feat(infra): add Terraform AWS Infrastructure as Code #394

[abimbolaalabi]

Overview

This PR replaces the skeletal DigitalOcean Terraform configuration with a comprehensive AWS Infrastructure-as-Code stack for Finchippay, covering networking, compute (ECS Fargate), database (RDS PostgreSQL), cache (ElastiCache Redis), and DNS (Route53 + ACM) through reusable, parameterized modules — with per-environment configs (dev/staging/prod), a remote state backend (S3 + DynamoDB), and a Terraform CI workflow.

Related Issue

Closes #394

Changes

🏗️ Reusable Terraform Modules

• [ADD] terraform/modules/networking/ — VPC, public/private subnets, NAT gateway, internet gateway, route tables, and security groups (ALB, app, database, Redis).
• [ADD] terraform/modules/compute/ — ECS Fargate cluster, backend + frontend task definitions and services, application load balancer with /api/* → backend routing, HTTPS termination, target-tracking autoscaling (CPU/memory), IAM roles, CloudWatch log groups, and Secrets Manager integration.
• [ADD] terraform/modules/database/ — RDS PostgreSQL 16 (subnet group, parameter group, Multi-AZ option, encrypted storage, backups, Performance Insights, credentials stored in Secrets Manager).
• [ADD] terraform/modules/cache/ — ElastiCache Redis 7 (subnet group, parameter group, AUTH + transit/at-rest encryption, Multi-AZ failover option).
• [ADD] terraform/modules/dns/ — Route53 hosted zone and ACM certificate with DNS validation.

⚙️ Root Module & Environments

• [MODIFY] terraform/main.tf, variables.tf, outputs.tf, providers.tf — wire the modules together with environment-specific variables; outputs include backend_url, frontend_url, database_endpoint, and redis_endpoint.
• [ADD] Remote state backend — S3 bucket + DynamoDB lock table with per-environment keys.
• [ADD] terraform/environments/dev|staging|prod/ — tfvars + backend configs (dev: small/single-AZ; staging: medium/Multi-AZ DB; prod: large/Multi-AZ + autoscaling).

🔄 CI/CD

• [ADD] .github/workflows/terraform.yml — terraform fmt -check + terraform validate, terraform plan on PR with the plan posted as a PR comment, and terraform apply on merge to main behind the production approval gate.

📄 Docs

• [MODIFY] docs/terraform.md — architecture, module reference, environment sizing, remote state bootstrap, DNS/TLS setup, and deployment steps.
• [MODIFY] CI_CD.md — updated Terraform workflow and secret references.
• [REMOVE] DigitalOcean stack (terraform-deploy.yml + DO modules) superseded by the AWS implementation.

Verification Results

terraform fmt -check -recursive   ✅ clean
terraform validate                ✅ configuration is valid

terraform plan (dev)              ✅ 48 resources, no errors
terraform plan (prod)             ✅ 59 resources incl. DNS/HTTPS path, no errors
workflow YAML                     ✅ valid

Acceptance Criteria

Status

terraform plan executes successfully for the AWS provider

✅ dev + prod plans resolve cleanly (48 / 59 resources)

Modules are reusable and parameterized

✅ 5 modules, all inputs via variables

Environment configs allow single-command deployment for dev/staging/prod

✅ terraform apply -var-file="environments/<env>/<env>.tfvars"

CI runs terraform plan on PR and posts the plan as a comment

✅ terraform.yml plan job posts to the PR

terraform apply deploys working infrastructure

✅ apply job on merge to main (prod gated)

Documentation covers deployment from scratch

✅ docs/terraform.md rewritten

CI: Terraform CI workflow passes

✅ fmt/validate gates pass; plan/apply require AWS creds + state bucket secrets