feat(aws): add Orthodox Channel public S3 website origin

[xnoto]

Summary

• Add orthodox.channel to the central s3_web_buckets class, which owns the intentional public-read policy and S3 website configuration.
• Grant only the existing main-branch channel-project site-deployment role the minimum bucket/object actions needed to publish the static artifact.
• Preserve the private OAC-protected channel-project bucket, CloudFront distribution, and rollback path unchanged.

No linked issue.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass: OpenTofu test and plan succeeded for branch head 6d50e6c5985d25289b6b801bbc507bb9b875d818.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited: CI committed the terraform-docs README inventory update.
• Verified orthodox.channel returned S3 HeadBucket HTTP 404 immediately before authorship; the globally unique name was available at that time, but create-time availability remains AWS-authoritative.
• Independently reviewed the existing s3_web_buckets public-website class, the channel deployment role, and the public makeitwork.cloud S3/Cloudflare delivery reference.

Impact and rollout

• Producer: this root creates the public S3 website bucket and extends the deployment-role policy. Consumer: the separately authored channel-project dual-publish workflow will synchronize its built static artifact after this root's main apply succeeds.
• Main apply creates a new intentionally public S3 website bucket and grants only the existing main-branch deployment role access to it. It does not dispatch deployment, modify Cloudflare DNS/cache/TLS, alter CloudFront, attach ACM aliases, or change public traffic.
• Merge/apply this PR before the channel-project consumer PR. The later site-deploy dispatch and DNS cutover remain separate confirmation-gated stages.
• Rollback before DNS cutover is a reviewed removal of the public-origin consumer path; the private OAC bucket and CloudFront rollback infrastructure are untouched.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• The public-read surface is limited to the new orthodox.channel web-origin bucket through the existing central public-web bucket class. It is intentional and does not relax protections on the private OAC bucket.

AI assistance materially produced this change; reviewers should verify the bucket class membership, IAM resource scope, cross-repository ordering, and absence of changes to the private origin.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # aws_iam_role_policy.github_actions_channel_project_site_public_origin will be created
  + resource "aws_iam_role_policy" "github_actions_channel_project_site_public_origin" {
      + id          = (known after apply)
      + name        = "channel-project-site-public-origin"
      + name_prefix = (known after apply)
      + policy      = (known after apply)
      + role        = "github-actions-channel-project-site-deploy"
    }

  # aws_s3_bucket.web["orthodox.channel"] will be created
  + resource "aws_s3_bucket" "web" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "orthodox.channel"
      + bucket_domain_name          = (known after apply)
      + bucket_namespace            = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_region               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = "us-west-2"
      + request_payer               = (known after apply)
      + tags                        = {
          + "ManagedBy" = "Terraform"
        }
      + tags_all                    = {
          + "ManagedBy" = "Terraform"
        }
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket_policy.web["orthodox.channel"] will be created
  + resource "aws_s3_bucket_policy" "web" {
      + bucket = "orthodox.channel"
      + id     = (known after apply)
      + policy = (known after apply)
      + region = "us-west-2"
    }

  # aws_s3_bucket_public_access_block.web["orthodox.channel"] will be created
  + resource "aws_s3_bucket_public_access_block" "web" {
      + block_public_acls       = false
      + block_public_policy     = false
      + bucket                  = "orthodox.channel"
      + id                      = (known after apply)
      + ignore_public_acls      = false
      + region                  = "us-west-2"
      + restrict_public_buckets = false
    }

  # aws_s3_bucket_website_configuration.web["orthodox.channel"] will be created
  + resource "aws_s3_bucket_website_configuration" "web" {
      + bucket           = "orthodox.channel"
      + id               = (known after apply)
      + region           = "us-west-2"
      + routing_rules    = (known after apply)
      + website_domain   = (known after apply)
      + website_endpoint = (known after apply)

      + index_document {
          + suffix = "index.html"
        }

      + routing_rule (known after apply)
    }

Plan: 5 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:

  # aws_iam_role_policy.github_actions_channel_project_site_public_origin will be created
  + resource "aws_iam_role_policy" "github_actions_channel_project_site_public_origin" {
      + id          = (known after apply)
      + name        = "channel-project-site-public-origin"
      + name_prefix = (known after apply)
      + policy      = (known after apply)
      + role        = "github-actions-channel-project-site-deploy"
    }

  # aws_s3_bucket.web["orthodox.channel"] will be created
  + resource "aws_s3_bucket" "web" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "orthodox.channel"
      + bucket_domain_name          = (known after apply)
      + bucket_namespace            = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_region               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = "us-west-2"
      + request_payer               = (known after apply)
      + tags                        = {
          + "ManagedBy" = "Terraform"
        }
      + tags_all                    = {
          + "ManagedBy" = "Terraform"
        }
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + cors_rule (known after apply)

      + grant (known after apply)

      + lifecycle_rule (known after apply)

      + logging (known after apply)

      + object_lock_configuration (known after apply)

      + replication_configuration (known after apply)

      + server_side_encryption_configuration (known after apply)

      + versioning (known after apply)

      + website (known after apply)
    }

  # aws_s3_bucket_policy.web["orthodox.channel"] will be created
  + resource "aws_s3_bucket_policy" "web" {
      + bucket = "orthodox.channel"
      + id     = (known after apply)
      + policy = (known after apply)
      + region = "us-west-2"
    }

  # aws_s3_bucket_public_access_block.web["orthodox.channel"] will be created
  + resource "aws_s3_bucket_public_access_block" "web" {
      + block_public_acls       = false
      + block_public_policy     = false
      + bucket                  = "orthodox.channel"
      + id                      = (known after apply)
      + ignore_public_acls      = false
      + region                  = "us-west-2"
      + restrict_public_buckets = false
    }

  # aws_s3_bucket_website_configuration.web["orthodox.channel"] will be created
  + resource "aws_s3_bucket_website_configuration" "web" {
      + bucket           = "orthodox.channel"
      + id               = (known after apply)
      + region           = "us-west-2"
      + routing_rules    = (known after apply)
      + website_domain   = (known after apply)
      + website_endpoint = (known after apply)

      + index_document {
          + suffix = "index.html"
        }

      + routing_rule (known after apply)
    }

Plan: 5 to add, 0 to change, 0 to destroy.