Phase 1 tasks: Adding opentofu terraform templates for deploying droplets / DOKS clusters. by dhruvmalik007 · Pull Request #5 · jAIMSnet/jaimsnet

dhruvmalik007 · 2026-03-07T20:22:57Z

Summary

This PR commences the PRJ-032 ( OpenTofu automations for deploying the WeOwn AI offerings) that was discussed in the W09 of the season 3. this merge adds the opentofu digital ocean provider in order to:

Infrastructure deployment Automation: define the templates for the setup of the droplets and the k8s clusters for hosting the environment with secured ( no unused ports open, firewall setup and associating with the given security policy).
Lifecycle management: lets you setup the virtual environment packaged CLI that creates the wrapper around the pre-existing CLI's ( doctl : for authorizing the user session , opentofu cli for setting up the infrastructure etc). in order to manage the whole setup lifecycle for the weown lifecycle of deploying the various services ( observability, gpu instances and others that are going to be defined in the other folders).

Type of Change

✨ Feature — new capability or component
🐛 Fix — bug fix or correction
📝 Docs — documentation only
🏗️ Infra — infrastructure / IaC change
🔒 Security — security improvement or policy
♻️ Refactor — code/structure reorganization, no behavior change

Related Issue:

Its the followup of the #4 with the focus on start expanding the iac folder with the necessary template code as defined in the corresponding README.

Testing steps:

Tested successfully to onboard the digital ocean account by user setting up their digital ocean access token ( Weown-ctl init account using underlying the doctl cli setup)
Tested the deployment of the anythingllm setup ( with the defined docker-compose and Dockerfile from the given setup) .

Test	Result
Tested successfully to onboard the digital ocean account by user setting up their digital ocean access token ( `Weown-ctl init account using underlying the doctl cli setup`)	Successfull
testing the deployment of the droplet with configured anythingllm setup	Successfull

Checklist

No secrets, passwords, API keys, or tokens committed
README updated if adding new components or directories
ADR created/updated if a significant architectural decision was made
Phase label added to this PR
CODEOWNERS is accurate for changed paths

Reviewer Notes

This pull request introduces a new Terraform environment (lite) and a reusable module for deploying AnythingLLM on DigitalOcean, along with a CLI tool for managing deployments. The changes enable automated provisioning of a secure droplet, firewall configuration, DNS integration, and container orchestration for AnythingLLM, as well as providing outputs and variables for customization. Additionally, a Python CLI project is scaffolded to streamline deployment and authentication.

Infrastructure provisioning and automation:

Added iac/environments/lite/main.tf, outputs.tf, and variables.tf to define a new Terraform environment for deploying AnythingLLM on DigitalOcean, including provider setup, droplet module usage, output values, and customizable variables. [1] [2] [3]
Introduced iac/modules/droplet/main.tf, outputs.tf, variables.tf, and a cloudinit.yaml template to encapsulate droplet creation, firewall rules, DNS record management, and automated container deployment via Docker Compose and Caddy, with modular support for Watchtower. [1] [2] [3] [4]

CLI tool for deployment management:

Scaffolded the weown-cli Python project with pyproject.toml, main entrypoint, and authentication helper (auth.py), leveraging Typer, Rich, Questionary, and pydo for interactive DigitalOcean deployment management and token verification. [1] [2] [3]

…ofu tf description.

…defining the templates for the setting up of the anythingllm + caddy reverse proxy setup for SSL domain deployment.

… py sdk integration in order to deploy , check the deployment logs and status of the previous droplet deployments.

…map along with the toolings description).

…eral roadmap

--> adding the litellm jAIMS endpoinnt and its configuration with the anythingLLM integration setup. --> updating also the iac cli configuration setup.

…/dhruvmalik007/jaimsnet ( sync from the core repo) to local branch (ldc/add-weown-ai-offers-template)

…he @romaindid

…e and environment structure with updated CLI support.

… current version

…ices and update CLI components.

--> Refactor droplet module for generic use ( by removing the explicit adding of do_token), --> introduce environment-specific cloud-init templates, --> update CLI for token handling.

…CLI. 2. Environment variable and add OpenTofu documentation and Uptime Kuma cloud-init template.

