Arquitetura de Infraestrutura

FROM python:3.12-slim
WORKDIR /app

# Dependências primeiro — layer cacheada independente do código
COPY requirements.txt .
RUN pip install -r requirements.txt --no-cache-dir

COPY . .

# Sem CMD: o command[] do ECS task definition define o entrypoint.
# booking-agent task definition: command = ["python", "app.py"]
# recovery-worker task definition: command = ["python", "recovery_worker.py"]
# Mesma imagem, comportamento diferente — sem manter dois Dockerfiles.

HEALTHCHECK --interval=10s --timeout=3s --retries=3 \
  CMD python -c "import httpx; httpx.get('http://localhost:8000/health')" || exit 1

resource "aws_ecs_task_definition" "agent" {
  family                   = "booking-agent"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = "1024"  # 1 vCPU — ajuste conforme carga
  memory                   = "2048"
  task_role_arn            = aws_iam_role.agent_task_role.arn
  execution_role_arn       = aws_iam_role.ecs_execution_role.arn

  container_definitions = jsonencode([
    {
      name      = "agent"
      image     = "${aws_ecr_repository.app.repository_url}:${var.image_tag}"
      command   = ["python", "app.py"]
      essential = true
      stopTimeout = 120  # segundos entre SIGTERM e SIGKILL

      portMappings = [{ containerPort = 8000, protocol = "tcp" }]

      environment = [
        { name = "REDIS_URL",         value = "redis://${local.redis_host}:6379" },
        { name = "SERVICE_NAME",      value = "booking-agent" },
        { name = "OTLP_ENDPOINT",     value = "http://localhost:4317" },
        { name = "ENVIRONMENT",       value = var.environment },
        { name = "TRACE_SAMPLE_RATE", value = "0.1" },
      ]

      # Secrets via Secrets Manager — nunca plaintext em environment.
      # O ECS injecta o valor como variável de ambiente no momento do start.
      secrets = [
        { name = "CLIENT_SECRET",   valueFrom = aws_secretsmanager_secret.client_secret.arn },
        { name = "AUTH_SERVICE_URL", valueFrom = aws_secretsmanager_secret.auth_url.arn },
      ]

      logConfiguration = {
        logDriver = "awslogs"
        options   = {
          "awslogs-group"         = "/ecs/booking-agent"
          "awslogs-region"        = var.aws_region
          "awslogs-stream-prefix" = "ecs"
        }
      }

      healthCheck = {
        command     = ["CMD-SHELL", "curl -f http://localhost:8000/health || exit 1"]
        interval    = 10; timeout = 5; retries = 3; startPeriod = 30
      }
    },

    {
      name      = "xray-daemon"
      image     = "amazon/aws-xray-daemon:latest"
      essential = false  # falha do sidecar não derruba o agente
      cpu       = 32     # sidecar leve — apenas forwarda spans
      memory    = 256

      portMappings = [
        { containerPort = 4317, protocol = "tcp" },  # OTLP gRPC
        { containerPort = 2000, protocol = "udp" },  # X-Ray nativo
      ]

      logConfiguration = {
        logDriver = "awslogs"
        options   = {
          "awslogs-group"         = "/ecs/booking-agent-xray"
          "awslogs-region"        = var.aws_region
          "awslogs-stream-prefix" = "xray"
        }
      }
    }
  ])
}

resource "aws_ecs_task_definition" "recovery_worker" {
  family = "recovery-worker"
  cpu    = "256"   # leve — Redis I/O e invocações ocasionais
  memory = "512"

  container_definitions = jsonencode([
    {
      name    = "recovery-worker"
      image   = "${aws_ecr_repository.app.repository_url}:${var.image_tag}"
      command = ["python", "recovery_worker.py"]  # mesma imagem, entrypoint diferente

