CirclePOS - DevOps Infrastructure

DevOps infrastructure and CI/CD setup for the CirclePOS project — a point-of-sale system consisting of a Java Spring Boot backend, React/Vite frontend, and a suite management web app. This repository contains the deployment, infrastructure, and automation components built as part of the CirclePOS project work.

Tools used: Terraform CDKTF (Python), AWS CodeDeploy, GitHub Actions CI/CD, Docker.

Architecture Overview

                    ┌─────────────┐
                    │  CloudFront │
                    │     CDN     │
                    └──────┬──────┘
                           │
              ┌────────────┼────────────┐
              │            │            │
        ┌─────▼─────┐ ┌───▼───┐ ┌─────▼─────┐
        │ S3 Bucket │ │  ALB  │ │ EC2 Test  │
        │ (Static)  │ │       │ │   Host    │
        └───────────┘ └───┬───┘ └───────────┘
                          │
                   ┌──────▼──────┐
                   │  Auto       │
                   │  Scaling    │
                   │  Group      │
                   └──────┬──────┘
                          │
                   ┌──────▼──────┐
                   │  RDS        │
                   │  MariaDB    │
                   └─────────────┘

Components

Terraform CDKTF (terraform/)

Infrastructure defined as Python code using CDK for Terraform:

Stack	File	Description
VPC	vpc_stack.py	VPC with public/private subnets across 2 AZs, Internet Gateway, S3 VPC Endpoint, IPv4 + IPv6 dual-stack
IAM	iam_stack.py	IAM users for GitHub Actions (S3 deploy), SES (email), and S3 (static content) with least-privilege policies
S3	s3_stack.py	S3 buckets for frontend hosting (with website config), Java artifacts, and static content. IP-restricted policies for prod.
RDS	rds_stack.py	MariaDB instance in private subnets with security groups, automated backups, dual-stack networking
CloudFront	cloudfront_stack.py	CloudFront distribution with S3 origin (static frontend) and ALB origin (API), custom cache behaviors for /api/*
Java App	java_app/java_stack.py	EC2 Auto Scaling Group with Launch Template, Application Load Balancer, IAM roles for S3/CloudWatch access
CodeDeploy	java_app/java_stack_codedeploy.py	Alternative stack with AWS CodeDeploy integration for blue/green deployments

Key design decisions:

• State stored in S3 with separate state files per stack (VPC, IAM, S3, RDS, Java App)
• Cross-stack references via DataTerraformRemoteStateS3
• Public subnets for ALB, private subnets for EC2 and RDS
• IPv6 dual-stack networking throughout
• create_before_destroy lifecycle for zero-downtime updates

CodeDeploy (codedeploy/)

AWS CodeDeploy lifecycle scripts for Java application deployment:

Script	Lifecycle Hook	Purpose
stop_app.sh	ApplicationStop	Gracefully stops the running Java application
begin_install.sh	BeforeInstall	Backs up previous deployment, cleans up old snapshots
finish_install.sh	AfterInstall	Copies new artifact, updates configuration with server ID
start_app.sh	ApplicationStart	Starts the application server in background
validate.sh	ValidateService	Health check - polls API endpoint until it responds

CI/CD (cicd/)

GitHub Actions workflows triggered on devops branch pushes:

• maven-deploy.yml - Builds Java service with Maven, uploads JAR artifact to S3
• vite-deploy.yml - Builds React frontend with Vite, deploys static files to S3

Both workflows use jakejarvis/s3-sync-action for S3 deployment with GitHub Secrets for AWS credentials.

Docker (docker/)

Multi-stage Dockerfiles for containerized builds:

File	Base Image	Purpose
Dockerfile.java	openjdk:17-jdk-slim	Multi-stage Java build with Maven wrapper
Dockerfile.react	node:16 → httpd:alpine	Production React build served by Apache
Dockerfile.react.dev	node:18-alpine → httpd:alpine	Development build with Alpine images
Dockerfile.react.local	node:alpine	Local development with hot reload

Tech Stack

• IaC: Terraform CDKTF (Python) with AWS Provider
• Cloud: AWS (VPC, EC2, ALB, ASG, RDS, S3, CloudFront, IAM, CodeDeploy, CloudWatch)
• CI/CD: GitHub Actions
• Containers: Docker (multi-stage builds)
• Region: ap-south-1 (Mumbai)

Getting Started

# Install dependencies
cd terraform
pip install pipenv
pipenv install

# Generate Terraform
cdktf get

# Plan infrastructure
cdktf plan

# Deploy infrastructure
cdktf deploy

Security Notes

• All sensitive values (AWS account IDs, IPs, certificates) have been replaced with placeholders
• S3 bucket policies use IP-based restrictions for production buckets
• RDS instances are in private subnets with no public access
• IAM policies follow least-privilege principle
• CloudWatch agent configured for application and infrastructure monitoring