Copilot

Pull request overview

Adds Phase 1 infrastructure automation for DigitalOcean using OpenTofu, including reusable IaC modules, two environments (lite droplet + production DOKS stack), and a new Python CLI (weown-cli) to drive interactive Lite deployments with isolated local state.

Changes:

Introduces OpenTofu modules for core DigitalOcean resources (droplet, VPC, DOKS, DB, DNS, load balancer) and composes them into lite and production environments.
Adds weown-cli (Typer-based) to authenticate, deploy, list, tail logs, and destroy Lite instances with per-account/per-deployment state isolation.
Expands iac/README.md significantly with architecture/ops documentation and updates .gitignore for CLI artifacts.

Reviewed changes

Copilot reviewed 33 out of 36 changed files in this pull request and generated 22 comments.

Show a summary per file

File	Description
iac/weown-cli/uv.lock	Adds a uv lockfile pinning Python CLI dependencies.
iac/weown-cli/src/weown_cli/state.py	Implements local OpenTofu state isolation, tfvars writing, and tofu command execution helpers.
iac/weown-cli/src/weown_cli/cli.py	Adds Typer CLI commands for auth, deploy wizard, logs, destroy, listing, and advanced tofu operations.
iac/weown-cli/src/weown_cli/auth.py	Implements local token storage, env/doctl fallback token retrieval, DO token verification, and Infisical client bootstrap.
iac/weown-cli/src/weown_cli/init.py	Package init file (empty).
iac/weown-cli/pyproject.toml	Defines the `weown-cli` Python project metadata and dependencies and registers the console script.
iac/weown-cli/main.py	Provides a simple entrypoint to run the Typer app.
iac/opentofu/modules/vpc/variables.tf	Defines inputs for VPC module (name/region/ip_range with CIDR validation).
iac/opentofu/modules/vpc/outputs.tf	Exposes VPC identifiers and allocated CIDR output.
iac/opentofu/modules/vpc/main.tf	Provisions a DigitalOcean VPC.
iac/opentofu/modules/load-balancer/variables.tf	Defines load balancer inputs (name/region/vpc/cluster/nodeports).
iac/opentofu/modules/load-balancer/outputs.tf	Exposes LB IP and ID outputs.
iac/opentofu/modules/load-balancer/main.tf	Provisions a DigitalOcean load balancer and attempts to attach DOKS node droplets dynamically.
iac/opentofu/modules/droplet/variables.tf	Defines droplet inputs including ssh keys, VPC attachment, tags, and cloud-init user_data.
iac/opentofu/modules/droplet/outputs.tf	Exposes droplet ID and IP outputs.
iac/opentofu/modules/droplet/main.tf	Provisions a DigitalOcean Droplet with monitoring/IPv6 and optional VPC attachment.
iac/opentofu/modules/doks-cluster/variables.tf	Defines DOKS cluster and autoscaling node pool inputs.
iac/opentofu/modules/doks-cluster/outputs.tf	Exposes DOKS ID/endpoint and kubeconfig/token/CA outputs.
iac/opentofu/modules/doks-cluster/main.tf	Provisions a DigitalOcean Kubernetes cluster with an autoscaling node pool.
iac/opentofu/modules/dns/variables.tf	Defines DNS module inputs for zone, routing records, and TXT records.
iac/opentofu/modules/dns/outputs.tf	Exposes DNS zone identifiers and created record FQDNs.
iac/opentofu/modules/dns/main.tf	Creates a DO domain zone and routing/TXT records.
iac/opentofu/modules/database/variables.tf	Defines managed PostgreSQL cluster inputs.
iac/opentofu/modules/database/outputs.tf	Exposes DB host/port and generated connection URIs for LiteLLM/Langfuse.
iac/opentofu/modules/database/main.tf	Provisions a DO managed PostgreSQL cluster, DBs/users, and a VPC firewall rule.
iac/opentofu/environments/production/variables.tf	Defines production environment parameters (region, DOKS sizing, domain/DNS, SSH allowlists).
iac/opentofu/environments/production/templates/cloudinit-uptime-kuma.yaml	Adds cloud-init to install and run Uptime Kuma via systemd on a droplet.
iac/opentofu/environments/production/providers.tf	Configures required providers and wires Kubernetes/Helm providers to DOKS outputs.
iac/opentofu/environments/production/outputs.tf	Exposes production environment outputs for VPC, DOKS kubeconfig, DB URIs, and DNS.
iac/opentofu/environments/production/main.tf	Composes modules/resources: VPC, DB, DOKS, ArgoCD (Helm), LB, DNS, and Uptime Kuma droplet+firewall.
iac/opentofu/environments/lite/variables.tf	Defines Lite droplet deployment parameters including API access CIDRs and LiteLLM gateway settings.
iac/opentofu/environments/lite/templates/cloudinit.yaml	Adds cloud-init to install Docker+Caddy and run AnythingLLM (and optionally Watchtower) via Docker Compose.
iac/opentofu/environments/lite/outputs.tf	Exposes Lite droplet outputs including IP, SSH command, and AnythingLLM URL.
iac/opentofu/environments/lite/main.tf	Composes Lite droplet + firewall + optional DNS A record.
iac/README.md	Major expansion of IaC architecture/usage documentation and operational guidance.
.gitignore	Adds ignore pattern for Python bytecode artifacts (weown-cli).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

