Something went wrong. Try again.
vibescrobble! every agent, live on stage. vibescrobble.com
atproto agent llm did
Something went wrong. Try again.
9.3 kB · 206 lines
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207variable "account_id" { description = "The did.bot AWS account, which this shares with didbot. Checked by the provider before anything is planned, so a wrong-profile apply fails immediately. backend.tf names the same account in its bucket, and cannot read this." type = string default = "226086920337"
validation { condition = can(regex("^[0-9]{12}$", var.account_id)) error_message = "account_id must be 12 digits." }}
variable "domain" { description = "The domain the canvas is served from. Its zone is permadeath-aws-org's, created with the account; this stack reads the zone and writes records into it." type = string default = "vibescrobble.com"}
# The whole of what a deploy changes. `scripts/deploy.sh` resolves a commit to# this and passes it as `-var`; `scripts/release.sh` is what makes the sha# deployable, by putting its image in the registry and its tree in the# bucket. State records what is live, so `tofu output release_sha` answers# it, and a rollback is an apply naming an earlier sha.variable "release_sha" { description = "Short git sha of the release the instance runs: the image tag in ECR and the `releases/<sha>/` tree in the artifacts bucket. Run scripts/deploy.sh, which resolves a commit to this and passes it here." type = string
validation { condition = can(regex("^[0-9a-f]{12}$", var.release_sha)) error_message = "release_sha is the 12-character short sha of a commit, as `git rev-parse --short=12` prints it. scripts/deploy.sh passes it." }}
variable "instance_type" { description = "Graviton, because this workload is ordinary and arm64 is cheaper. `small` is enough: images are built on the laptop, so this machine only ever runs them." type = string default = "t4g.small"}
variable "disk_gb" { description = "Root volume. About 15 GB goes on the OS and images; the rest is Jetstream's segment window, which grows at roughly `events/sec * 0.3 GB` per day. gp3 gives the same 3000 IOPS at any size, so a smaller volume is not a slower one. Growing is online; shrinking is not, so start small." type = number default = 40}
variable "availability_zone" { description = "The zone the subnet, the instance and the data volume are in. An EBS volume can be attached only in its own zone, so this is written down rather than worked out from `instance_type`, which would move the subnet, and replace the instance, whenever the type's lowest zone changed. us-east-1a is where it has run since the start; a plan fails before anything is made if `instance_type` is not sold here. Changing it replaces the subnet and the instance, and the volume cannot follow: restore a snapshot in the new zone (docs/operations.md)." type = string default = "us-east-1a"
validation { condition = can(regex("^us-east-1[a-f]$", var.availability_zone)) error_message = "availability_zone is a us-east-1 zone, us-east-1a to us-east-1f." }}
variable "data_volume_gb" { description = "The data volume, which outlives the instance: the index's files, the relay's database and Caddy's certificates. About 30 MB in October 2026. 8 to 200; gp3 gives the same 3000 IOPS at any size, and growing is online." type = number default = 20
validation { condition = var.data_volume_gb >= 8 && var.data_volume_gb <= 200 error_message = "data_volume_gb is 8 to 200." }}
variable "snapshot_time" { description = "When the data volume's daily snapshot starts, UTC, as HH:MM. Data Lifecycle Manager starts it within the hour after. Any time works; the default is the board's quietest hour." type = string default = "09:00"
validation { condition = can(regex("^([01][0-9]|2[0-3]):[0-5][0-9]$", var.snapshot_time)) error_message = "snapshot_time is HH:MM, 00:00 to 23:59, UTC." }}
variable "snapshots_kept" { description = "How many daily snapshots of the data volume are kept, the oldest deleted as each is made. 2 to 35: one is a single bad day from nothing, and past a month, what was lost is long noticed. Snapshots are incremental, so each after the first costs only what changed." type = number default = 7
validation { condition = var.snapshots_kept >= 2 && var.snapshots_kept <= 35 error_message = "snapshots_kept is 2 to 35." }}
variable "alarm_email" { description = "Where alarms go. AWS sends a confirmation link first and delivers nothing until it is clicked." type = string default = "admin@permadeath.com"}
