Sygnal production CI/CD

[wcjord]

Summary

Production CI/CD for Sygnal is complete. Push to production branch builds, pushes to ECR, and deploys to production EC2 via SSM — mirroring the staging pipeline on main.

All infrastructure is in Terraform. See deployment.instructions.md for full details.

Testing

@TigToggle @Kelrap — please verify push notifications on your devices:

• iOS: Background the app on production, have someone send you a message. Confirm push notification arrives.
• Android: Background the app on production, have someone send you a message. Confirm push notification arrives.
• Staging iOS: Same test on staging (sygnal.staging.pangea.chat).
• Staging Android: Same test on staging.

Implementation PRs

• pangeachat/devops#50 — Terraform: ECR repo, OIDC role, ec2-ecr-pull policy
• pangeachat/devops#51 — Terraform: production DNS CNAME
• ci: add production CI/CD workflow #6 — CI/CD workflow + deployment docs
• pangeachat/synapse#103 — Ansible: production image switched to ECR

[wcjord]

Progress Update (2026-03-04)

Completed

• pangea-prod-sygnal ECR repo created and applied (devops#50)
• EC2 ecr-pull-prod policy on CloudWatchAgentServerRole (devops#50)
• github-deploy-prod OIDC role with SSM + ECR policies (devops#50)
• deploy-production.yml workflow — push to production branch triggers ECR build + SSM deploy (sygnal#6)
• Ansible vars updated: prod image switched from local to ECR (synapse#103)
• deployment.instructions.md updated with production CI/CD docs (sygnal#6)

PRs

• pangeachat/devops#50 — Terraform infrastructure (already applied)
• ci: add production CI/CD workflow #6 — CI/CD workflow + docs
• pangeachat/synapse#103 — Ansible prod vars

Remaining

• Merge PRs, create production branch, bootstrap Ansible on prod
• Move production DNS CNAME into Terraform
• Document install-aux requirement in bootstrap section

OIDC module note

Added create_oidc_provider variable to _modules/aws/github-oidc. Only one OIDC provider per AWS account — staging creates it, prod references it via data source (create_oidc_provider = false). Staging plan verified as no-op after the change.

ECR pull policy note

Both envs share CloudWatchAgentServerRole (created outside Terraform). Policies named ecr-pull (staging) and ecr-pull-prod (production) to avoid collision.

[Kelrap]

Worked on iOS