I need a CDKv2 stack, written in python, that sets up the infrastructure for a second stack. This first stack should:

- A VPC and its associated subnets, route tables, etc.
- A Route 53 hosted zone for your DNS records
- An ACM-managed TLS certificate (used by API Gateway later)
- An API Gateway VPC Link and its security group. This is how API GW “reaches in” to the container running in your VPC.
- A Cloud Map namespace.

Import from . import VPC_ID, and HOSTED_ZONE_ID and use them instead of createing a VPC and a new hosted zone.

Create a second stack that is passed the infrastructure stack to deploy a containerized web app. This second stack contains everything specific to a single application hosted on example.com. You would deploy multiple stacks from this template, one for each serverless app you have developed. It contains:

- An ECS task definition
- IAM roles for your ECS task definition
- A CloudMap service. This holds the IP addresses of your running containers
- An ECS service. This runs one copy of your task and registers/deregisters Fargate IPs with the CloudMap service when tasks start and stop.
- A security group for your ECS service that only allows the VPC link to make requests to it.
- An API gateway that forwards all requests to the CloudMap service via the VPC link.
- An API Gateway API mapping and Route 53 record to make your API accessible at my-app.example.com.

Note that the ECS task definition contains a health check. This is because API Gateway itself doesn’t perform health, have ECS run curl inside the container.

FROM python:3.9-slim-bookworm AS app

WORKDIR /app

ARG UID=1000
ARG GID=1000

RUN apt-get update \
    && apt-get install -y --no-install-recommends build-essential curl libpq-dev \
    && rm -rf /var/lib/apt/lists/* /usr/share/doc /usr/share/man \
    && apt-get clean \
    && groupadd -g "${GID}" python \
    && useradd --create-home --no-log-init -u "${UID}" -g "${GID}" python \
    && mkdir -p /public_collected public \
    && chown python:python -R /public_collected /app

USER python

COPY --chown=python:python requirements.txt ./

RUN pip3 install --no-warn-script-location --no-cache-dir --user -r requirements.txt

ARG DEBUG="false"
ENV DEBUG="${DEBUG}" \
    PYTHONUNBUFFERED="true" \
    PYTHONPATH="." \
    PATH="${PATH}:/home/python/.local/bin" \
    USER="python" \
    DJANGO_SETTINGS_MODULE="config.production"

COPY --chown=python:python . .

RUN if [ "${DEBUG}" = "false" ]; then \
    python3 manage.py collectstatic --no-input; \
    else mkdir -p /app/public_collected; fi

EXPOSE 5555

CMD ["gunicorn", "-b", "0.0.0.0:5555", "-w", "4", "--worker-tmp-dir", "/dev/shm", "mindikatta.wsgi"]

FROM python:3.9-slim-bookworm AS app

WORKDIR /app

RUN apt-get update \
    && apt-get install -y --no-install-recommends build-essential curl libpq-dev \
    && rm -rf /var/lib/apt/lists/* /usr/share/doc /usr/share/man \
    && apt-get clean

COPY requirements.txt ./

RUN pip3 install --no-cache-dir -r requirements.txt

ARG DEBUG="false"
ENV DEBUG="${DEBUG}" \
    PYTHONUNBUFFERED="true" \
    PYTHONPATH="." \
    PATH="${PATH}:/home/python/.local/bin" \
    DJANGO_SETTINGS_MODULE="config.production"

COPY . .

EXPOSE 3000

CMD ["gunicorn", "-b", "0.0.0.0:3000", "-w", "4", "--worker-tmp-dir", "/dev/shm", "mindikatta.wsgi"]

apiVersion: v1
kind: Secret
metadata:
  name: myapp-database-secret
  namespace: myapp
type: Opaque
stringData:
  database_url: "postgres://<username>:<password>@<location>:5432/postgres"

kubectl create secret docker-registry dockerreg --docker-server=docker.io --docker-username=someone --docker-password=a_password --docker-email=somebody@example.com --namespace myapp

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
  namespace: myapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - name: myapp
          image: someone/myapp
          imagePullPolicy: Always
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: myapp-service
  name: myapp-service
  namespace: myapp
spec:
  ports:
    - name: "5555-80"
      port: 5555
      protocol: TCP
      targetPort: 80
  selector:
    app: myapp
  sessionAffinity: None
  type: ClusterIP
status:
  loadBalancer: {}
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-ingress
  annotations:
    ingress.kubernetes.io/ssl-redirect: "false"
  namespace: myapp
spec:
  rules:
    - host: myapp.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myapp-service
                port:
                  number: 5555