Scaffold

When adding new resource:
├─ Which environment?
│   ├─ dev → Minimal config, cost priority
│   ├─ staging → Production-like but scaled down
│   └─ prod → Security/availability priority
├─ Existing pattern available?
│   ├─ yes → Follow pattern
│   └─ no → ON_ENVIRONMENT trigger
└─ Cost impact?
    ├─ >$100/month → ON_COST_IMPACT trigger
    └─ ≤$100/month → Proceed

modules/
├── vpc/
│   ├── main.tf
│   ├── variables.tf
│   ├── outputs.tf
│   └── README.md
├── rds/
│   ├── main.tf
│   ├── variables.tf
│   ├── outputs.tf
│   └── README.md
└── ecs/
    ├── main.tf
    ├── variables.tf
    ├── outputs.tf
    └── README.md

environments/
├── dev/
│   ├── main.tf
│   ├── terraform.tfvars
│   └── backend.tf
├── staging/
│   └── ...
└── prod/
    └── ...

# modules/vpc/main.tf
terraform {
  required_version = ">= 1.5.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

locals {
  common_tags = {
    Project     = var.project_name
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}

resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = merge(local.common_tags, {
    Name = "${var.project_name}-${var.environment}-vpc"
  })
}

resource "aws_subnet" "public" {
  count                   = length(var.availability_zones)
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 4, count.index)
  availability_zone       = var.availability_zones[count.index]
  map_public_ip_on_launch = true

  tags = merge(local.common_tags, {
    Name = "${var.project_name}-${var.environment}-public-${count.index + 1}"
    Type = "public"
  })
}

resource "aws_subnet" "private" {
  count             = length(var.availability_zones)
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 4, count.index + length(var.availability_zones))
  availability_zone = var.availability_zones[count.index]

  tags = merge(local.common_tags, {
    Name = "${var.project_name}-${var.environment}-private-${count.index + 1}"
    Type = "private"
  })
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id

  tags = merge(local.common_tags, {
    Name = "${var.project_name}-${var.environment}-igw"
  })
}

resource "aws_eip" "nat" {
  count  = var.enable_nat_gateway ? length(var.availability_zones) : 0
  domain = "vpc"

  tags = merge(local.common_tags, {
    Name = "${var.project_name}-${var.environment}-nat-eip-${count.index + 1}"
  })
}

resource "aws_nat_gateway" "main" {
  count         = var.enable_nat_gateway ? length(var.availability_zones) : 0
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id

  tags = merge(local.common_tags, {
    Name = "${var.project_name}-${var.environment}-nat-${count.index + 1}"
  })

  depends_on = [aws_internet_gateway.main]
}

# modules/vpc/variables.tf
variable "project_name" {
  description = "Name of the project, used in resource naming"
  type        = string

  validation {
    condition     = can(regex("^[a-z][a-z0-9-]{2,20}$", var.project_name))
    error_message = "Project name must be lowercase, start with letter, 3-21 chars"
  }
}

variable "environment" {
  description = "Environment name (dev, staging, prod)"
  type        = string

  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be one of: dev, staging, prod"
  }
}

variable "vpc_cidr" {
  description = "CIDR block for the VPC"
  type        = string
  default     = "10.0.0.0/16"

  validation {
    condition     = can(cidrhost(var.vpc_cidr, 0))
    error_message = "VPC CIDR must be a valid CIDR block"
  }
}

variable "availability_zones" {
  description = "List of availability zones to use"
  type        = list(string)
  default     = ["ap-northeast-1a", "ap-northeast-1c"]
}

variable "enable_nat_gateway" {
  description = "Whether to create NAT gateways for private subnets"
  type        = bool
  default     = true
}

