# `aurora`

The Pulumi program for the shared database tier: the CFX Aurora Postgres cluster, RDS Proxy (private, reader and public endpoints), the Valkey cache, and every workload's Postgres and Valkey identity ([`pulumi/workloadIdentities.ts`](./pulumi/workloadIdentities.ts)). The schema itself, its migrations and the Drizzle types live in [`db`](../db/README.md).

The Pulumi project is still named `cfx-db` (`dev` and `prod` stacks). State is keyed on that name, so it stays `cfx-db` even though the folder moved out of `packages/db`.

## Deploy

`deploy.yml` applies this stack alone, before `db:migrate`, whenever `aurora` is selected. It is the one stack whose `deploy` does not wait on the migration, because the migration runs against the roles it creates.

```sh
bun nx run aurora:pulumi-preview        # dev (default)
bun nx run aurora:pulumi-preview:prod
bun nx run aurora:deploy:dev
bun nx run aurora:deploy:prod
```

A ref deploy cannot name `aurora`: an old commit's stack would revert every change made since.

## Local workload roles

[`scripts/generate-local-roles.ts`](./scripts/generate-local-roles.ts) runs the stack's role and grant components under Pulumi mocks and writes them as SQL to `packages/db/test/fixtures/workload-roles.{before,after}.sql`, which `db`'s `startPostgres` applies to every local and test Postgres. After changing a role or grant here, regenerate and commit both files:

```sh
bun packages/aurora/scripts/generate-local-roles.ts
```

`test/localWorkloadRoles.test.ts` fails when the committed files are stale.