graph TD
    subgraph "ユーザー"
        A[ブラウザ]
    end
    subgraph "AWS Cloud"
        B[Route 53] --> C[CloudFront]
        C --> D[ALB]
        D --> E[ECS Fargate Service]
        E -- DB接続 --> F[RDS for PostgreSQL]
        E -- 画像等 --> G[S3]
        subgraph "CI/CD on GitHub"
            H[GitHub Actions] -- 1. Push Image --> I[ECR]
            H -- 2. Deploy --> E
        end
    end
    A -- DNSクエリ --> B
    A -- HTTPS --> C

# --- vpc.tf ---
provider "aws" {
  region = "ap-northeast-1"
}
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
  tags = {
    Name = "my-app-vpc"
  }
}
# Public Subnets (for ALB)
resource "aws_subnet" "public" {
  count             = 2
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.${10 + count.index}.0/24"
  availability_zone = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch = true
  tags = {
    Name = "my-app-public-subnet-${count.index + 1}"
  }
}
# Private Subnets (for ECS, RDS)
resource "aws_subnet" "private" {
  count             = 2
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.${20 + count.index}.0/24"
  availability_zone = data.aws_availability_zones.available.names[count.index]
  tags = {
    Name = "my-app-private-subnet-${count.index + 1}"
  }
}
# ... (Internet Gateway, NAT Gateway, Route Tables etc.)

# --- rds.tf ---
resource "aws_db_subnet_group" "default" {
  name       = "my-app-db-subnet-group"
  subnet_ids = [aws_subnet.private[0].id, aws_subnet.private[1].id]
  tags = {
    Name = "My App DB Subnet Group"
  }
}
resource "aws_security_group" "rds" {
  name        = "my-app-rds-sg"
  description = "Allow PostgreSQL traffic"
  vpc_id      = aws_vpc.main.id
  ingress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.ecs_tasks.id] # ECSタスクからのアクセスのみ許可
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}
resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "postgres"
  engine_version       = "15.3"
  instance_class       = "db.t3.micro"
  db_name              = "myappdb"
  username             = "admin"
  password             = random_password.password.result
  db_subnet_group_name = aws_db_subnet_group.default.name
  vpc_security_group_ids = [aws_security_group.rds.id]
  skip_final_snapshot  = true
}

# ---- Base Stage: 依存関係のインストール ----
FROM node:18-alpine AS base
WORKDIR /app
# package.jsonとlockファイルを先にコピーしてキャッシュを効かせる
COPY package*.json ./
RUN npm install
# ---- Build Stage: アプリケーションのビルド ----
FROM base AS build
COPY . .
# Next.jsのビルドコマンドを実行
RUN npm run build
# ---- Production Stage: 本番用の軽量イメージ作成 ----
FROM node:18-alpine
WORKDIR /app
ENV NODE_ENV=production
# ビルドステージから必要なファイルのみをコピー
COPY --from=build /app/next.config.mjs ./
COPY --from=build /app/public ./public
COPY --from=build /app/package.json ./package.json
# standaloneモードで生成されたファイル群をコピー
COPY --from=build /app/.next/standalone ./
COPY --from=build /app/.next/static ./.next/static
EXPOSE 3000
# アプリケーションの起動
CMD ["node", "server.js"]

# --- ecs.tf ---
resource "aws_ecs_cluster" "main" {
  name = "my-app-cluster"
}
resource "aws_ecr_repository" "app" {
  name = "my-app-repo"
}
resource "aws_ecs_task_definition" "app" {
  family                   = "my-app-task"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "256" # 0.25 vCPU
  memory                   = "512" # 512MB
  execution_role_arn       = aws_iam_role.ecs_task_execution_role.arn
  task_role_arn            = aws_iam_role.ecs_task_role.arn
  container_definitions = jsonencode([
    {
      name      = "my-app-container",
      image     = "${aws_ecr_repository.app.repository_url}:latest",
      cpu       = 256,
      memory    = 512,
      essential = true,
      portMappings = [
        {
          containerPort = 3000,
          hostPort      = 3000
        }
      ]
    }
  ])
}
# ... (ECS Service, ALB, Target Group, IAM Roles etc.)

name: Deploy to Amazon ECS
on:
  push:
    branches:
      - main
permissions:
  id-token: write
  contents: read
jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    environment: production
    steps:
    - name: Checkout
      uses: actions/checkout@v3
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v2
      with:
        role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-deploy-role
        aws-region: ap-northeast-1
    - name: Login to Amazon ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v1
    - name: Build, tag, and push image to Amazon ECR
      id: build-image
      env:
        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        ECR_REPOSITORY: my-app-repo
        IMAGE_TAG: ${{ github.sha }}
      run: |
        docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
        docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
        echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
    - name: Deploy to Amazon ECS
      uses: aws-actions/amazon-ecs-deploy-task-definition@v1
      with:
        task-definition: ${{ secrets.ECS_TASK_DEFINITION_FAMILY }}
        service: ${{ secrets.ECS_SERVICE_NAME }}
        cluster: ${{ secrets.ECS_CLUSTER_NAME }}
        image: ${{ steps.build-image.outputs.image }}
        wait-for-service-stability: true