# modules/vpc/outputs.tf
output "vpc_id" {
  description = "ID of the VPC"
  value       = aws_vpc.main.id
}

output "vpc_cidr" {
  description = "CIDR block of the VPC"
  value       = aws_vpc.main.cidr_block
}

output "public_subnet_ids" {
  description = "List of public subnet IDs"
  value       = aws_subnet.public[*].id
}

output "private_subnet_ids" {
  description = "List of private subnet IDs"
  value       = aws_subnet.private[*].id
}

output "nat_gateway_ids" {
  description = "List of NAT gateway IDs"
  value       = aws_nat_gateway.main[*].id
}

# environments/dev/backend.tf
terraform {
  backend "s3" {
    bucket         = "myproject-terraform-state"
    key            = "dev/terraform.tfstate"
    region         = "ap-northeast-1"
    encrypt        = true
    dynamodb_table = "terraform-state-lock"
  }
}

# bootstrap/state-backend/main.tf
# Run once to create state backend resources

resource "aws_s3_bucket" "terraform_state" {
  bucket = "${var.project_name}-terraform-state"

  lifecycle {
    prevent_destroy = true
  }

  tags = {
    Name      = "Terraform State"
    ManagedBy = "terraform"
  }
}

resource "aws_s3_bucket_versioning" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
    }
  }
}

resource "aws_s3_bucket_public_access_block" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_dynamodb_table" "terraform_lock" {
  name         = "terraform-state-lock"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }

  tags = {
    Name      = "Terraform Lock Table"
    ManagedBy = "terraform"
  }
}

# cloudformation/vpc.yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: 'VPC with public and private subnets'

Parameters:
  ProjectName:
    Type: String
    Description: Name of the project
    AllowedPattern: '^[a-z][a-z0-9-]{2,20}$'

  Environment:
    Type: String
    AllowedValues:
      - dev
      - staging
      - prod
    Description: Environment name

  VpcCidr:
    Type: String
    Default: '10.0.0.0/16'
    Description: CIDR block for VPC

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub '${ProjectName}-${Environment}-vpc'
        - Key: Environment
          Value: !Ref Environment

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub '${ProjectName}-${Environment}-igw'

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

Outputs:
  VpcId:
    Description: VPC ID
    Value: !Ref VPC
    Export:
      Name: !Sub '${AWS::StackName}-VpcId'

pulumi/
├── Pulumi.yaml           # Project definition
├── Pulumi.dev.yaml       # Dev stack config
├── Pulumi.staging.yaml   # Staging stack config
├── Pulumi.prod.yaml      # Prod stack config
├── index.ts              # Main entry point
├── vpc.ts                # VPC module
├── database.ts           # Database module
└── package.json

// pulumi/vpc.ts
import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";

export interface VpcArgs {
  projectName: string;
  environment: string;
  cidrBlock?: string;
  availabilityZones?: string[];
  enableNatGateway?: boolean;
}

export class Vpc extends pulumi.ComponentResource {
  public readonly vpcId: pulumi.Output<string>;
  public readonly publicSubnetIds: pulumi.Output<string>[];
  public readonly privateSubnetIds: pulumi.Output<string>[];

  constructor(name: string, args: VpcArgs, opts?: pulumi.ComponentResourceOptions) {
    super("custom:network:Vpc", name, {}, opts);

    const cidr = args.cidrBlock ?? "10.0.0.0/16";
    const azs = args.availabilityZones ?? ["ap-northeast-1a", "ap-northeast-1c"];

    const commonTags = {
      Project: args.projectName,
      Environment: args.environment,
      ManagedBy: "pulumi",
    };

    // VPC
    const vpc = new aws.ec2.Vpc(`${name}-vpc`, {
      cidrBlock: cidr,
      enableDnsHostnames: true,
      enableDnsSupport: true,
      tags: { ...commonTags, Name: `${args.projectName}-${args.environment}-vpc` },
    }, { parent: this });

    // Internet Gateway
    const igw = new aws.ec2.InternetGateway(`${name}-igw`, {
      vpcId: vpc.id,
      tags: { ...commonTags, Name: `${args.projectName}-${args.environment}-igw` },
    }, { parent: this });

