From 3eef52b1a9b90c158907540283aafd59b63ff322 Mon Sep 17 00:00:00 2001
From: Jon Miller <jon@treehouse.pro>
Date: Mon, 15 Sep 2025 13:38:51 -0400
Subject: [PATCH 1/2] Add `additional_env_vars` to end of env vars list so they
 can override defaults, instead of being overridden.

This is necessary when migrating an existing database for the `ENCRYPTION_KEY` variable to be used.
---
 modules/aws_ecs/locals.tf     | 10 +++++-----
 modules/aws_ecs_ec2/locals.tf |  8 ++++----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/modules/aws_ecs/locals.tf b/modules/aws_ecs/locals.tf
index a58c2bb..01cec9f 100644
--- a/modules/aws_ecs/locals.tf
+++ b/modules/aws_ecs/locals.tf
@@ -24,7 +24,6 @@ locals {
   ecs_telemetry_fluentbit_image = var.ecs_telemetry_fluentbit_image != "" ? var.ecs_telemetry_fluentbit_image : format("%s:%s", "tryretool/retool-aws-for-fluent-bit", split(":", var.ecs_retool_image)[1])
 
   environment_variables = concat(
-    var.additional_env_vars, # add additional environment variables
     local.base_environment_variables,
     local.temporal_mtls_config,
     var.code_executor_enabled ? [
@@ -109,7 +108,8 @@ locals {
         "name" : "WORKFLOW_TEMPORAL_TLS_ENABLED",
         "value" : tostring(var.temporal_cluster_config.tls_enabled)
       }
-    ]
+    ],
+    var.additional_env_vars, # add additional environment variables after defaults so they can override when necessary
   )
 
   task_log_configuration = (
@@ -123,7 +123,7 @@ locals {
         auto_create_group = "true"
         log_stream_prefix = "SERVICE_RETOOL/"
       }
-    } : {
+      } : {
       logDriver = "awslogs"
       options = {
         awslogs-group         = aws_cloudwatch_log_group.this.id
@@ -143,7 +143,7 @@ locals {
         memory    = var.launch_type == "EC2" ? var.ecs_task_resource_map["fluentbit"]["memory"] : null
 
         firelensConfiguration = {
-          type    = "fluentbit"
+          type = "fluentbit"
           options = {
             config-file-type  = "file"
             config-file-value = "/extra.conf"
@@ -152,7 +152,7 @@ locals {
 
         logConfiguration = {
           logDriver = "awslogs"
-          options   = {
+          options = {
             awslogs-group         = aws_cloudwatch_log_group.this.id
             awslogs-region        = var.aws_region
             awslogs-stream-prefix = "SERVICE_RETOOL"
diff --git a/modules/aws_ecs_ec2/locals.tf b/modules/aws_ecs_ec2/locals.tf
index 7a14150..f62c8b3 100644
--- a/modules/aws_ecs_ec2/locals.tf
+++ b/modules/aws_ecs_ec2/locals.tf
@@ -1,6 +1,5 @@
 locals {
   environment_variables = concat(
-    var.additional_env_vars, # add additional environment variables
     [
       {
         name  = "NODE_ENV"
@@ -47,9 +46,10 @@ locals {
         "value" : var.retool_license_key
       },
       {
-        "name": "DEPLOYMENT_TEMPLATE_TYPE"
-        "value": "aws-ecs-ec2-terraform-deprecated"
+        "name" : "DEPLOYMENT_TEMPLATE_TYPE"
+        "value" : "aws-ecs-ec2-terraform-deprecated"
       }
-    ]
+    ],
+    var.additional_env_vars, # add additional environment variables if provided so they can override defaults
   )
 }

From 224773d71fb1d89bfd74a0685c00701257fab5b4 Mon Sep 17 00:00:00 2001
From: Jon Miller <jon@treehouse.pro>
Date: Mon, 15 Sep 2025 13:45:18 -0400
Subject: [PATCH 2/2] cleanup autoformat on save

---
 modules/aws_ecs/locals.tf     | 6 +++---
 modules/aws_ecs_ec2/locals.tf | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/modules/aws_ecs/locals.tf b/modules/aws_ecs/locals.tf
index 01cec9f..987368b 100644
--- a/modules/aws_ecs/locals.tf
+++ b/modules/aws_ecs/locals.tf
@@ -123,7 +123,7 @@ locals {
         auto_create_group = "true"
         log_stream_prefix = "SERVICE_RETOOL/"
       }
-      } : {
+    } : {
       logDriver = "awslogs"
       options = {
         awslogs-group         = aws_cloudwatch_log_group.this.id
@@ -143,7 +143,7 @@ locals {
         memory    = var.launch_type == "EC2" ? var.ecs_task_resource_map["fluentbit"]["memory"] : null
 
         firelensConfiguration = {
-          type = "fluentbit"
+          type    = "fluentbit"
           options = {
             config-file-type  = "file"
             config-file-value = "/extra.conf"
@@ -152,7 +152,7 @@ locals {
 
         logConfiguration = {
           logDriver = "awslogs"
-          options = {
+          options   = {
             awslogs-group         = aws_cloudwatch_log_group.this.id
             awslogs-region        = var.aws_region
             awslogs-stream-prefix = "SERVICE_RETOOL"
diff --git a/modules/aws_ecs_ec2/locals.tf b/modules/aws_ecs_ec2/locals.tf
index f62c8b3..7f637a6 100644
--- a/modules/aws_ecs_ec2/locals.tf
+++ b/modules/aws_ecs_ec2/locals.tf
@@ -46,8 +46,8 @@ locals {
         "value" : var.retool_license_key
       },
       {
-        "name" : "DEPLOYMENT_TEMPLATE_TYPE"
-        "value" : "aws-ecs-ec2-terraform-deprecated"
+        "name": "DEPLOYMENT_TEMPLATE_TYPE"
+        "value": "aws-ecs-ec2-terraform-deprecated"
       }
     ],
     var.additional_env_vars, # add additional environment variables if provided so they can override defaults