      environment = [
        { name = "REDIS_URL",               value = "redis://${local.redis_host}:6379" },
        { name = "RECOVERY_MAX_ATTEMPTS",   value = "3" },
        { name = "RECOVERY_QUEUE_MAX_SIZE", value = "100" },
        { name = "SERVICE_NAME",            value = "recovery-worker" },
        { name = "OTLP_ENDPOINT",           value = "http://localhost:4317" },
      ]
      # Sem portMappings — não é um servidor HTTP
      # Sem healthCheck de porta — ECS usa o exit code do processo
    },
    {
      name = "xray-daemon"; image = "amazon/aws-xray-daemon:latest"
      essential = false; cpu = 32; memory = 128
      portMappings = [
        { containerPort = 4317, protocol = "tcp" },
        { containerPort = 2000, protocol = "udp" },
      ]
    }
  ])
}

resource "aws_elasticache_replication_group" "main" {
  replication_group_id = "agent-redis"
  description          = "Redis compartilhado: checkpoints, lifecycle, locks"

  # r7g.large: memory-optimized — checkpoints LangGraph podem ser grandes
  # 2 nodes: primary + 1 replica para HA sem perda de dados em failover
  node_type          = "cache.r7g.large"
  num_cache_clusters = 2
  automatic_failover_enabled = true
  engine         = "redis"
  engine_version = "7.1"

  # Checkpoints podem conter dados sensíveis do usuário
  at_rest_encryption_enabled = true
  transit_encryption_enabled = true

  subnet_group_name  = aws_elasticache_subnet_group.main.name
  security_group_ids = [aws_security_group.redis.id]

  # Snapshot: checkpoints são os dados mais críticos do sistema.
  # Em falha catastrófica do Redis, o snapshot permite recuperar o estado.
  snapshot_retention_limit = 7
  snapshot_window          = "03:00-04:00"

  log_delivery_configuration {
    destination      = aws_cloudwatch_log_group.redis.name
    destination_type = "cloudwatch-logs"
    log_format       = "json"
    log_type         = "slow-log"  # útil para diagnosticar Lua scripts lentos
  }
}

# Redis: aceita apenas de ECS tasks autorizadas — não da VPC inteira
resource "aws_security_group" "redis" {
  ingress {
    from_port       = 6379; to_port = 6379; protocol = "tcp"
    security_groups = [
      aws_security_group.booking_agent.id,
      aws_security_group.search_agent.id,
      aws_security_group.recovery_worker.id,
      aws_security_group.auth_service.id,
    ]
  }
}

# booking-agent: aceita do ALB e de outros agentes via A2A
resource "aws_security_group" "booking_agent" {
  ingress {
    from_port       = 8000; to_port = 8000; protocol = "tcp"
    security_groups = [aws_security_group.alb.id]
    description     = "Requests do ALB externo"
  }
  egress {
    from_port   = 0; to_port = 0; protocol = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    description = "Saída: Redis, auth-service, search-agent, APIs externas"
  }
}

resource "aws_service_discovery_private_dns_namespace" "agents" {
  name = "agents.internal"; vpc = var.vpc_id
}

# search-agent → search-agent.agents.internal:8000
# TTL curto: quando uma task é substituída, DNS converge em 10s.
# TTL longo (60s+) causaria erros durante deploys — clientes tentariam
# conectar em IPs de tasks antigas já drenadas.
resource "aws_service_discovery_service" "search_agent" {
  name = "search-agent"
  dns_config {
    namespace_id   = aws_service_discovery_private_dns_namespace.agents.id
    routing_policy = "MULTIVALUE"  # retorna múltiplos IPs — client-side balancing
    dns_records { ttl = 10; type = "A" }
  }
  health_check_custom_config { failure_threshold = 1 }
}

# Agent Task Role — permissões para operar normalmente
resource "aws_iam_role_policy" "agent" {
  policy = jsonencode({
    Statement = [
      # X-Ray: envia traces via OTLP para o sidecar que repassa para a API
      { Effect = "Allow"; Action = ["xray:PutTraceSegments", "xray:PutTelemetryRecords"]; Resource = "*" },
      # Secrets Manager: apenas os dois secrets específicos deste agente
      { Effect = "Allow"; Action = ["secretsmanager:GetSecretValue"]
        Resource = [aws_secretsmanager_secret.client_secret.arn, aws_secretsmanager_secret.auth_url.arn] },
      # CloudWatch Logs: apenas para o log group deste serviço
      { Effect = "Allow"; Action = ["logs:CreateLogStream", "logs:PutLogEvents"]
        Resource = "arn:aws:logs:*:*:log-group:/ecs/booking-agent:*" },
    ]
  })
}