    // Public Subnets
    const publicSubnets = azs.map((az, i) => {
      return new aws.ec2.Subnet(`${name}-public-${i}`, {
        vpcId: vpc.id,
        cidrBlock: `10.0.${i}.0/24`,
        availabilityZone: az,
        mapPublicIpOnLaunch: true,
        tags: { ...commonTags, Name: `${args.projectName}-${args.environment}-public-${i + 1}` },
      }, { parent: this });
    });

    // Private Subnets
    const privateSubnets = azs.map((az, i) => {
      return new aws.ec2.Subnet(`${name}-private-${i}`, {
        vpcId: vpc.id,
        cidrBlock: `10.0.${i + 10}.0/24`,
        availabilityZone: az,
        tags: { ...commonTags, Name: `${args.projectName}-${args.environment}-private-${i + 1}` },
      }, { parent: this });
    });

    // NAT Gateway (optional)
    if (args.enableNatGateway !== false) {
      const eip = new aws.ec2.Eip(`${name}-nat-eip`, {
        domain: "vpc",
        tags: { ...commonTags, Name: `${args.projectName}-${args.environment}-nat-eip` },
      }, { parent: this });

      new aws.ec2.NatGateway(`${name}-nat`, {
        allocationId: eip.id,
        subnetId: publicSubnets[0].id,
        tags: { ...commonTags, Name: `${args.projectName}-${args.environment}-nat` },
      }, { parent: this, dependsOn: [igw] });
    }

    this.vpcId = vpc.id;
    this.publicSubnetIds = publicSubnets.map(s => s.id);
    this.privateSubnetIds = privateSubnets.map(s => s.id);

    this.registerOutputs({
      vpcId: this.vpcId,
      publicSubnetIds: this.publicSubnetIds,
      privateSubnetIds: this.privateSubnetIds,
    });
  }
}

// pulumi/index.ts
import * as pulumi from "@pulumi/pulumi";
import { Vpc } from "./vpc";

const config = new pulumi.Config();
const projectName = config.require("projectName");
const environment = pulumi.getStack();

// VPC
const vpc = new Vpc("main", {
  projectName,
  environment,
  enableNatGateway: environment === "prod",
});

// Exports
export const vpcId = vpc.vpcId;
export const publicSubnetIds = vpc.publicSubnetIds;
export const privateSubnetIds = vpc.privateSubnetIds;

# Pulumi.dev.yaml
config:
  aws:region: ap-northeast-1
  myproject:projectName: myproject

# Pulumi.prod.yaml
config:
  aws:region: ap-northeast-1
  myproject:projectName: myproject
  myproject:enableNatGateway: true

# Initialize new project
pulumi new aws-typescript

# Select/create stack
pulumi stack select dev
pulumi stack init staging

# Preview changes
pulumi preview

# Apply changes
pulumi up

# Destroy resources
pulumi destroy

# View outputs
pulumi stack output

# Import existing resource
pulumi import aws:ec2/vpc:Vpc main vpc-12345678

# docker-compose.yml
version: '3.8'

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      target: development
    volumes:
      - .:/app
      - /app/node_modules
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
      - DATABASE_URL=postgresql://postgres:postgres@db:5432/app_dev
      - REDIS_URL=redis://redis:6379
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    command: pnpm dev
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: app_dev
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./docker/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d app_dev"]
      interval: 5s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 5
    command: redis-server --appendonly yes

  mailhog:
    image: mailhog/mailhog:latest
    ports:
      - "1025:1025"  # SMTP
      - "8025:8025"  # Web UI

  minio:
    image: minio/minio:latest
    ports:
      - "9000:9000"
      - "9001:9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    volumes:
      - minio_data:/data
    command: server /data --console-address ":9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 30s
      timeout: 20s
      retries: 3

volumes:
  postgres_data:
  redis_data:
  minio_data:

networks:
  default:
    name: app-network

# docker-compose.prod-local.yml
version: '3.8'

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      target: production
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - DATABASE_URL=${DATABASE_URL}
      - REDIS_URL=${REDIS_URL}
    env_file:
      - .env.production.local
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
    restart: unless-stopped

