Praesidium2

Tiltfile

The Tiltfile builds all service images from Dockerfiles in each service repo, deploys via Helm charts from praesidium-cd to the praesidium-local namespace, watches source directories for live-reload, and port-forwards key services.

# Tiltfile

# ── Configuration ──────────────────────────────────
load('ext://namespace', 'namespace_create')
namespace_create('praesidium-local')

allow_k8s_contexts('docker-desktop')

# ── Infrastructure Dependencies (Helm charts) ─────
# PostgreSQL (bitnami)
helm_resource(
  'postgresql',
  'oci://registry-1.docker.io/bitnamicharts/postgresql',
  flags=['--namespace=praesidium-local',
         '--set=auth.database=praesidium',
         '--set=auth.username=praesidium',
         '--set=auth.password=localdev',
         '--set=image.tag=16',
         '--set=primary.extendedConfiguration=shared_preload_libraries=vector'],
  port_forwards=['5432:5432'],
  labels=['infra']
)

# Redis (bitnami)
helm_resource(
  'redis',
  'oci://registry-1.docker.io/bitnamicharts/redis',
  flags=['--namespace=praesidium-local',
         '--set=auth.enabled=false',
         '--set=architecture=standalone'],
  port_forwards=['6379:6379'],
  labels=['infra']
)

# Authentik
helm_resource(
  'authentik',
  'oci://ghcr.io/goauthentik/helm/authentik',
  flags=['--namespace=praesidium-local',
         '--set=authentik.secret_key=local-dev-secret-key-change-in-prod',
         '--set=authentik.postgresql.host=postgresql',
         '--set=authentik.postgresql.user=praesidium',
         '--set=authentik.postgresql.password=localdev',
         '--set=authentik.postgresql.name=authentik',
         '--set=authentik.redis.host=redis-master'],
  port_forwards=['9443:9443'],
  resource_deps=['postgresql', 'redis'],
  labels=['infra']
)

# MinIO (S3-compatible object storage)
helm_resource(
  'minio',
  'oci://registry-1.docker.io/bitnamicharts/minio',
  flags=['--namespace=praesidium-local',
         '--set=auth.rootUser=praesidium',
         '--set=auth.rootPassword=localdevkey'],
  port_forwards=['9000:9000', '9001:9001'],
  labels=['infra']
)

# Ollama (local LLM inference)
helm_resource(
  'ollama',
  './charts/ollama',
  flags=['--namespace=praesidium-local'],
  port_forwards=['11434:11434'],
  labels=['llm']
)

# Jaeger (distributed tracing)
helm_resource(
  'jaeger',
  'jaegertracing/jaeger',
  flags=['--namespace=praesidium-local',
         '--set=allInOne.enabled=true'],
  port_forwards=['16686:16686'],
  labels=['observability']
)

# ── Application Services ──────────────────────────
# qqq-api (Java — full rebuild on change)
docker_build(
  'praesidium2-qqq',
  context='./praesidium2-qqq',
  dockerfile='./praesidium2-qqq/Dockerfile'
)

# gateway (Python — live_update for hot reload)
docker_build(
  'praesidium2-gateway',
  context='./praesidium2-python',
  dockerfile='./praesidium2-python/services/agent-gateway/Dockerfile',
  live_update=[
    sync('./praesidium2-python/services/agent-gateway/src', '/app/src'),
    run('cd /app && pip install -e .', trigger=['./praesidium2-python/services/agent-gateway/pyproject.toml']),
  ]
)

# worker (Python — live_update for hot reload)
docker_build(
  'praesidium2-worker',
  context='./praesidium2-python',
  dockerfile='./praesidium2-python/services/agent-worker/Dockerfile',
  live_update=[
    sync('./praesidium2-python/services/agent-worker/src', '/app/src'),
    run('cd /app && pip install -e .', trigger=['./praesidium2-python/services/agent-worker/pyproject.toml']),
  ]
)

# web (React — live_update for Vite HMR)
docker_build(
  'praesidium2-web',
  context='./praesidium2-web',
  dockerfile='./praesidium2-web/Dockerfile',
  live_update=[
    sync('./praesidium2-web/src', '/app/src'),
    run('cd /app && pnpm install', trigger=['./praesidium2-web/package.json']),
  ]
)

