twinmind-deploy-integration

name	twinmind-deploy-integration
description	Deploy TwinMind integrations to production environments. Use when deploying to cloud platforms, configuring production infrastructure, or setting up deployment automation. Trigger with phrases like "deploy twinmind", "twinmind production deploy", "twinmind cloud deployment", "twinmind infrastructure".
allowed-tools	Read, Write, Edit, Bash(npm:*), Bash(docker:*), Grep
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>

TwinMind Deploy Integration

Overview

Deploy TwinMind integrations to production cloud environments.

Prerequisites

• Completed twinmind-ci-integration setup
• Cloud provider account (AWS, GCP, or Azure)
• Docker installed (for containerized deployments)
• Terraform or Pulumi (for IaC)

Instructions

Step 1: Docker Configuration

# Dockerfile
FROM node:20-alpine AS builder

WORKDIR /app

# Install dependencies
COPY package*.json ./
RUN npm ci --only=production

# Copy source
COPY . .

# Build TypeScript
RUN npm run build

# Production image
FROM node:20-alpine AS runner

WORKDIR /app

# Security: run as non-root
RUN addgroup -g 1001 -S nodejs && \
    adduser -S twinmind -u 1001 -G nodejs

# Copy built assets
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./

USER twinmind

ENV NODE_ENV=production
ENV PORT=8080

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1

CMD ["node", "dist/index.js"]

# docker-compose.yml
version: '3.8'

services:
  twinmind-service:
    build: .
    ports:
      - "8080:8080"
    environment:
      - NODE_ENV=production
      - TWINMIND_API_KEY=${TWINMIND_API_KEY}
      - TWINMIND_WEBHOOK_SECRET=${TWINMIND_WEBHOOK_SECRET}
      - DATABASE_URL=${DATABASE_URL}
      - REDIS_URL=${REDIS_URL}
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      replicas: 2
      resources:
        limits:
          cpus: '1'
          memory: 512M
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  redis:
    image: 
    
       
    
       


  

Step 2: AWS Deployment (ECS/Fargate)

# terraform/aws/main.tf
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
}

# Secrets Manager for API keys
resource "aws_secretsmanager_secret" "twinmind" {
  name = "twinmind-api-credentials"
}

resource "aws_secretsmanager_secret_version" "twinmind" {
  secret_id = aws_secretsmanager_secret.twinmind.id
  secret_string = jsonencode({
    api_key        = var.twinmind_api_key
    webhook_secret = var.twinmind_webhook_secret
  })
}

# ECS Cluster
resource "aws_ecs_cluster" "main" {
  name = "twinmind-cluster"

  setting {
    name  = "containerInsights"
    value = "enabled"
  }
}

# Task Definition
resource "aws_ecs_task_definition" "twinmind" {
  family                   = "twinmind-service"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = 512
  memory                   = 1024
  execution_role_arn       = aws_iam_role.ecs_execution.arn
  task_role_arn            = aws_iam_role.ecs_task.arn

  container_definitions = jsonencode([
    {
      name  = "twinmind"
      image = "${aws_ecr_repository.twinmind.repository_url}:latest"

      portMappings = [
        {
          containerPort = 8080
          protocol      = "tcp"
        }
      ]

      environment = [
        { name = "NODE_ENV", value = "production" },
        { name = "PORT", value = "8080" }
      ]

      secrets = [
        {
          name      = "TWINMIND_API_KEY"
          valueFrom = "${aws_secretsmanager_secret.twinmind.arn}:api_key::"
        },
        {
          name      = "TWINMIND_WEBHOOK_SECRET"
          valueFrom = "${aws_secretsmanager_secret.twinmind.arn}:webhook_secret::"
        }
      ]

      logConfiguration = {
        logDriver = "awslogs"
        options = {
          awslogs-group         = aws_cloudwatch_log_group.twinmind.name
          awslogs-region        = var.aws_region
          awslogs-stream-prefix = "ecs"
        }
      }

      healthCheck = {
        command     = ["CMD-SHELL", "wget -q --spider http://localhost:8080/health || exit 1"]
        interval    = 30
        timeout     = 5
        retries     = 3
        startPeriod = 60
      }
    }
  ])
}