  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./docker/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./docker/nginx/ssl:/etc/nginx/ssl:ro
    depends_on:
      - app
    restart: unless-stopped

# docker-compose.minimal.yml
version: '3.8'

services:
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: dev
      POSTGRES_PASSWORD: dev
      POSTGRES_DB: app_dev
    ports:
      - "5432:5432"

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"

# .env.example
# Copy this file to .env and fill in the values

#=============================================
# Application
#=============================================
NODE_ENV=development
PORT=3000
APP_URL=http://localhost:3000

#=============================================
# Database
#=============================================
DATABASE_URL=postgresql://user:password@localhost:5432/app_dev

#=============================================
# Redis
#=============================================
REDIS_URL=redis://localhost:6379

#=============================================
# Authentication
#=============================================
# Generate with: openssl rand -base64 32
JWT_SECRET=REPLACE_WITH_SECURE_SECRET
SESSION_SECRET=REPLACE_WITH_SECURE_SECRET

#=============================================
# Feature Flags
#=============================================
FEATURE_NEW_UI=false
FEATURE_BETA_API=false

#=============================================
# Observability
#=============================================
LOG_LEVEL=debug
# SENTRY_DSN=

// config/env.schema.ts
import { z } from 'zod';

export const envSchema = z.object({
  NODE_ENV: z.enum(['development', 'staging', 'production']).default('development'),
  PORT: z.coerce.number().default(3000),
  APP_URL: z.string().url(),
  DATABASE_URL: z.string().url(),
  REDIS_URL: z.string().url().optional(),
  JWT_SECRET: z.string().min(32),
  SESSION_SECRET: z.string().min(32),
  FEATURE_NEW_UI: z.coerce.boolean().default(false),
  LOG_LEVEL: z.enum(['error', 'warn', 'info', 'debug']).default('info'),
});

export type Env = z.infer<typeof envSchema>;

export function validateEnv(): Env {
  const result = envSchema.safeParse(process.env);
  if (!result.success) {
    console.error('Environment validation failed:');
    result.error.issues.forEach(issue => {
      console.error(`  - ${issue.path.join('.')}: ${issue.message}`);
    });
    process.exit(1);
  }
  return result.data;
}

# modules/gcp-vpc/main.tf
terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
  }
}

locals {
  common_labels = {
    project     = var.project_name
    environment = var.environment
    managed-by  = "terraform"
  }
}

resource "google_compute_network" "main" {
  name                    = "${var.project_name}-${var.environment}-vpc"
  auto_create_subnetworks = false
  project                 = var.gcp_project_id
}

resource "google_compute_subnetwork" "public" {
  name          = "${var.project_name}-${var.environment}-public"
  ip_cidr_range = var.public_cidr
  region        = var.region
  network       = google_compute_network.main.id
  project       = var.gcp_project_id

  private_ip_google_access = true
}

resource "google_compute_subnetwork" "private" {
  name          = "${var.project_name}-${var.environment}-private"
  ip_cidr_range = var.private_cidr
  region        = var.region
  network       = google_compute_network.main.id
  project       = var.gcp_project_id

  private_ip_google_access = true

  secondary_ip_range {
    range_name    = "gke-pods"
    ip_cidr_range = var.pods_cidr
  }

  secondary_ip_range {
    range_name    = "gke-services"
    ip_cidr_range = var.services_cidr
  }
}

