PR-A: CI safety + bootable ECS monolith + Odoo state on RDS

[ramaguruprakash]

PR-A of the piecewise production plan (docs/aws-arch-v2-plan.md, included here): make the AWS ECS stack safe, bootable, and durable — the base every later PR builds on. Read-only recon (documented in the plan) showed the ECS stack described by iac/ has never actually been deployed to account 470298448112, so this is a first-time bootstrap, not a migration.

Three parts, one PR, so the result is independently testable:

A1 — CI safety

• destroy-pipeline.yml no longer runs on push to main. It previously ran terraform destroy -auto-approve on every push to main, racing the deploy pipeline. Now workflow_dispatch only, gated on typing the cluster name.
• Removed the if: needs.deploy_aws_infrastructure.output.terraform_action != 'destroy' guards — that path doesn't exist (no job outputs are defined), so the conditions were always true; the destroy pipeline was also building and deploying images.
• Fixed the task-def render chain: the final deploy step used the backend render output, silently discarding the odoo image update (and the odoo-db step rendered with the odoo image).
• push-to-ecr.sh now pushes an explicit image list instead of grepping compose (which would have tried to push influxdb:1.8).

A2 — the monolith task can actually boot

• Removed the edge container from the AWS stack. Edges run in the field (or locally) and connect in over ws://<task>:8081; they are not cloud containers.
• openems-backend.sh renders the Felix configs (Metadata/Odoo, Timedata/InfluxDB) from env vars at startup. Defaults equal the docker-compose values, so local behavior is unchanged; ECS injects the RDS endpoint and Secrets Manager credentials through the same variables.
• Task definition rewritten (iac/ecs.tf is the source of truth; the CI JSON mirrors it and only gets image URIs stamped): ui (:8089) + backend (:8075/:8079/:8081/:8082) + odoo (:8069) + influxdb, localhost inter-container addressing (containers in one awsvpc task share a network namespace — the previous compose-style hostnames db/odoo16 could never resolve), correct essential flags, container healthchecks, 2 vCPU / 6 GB (was 4/12).
• Service deploys are stop-then-start (min 0 / max 100): the backend is a singleton (one websocket per edge, one telemetry writer) — two live copies must never coexist.
• ⚠️ InfluxDB storage is ephemeral in this task (lost on replacement) — accepted for the PR-A base; PR-B moves telemetry to a managed store.

A3 — Odoo state on RDS (durable base)

• App credentials are generated by Terraform into Secrets Manager and injected via ECS secrets; the execution role is scoped to that single ARN. Hardcoded/mismatched passwords removed from tfvars and the task-def JSON.
• RDS hardening: deletion protection, 14-day automated backups, final snapshot, encrypted storage. DB security group drops an ssh-from-anywhere rule (RDS has no SSH).
• Task security group trimmed to served ports only (8069 temp until the ALB PR, 8075, 8081, 8082, 8089). InfluxDB (:8086, no auth) is no longer internet-reachable.
• Postgres pinned to 15 everywhere — the local image had drifted to postgres:18, which refuses the PG-15 data directory and exceeds Odoo 16's support matrix; tfvars had 18.1. Local image, local data, and RDS now agree.

How it was tested (local — the compose stack mirrors the ECS task)

Check	Result
./setup.sh --edges 1 full bootstrap	✅ "All checks passed!" (backend→Postgres, backend→InfluxDB, Edge websocket, edge scheduler/RRD4j)
Entrypoint renders defaults	✅ pgHost="db", odooHost="odoo16" in the running container
ECS-style env override (fake RDS host + password containing " & | \)	✅ rendered config correct, quotes Felix-escaped
Edge connects through the env-rendered backend	✅ backend log: Edge.Websocket … Connections: 1; Metadata.Odoo registered edge0
Telemetry persisted	✅ InfluxQL query returns edge0 _sum/ProductionActivePower = 5000 W from measurement data
UI	✅ http://localhost:4200 → 200
terraform validate + terraform fmt -check (1.14, containerized)	✅ (validate caught and fixed an invalid SG description charset)
actionlint on both workflows	✅ clean
docker compose config	✅ clean
td JSON ↔ ecs.tf consistency (containers, cpu/mem)	✅ scripted comparison

Not testable locally (needs the account bootstrap below): terraform plan/apply, the actual Fargate boot, and the one-time Odoo DB init on AWS (odoo -d openems -i openems --stop-after-init via aws ecs run-task — runbook in the plan doc).

One-time bootstrap prerequisites (before first deploy)

1. S3 state bucket eiot-openems-tf-state-file (per iac/backend.tf; uses S3-native locking) — does not exist yet.
2. Valid AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/ECR_REGISTRY repo secrets with ECS/ECR/RDS/EC2/IAM/SecretsManager permissions (or move the pipeline to OIDC).
3. First deploy: run the Deploy Pipeline via workflow_dispatch on this branch.

Follow-ups (tracked in docs/aws-arch-v2-plan.md)

• PR-A2: bump jars — backend to 2026.1.0 (last monolithic release; upstream's own recommendation while the two-tier fixes #3795–#3798 remain unmerged), edge to 2026.7.0. This PR keeps the known-good 2025.11.0 jars to limit blast radius.
• PR-B: InfluxDB out of the task (managed store) · PR-C: Route 53 + ACM + ALB (wss://) · PR-D: split UI/Odoo into their own services · PR-E: observability, SES, mTLS.