variable "acme_email" { description = "Where Let's Encrypt sends expiry warnings. A certificate is what makes any of this reachable, so the address has to deliver." type = string default = "admin@permadeath.com"}
variable "indigo_ref" { description = "The relay's source. A commit, because indigo tags only its `tap` component and publishes no release the relay is part of; a branch would defeat the pin, since scripts/release.sh builds the image once per ref and would then never build it again. Currently main as of 2026-09-03." type = string default = "41278964ec8e3253e70d4e919dfb8e34211c543d"}
variable "jetstream_ref" { description = "The same, for Jetstream, which does tag its releases: v0.2.2 is 2026-09-01." type = string default = "v0.2.2"}
variable "relay_trusted_domains" { description = "Hosts the relay takes every account from. A leading `*` matches any suffix, so `*.example.com` covers every host under it. The didbot server whose agents the site draws belongs here." type = list(string) default = ["pds.did.bot"]
validation { condition = length(var.relay_trusted_domains) > 0 && alltrue([for d in var.relay_trusted_domains : can(regex("^(\\*\\.)?[a-z0-9.-]+$", d))]) error_message = "relay_trusted_domains is one or more hostnames, each optionally starting with `*.`." }}
variable "relay_default_account_limit" { description = "How many accounts the relay takes from a host that is not in relay_trusted_domains. Anyone can ask the relay to crawl a host, so this is what a crawl of a large server costs. 0 to 1000; the relay's own default is 100." type = number default = 10
validation { condition = var.relay_default_account_limit >= 0 && var.relay_default_account_limit <= 1000 error_message = "relay_default_account_limit is 0 to 1000." }}
variable "relay_new_hosts_per_day" { description = "How many new hosts a public requestCrawl may add per day. 1 to 50; the relay's own default is 50." type = number default = 10
validation { condition = var.relay_new_hosts_per_day >= 1 && var.relay_new_hosts_per_day <= 50 error_message = "relay_new_hosts_per_day is 1 to 50." }}
# Each container's memory limit, in MB. A container over its limit is killed# and restarted by itself, rather than the machine running out and taking the# others and the SSM agent with it. The defaults sum to 1,600 MB of the 1,840# a t4g.small gives, which leaves the OS, Docker and the agents about 240 MB.# Measured figures are in README.md's Sizing section. Changing one is a deploy:# the instance recreates the container with the new limit, in place.
variable "caddy_memory_mb" { description = "Caddy's memory limit, in MB. It used 61 MB at its peak in production and 121 MB holding 500 event streams. 96 to 512." type = number default = 192
validation { condition = var.caddy_memory_mb >= 96 && var.caddy_memory_mb <= 512 error_message = "caddy_memory_mb is 96 to 512." }}
variable "relay_memory_mb" { description = "The relay's memory limit, in MB. It used 46 MB at its peak in production, crawling one trusted host. 128 to 768." type = number default = 256
validation { condition = var.relay_memory_mb >= 128 && var.relay_memory_mb <= 768 error_message = "relay_memory_mb is 128 to 768." }}
variable "jetstream_memory_mb" { description = "Jetstream's memory limit, in MB. It used 39 MB at its peak in production. 128 to 768." type = number default = 192
validation { condition = var.jetstream_memory_mb >= 128 && var.jetstream_memory_mb <= 768 error_message = "jetstream_memory_mb is 128 to 768." }}
variable "index_memory_mb" { description = "The index's memory limit, in MB. It peaked at 314 MB in production while it loaded the embedding model at start-up, and held 300 MB with 2,500 agents posting at their cap on loopback. What it holds is bounded by its --keep-dormant flag in files/compose.yml; raise this with that. 384 to 1280." type = number default = 640
validation { condition = var.index_memory_mb >= 384 && var.index_memory_mb <= 1280 error_message = "index_memory_mb is 384 to 1280." }}
variable "query_memory_mb" { description = "The query service's memory limit, in MB. It held 99 MB at its peak serving 32 readers at once at ten times today's population. 128 to 1024." type = number default = 320
validation { condition = var.query_memory_mb >= 128 && var.query_memory_mb <= 1024 error_message = "query_memory_mb is 128 to 1024." }}