LANGFUSE × EKS
FARGATE 部署方案

terraform-aws-langfuse-no-domain-test/
├── main.tf                     # 入口: provider 配置 + module 调用 + 参数覆盖
├── setup.sh                    # 部署后脚本: 自动修复 NEXTAUTH_URL
├── .terraform.lock.hcl         # Provider 版本锁定
└── module/
    ├── versions.tf             # Terraform / Provider 版本约束
    ├── variables.tf            # 所有可调参数 (26 个)
    ├── locals.tf               # 局部变量 (tag 命名)
    ├── outputs.tf              # 输出: cluster 信息 / ALB DNS / bucket
    ├── vpc.tf                  # VPC + Subnets + NAT + VPC Endpoints
    ├── eks.tf                  # EKS Cluster + Fargate Profile + OIDC
    ├── ingress.tf              # ALB Controller (IAM + Helm)
    ├── langfuse.tf             # Langfuse Helm values + K8s Secret
    ├── postgresql.tf           # Aurora PostgreSQL Serverless v2
    ├── redis.tf                # ElastiCache Redis 7.1
    ├── clickhouse.tf           # ClickHouse EFS PV + Access Points
    ├── s3.tf                   # S3 Bucket + IRSA Role + Lifecycle
    ├── efs.tf                  # EFS + CSI Driver + StorageClass
    └── tls-certificate.tf      # ACM + Route53 (enable_dns=true 时)

# 方式一: 环境变量
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...
export AWS_DEFAULT_REGION=us-east-1

# 方式二: profile
aws configure --profile langfuse-deploy
export AWS_PROFILE=langfuse-deploy

provider "aws" {
  region = "us-east-1"   # ← 改为目标 Region
}

module "langfuse" {
  source = "./module"

  # ====== 域名 (二选一) ======
  domain     = "langfuse-test.local"   # 无域名模式 (测试推荐)
  enable_dns = false
  # domain   = "langfuse.yourcompany.com"  # 有域名模式 (生产)
  # enable_dns = true

  # ====== 规模配置 ======
  name                      = "langfuse"
  use_single_nat_gateway    = true      # true=省$32/月
  postgres_instance_count   = 1         # 2=生产 HA
  postgres_min_capacity     = 0.5       # ACU
  postgres_max_capacity     = 2.0
  cache_instance_count      = 1         # 2=生产
  clickhouse_replicas       = 2         # 最少 2
  langfuse_web_replicas     = 1
  langfuse_worker_replicas  = 1
  use_encryption_key        = false     # 生产建议 true

  # ====== 资源限制 ======
  langfuse_cpu              = "0.5"
  langfuse_memory           = "1Gi"
  clickhouse_cpu            = "0.5"
  clickhouse_memory         = "2Gi"
  clickhouse_keeper_cpu     = "0.25"
  clickhouse_keeper_memory  = "0.5Gi"
}

cd terraform-aws-langfuse-no-domain-test

terraform init                     # 初始化 provider
terraform plan -out=plan.tfplan    # 预览变更
terraform apply plan.tfplan        # 执行 (约 25-35 分钟)

bash setup.sh
# 1. aws eks update-kubeconfig 配置 kubectl
# 2. 等待 ALB DNS 就绪 (最长 5 分钟)
# 3. helm upgrade 设置正确的 NEXTAUTH_URL
# 4. 等待 web Pod Ready

terraform output alb_dns_url
# http://langfuse-xxxx.us-east-1.elb.amazonaws.com

kubectl get pods -n langfuse
# langfuse-web-xxx                1/1   Running
# langfuse-worker-xxx             1/1   Running
# langfuse-clickhouse-shard0-0-0  1/1   Running
# langfuse-clickhouse-shard0-1-0  1/1   Running
# langfuse-zookeeper-0            1/1   Running
# langfuse-zookeeper-1            1/1   Running

kubectl get ingress -n langfuse
# 浏览器打开 ALB URL → 注册管理员账号

module "langfuse" {
  source = "./module"

  domain     = "langfuse.yourcompany.com"
  enable_dns = true

  name                      = "langfuse"
  use_single_nat_gateway    = false     # 每 AZ 一个 NAT
  postgres_instance_count   = 2         # Multi-AZ
  postgres_min_capacity     = 1.0
  postgres_max_capacity     = 8.0
  cache_instance_count      = 2
  redis_multi_az            = true
  redis_at_rest_encryption  = true
  clickhouse_replicas       = 3
  langfuse_web_replicas     = 2
  langfuse_worker_replicas  = 2
  use_encryption_key        = true

  langfuse_cpu              = "2"
  langfuse_memory           = "4Gi"
  clickhouse_cpu            = "2"
  clickhouse_memory         = "8Gi"
  clickhouse_keeper_cpu     = "1"
  clickhouse_keeper_memory  = "2Gi"

  ingress_inbound_cidrs     = ["10.0.0.0/8", "172.16.0.0/12"]
}

terraform destroy                  # 全量销毁 (约 15-20 分钟)

# ⚠ EFS PV 为 Retain 策略，需手动清理
# ⚠ S3 开启了版本控制，先清空对象:
aws s3 rm s3://langfuse-test-local-langfuse --recursive
terraform destroy

# Pod 无法调度 (Fargate Profile 未就绪)
kubectl describe pod -n langfuse <pod-name>
aws eks list-fargate-profiles --cluster-name langfuse   # 状态应为 ACTIVE

# ALB 未创建
kubectl get ingress -n langfuse -o yaml
kubectl logs -n kube-system -l app.kubernetes.io/name=aws-load-balancer-controller

# ClickHouse CrashLoop
kubectl logs -n langfuse langfuse-clickhouse-shard0-0-0
kubectl describe pv clickhouse-data-0                   # 检查 EFS 挂载

# 数据库连接失败
kubectl logs -n langfuse -l app.kubernetes.io/component=web | grep -iE "postgres|redis"
# 检查安全组是否放行 VPC CIDR

# NEXTAUTH 错误 (OAuth 回调失败)
helm get values langfuse -n langfuse | grep nextauth    # 须与实际访问 URL 一致