fix(platform): make groups core service

Author: casey-brooks

README.md

@@ -68,22 +68,17 @@ Default domain and port: `agyn.dev` on `2496`.
 - OpenFGA API: https://openfga.agyn.dev:2496/
 - OpenFGA Playground: https://openfga-playground.agyn.dev:2496/
 
-## Optional NATS JetStream event bus
+## NATS JetStream event bus
 
-The platform stack can deploy NATS JetStream for durable service-to-service
-events used by private Networks and the Groups service. Groups is wired into
-the platform stack and depends on NATS, so enable both when applying the
-platform stack:
+The platform stack deploys NATS JetStream for durable service-to-service
+events used by private Networks and the Groups service. Groups is wired as a
+core platform service and depends on NATS so it is created after the event bus.
 
-```sh
-terraform -chdir=stacks/platform apply -var='groups_enabled=true' -var='nats_enabled=true'
-```
-
-The local deployment creates the `nats` Argo CD application in the platform
-namespace, enables JetStream file storage with a PVC, configures the
-`AGYN_GROUPS` and `AGYN_NETWORKS` streams, and deploys the `groups-db` and
-`groups` Argo CD applications when `groups_enabled=true`. The stable in-cluster
-endpoint is available from the platform stack output `nats_endpoint`.
+The local deployment creates the `nats`, `groups-db`, and `groups` Argo CD
+applications in the platform namespace, enables JetStream file storage with a
+PVC, and configures the `AGYN_GROUPS` and `AGYN_NETWORKS` streams. The stable
+in-cluster endpoint is available from the platform stack output
+`nats_endpoint`.
 
 ## DEV/E2E-only diagnostics credentials
 

stacks/platform/README.md

@@ -38,16 +38,10 @@ Platform charts are pulled from the GHCR OCI registry (`ghcr.io/agynio/charts`).
 
 ### NATS JetStream event bus
 
-NATS JetStream is required by the Groups service and disabled by default so
-existing local stacks keep their previous footprint. Enable it together with
-Groups using platform stack variables:
-
-```bash
-terraform -chdir=stacks/platform apply -var='groups_enabled=true' -var='nats_enabled=true'
-```
-
-When enabled, Terraform creates an Argo CD application named `nats` in the
-platform namespace using the upstream NATS Helm chart. The application enables
+NATS JetStream is required by the Groups service and is deployed as a core
+platform application. Terraform creates an Argo CD application named `nats` in
+the platform namespace using the upstream NATS Helm chart. The application
+enables
 JetStream file storage with a PVC (`nats_jetstream_file_store_pvc_size`,
 default `10Gi`) and a matching file store max size
 (`nats_jetstream_file_store_max_size`, default `10Gi`). The stable in-cluster
@@ -70,10 +64,10 @@ stream config changes delete and recreate the Job instead of attempting an
 immutable Job update. Stream retention knobs follow the NATS API schema: age and
 duplicate window values are in nanoseconds, and size values are in bytes.
 
-The Groups service is disabled by default for backwards compatibility. Set
-`groups_enabled=true` to deploy the `groups-db` and `groups` Argo CD
-applications. Terraform enforces `nats_enabled=true` for the Groups application
-because the chart is configured to use the in-cluster NATS endpoint above.
+The Groups service is deployed as a core platform application together with its
+`groups-db` PostgreSQL application. The Groups application depends on `nats`,
+`groups-db`, `authorization`, and `identity` so it is created after the event
+bus and required platform services.
 
 ### Graph persistence
 
@@ -93,7 +87,8 @@ Verify persistence by:
 |-----------|--------------------|-------------------------------------|-------|
 | 5         | `platform-db`      | PostgreSQL for platform workloads   | Uses chart `oci://ghcr.io/agynio/charts/postgres-helm` with inline Helm values |
 | 18        | `k8s-runner`       | Kubernetes workspace runner         | Uses cluster-wide RBAC; TCP-only runner mode |
-| 18        | `groups`           | Groups service                      | Optional; set `groups_enabled=true`; depends on `groups-db`, `authorization`, `identity`, and `nats` |
+| 16        | `nats`             | NATS JetStream event bus            | Required by Groups and private Networks |
+| 18        | `groups`           | Groups service                      | Depends on `groups-db`, `authorization`, `identity`, and `nats` |
 | 20        | `platform-server`  | Core platform API                   | Depends on `platform-db` |
 | 25        | `platform-ui`      | Platform web UI                     | Connects to `platform-server` |
 

stacks/platform/main.tf

@@ -1664,17 +1664,6 @@ resource "random_password" "cluster_admin_token" {
   special = false
 }
 