iac/weown-cli/src/weown_cli/auth.py

iac/weown-cli/src/weown_cli/state.py

iac/opentofu/modules/load-balancer/main.tf

iac/opentofu/environments/production/main.tf

iac/weown-cli/src/weown_cli/cli.py

iac/weown-cli/src/weown_cli/auth.py

iac/README.md

…les . Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…ical for secret management, and OpenTofu.

…ces including LiteLLM, Redis, Langfuse, and AnythingLLM, with OpenTofu IaC and Infisical secret

… Infisical secret management, and refine IaC configurations.

…up, including deployment scripts and gateway configurations.

…and production environment setup, and a new `weown-cli` gateway.

…/dhruvmalik007/jaimsnet into ldc/add-weown-ai-offers-template

Copilot

Pull request overview

Copilot reviewed 59 out of 62 changed files in this pull request and generated 20 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

iac/weown-cli/src/weown_cli/cli.py

iac/opentofu/modules/load-balancer/main.tf

iac/weown-cli/src/weown_cli/cli.py

iac/weown-cli/src/weown_cli/state.py

iac/weown-cli/src/weown_cli/cli.py

iac/weown-cli/src/weown_cli/gateway.py

iac/opentofu/environments/lite/templates/cloudinit.yaml

iac/README.md

iac/weown-cli/pyproject.toml

…d later).

…romandid

…romandid and @Mshahid).

…iles.

removing the gitops implementation ( thats the phase 3 implementation for @rmn) . replacing to the default version for the iac documentation ( to be in detailed explained only for opentofu phase 1 tasks).

dhruvmalik007 · 2026-03-14T07:16:23Z

@romandidomizio You can again tun the test and check whether the opentofu templates are aligned or not. also argo CD templates are removed.

dhruvmalik007 added 9 commits March 7, 2026 12:26

Defining the general environents for the lite variables via the opent…

a9b6199

…ofu tf description.

chore: define the opentofu digitalocean template for the droplet and …

3a950f3

…defining the templates for the setting up of the anythingllm + caddy reverse proxy setup for SSL domain deployment.

Feat: defining the initial version of weown-cli with the digitalOcean…

a952599

… py sdk integration in order to deploy , check the deployment logs and status of the previous droplet deployments.

WIP: generating readme ( general description of the overall repo road…

590cb0a

…map along with the toolings description).

updating the readme more precisely.

50d05ea

updating readme with the phased architecture along with the jAIMS gen…

cb58c50

…eral roadmap

Merge branch 'main' into ldc/add-weown-ai-offers-template

dd43502

feat: resolve mistake of adding doctl vis aws cli in readme.

9f30f9e

--> adding the litellm jAIMS endpoinnt and its configuration with the anythingLLM integration setup. --> updating also the iac cli configuration setup.