# tool-runner (Python — no live_update, runs as Job)
docker_build(
  'praesidium2-tool-runner',
  context='./praesidium2-tool-runner',
  dockerfile='./praesidium2-tool-runner/Dockerfile'
)

# ── Deploy via Helm (charts from praesidium-cd) ───
k8s_yaml(helm(
  './praesidium-cd',
  name='praesidium',
  namespace='praesidium-local',
  values=['./praesidium-cd/values-local.yaml']
))

# ── Port Forwards ─────────────────────────────────
k8s_resource('qqq-api',    port_forwards=['8080:8080'], resource_deps=['postgresql', 'authentik'], labels=['app'])
k8s_resource('gateway',    port_forwards=['8000:8000'], resource_deps=['qqq-api', 'redis', 'ollama'], labels=['app'])
k8s_resource('worker',     resource_deps=['qqq-api', 'redis', 'ollama'],                           labels=['app'])
k8s_resource('web',        port_forwards=['3000:3000'], resource_deps=['gateway'],                  labels=['app'])

Helm values-local.yaml

Local overrides for the same Helm charts used in dev/staging/prod. Single-replica services, local infrastructure dependencies, observability disabled.

# praesidium-cd/values-local.yaml
# Local k8s development overrides (used by Tiltfile)

global:
  imageRegistry: ""                # local images, no registry prefix
  imagePullPolicy: Never           # use locally-built images

instance:
  namespace: praesidium-local
  id: "local-dev"

# ── Per-service: single replica, local images ─────
qqq-api:
  replicas: 1
  image: praesidium2-qqq
  tag: latest
  resources:
    requests: { cpu: 250m, memory: 512Mi }
    limits:   { cpu: 1000m, memory: 2Gi }
  env:
    SPRING_PROFILES_ACTIVE: local
    SPRING_DATASOURCE_URL: jdbc:postgresql://postgresql:5432/praesidium
    SPRING_DATASOURCE_USERNAME: praesidium
    SPRING_DATASOURCE_PASSWORD: localdev
    AUTHENTIK_ISSUER_URL: https://authentik:9443/application/o/praesidium/
    AUTHENTIK_JWKS_URL: https://authentik:9443/application/o/praesidium/jwks/

gateway:
  replicas: 1
  image: praesidium2-gateway
  tag: latest
  resources:
    requests: { cpu: 100m, memory: 256Mi }
    limits:   { cpu: 500m, memory: 1Gi }
  env:
    QQQ_API_URL: http://qqq-api:8080
    REDIS_URL: redis://redis-master:6379/0
    MINIO_ENDPOINT: http://minio:9000
    MINIO_ACCESS_KEY: praesidium
    MINIO_SECRET_KEY: localdevkey
    AUTHENTIK_ISSUER_URL: https://authentik:9443/application/o/praesidium/
    LLM_PROVIDER: ollama
    LLM_BASE_URL: http://ollama:11434
    LLM_MODEL: llama3.1:70b

worker:
  replicas: 1
  image: praesidium2-worker
  tag: latest
  hpa:
    enabled: false
  resources:
    requests: { cpu: 250m, memory: 512Mi }
    limits:   { cpu: 1000m, memory: 2Gi }
  env:
    QQQ_API_URL: http://qqq-api:8080
    REDIS_URL: redis://redis-master:6379/0
    MINIO_ENDPOINT: http://minio:9000
    CELERY_BROKER_URL: redis://redis-master:6379/1
    CELERY_RESULT_BACKEND: redis://redis-master:6379/2
    LLM_PROVIDER: ollama
    LLM_BASE_URL: http://ollama:11434
    LLM_MODEL: llama3.1:70b

web:
  replicas: 1
  image: praesidium2-web
  tag: latest
  resources:
    requests: { cpu: 50m, memory: 64Mi }
    limits:   { cpu: 100m, memory: 128Mi }
  env:
    VITE_API_URL: http://localhost:8080
    VITE_GATEWAY_URL: http://localhost:8000
    VITE_AUTHENTIK_URL: https://localhost:9443

# ── Infrastructure (deployed by Tilt helm_resource) ─
postgresql:
  enabled: false       # managed by Tilt helm_resource
redis:
  enabled: false       # managed by Tilt helm_resource
authentik:
  enabled: false       # managed by Tilt helm_resource

# ── Observability (disabled locally) ──────────────
datadog:
  enabled: false
  apm: false
  rum: false

Local Setup Script

./scripts/local-dev-setup.sh — one-time setup for local k8s development. Idempotent (safe to re-run).