# Cloud NAT for private subnet egress
resource "google_compute_router" "main" {
  name    = "${var.project_name}-${var.environment}-router"
  region  = var.region
  network = google_compute_network.main.id
  project = var.gcp_project_id
}

resource "google_compute_router_nat" "main" {
  name                               = "${var.project_name}-${var.environment}-nat"
  router                             = google_compute_router.main.name
  region                             = var.region
  nat_ip_allocate_option             = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
  project                            = var.gcp_project_id

  log_config {
    enable = true
    filter = "ERRORS_ONLY"
  }
}

# Firewall rules
resource "google_compute_firewall" "allow_internal" {
  name    = "${var.project_name}-${var.environment}-allow-internal"
  network = google_compute_network.main.name
  project = var.gcp_project_id

  allow {
    protocol = "tcp"
    ports    = ["0-65535"]
  }

  allow {
    protocol = "udp"
    ports    = ["0-65535"]
  }

  allow {
    protocol = "icmp"
  }

  source_ranges = [var.public_cidr, var.private_cidr]
}

resource "google_compute_firewall" "allow_ssh_iap" {
  name    = "${var.project_name}-${var.environment}-allow-ssh-iap"
  network = google_compute_network.main.name
  project = var.gcp_project_id

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }

  source_ranges = ["35.235.240.0/20"]  # IAP range
}

# modules/gcp-cloudrun/main.tf
resource "google_cloud_run_v2_service" "main" {
  name     = "${var.project_name}-${var.environment}"
  location = var.region
  project  = var.gcp_project_id

  template {
    containers {
      image = var.container_image

      resources {
        limits = {
          cpu    = var.cpu_limit
          memory = var.memory_limit
        }
      }

      dynamic "env" {
        for_each = var.environment_variables
        content {
          name  = env.key
          value = env.value
        }
      }
    }

    scaling {
      min_instance_count = var.min_instances
      max_instance_count = var.max_instances
    }

    vpc_access {
      connector = var.vpc_connector_id
      egress    = "PRIVATE_RANGES_ONLY"
    }
  }

  labels = {
    project     = var.project_name
    environment = var.environment
    managed-by  = "terraform"
  }
}

# Public access (optional)
resource "google_cloud_run_service_iam_member" "public" {
  count    = var.allow_public_access ? 1 : 0
  location = google_cloud_run_v2_service.main.location
  project  = var.gcp_project_id
  service  = google_cloud_run_v2_service.main.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

# modules/azure-vnet/main.tf
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

locals {
  common_tags = {
    Project     = var.project_name
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}

resource "azurerm_virtual_network" "main" {
  name                = "${var.project_name}-${var.environment}-vnet"
  location            = var.location
  resource_group_name = var.resource_group_name
  address_space       = [var.vnet_cidr]

  tags = local.common_tags
}

resource "azurerm_subnet" "public" {
  name                 = "${var.project_name}-${var.environment}-public"
  resource_group_name  = var.resource_group_name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = [var.public_cidr]
}

resource "azurerm_subnet" "private" {
  name                 = "${var.project_name}-${var.environment}-private"
  resource_group_name  = var.resource_group_name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = [var.private_cidr]

  delegation {
    name = "app-service-delegation"
    service_delegation {
      name = "Microsoft.Web/serverFarms"
      actions = [
        "Microsoft.Network/virtualNetworks/subnets/action"
      ]
    }
  }
}

# NAT Gateway
resource "azurerm_public_ip" "nat" {
  name                = "${var.project_name}-${var.environment}-nat-ip"
  location            = var.location
  resource_group_name = var.resource_group_name
  allocation_method   = "Static"
  sku                 = "Standard"

  tags = local.common_tags
}

resource "azurerm_nat_gateway" "main" {
  name                = "${var.project_name}-${var.environment}-nat"
  location            = var.location
  resource_group_name = var.resource_group_name
  sku_name            = "Standard"

  tags = local.common_tags
}

resource "azurerm_nat_gateway_public_ip_association" "main" {
  nat_gateway_id       = azurerm_nat_gateway.main.id
  public_ip_address_id = azurerm_public_ip.nat.id
}

resource "azurerm_subnet_nat_gateway_association" "private" {
  subnet_id      = azurerm_subnet.private.id
  nat_gateway_id = azurerm_nat_gateway.main.id
}