Merge branch 'ldc/add-weown-ai-offers-template' of https://github.com…

a45ead2

…/dhruvmalik007/jaimsnet ( sync from the core repo) to local branch (ldc/add-weown-ai-offers-template)

dhruvmalik007 self-assigned this Mar 12, 2026

dhruvmalik007 added 5 commits March 12, 2026 19:15

structuring the environment files vis a vis the structuredefined by t…

9ec052b

…he @romaindid

restructuring contd.

14b1f1a

feat: Migrate IAC from Terraform to OpenTofu, introducing a new modul…

b0a6599

…e and environment structure with updated CLI support.

shifting the templates from the previous droplet integration with the…

05f33fc

… current version

feat: Introduce OpenTofu for infrastructure provisioning of core serv…

5c87398

…ices and update CLI components.

dhruvmalik007 changed the title ~~WIP: Adding opentofu terraform templates for deploying droplets and connecting with pre-existing architecture.~~ Phase 1 tasks: Adding opentofu terraform templates for deploying droplets / DOKS clusters. Mar 12, 2026

dhruvmalik007 requested review from Copilot and removed request for Copilot March 12, 2026 18:27

Copilot started reviewing on behalf of dhruvmalik007 March 12, 2026 18:27 View session

dhruvmalik007 added 2 commits March 13, 2026 00:06

feat:

ff1bc4e

--> Refactor droplet module for generic use ( by removing the explicit adding of do_token), --> introduce environment-specific cloud-init templates, --> update CLI for token handling.

1. Refactoring: Update DigitalOcean token handling to use underlying …

2141da7

…CLI. 2. Environment variable and add OpenTofu documentation and Uptime Kuma cloud-init template.

dhruvmalik007 requested a review from Copilot March 12, 2026 19:08

Copilot started reviewing on behalf of dhruvmalik007 March 12, 2026 19:08 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

update the correct description of the directory for the opentofu/modu…

4504c93

…les . Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

dhruvmalik007 requested a review from romandidomizio March 12, 2026 20:36

dhruvmalik007 added 4 commits March 13, 2026 02:44

feat: Deploy core services and infrastructure using Kubernetes, Infis…

d4b3411

…ical for secret management, and OpenTofu.

feat: establish initial Kubernetes deployment for jAIMSnet core servi…

c9b88a8

…ces including LiteLLM, Redis, Langfuse, and AnythingLLM, with OpenTofu IaC and Infisical secret

feat: Implement Redis and Langfuse Kubernetes deployments, centralize…

7cca138

… Infisical secret management, and refine IaC configurations.

feat: Introduce OpenTofu documentation and initial infrastructure set…

045c48b

…up, including deployment scripts and gateway configurations.

dhruvmalik007 added 2 commits March 13, 2026 03:52

feat: Add Infisical Kubernetes configuration, OpenTofu documentation …

7f52d8e

…and production environment setup, and a new `weown-cli` gateway.

Merge branch 'ldc/add-weown-ai-offers-template' of https://github.com…

85a9417

…/dhruvmalik007/jaimsnet into ldc/add-weown-ai-offers-template

romandidomizio requested a review from Copilot March 12, 2026 22:56

Copilot started reviewing on behalf of romandidomizio March 12, 2026 22:56 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

romandidomizio marked this pull request as draft March 13, 2026 03:59

dhruvmalik007 added 7 commits March 13, 2026 12:31

remoing weown-cli: Not the part of the core iac module ( to be decide…

36b463d

…d later).

removing the scope creep ( redundant code and will be implemented by @…

61dbccb

…romandid and @Mshahid).

Resolving issue of docker compose is run without running compose prof…

1e6115d

…iles.

WIP: importing custom domain into the environments

d7bda60

removing the gitops implementation ( thats the phase 3 implementation for @rmn) . replacing to the default version for the iac documentation ( to be in detailed explained only for opentofu phase 1 tasks).

resolve the issue regarding the too much permissive ssh cidr's :

dfd1f57

contd: remove overtly permissive ssh to be done via localhost cidr.

12fbf1f

resolve the watchtower issue

89742d6

Conversation

dhruvmalik007 commented Mar 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Related Issue:

Testing steps:

Checklist

Reviewer Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dhruvmalik007 commented Mar 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dhruvmalik007 commented Mar 7, 2026 •

edited

Loading