# AWS Deployment Notes

These notes describe the fastest sensible AWS deployment shape for the Anglo-Suisse Capital prototype while keeping secrets server-side and preserving a path to a more production-ready architecture.

## Recommended prototype deployment

- Web app: deploy the Next.js app on AWS App Runner or as a container on ECS Fargate
- API: deploy the Fastify API as a separate AWS App Runner service or ECS Fargate service
- File storage: S3 bucket for uploaded documents and original artifacts
- Persistent storage: RDS PostgreSQL when replacing the current file-backed prototype state
- Identity: Amazon Cognito user pool for internal users if demo auth is replaced
- Secrets: AWS Secrets Manager or SSM Parameter Store for `OPENAI_API_KEY`, SuiteCRM credentials, JWT secret, and Google OAuth secrets
- Auth for internal users: Amazon Cognito user pool with the API configured using `COGNITO_ISSUER` and `COGNITO_AUDIENCE` or `COGNITO_CLIENT_ID`

## Fastest initial environment split

- `dev`: local-only
- `staging`: first deployed internal prototype
- `prod`: only after SuiteCRM live integration, real auth, and audit review are complete

Keep separate values for:

- `OPENAI_API_KEY`
- `JWT_SECRET`
- `COGNITO_ISSUER`
- `COGNITO_AUDIENCE`
- `COGNITO_CLIENT_ID`
- `SUITECRM_*`
- any Google OAuth settings
- `NEXT_PUBLIC_API_BASE_URL`

## Suggested App Runner shape

### Web service

- Source: containerized Next.js app from `apps/web`
- Public HTTPS endpoint
- Environment:
  - `NEXT_PUBLIC_API_BASE_URL=https://<api-service-url>`

### API service

- Source: containerized Fastify app from `apps/api`
- Public or private HTTPS endpoint depending on internal network expectations
- Environment:
  - `PORT`
  - `CORS_ORIGIN`
  - `AUTH_MODE`
  - `COGNITO_*`
  - `OPENAI_*`
  - `SUITECRM_*`
  - `GMAIL_MODE`

## Security notes

- Keep all API keys and SuiteCRM credentials on the server side only
- Do not expose SuiteCRM credentials or OpenAI credentials in the web app
- Enforce HTTPS only
- Restrict internal access using Cognito, reverse-proxy access control, VPN, or IP allowlisting if required by Anglo-Suisse Capital
- Enable S3 encryption at rest
- Prefer encrypted RDS storage and automated backups once PostgreSQL is introduced
- Redact or minimize sensitive audit payloads before moving beyond prototype use

## Live SuiteCRM rollout sequence

1. Confirm whether Anglo-Suisse Capital Sales Leads maps to `Cases` or another module.
2. Confirm the real field names for assignee, status/stage, source, campaign, and `Client notes`.
3. Create a dedicated SuiteCRM service user such as `codex.crm.assistant`.
4. Configure `SUITECRM_MODE=live` in staging only.
5. Use the Settings diagnostics screen to confirm module existence and field discovery before enabling write testing.
6. Test create and update flows in staging before any production usage.

## Containerization notes

- Keep the web and API as separate containers
- Pass env vars at deploy time rather than baking them into images
- Exclude `prototype-data`, `.next`, and `node_modules` from source bundles

## Phase 2 infrastructure upgrades

- Move from file-backed state to PostgreSQL
- Move document storage fully to S3 with signed URLs
- Add CloudWatch dashboards and alarms for API errors and failed SuiteCRM writes
- Add structured request tracing
- Add private networking for the API if SuiteCRM access requires it