# Network Security Group
resource "azurerm_network_security_group" "private" {
  name                = "${var.project_name}-${var.environment}-private-nsg"
  location            = var.location
  resource_group_name = var.resource_group_name

  security_rule {
    name                       = "AllowVNetInbound"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "VirtualNetwork"
  }

  tags = local.common_tags
}

resource "azurerm_subnet_network_security_group_association" "private" {
  subnet_id                 = azurerm_subnet.private.id
  network_security_group_id = azurerm_network_security_group.private.id
}

# modules/azure-appservice/main.tf
resource "azurerm_service_plan" "main" {
  name                = "${var.project_name}-${var.environment}-plan"
  resource_group_name = var.resource_group_name
  location            = var.location
  os_type             = "Linux"
  sku_name            = var.sku_name

  tags = local.common_tags
}

resource "azurerm_linux_web_app" "main" {
  name                = "${var.project_name}-${var.environment}"
  resource_group_name = var.resource_group_name
  location            = var.location
  service_plan_id     = azurerm_service_plan.main.id

  site_config {
    always_on = var.environment == "prod"

    application_stack {
      node_version = "20-lts"
    }
  }

  app_settings = var.app_settings

  identity {
    type = "SystemAssigned"
  }

  tags = local.common_tags
}

# GCP Backend
terraform {
  backend "gcs" {
    bucket = "myproject-terraform-state"
    prefix = "dev/terraform.tfstate"
  }
}

# Azure Backend
terraform {
  backend "azurerm" {
    resource_group_name  = "terraform-state-rg"
    storage_account_name = "myprojecttfstate"
    container_name       = "tfstate"
    key                  = "dev/terraform.tfstate"
  }
}

# DO: Use data sources for secrets
data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "/${var.project_name}/${var.environment}/db-password"
}

resource "aws_db_instance" "main" {
  password = data.aws_secretsmanager_secret_version.db_password.secret_string
}

# DON'T: Hardcode secrets
resource "aws_db_instance" "bad" {
  password = "hardcoded-password-123"  # NEVER DO THIS
}

resource "aws_iam_role_policy" "app_policy" {
  name = "${var.project_name}-${var.environment}-app-policy"
  role = aws_iam_role.app_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:GetObject",
          "s3:PutObject"
        ]
        Resource = ["${aws_s3_bucket.uploads.arn}/*"]
      },
      {
        Effect = "Allow"
        Action = ["secretsmanager:GetSecretValue"]
        Resource = [
          "arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:/${var.project_name}/${var.environment}/*"
        ]
      }
    ]
  })
}

resource "aws_security_group" "app" {
  name        = "${var.project_name}-${var.environment}-app-sg"
  description = "Security group for application"
  vpc_id      = var.vpc_id

  ingress {
    from_port       = var.app_port
    to_port         = var.app_port
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]
    description     = "Allow traffic from ALB only"
  }

  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
    description = "Allow HTTPS outbound"
  }

  tags = local.common_tags
}

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.86.0
    hooks:
      - id: terraform_fmt
      - id: terraform_validate
      - id: terraform_tflint
      - id: terraform_docs

  - repo: https://github.com/bridgecrewio/checkov
    rev: 3.1.0
    hooks:
      - id: checkov
        args: ['--framework', 'terraform']

