# AWS Deployment

Deploy Monetarie PIX on Amazon Web Services using EKS, RDS, ElastiCache, and MSK/NATS.

## Prerequisites

- AWS account with appropriate IAM permissions
- AWS CLI configured
- `eksctl` and `kubectl` installed
- Domain registered in Route 53

## Architecture

```mermaid
graph TB
    R53[Route 53] --> ALB[Application Load Balancer]
    ALB --> EKS[EKS Cluster<br/>3 nodes]

    subgraph VPC
        EKS --> RDS[(RDS PostgreSQL 16<br/>Multi-AZ)]
        EKS --> EC[(ElastiCache Redis 7)]
        EKS --> NATS[NATS on EC2<br/>3-node cluster]
    end

    EKS -->|Outbound| BACEN[BACEN RSFN]
```

## Infrastructure Setup

### VPC and Networking

```bash
# Create VPC with public and private subnets
aws ec2 create-vpc --cidr-block 10.0.0.0/16

# Create private subnets for EKS, RDS, ElastiCache
# Create public subnets for ALB
# Configure NAT Gateway for outbound BACEN access
```

### EKS Cluster

```bash
eksctl create cluster \
  --name monetarie-pix \
  --region sa-east-1 \
  --nodegroup-name workers \
  --node-type m5.2xlarge \
  --nodes 3 \
  --nodes-min 2 \
  --nodes-max 6 \
  --managed
```

### RDS PostgreSQL

```bash
aws rds create-db-instance \
  --db-instance-identifier monetarie-pix-db \
  --db-instance-class db.r6g.xlarge \
  --engine postgres \
  --engine-version 16.1 \
  --master-username monetarie_prod \
  --master-user-password "SECURE_PASSWORD" \
  --allocated-storage 500 \
  --storage-type gp3 \
  --multi-az \
  --vpc-security-group-ids sg-xxx \
  --db-subnet-group-name pix-db-subnet
```

Key RDS parameters:

| Parameter | Value | Purpose |
|-----------|-------|---------|
| `max_connections` | 6000 | Support POOL_SIZE=200 x 4 repos x 4 pods |
| `shared_buffers` | 8 GB | ~25% of instance RAM |
| `effective_cache_size` | 24 GB | ~75% of instance RAM |

### ElastiCache Redis

```bash
aws elasticache create-replication-group \
  --replication-group-id monetarie-pix-redis \
  --replication-group-description "Monetarie PIX Redis" \
  --engine redis \
  --engine-version 7.1 \
  --cache-node-type cache.r6g.large \
  --num-cache-clusters 2
```

### NATS Cluster (EC2)

Deploy 3 NATS nodes on EC2 instances with JetStream enabled:

```bash
# Launch 3 EC2 instances (t3.xlarge) in private subnets
# Install NATS Server 2.10 with JetStream
# Configure cluster routing between nodes
```

## Application Deployment

### ECR Repository

```bash
aws ecr create-repository --repository-name monetarie/pix-backend
aws ecr create-repository --repository-name monetarie/pix-frontend

# Build and push
docker build -t pix-backend:latest backend/
docker tag pix-backend:latest ACCOUNT.dkr.ecr.sa-east-1.amazonaws.com/monetarie/pix-backend:latest
docker push ACCOUNT.dkr.ecr.sa-east-1.amazonaws.com/monetarie/pix-backend:latest
```

### Secrets (AWS Secrets Manager)

```bash
aws secretsmanager create-secret \
  --name monetarie-pix/db-credentials \
  --secret-string '{"database-url":"postgres://...","secret-key-base":"..."}'
```

Use External Secrets Operator or IRSA to inject into pods.

### Deploy to EKS

```bash
kubectl create namespace pix
kubectl apply -f deploy/backend.yaml -n pix
kubectl apply -f deploy/admin-frontend.yaml -n pix
```

### ALB Ingress

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: pix-ingress
  namespace: pix
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:...
    alb.ingress.kubernetes.io/ssl-redirect: "443"
spec:
  rules:
    - host: pix.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: pix-backend
                port:
                  number: 4003
```

## Cost Estimate (sa-east-1)

| Resource | Instance | Monthly (USD) |
|----------|----------|---------------|
| EKS Cluster | Control plane | ~$73 |
| EC2 Workers (3x) | m5.2xlarge | ~$900 |
| RDS PostgreSQL | db.r6g.xlarge Multi-AZ | ~$800 |
| ElastiCache | cache.r6g.large x2 | ~$400 |
| NATS EC2 (3x) | t3.xlarge | ~$300 |
| ALB | Standard | ~$50 |
| **Total** | | **~$2,523** |

## Expected Outcome

After completing this deployment:

- EKS cluster running in sa-east-1 with 3+ worker nodes
- RDS Multi-AZ for database high availability
- ElastiCache Redis for caching and rate limiting
- NATS cluster for JetStream messaging
- ALB with TLS termination and Route 53 DNS