Current tasks
Tracking the 6-step deployment flow from the project's Miro mapping board.
-
✅1. Fork repo
All 6 source repos cloned to a working dir, on a fresh
humanitibranch off each repo's existing default. Noupstreamremote pointing to Aseel — repos are operationally standalone.ASEEL-APP/humaniti_medusa_admin— React/Vite admin SPAASEEL-APP/humaniti_Backend— Medusa 1.20 serverASEEL-APP/humaniti_StoreFront— Next.js 14 SSR storefrontASEEL-APP/Humaniti_HumanitiOS_Frontend— React/Vite SPAASEEL-APP/Humaniti_AidOS_Widgets— Next 16 (currently OpenNext / Cloudflare Workers; needs port to AWS)ASEEL-APP/Humaniti_StaticAssets_CDN— precompiled static JS
-
⬜2. Empty (remove all Aseel data)
Code still contains Aseel-specific integrations and copy: Hesabpay payments, Mailchimp lists, Apple Sign-In config, Recombee ML, Aseel branding strings, asset URLs. Deferred until after first successful deploy — the principle is "deploy as-is, then rebrand one repo at a time" so we have a known-working baseline to compare against.
-
🟡3. Get a new Amazon server up with a new user
humaniti@aseelapp.comThe original plan was a separate AWS account (Organizations member, root email
humaniti+staging@aseelapp.com). The org's management account267897643464turned out to be inaccessible in this session, so account creation from a child account is blocked by AWS.Pivot: single-account isolation. Humaniti lives inside account
805102729295(the same account that hosts GoodSmith) but is fenced off by:- Naming prefix
humaniti-{staging|prod}-*on every resource - Tags
Project=Humaniti,Env=staging|prod,ManagedBy=terraform - Separate VPCs per environment (
10.10.0.0/16staging,10.20.0.0/16prod) - Always passing
--profileon AWS CLI calls — never running unscoped commands
- Naming prefix
-
✅4. Figure out the domain and get access
Using
humaniti.nasratkhalid.comfor now (registrar Name.com, owned by the team). The smith DigitalOcean droplet atsmith.nasratkhalid.comis untouched.Subdomain delegation set up: 4 NS records added at Name.com for host
humaniti, pointing to AWS Route 53 hosted zoneZ06723031XBY2LQL2JD8Q. Verified resolving end-to-end from Google DNS and AWS authoritative nameservers.From this point on, Name.com is never touched again — every record under
humaniti.nasratkhalid.comis managed by Terraform in thesharedenvironment. -
⬜5. Get Ferri customized + live
"Ferri" is the Backend (Medusa server). Live = reachable behind an ALB at a stable URL, with DB migrations run, talking to a Postgres in RDS, a Redis in ElastiCache, and a MeiliSearch on Fargate.
Foundation is in place (VPCs, subnets, NAT, state buckets, hosted zone). Compute layer is the next phase:
- ECR repos + push first container image
- RDS Postgres + ElastiCache Redis (~15 min provisioning wait for RDS)
- MeiliSearch Fargate task with EBS
- ECS cluster + ALB + Backend API + Backend worker services
- Run migrations, hit the API, verify HTTP 200
-
🟦6. Page design
The page you're looking at right now is the start of this. Static site hosted on AWS (S3 + CloudFront + ACM cert), HTTPS via the ACM cert in
us-east-1, served athumaniti.nasratkhalid.com. No backend yet — pure static, vanilla HTML/CSS, no frameworks.This page is also itself the deployment-status dashboard. As the rest of the system comes online, more buttons in the top nav will activate (Repos, Deploys, Services, Runbook).
What's live in AWS right now
Account 805102729295, region us-east-1. All resources tagged Project=Humaniti.
Networking
- Staging VPC
vpc-0a2bb148366347393—10.10.0.0/16, 6 subnets (3 tiers × 2 AZs), 1 NAT gateway - Prod VPC
vpc-0d4e17bb27e1d88c3—10.20.0.0/16, 6 subnets, 2 NAT gateways (per-AZ HA)
State + locking
- S3
humaniti-staging-tfstate-805102729295 - S3
humaniti-prod-tfstate-805102729295 - DynamoDB
humaniti-staging-tflock - DynamoDB
humaniti-prod-tflock
DNS
- Route 53 hosted zone
Z06723031XBY2LQL2JD8Qforhumaniti.nasratkhalid.com - Delegated from Name.com via 4 NS records (one-time, never touched again)
This page
- S3 bucket
humaniti-status-site-805102729295(private, OAC-only) - CloudFront distribution + ACM cert for
humaniti.nasratkhalid.com
Not yet built
- ECR repositories (one per service)
- Secrets Manager namespace (per env)
- RDS Postgres (staging + prod)
- ElastiCache Redis (staging + prod)
- MeiliSearch on Fargate + EBS
- ECS cluster + ALB
- Backend API service + Backend worker service
- StoreFront SSR service
- Admin SPA + HumanitiOS SPA + StaticAssets CDN (S3 + CloudFront)
- GitHub Actions OIDC trust → AWS for CI/CD
- Aseel-data removal pass (after first green deploy)
- AidOS Widgets port from Cloudflare Workers
- Real Humaniti production domain swap