#!/usr/bin/env bash
set -euo pipefail

# scripts/local-dev-setup.sh
# One-time local k8s development environment setup

echo "==> Verifying prerequisites..."
command -v docker >/dev/null  || { echo "ERROR: Docker not found"; exit 1; }
command -v kubectl >/dev/null || { echo "ERROR: kubectl not found"; exit 1; }
command -v helm >/dev/null    || { echo "ERROR: Helm not found"; exit 1; }
command -v tilt >/dev/null    || { echo "ERROR: Tilt not found"; exit 1; }

# Verify Docker Desktop k8s is running
kubectl cluster-info --context docker-desktop >/dev/null 2>&1 \
  || { echo "ERROR: Docker Desktop Kubernetes not running. Enable it in Docker Desktop settings."; exit 1; }

echo "==> Setting kubectl context to docker-desktop..."
kubectl config use-context docker-desktop

echo "==> Creating namespace praesidium-local..."
kubectl create namespace praesidium-local --dry-run=client -o yaml | kubectl apply -f -

echo "==> Adding Helm repos..."
helm repo add bitnami https://charts.bitnami.com/bitnami 2>/dev/null || true
helm repo add authentik https://charts.goauthentik.io 2>/dev/null || true
helm repo update

echo "==> Setup complete. Run 'tilt up' to start the development environment."
echo "    Tilt UI will be available at http://localhost:10350"

Multi-Stage Dockerfiles (in each service repo)

Each service repo owns its own Dockerfile with a multi-stage build for minimal image size and layer caching. Faber uses these for CI builds; Tilt uses them for local k8s dev.

FROM eclipse-temurin:21-jdk AS build
WORKDIR /app
COPY build.gradle.kts settings.gradle.kts ./
COPY gradle/ gradle/
RUN ./gradlew dependencies --no-daemon
COPY src/ src/
RUN ./gradlew bootJar --no-daemon

FROM eclipse-temurin:21-jre
COPY --from=build /app/build/libs/*.jar app.jar
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "app.jar"]

FROM python:3.12-slim AS base
WORKDIR /app
RUN pip install uv
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen --no-dev

FROM python:3.12-slim
WORKDIR /app
COPY --from=base /app/.venv /app/.venv
COPY src/ src/
ENV PATH="/app/.venv/bin:$PATH"

# gateway:
EXPOSE 8000
CMD ["uvicorn", "src.main:app", \
     "--host", "0.0.0.0", "--port", "8000"]

# worker:
CMD ["celery", "-A", "src.worker", "worker", \
     "--loglevel=info", "--concurrency=4"]

FROM node:20-alpine AS build
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN corepack enable && pnpm install --frozen-lockfile
COPY . .
RUN pnpm build

FROM nginx:alpine
COPY --from=build /app/dist /usr/share/nginx/html
COPY nginx.conf /etc/nginx/conf.d/default.conf
EXPOSE 80

FROM python:3.12-slim
WORKDIR /sandbox
RUN pip install uv
COPY tool_runner/ tool_runner/
COPY requirements.txt .
RUN uv pip install -r requirements.txt

# No EXPOSE — runs as k8s Job
# Entry point set dynamically via Job spec
ENTRYPOINT ["python", "-m", "tool_runner"]

Kubernetes Manifests

Each service gets a Deployment, Service, ConfigMap, and NetworkPolicy. Worker pods get HPA and PDB for production resilience.