# Recovery Worker Task Role — subconjunto das permissões do agente
# Não tem Secrets Manager: não faz chamadas autenticadas para outros agentes
resource "aws_iam_role_policy" "recovery" {
  policy = jsonencode({
    Statement = [
      { Effect = "Allow"; Action = ["xray:PutTraceSegments", "xray:PutTelemetryRecords"]; Resource = "*" },
      { Effect = "Allow"; Action = ["logs:CreateLogStream", "logs:PutLogEvents"]
        Resource = "arn:aws:logs:*:*:log-group:/ecs/recovery-worker:*" },
    ]
  })
}

# 1. Recovery Worker parou de rodar.
# desired_count=1 mas running_count=0 → ninguém está recuperando threads órfãos.
# Threads vão acumular como zumbis sem que ninguém saiba.
resource "aws_cloudwatch_metric_alarm" "recovery_worker_down" {
  alarm_name          = "recovery-worker-not-running"
  metric_name         = "RunningTaskCount"
  namespace           = "ECS/ContainerInsights"
  comparison_operator = "LessThanThreshold"
  threshold           = 1; evaluation_periods = 2; period = 60; statistic = "Average"
  dimensions          = { ClusterName = "booking", ServiceName = "recovery-worker" }
  alarm_actions       = [aws_sns_topic.ops_alerts.arn]
}

# 2. DLQ contém itens — threads irrecuperáveis aguardando intervenção manual.
# QueueMonitor emite { "dlq_size": N } como JSON nos logs.
# Logs Insights parseia o campo dlq_size automaticamente.
resource "aws_cloudwatch_log_metric_filter" "dlq_size" {
  name           = "dlq-size"
  log_group_name = "/ecs/recovery-worker"
  pattern        = "{ $.dlq_size > 0 }"
  metric_transformation {
    name = "DLQSize"; namespace = "MultiAgent/Recovery"; value = "$.dlq_size"
  }
}

resource "aws_cloudwatch_metric_alarm" "dlq_not_empty" {
  alarm_name          = "recovery-dlq-not-empty"
  metric_name         = "DLQSize"; namespace = "MultiAgent/Recovery"
  comparison_operator = "GreaterThanThreshold"
  threshold           = 0; evaluation_periods = 1; period = 60; statistic = "Maximum"
  alarm_actions       = [aws_sns_topic.ops_alerts.arn]
}

# 3. Recovery queue próxima do limite — backpressure iminente.
# Alarme em 80% (80/100) — não quando já está cheio, mas antes.
# Dá tempo para investigar e escalar antes de threads irem para DLQ.
resource "aws_cloudwatch_metric_alarm" "queue_high" {
  alarm_name          = "recovery-queue-near-limit"
  metric_name         = "RecoveryQueueSize"; namespace = "MultiAgent/Recovery"
  comparison_operator = "GreaterThanThreshold"
  threshold           = 80; evaluation_periods = 2; period = 60; statistic = "Maximum"
  alarm_actions       = [aws_sns_topic.ops_alerts.arn]
}

# 4. Redis com memória alta — checkpoints podem não caber.
# Se o Redis ficar sem memória e o eviction policy for noeviction,
# novos writes vão falhar — checkpoints não são salvos, dados perdidos.
resource "aws_cloudwatch_metric_alarm" "redis_memory" {
  alarm_name          = "redis-memory-high"
  metric_name         = "DatabaseMemoryUsagePercentage"
  namespace           = "AWS/ElastiCache"
  comparison_operator = "GreaterThanThreshold"
  threshold           = 80; evaluation_periods = 3; period = 300; statistic = "Average"
  alarm_actions       = [aws_sns_topic.ops_alerts.arn]
}