Deploy via CI

Two manual GitHub Actions workflows run the whole lifecycle. Nothing runs on push — you trigger them from the Actions tab.

Workflow	What it does	Cost after
Deploy	tofu apply → build/push arm64 images → converge cluster → live smoke test	~€52/mo running
Teardown	scale fck-nat to 0 → tofu destroy	~€0/mo idle

Auth is GitHub OIDC → the vouch-ci IAM role (no stored keys). The runner reaches the k3s API through an SSM port-forward tunnel; port 6443 is not open to the internet at all.

First-time setup (once)

1. State bucket — already exists for this account; see infra/bootstrap/README.md.
2. Bootstrap the CI role (local, with SSO creds):

   cd infra/bootstrap
   AWS_PROFILE=<sso-profile> tofu init
   AWS_PROFILE=<sso-profile> tofu apply -var create_oidc_provider=false

   Use create_oidc_provider=false when the account already has the GitHub OIDC provider; drop it for a fresh account.
3. Repo variables (Settings → Secrets and variables → Actions → Variables), already set for mavills/vouch: AWS_ROLE_ARN, AWS_REGION, AWS_ACCOUNT_ID, ACME_EMAIL, ALERT_EMAIL.

Day to day

• Deploy / update: Actions → Deploy → Run workflow. Idempotent — run it any time to push new code or bring the stack back after a teardown. The run summary prints the live app./api./hyperdx. URLs (the domain changes after a teardown because the EIP is released).
• Tear down: Actions → Teardown → Run workflow → type destroy in the confirm box. Anything else aborts.

Notes and limits

• GitHub Actions’ free tier easily covers ~1 deploy/day.
• A deploy and a teardown can’t overlap (shared concurrency: vouch-infra).
• The vouch-ci role is broad (repo-scoped but ec2:*/iam:*); tightening it is tracked in the production roadmap.