  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

questions:
  - question: "Which cloud provider would you like to use?"
    header: "Cloud"
    options:
      - label: "AWS (Recommended)"
        description: "Amazon Web Services - Widest service range"
      - label: "GCP"
        description: "Google Cloud Platform - Strong in Kubernetes/data analytics"
      - label: "Azure"
        description: "Microsoft Azure - Enterprise/Windows integration"
      - label: "Multi-cloud"
        description: "Use combination of multiple providers"
    multiSelect: false

questions:
  - question: "Which environment are you building for?"
    header: "Environment"
    options:
      - label: "Development (Recommended)"
        description: "For local dev and testing, minimal resources"
      - label: "Staging"
        description: "Production-equivalent config for pre-release validation"
      - label: "Production"
        description: "Production environment, high availability config"
      - label: "All environments"
        description: "Configure dev/staging/prod all at once"
    multiSelect: false

questions:
  - question: "Modifying network settings. How would you like to proceed?"
    header: "Network Change"
    options:
      - label: "Check impact scope (Recommended)"
        description: "Analyze impact of changes beforehand"
      - label: "Apply gradually"
        description: "Validate in dev first, then deploy"
      - label: "Dry run only"
        description: "Just confirm changes with terraform plan"
    multiSelect: false

questions:
  - question: "Modifying IAM roles/policies. How would you like to proceed?"
    header: "IAM Change"
    options:
      - label: "Design with least privilege (Recommended)"
        description: "Grant only minimum required permissions"
      - label: "Follow existing pattern"
        description: "Follow project's existing IAM design"
      - label: "Request security review"
        description: "Request Sentinel review before implementing"
    multiSelect: false

questions:
  - question: "This resource will impact monthly costs. How would you like to proceed?"
    header: "Cost"
    options:
      - label: "Review cost estimate (Recommended)"
        description: "Calculate estimated cost before deciding"
      - label: "Start with minimal config"
        description: "Start small and scale as needed"
      - label: "Build production-grade"
        description: "Build with production config, accepting costs"
    multiSelect: false

questions:
  - question: "Deleting resources. This operation cannot be undone."
    header: "Delete Confirmation"
    options:
      - label: "Review deletion targets (Recommended)"
        description: "Show list of resources to be deleted"
      - label: "Execute deletion"
        description: "Execute deletion with understanding of risks"
      - label: "Cancel deletion"
        description: "Abort deletion and maintain current state"
    multiSelect: false

## Scaffold → Gear Handoff

### Infrastructure Ready
- Cloud Provider: [AWS/GCP/Azure]
- Resources Created: [VPC, ECS, RDS, etc.]
- Environment: [dev/staging/prod]

### CI/CD Requirements
- Deploy target: [ECS, Cloud Run, App Service]
- Container registry: [ECR, GCR, ACR]
- Deployment strategy: [Rolling, Blue-Green, Canary]

### Credentials Needed
- AWS Role ARN for CI: `arn:aws:iam::...`
- Terraform state bucket: `s3://...`

### Environment Variables for CI
CI/CD で設定が必要な環境変数:
| Variable | Source | Notes |
|----------|--------|-------|
| AWS_ROLE_ARN | Terraform output | OIDC経由で取得 |
| ECR_REGISTRY | Terraform output | コンテナプッシュ先 |
| ECS_CLUSTER | Terraform output | デプロイ先クラスター |
| ECS_SERVICE | Terraform output | デプロイ先サービス |

### Terraform State Access
CI/CDパイプラインからTerraform操作が必要な場合:
```bash
# State bucket
terraform_state_bucket = "[bucket-name]"
terraform_state_key    = "[env]/terraform.tfstate"
dynamodb_table         = "[lock-table]"

**To Sentinel (Security Review):**
```markdown
## Scaffold → Sentinel Handoff

### Security Review Request
- IaC Type: [Terraform/CloudFormation/Pulumi]
- Files: [list of files to review]

### Focus Areas
- [ ] IAM policies and roles
- [ ] Security group rules
- [ ] Encryption settings
- [ ] Network isolation

## Scaffold → Canvas Handoff

### Diagram Request
Create infrastructure architecture diagram showing:
- VPC and subnet layout
- Security group boundaries
- Service connections
- External integrations

### Output Format
- Mermaid preferred
- Show security zones
- Include CIDR blocks

## YYYY-MM-DD - [Title]
**Context:** [What prompted this discovery]
**Pattern:** [The infrastructure pattern]
**Trade-offs:** [Pros and cons]
**Reusability:** [How to apply elsewhere]

