm.mdj

@@ -1531,4 +1531,4 @@
 			]
 		}
 	]
-}
+}

files/terraform/module/README.md

@@ -0,0 +1,79 @@
+# aws-letsencrypt-lambda Terraform module
+
+Terraform module which creates aws-letsencrypt-lambda resources.
+
+## Examples
+
+Examples codified under
+the [`examples`](https://github.com/kvendingoldo/aws-letsencrypt-lambda/tree/main/files/terraform/module/examples) are intended
+to give users references for how to use the module(s) as well as testing/validating changes to the source code of the
+module. If contributing to the project, please be sure to make any appropriate updates to the relevant examples to allow
+maintainers to test your changes and to keep the examples up to date for users. Thank you!
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_cloudwatch_event_rule.schedule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
+| [aws_cloudwatch_event_target.event_target](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
+| [aws_cloudwatch_log_group.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
+| [aws_ecr_pull_through_cache_rule.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_pull_through_cache_rule) | resource |
+| [aws_iam_policy.acm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
+| [aws_iam_policy.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
+| [aws_iam_policy.route53](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
+| [aws_iam_role.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy_attachment.acm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.route53](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_iam_role_policy_attachment.vpc_permissions](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
+| [aws_lambda_function.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
+| [aws_lambda_permission.allow_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_blank_name"></a> [blank\_name](#input\_blank\_name) | Blank name for AWS resources | `string` | n/a | yes |
+| <a name="input_create_iam_role"></a> [create\_iam\_role](#input\_create\_iam\_role) | Create IAM role with a defined name that permits Lambda to work with Route53 & ACM | `bool` | `false` | no |
+| <a name="input_cron_enabled"></a> [cron\_enabled](#input\_cron\_enabled) | If true, CRON schedule rules will be enabled | `bool` | `true` | no |
+| <a name="input_cron_schedule"></a> [cron\_schedule](#input\_cron\_schedule) | The schedule expression for how often the Lambda function runs | `string` | `"rate(24 hours)"` | no |
+| <a name="input_description"></a> [description](#input\_description) | Lambda description | `string` | `""` | no |
+| <a name="input_ecr_repository_prefix"></a> [ecr\_repository\_prefix](#input\_ecr\_repository\_prefix) | The repository name prefix to use when caching images from the source registry. | `string` | `"docker-hub/kvendingoldo"` | no |
+| <a name="input_ecr_upstream_registry_url"></a> [ecr\_upstream\_registry\_url](#input\_ecr\_upstream\_registry\_url) | The registry URL of the upstream public registry to use as the source. | `string` | `"registry-1.docker.io"` | no |
+| <a name="input_environ"></a> [environ](#input\_environ) | Environment variables passed to the Lambda function | `map(string)` | `{}` | no |
+| <a name="input_events"></a> [events](#input\_events) | List of events for Lambda function (each event contains info about one certificate) | `any` | `[]` | no |
+| <a name="input_iam_role_arn"></a> [iam\_role\_arn](#input\_iam\_role\_arn) | The ARN for the IAM role that permits Lambda to work with Route53 & ACM. Must be specified if monitoring\_interval is non-zero | `string` | `null` | no |
+| <a name="input_image"></a> [image](#input\_image) | DockerHub image containing the function's deployment package | `string` | `"kvendingoldo/aws-letsencrypt-lambda:rc-0.9.0"` | no |
+| <a name="input_memory_size"></a> [memory\_size](#input\_memory\_size) | The memory in Mb that the function can use | `string` | `128` | no |
+| <a name="input_retention"></a> [retention](#input\_retention) | Number of days to retain log events in the specified log group | `number` | `7` | no |
+| <a name="input_security_group_ids"></a> [security\_group\_ids](#input\_security\_group\_ids) | The VPC security groups assigned to the Lambda | `list(string)` | `[]` | no |
+| <a name="input_subnet_ids"></a> [subnet\_ids](#input\_subnet\_ids) | The VPC subnets in which the Lambda runs | `list(string)` | `[]` | no |
+| <a name="input_tags"></a> [tags](#input\_tags) | Any tags that should be present on AWS resources | `map(string)` | `{}` | no |
+| <a name="input_timeout"></a> [timeout](#input\_timeout) | The maximum time in seconds that the Lambda can run for | `string` | `900` | no |
+
+## Outputs
+
+No outputs.
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+
+## License
+See [LICENSE](https://github.com/kvendingoldo/aws-letsencrypt-lambda/blob/main/LICENSE).

files/terraform/module/data.tf

@@ -0,0 +1,2 @@
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}

files/terraform/module/ecr.tf

@@ -0,0 +1,4 @@
+resource "aws_ecr_pull_through_cache_rule" "lambda" {
+  ecr_repository_prefix = var.ecr_repository_prefix
+  upstream_registry_url = var.ecr_upstream_registry_url
+}

files/terraform/module/iam.tf

@@ -135,5 +135,3 @@ resource "aws_iam_role_policy_attachment" "route53" {
   role       = aws_iam_role.main[0].name
   policy_arn = aws_iam_policy.route53[0].arn
 }
-
-

files/terraform/module/locals.tf

@@ -1,3 +1,4 @@
 locals {
-  events = {for event in var.events : event["domainName"] => event if var.cron_enabled}
-}
+  events = { for event in var.events : event["domainName"] => event if var.cron_enabled }
+  image  = "${data.aws_caller_identity.current.account_id}.dkr.ecr.${data.aws_region.current.name}.amazonaws.com/${var.ecr_repository_prefix}/${var.image}"
+}

files/terraform/module/main.tf

@@ -7,7 +7,7 @@ resource "aws_lambda_function" "main" {
   tags          = var.tags
 
   role         = var.create_iam_role ? aws_iam_role.main[0].arn : var.iam_role_arn
-  image_uri    = var.image_uri
+  image_uri    = local.image
   package_type = "Image"
   timeout      = var.timeout
   memory_size  = var.memory_size

files/terraform/module/variables.tf

@@ -24,16 +24,16 @@ variable "security_group_ids" {
   description = "The VPC security groups assigned to the Lambda"
   default     = []
 }
-
+variable "image" {
+  type        = string
+  description = "DockerHub image containing the function's deployment package"
+  default     = "kvendingoldo/aws-letsencrypt-lambda:rc-0.9.0"
+}
 variable "description" {
   type        = string
   description = "Lambda description"
   default     = ""
 }
-variable "image_uri" {
-  type        = string
-  description = "ECR image URI containing the function's deployment package"
-}
 variable "timeout" {
   type        = string
   description = "The maximum time in seconds that the Lambda can run for"
@@ -50,6 +50,20 @@ variable "environ" {
   default     = {}
 }
 
+#
+# ECR proxy
+#
+variable "ecr_repository_prefix" {
+  description = "The repository name prefix to use when caching images from the source registry."
+  type        = string
+  default     = "docker-hub/kvendingoldo"
+}
+variable "ecr_upstream_registry_url" {
+  description = "The registry URL of the upstream public registry to use as the source."
+  type        = string
+  default     = "registry-1.docker.io"
+}
+
 #
 # IAM configuration
 #
@@ -77,8 +91,9 @@ variable "events" {
 # Cron variables
 #
 variable "cron_enabled" {
-  type    = bool
-  default = true
+  type        = bool
+  description = "If true, CRON schedule rules will be enabled"
+  default     = true
 }
 variable "cron_schedule" {
   type        = string