# ECS Service
resource "aws_ecs_service" "twinmind" {
  name            = "twinmind-service"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.twinmind.arn
  desired_count   = 2
  launch_type     = "FARGATE"

  network_configuration {
    subnets          = var.private_subnet_ids
    security_groups  = [aws_security_group.ecs.id]
    assign_public_ip = false
  }

  load_balancer {
    target_group_arn = aws_lb_target_group.twinmind.arn
    container_name   = "twinmind"
    container_port   = 8080
  }

  deployment_circuit_breaker {
    enable   = true
    rollback = true
  }
}

# Auto-scaling
resource "aws_appautoscaling_target" "twinmind" {
  max_capacity       = 10
  min_capacity       = 2
  resource_id        = "service/${aws_ecs_cluster.main.name}/${aws_ecs_service.twinmind.name}"
  scalable_dimension = "ecs:service:DesiredCount"
  service_namespace  = "ecs"
}

resource "aws_appautoscaling_policy" "cpu" {
  name               = "cpu-autoscaling"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.twinmind.resource_id
  scalable_dimension = aws_appautoscaling_target.twinmind.scalable_dimension
  service_namespace  = aws_appautoscaling_target.twinmind.service_namespace

  target_tracking_scaling_policy_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ECSServiceAverageCPUUtilization"
    }
    target_value       = 70.0
    scale_in_cooldown  = 300
    scale_out_cooldown = 60
  }
}

Step 3: GCP Deployment (Cloud Run)

# terraform/gcp/main.tf
terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

# Secret Manager for API keys
resource "google_secret_manager_secret" "twinmind_api_key" {
  secret_id = "twinmind-api-key"

  replication {
    auto {}
  }
}

resource "google_secret_manager_secret_version" "twinmind_api_key" {
  secret      = google_secret_manager_secret.twinmind_api_key.id
  secret_data = var.twinmind_api_key
}

# Cloud Run Service
resource "google_cloud_run_v2_service" "twinmind" {
  name     = "twinmind-service"
  location = var.region

  template {
    scaling {
      min_instance_count = 1
      max_instance_count = 10
    }

    containers {
      image = "${var.region}-docker.pkg.dev/${var.project_id}/twinmind/service:latest"

      ports {
        container_port = 8080
      }

      env {
        name  = "NODE_ENV"
        value = "production"
      }

      env {
        name = "TWINMIND_API_KEY"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.twinmind_api_key.secret_id
            version = "latest"
          }
        }
      }

      resources {
        limits = {
          cpu    = "1"
          memory = "512Mi"
        }
      }

      startup_probe {
        http_get {
          path = "/health"
          port = 8080
        }
        initial_delay_seconds = 10
        period_seconds        = 10
        failure_threshold     = 3
      }

      liveness_probe {
        http_get {
          path = "/health"
          port = 8080
        }
        period_seconds = 30
      }
    }

    service_account = google_service_account.twinmind.email
  }

  traffic {
    percent = 100
    type    = "TRAFFIC_TARGET_ALLOCATION_TYPE_LATEST"
  }
}

# Service Account
resource "google_service_account" "twinmind" {
  account_id   = "twinmind-service"
  display_name = "TwinMind Service Account"
}

# Allow access to secrets
resource "google_secret_manager_secret_iam_member" "twinmind" {
  secret_id = google_secret_manager_secret.twinmind_api_key.id
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.twinmind.email}"
}

Step 4: Kubernetes Deployment

# k8s/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: twinmind-service
  labels:
    app: twinmind
spec:
  replicas: 2
  selector:
    matchLabels:
      app: twinmind
  template:
    metadata:
      labels:
        app: twinmind
    spec:
      serviceAccountName: twinmind
      containers:
        - name: twinmind
          image: your-registry/twinmind:latest
          ports:
            - containerPort: 8080
          env:
            - name: NODE_ENV
              value: "production"
            - name: TWINMIND_API_KEY
              valueFrom:
                secretKeyRef:
                  name: twinmind-secrets
                  key: api-key
            - name: TWINMIND_WEBHOOK_SECRET
              
                
                   
                   
          
            
               
               
            
               
               
          
            
               
               
             
             
          
            
               
               
             
             
          
             
             
             

 
 

   

  
     
  
      
       
   

 
 

   

  
     
     
     
   
   
  
      
      
         
        
           
           

Step 5: GitHub Actions Deployment

# .github/workflows/deploy.yml
name: Deploy TwinMind Service

on:
  push:
    branches: [main]
    tags: ['v*']

env:
  AWS_REGION: us-east-1
  ECR_REPOSITORY: twinmind

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    outputs:
      image: ${{ steps.build.outputs.image }}

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to ECR
         
         

           
         
        
             
             
         
  
     
     
     

    
        

          
         
        
             
             
             

          
         
          
         
  
     [, ]
     
     

    
        

          
         
        
             
             
             

          
         
          
         

Output

• Docker configuration files
• AWS ECS/Fargate Terraform
• GCP Cloud Run Terraform
• Kubernetes manifests
• GitHub Actions deployment workflow

Error Handling

Issue	Cause	Solution
Image pull failed	Registry auth	Verify credentials
Health check failed	Service not ready	Increase start period
Scaling not working	Metrics missing	Check monitoring config
Secrets not found	IAM permissions	Update service account

Resources

• AWS ECS Documentation
• GCP Cloud Run Documentation
• Kubernetes Documentation

Next Steps

For webhook handling, see twinmind-webhooks-events.