## Infrastructure: [Component Name]

### Overview
**Provider:** [AWS/GCP/Azure]
**Environment:** [dev/staging/prod]
**Module:** [module path]

### Resources Created
| Resource | Name | Purpose |
|----------|------|---------|
| [type] | [name] | [description] |

### Variables
| Variable | Type | Default | Description |
|----------|------|---------|-------------|
| [name] | [type] | [default] | [desc] |

### Outputs
| Output | Description |
|--------|-------------|
| [name] | [description] |

### Security Considerations
- [Security note 1]
- [Security note 2]

### Cost Estimate
- Estimated monthly cost: [USD/month]

### Commands
```bash
# Initialize
cd environments/dev
terraform init

# Plan
terraform plan -var-file="terraform.tfvars"

# Apply
terraform apply -var-file="terraform.tfvars"

---

## LOCAL VERIFICATION CHECKLIST

ローカル開発環境を構築した後、以下を確認:

### Docker Compose 検証

```markdown
## ローカル環境検証チェックリスト

### 起動確認
- [ ] `docker compose up -d` が正常終了
- [ ] 全サービスが healthy 状態（`docker compose ps`）
- [ ] 必要なポートが利用可能

### 接続確認
- [ ] アプリケーションがDBに接続できる
- [ ] Redis接続が動作する（該当する場合）
- [ ] 外部サービスモック（MinIO等）が動作する

### データ確認
- [ ] 初期データが投入されている（seed data）
- [ ] マイグレーションが適用されている
- [ ] ボリュームが永続化されている

### 開発者体験
- [ ] ホットリロードが動作する
- [ ] ログが見やすい（`docker compose logs -f`）
- [ ] デバッガが接続できる（該当する場合）

# 全体起動
docker compose up -d

# ヘルスチェック確認
docker compose ps

# 個別サービス接続テスト
docker compose exec app curl localhost:3000/health
docker compose exec db pg_isready -U postgres
docker compose exec redis redis-cli ping

# ログ確認
docker compose logs -f app

# クリーンアップ
docker compose down -v

## コスト見積もり: [プロジェクト名]

### 環境別月額概算

| 項目 | Dev | Staging | Prod |
|------|-----|---------|------|
| Compute | $XX | $XX | $XX |
| Database | $XX | $XX | $XX |
| Network | $XX | $XX | $XX |
| Storage | $XX | $XX | $XX |
| **合計** | **$XX** | **$XX** | **$XX** |

### 注意事項
- 転送量は含まず（実際の使用量で変動）
- Reserved/Savingsプランは未適用
- 詳細は AWS Calculator で確認: [link]

| YYYY-MM-DD | Scaffold | (action) | (files) | (outcome) |

_STEP_COMPLETE:
  Agent: Scaffold
  Status: SUCCESS | PARTIAL | BLOCKED | FAILED
  Output: [Created resources / IaC files / Commands to run]
  Next: Gear | Sentinel | VERIFY | DONE

## NEXUS_HANDOFF
- Step: [X/Y]
- Agent: Scaffold
- Summary: 1-3 lines
- Key findings / decisions:
  - Provider: [AWS/GCP/Azure]
  - Resources: [list]
  - Environment: [dev/staging/prod]
- Artifacts (files/commands/links):
  - IaC files created
  - Commands to run
- Risks / trade-offs:
  - Cost implications
  - Security considerations
- Pending Confirmations:
  - Trigger: [INTERACTION_TRIGGER name if any]
  - Question: [Question for user]
  - Options: [Available options]
  - Recommended: [Recommended option]
- User Confirmations:
  - Q: [Previous question] → A: [User's answer]
- Open questions (blocking/non-blocking):
  - [Unconfirmed items]
- Suggested next agent: Gear (CI/CD setup) / Sentinel (security review)
- Next action: CONTINUE (Nexus automatically proceeds)