Per-Service Resource Matrix

Example: Gateway Deployment + Service

apiVersion: apps/v1
kind: Deployment
metadata:
  name: gateway
  namespace: {{ .Values.instance.namespace }}
spec:
  replicas: {{ .Values.gateway.replicas }}
  selector:
    matchLabels:
      app: gateway
  template:
    metadata:
      labels:
        app: gateway
    spec:
      terminationGracePeriodSeconds: 60
      containers:
        - name: gateway
          image: {{ .Values.gateway.image }}:{{ .Values.gateway.tag }}
          ports:
            - containerPort: 8000
          envFrom:
            - configMapRef:
                name: gateway-config
            - secretRef:
                name: gateway-secrets
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8000
            initialDelaySeconds: 10
            periodSeconds: 15
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8000
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            requests:
              cpu: {{ .Values.gateway.resources.requests.cpu }}
              memory: {{ .Values.gateway.resources.requests.memory }}
            limits:
              cpu: {{ .Values.gateway.resources.limits.cpu }}
              memory: {{ .Values.gateway.resources.limits.memory }}
---
apiVersion: v1
kind: Service
metadata:
  name: gateway
spec:
  selector:
    app: gateway
  ports:
    - port: 8000
      targetPort: 8000

NetworkPolicy (restrict pod-to-pod)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: gateway-netpol
spec:
  podSelector:
    matchLabels:
      app: gateway
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: web           # frontend can reach gateway
      ports:
        - port: 8000
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: qqq-api       # gateway calls qqq
      ports:
        - port: 8080
    - to:
        - podSelector:
            matchLabels:
              app: redis
      ports:
        - port: 6379

PodDisruptionBudget (production)

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: qqq-api-pdb
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: qqq-api
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: gateway-pdb
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: gateway

Helm Chart Structure (in praesidium-cd)

Umbrella chart with sub-charts per service. Lives in the praesidium-cd repo (not owned by Praesidium2 team). Environment-specific values files override defaults.

# Global
global:
  imageRegistry: ""          # ghcr.io/dmdbrands in prod
  imagePullPolicy: IfNotPresent

instance:
  namespace: praesidium-dev
  id: ""                     # set per-instance

# Per-service
qqq-api:
  replicas: 1
  image: praesidium2-qqq
  tag: latest
  resources:
    requests: { cpu: 500m, memory: 1Gi }
    limits:   { cpu: 1000m, memory: 2Gi }
  env:
    SPRING_PROFILES_ACTIVE: dev

gateway:
  replicas: 1
  image: praesidium2-gateway
  tag: latest
  resources:
    requests: { cpu: 250m, memory: 512Mi }
    limits:   { cpu: 500m, memory: 1Gi }

worker:
  replicas: 1
  image: praesidium2-worker
  tag: latest
  hpa:
    enabled: false
    minReplicas: 2
    maxReplicas: 8
    targetCPU: 70
  resources:
    requests: { cpu: 500m, memory: 1Gi }
    limits:   { cpu: 2000m, memory: 4Gi }

web:
  replicas: 1
  image: praesidium2-web
  tag: latest
  resources:
    requests: { cpu: 50m, memory: 64Mi }
    limits:   { cpu: 100m, memory: 128Mi }

Per-Instance Provisioning

Each business unit gets its own k8s namespace. ArgoCD ApplicationSet generates one Application per instance YAML file in the instances/ directory.

Instance YAML Example (tech-team.yaml)

# instances/tech-team.yaml
instance:
  id: "tech-team"
  namespace: "praesidium-tech-team"
  displayName: "CTO Engineering"

# Instance-specific overrides
worker:
  replicas: 2
  hpa:
    enabled: true
    minReplicas: 2
    maxReplicas: 6

# Instance-specific env vars (merged with defaults)
env:
  INSTANCE_ID: "uuid-for-tech-team"
  AUTHENTIK_GROUP: "tech-team"
  DEFAULT_LLM_MODEL: "claude-sonnet-4-6"
  DAILY_BUDGET_USD: "50.00"

Per-Language Pipeline Configuration

Python, Java, and TypeScript services each have language-specific lint and test tooling. All three run in parallel during the Lint + Test stages.

Docker Build + GHCR Push

Multi-stage builds with Docker BuildKit layer caching. Each service repo owns its own Dockerfile. Images are pushed to ghcr.io/dmdbrands and tagged with both git SHA and environment label.

# Faber build stage (per service, Dockerfile in each service repo)
docker buildx build \
  --cache-from type=registry,ref=$GHCR_REPO:cache \
  --cache-to type=registry,ref=$GHCR_REPO:cache,mode=max \
  --tag $GHCR_REPO:$GIT_SHA \
  --tag $GHCR_REPO:$ENVIRONMENT \
  --push \
  -f Dockerfile .

