Wiki.js on AWS EKS Auto Mode

• Overview
  • Key Technologies
  • Layer Summary
  • Key Features
• Getting Started
  • Prerequisites
  • Deployment Options
  • Layer Apply Order
• Architecture
  • Design Drivers
  • Layer Responsibilities
• Documentation
• Security

This repository deploys a production-grade Wiki.js knowledge management platform on Amazon EKS Auto Mode using Infrastructure as Code. The deployment follows a layered architecture with strict separation of concerns: nine independent Terraform layers with isolated state, automated GitHub Actions workflows (OIDC to AWS, no repository secrets), and GitOps delivery via ArgoCD.

• AWS EKS Auto Mode - Kubernetes cluster with managed capabilities
• Terraform - 9 independent layers, isolated state per layer
• GitHub Actions - OIDC authentication, workflow_dispatch provision/destroy per layer
• ArgoCD - GitOps for Kubernetes workloads (internal by default)
• Amazon RDS PostgreSQL - External database for Wiki.js (managed master password)
• Amazon S3 - Mandatory Wiki.js assets storage (SSE-KMS)
• AWS Systems Manager Parameter Store - Inter-layer contract (non-secret values)
• AWS Secrets Manager - All secrets; none in code, logs, or Terraform state

Apply in order 00 → 01 → … → 50. Destroy in reverse 50 → … → 00.

• 00-bootstrap - State bucket, KMS keys, Parameter Store contract
• 01-dns-main - DNS IAM role in domain account (for Route 53)
• 10-network - VPC, subnets, security groups, VPC endpoints
• 20-eks - EKS Auto Mode cluster, OIDC/IRSA
• 30-data-rds - RDS PostgreSQL with managed master password
• 35-storage-s3-assets - S3 bucket (SSE-KMS) and IRSA role for Wiki.js
• 40-platform - Namespaces, Secrets Store CSI, storage drivers, logging
• 45-argocd - ArgoCD installation (internal by default)
• 50-app-wikijs - Wiki.js via ArgoCD, ALB ingress, Route 53 record

• No terraform_remote_state - Inter-layer communication only via Parameter Store
• Secrets in Secrets Manager only - Terraform references by ARN; workloads use Secrets Store CSI Driver
• IRSA/pod identity - No long-lived credentials in the cluster
• Cross-account DNS - Optional domain account; layer 01 creates DNS role, layer 50 assumes it for Route 53
• Resource naming - ${prefix}-${region}-<name>-${env} (e.g. wikijs-us-east-1-eks-sandbox)
• Two-apply for layer 50 - Run provision again after ArgoCD syncs Wiki.js so Route 53 and Parameter Store outputs can be published once the ALB exists

• AWS resources - Domain, Route 53 hosted zone, ACM certificate (deployment account, same region as ALB), and IAM roles: GitHub OIDC role in deployment account; for 01-dns-main only, an assumable role in the domain account.
• Terraform variables - Each layer has terraform.tfvars with env, region, prefix (e.g. wikijs). Bootstrap expects domain_name, wikijs_fqdn, hosted_zone_id, acm_cert_arn.
• See Prerequisites runbook for step-by-step AWS CLI commands.

Provision: 00-bootstrap → 01-dns-main → 10-network → 20-eks → 30-data-rds → 35-storage-s3-assets → 40-platform → 45-argocd → 50-app-wikijs.

Destroy: 50-app-wikijs → 45-argocd → … → 01-dns-main → 00-bootstrap. Per-layer destroy requires confirmation string DESTROY-<layer>-<env>-<region>. For tf-all-destroy, use DESTROY-ALL-<env>-<region> once.

RDS has deletion protection by default; disable it before destroying layer 30 (see Teardown).

• Layering - Each terraform/<layer>/ is a standalone root module with its own backend key. No terraform_remote_state across layers; inter-layer values only via SSM Parameter Store (prefix /<prefix>/<region>/<env>/<layer>/<key>).
• Secrets - All sensitive values in AWS Secrets Manager. Terraform and workflows reference by ARN only. Kubernetes consumes secrets via Secrets Store CSI Driver + SecretProviderClass.
• Wiki.js - Deployed on a dedicated FQDN (HTTPS), external PostgreSQL (RDS), and S3 assets backend with IRSA.

Diagrams: Terraform layer dependency, Request and data flows, GitOps delivery flow, Cross-account DNS. Full text: Architecture.

Summary of the security model (full details in Security considerations):

• Secrets - All in AWS Secrets Manager only; Terraform and workflows reference by ARN. No secrets in code, logs, or Terraform state. No GitHub repository secrets for sensitive data; role ARNs supplied as workflow inputs.
• IAM - Terraform execution and workload identities use least privilege. IRSA/pod identity for Wiki.js S3 access; no long-lived credentials in the cluster. Cross-account DNS uses a dedicated DNS role (layer 01) assumed by the deployment role in layer 50.
• Network - EKS and RDS in private subnets; ALB in public subnets. Security groups restrict RDS to cluster only. VPC endpoints for AWS APIs where applicable.
• State and Parameter Store - State in S3 with SSE-KMS and versioning; locking via S3 native lockfile. Parameter Store holds only non-secret contract values; no raw secrets.
• Destroy - Destroy workflows are workflow_dispatch only with typed confirmation; use GitHub Environment required reviewers on tf-<env>-<layer> to gate destroy.