-resource "terraform_data" "groups_requires_nats" {
-  count = var.groups_enabled ? 1 : 0
-
-  lifecycle {
-    precondition {
-      condition     = var.nats_enabled
-      error_message = "Groups requires NATS JetStream. Set nats_enabled=true when groups_enabled=true."
-    }
-  }
-}
-
 resource "openfga_relationship_tuple" "cluster_admin" {
   store_id               = module.openfga_authorization.store_id
   authorization_model_id = module.openfga_authorization.model_id
@@ -3035,8 +3024,6 @@ resource "argocd_application" "organizations_db" {
 }
 
 resource "argocd_application" "groups_db" {
-  count = var.groups_enabled ? 1 : 0
-
   depends_on = [argocd_repository.ghcr]
   wait       = true
 
@@ -3704,8 +3691,6 @@ resource "argocd_application" "notifications_redis" {
 }
 
 resource "argocd_application" "nats" {
-  count = var.nats_enabled ? 1 : 0
-
   depends_on = [argocd_repository.nats_repo]
   wait       = true
 
@@ -4194,13 +4179,10 @@ resource "argocd_application" "organizations" {
 }
 
 resource "argocd_application" "groups" {
-  count = var.groups_enabled ? 1 : 0
-
   depends_on = [
-    terraform_data.groups_requires_nats[0],
     argocd_repository.ghcr,
-    argocd_application.nats[0],
-    argocd_application.groups_db[0],
+    argocd_application.nats,
+    argocd_application.groups_db,
     argocd_application.authorization,
     argocd_application.identity,
   ]

stacks/platform/outputs.tf

@@ -1,6 +1,6 @@
 output "platform_app_names" {
   description = "Names of Argo CD applications managed by this stack"
-  value = concat([
+  value = [
     argocd_application.platform_db.metadata[0].name,
     argocd_application.threads_db.metadata[0].name,
     argocd_application.metering_db.metadata[0].name,
@@ -46,12 +46,15 @@ output "platform_app_names" {
     argocd_application.tracing_app.metadata[0].name,
     argocd_application.gateway.metadata[0].name,
     argocd_application.llm_proxy.metadata[0].name,
-  ], argocd_application.groups_db[*].metadata[0].name, argocd_application.groups[*].metadata[0].name, argocd_application.nats[*].metadata[0].name)
+    argocd_application.groups_db.metadata[0].name,
+    argocd_application.nats.metadata[0].name,
+    argocd_application.groups.metadata[0].name,
+  ]
 }
 
 output "platform_app_ids" {
   description = "Identifiers returned by the Argo CD provider for the applications"
-  value = concat([
+  value = [
     argocd_application.platform_db.id,
     argocd_application.threads_db.id,
     argocd_application.metering_db.id,
@@ -97,7 +100,10 @@ output "platform_app_ids" {
     argocd_application.tracing_app.id,
     argocd_application.gateway.id,
     argocd_application.llm_proxy.id,
-  ], argocd_application.groups_db[*].id, argocd_application.groups[*].id, argocd_application.nats[*].id)
+    argocd_application.groups_db.id,
+    argocd_application.nats.id,
+    argocd_application.groups.id,
+  ]
 }
 
 output "platform_namespace" {

stacks/platform/variables.tf

@@ -113,12 +113,6 @@ variable "groups_chart_version" {
   default     = "0.1.0"
 }
 
-variable "groups_enabled" {
-  type        = bool
-  description = "Enable the Groups service and its PostgreSQL database"
-  default     = false
-}
-
 variable "identity_chart_version" {
   type        = string
   description = "Version of the identity Helm chart published to GHCR"
@@ -330,12 +324,6 @@ variable "notifications_redis_addr" {
   default     = "notifications-redis-master.platform.svc.cluster.local:6379"
 }
 
-variable "nats_enabled" {
-  type        = bool
-  description = "Enable NATS JetStream deployment for durable platform events"
-  default     = false
-}
-
 variable "nats_jetstream_file_store_pvc_size" {
   type        = string
   description = "Persistent volume claim size for the NATS JetStream file store"