GitOps Update (Helm Values in praesidium-cd)

After a successful image push to GHCR, Faber commits the new image tag to the praesidium-cd GitOps repository. ArgoCD watches this repo and auto-syncs. Helm charts also live in praesidium-cd.

# Faber GitOps update step (runs after GHCR push)
git clone $GITOPS_REPO /tmp/gitops  # praesidium-cd
cd /tmp/gitops

# Determine target values file from branch
case "$BRANCH" in
  develop)  VALUES_FILE="values-dev.yaml" ;;
  staging)  VALUES_FILE="values-staging.yaml" ;;
  main)     VALUES_FILE="values-prod.yaml" ;;
esac

# Update image tags for the changed service
yq eval ".${SERVICE}.tag = \"${GIT_SHA}\"" -i "$VALUES_FILE"

git add "$VALUES_FILE"
git commit -m "ci(${SERVICE}): update to ${GIT_SHA} [skip ci]"
git push origin main

CI Time Budget

Target: full pipeline completes in under 5 minutes. Parallelism is key.

Faber Pipeline Configuration

Each service repository includes a .faber.yml configuration file that Faber reads to determine build, test, and deployment behavior.

# praesidium2-qqq/.faber.yml
pipeline: java-webapp
image_name: praesidium2-qqq
java_version: "21"
docker:
  registry: ghcr.io/dmdbrands
cd:
  repo: dmdbrands/praesidium-cd
  format: helm
coverage:
  min_instruction: "90"
health:
  path: /qqq-api/health
  port: 8000
  db: true
services:
  - image: pgvector/pgvector:pg17
    port: 5432
    healthcheck: "pg_isready -U test"
    env:
      POSTGRES_USER: test
      POSTGRES_PASSWORD: testing
      POSTGRES_DB: praesidium_test

Each repo has its own .faber.yml. The pipeline type varies: python-webapp for praesidium2-python, node-webapp for praesidium2-web. The pattern is the same — image name, registry, CD repo, coverage gates, and health checks — adjusted per language and service.

Sync Policy by Environment

Dev and staging auto-sync on every commit. Production requires manual approval via the ArgoCD UI or CLI.

Rollback Procedure

Rollbacks are git operations, not kubectl commands. Reverting the values file triggers ArgoCD to automatically restore the previous version.

# Revert the last values commit
cd praesidium-cd/
git revert HEAD --no-edit
git push origin main

# ArgoCD detects the revert commit
# → Auto-syncs dev/staging immediately
# → Prod: marks OutOfSync, awaits manual sync

Health Check Verification

ArgoCD verifies each service is healthy after every sync. A sync is only marked Healthy when all pods pass readiness probes.

Notifications (Slack Integration)

ArgoCD Notifications controller sends deploy status to Slack. Every sync event triggers a notification.

# argocd-notifications-cm ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-notifications-cm
data:
  service.slack: |
    token: $slack-token
  trigger.on-sync-succeeded: |
    - when: app.status.operationState.phase in ['Succeeded']
      send: [slack-deploy-success]
  trigger.on-sync-failed: |
    - when: app.status.operationState.phase in ['Error', 'Failed']
      send: [slack-deploy-failure]
  trigger.on-health-degraded: |
    - when: app.status.health.status == 'Degraded'
      send: [slack-health-degraded]
  template.slack-deploy-success: |
    slack:
      channel: praesidium-deploys
      blocks: |
        - type: section
          text:
            type: mrkdwn
            text: |
              :white_check_mark: *{{.app.metadata.name}}* deployed successfully
              *Revision:* {{.app.status.sync.revision | truncate 7}}
              *Environment:* {{.app.spec.destination.namespace}}
  template.slack-deploy-failure: |
    slack:
      channel: praesidium-deploys
      blocks: |
        - type: section
          text:
            type: mrkdwn
            text: |
              :x: *{{.app.metadata.name}}* deploy FAILED
              *Revision:* {{.app.status.sync.revision | truncate 7}}
              *Error:* {{.app.status.operationState.message}}

RDS PostgreSQL + pgvector

Managed PostgreSQL with pgvector extension for embedding storage. Multi-AZ for production resilience.

ElastiCache Redis

Two separate Redis clusters for workload isolation: one for task queues (durable) and one for caching (ephemeral).

S3 Buckets

Three purpose-specific buckets with versioning, encryption, and lifecycle policies.

Secrets Manager

All secrets stored in AWS Secrets Manager with hierarchical naming and automatic rotation policies.

Secret Organization Structure

praesidium/
  global/                              # Shared across all instances
    authentik-admin-password
    ecr-pull-credentials
    argocd-slack-token
  {instance-id}/                       # Per-instance secrets
    db-credentials                     # RDS username + password
    redis-auth-token                   # ElastiCache AUTH
    authentik-oidc-client-secret       # OAuth2 client secret
    service-account-jwt                # Worker service identity
    secrets/                           # User-managed secrets (via secret_ref table)
      ANTHROPIC_API_KEY
      OPENAI_API_KEY
      SLACK_BOT_TOKEN
      JIRA_API_TOKEN
      GITHUB_PAT
      GOOGLE_SERVICE_ACCOUNT_JSON
      ZOHO_OAUTH_REFRESH_TOKEN
      HUBSPOT_API_KEY

ALB / Route53

Application Load Balancer routes traffic to services. Route53 manages DNS per instance.

# Kubernetes Ingress (per instance, via Helm template)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: praesidium-ingress
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:ACCOUNT:certificate/CERT-ID
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/ssl-redirect: "443"
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/wafv2-acl-arn: arn:aws:wafv2:us-east-1:ACCOUNT:regional/webacl/praesidium-waf
spec:
  rules:
    - host: "{{.Values.instance.id}}.praesidium.dmdbrand.com"
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port: { number: 80 }
    - host: "api.{{.Values.instance.id}}.praesidium.dmdbrand.com"
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: qqq-api
                port: { number: 8080 }
    - host: "ws.{{.Values.instance.id}}.praesidium.dmdbrand.com"
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: gateway
                port: { number: 8000 }

CloudWatch Monitoring

Centralized logging and metrics via CloudWatch. Fluent Bit DaemonSet ships container logs. Container Insights provides cluster-level metrics.

IAM Roles (IRSA)

Each Kubernetes ServiceAccount maps to an IAM role via IRSA (IAM Roles for Service Accounts). Least-privilege access to AWS services.

Infrastructure-as-Code (OpenTofu + Terragrunt)

All AWS resources are managed via Infrastructure-as-Code. Praesidium2 runs in its own dedicated AWS accounts under AWS Control Tower (not in a shared legacy account like me-health). This provides billing isolation, blast-radius containment, independent IAM policies, and cleaner security boundaries.

Greater Goods AWS Control Tower
└─ Management Account
└─ praesidium-dev       (Dev)
└─ praesidium-staging   (Staging)
└─ praesidium-prod      (Production)

Terraform Module Structure

Modeled after me-health-portal-infrastructure layout with Praesidium-specific modules.

praesidium-infrastructure/
├─ terraform/
│   ├─ modules/
│   │   ├─ vpc/              # VPC, subnets, endpoints, NAT
│   │   ├─ eks/              # EKS cluster, managed node groups
│   │   ├─ rds/              # Aurora PostgreSQL 17 + pgvector
│   │   ├─ elasticache/      # Redis 7.0 (HA)
│   │   ├─ secrets/          # AWS Secrets Manager
│   │   ├─ iam/              # IRSA roles, service accounts
│   │   ├─ acm/              # TLS certificates
│   │   ├─ cloudtrail/       # HIPAA audit logging (6-year retention)
│   │   ├─ cluster-addons/   # Helm releases (Datadog, ESO, External DNS, ALB Controller)
│   │   ├─ s3/               # Application buckets
│   │   └─ kms/              # Encryption keys
│   ├─ live/
│   │   ├─ dev/terragrunt.hcl
│   │   ├─ staging/terragrunt.hcl
│   │   ├─ production/terragrunt.hcl
│   │   └─ root.hcl
│   └─ root/
│       ├─ main.tf           # Module calls
│       ├─ variables.tf      # 100+ variables
│       └─ outputs.tf
├─ .faber.yml                    # CI/CD config
├─ docs/
│   └─ adr/                  # Architecture Decision Records (v1.10)
└─ README.md

Per-Environment Resources

IRSA Roles (6)

Day 1 HIPAA Hardening v1.10

These security controls ship in Phase 1 alongside infrastructure provisioning. No data-at-rest or data-in-transit may exist without encryption from Day 1.