Add oauth proxy and supporting ecr infra

terraform/ecr.tf

@@ -0,0 +1,33 @@
+resource "aws_ecr_repository" "dumpnet" {
+  name                 = "dumpnet/mcp-auth-proxy"
+  image_tag_mutability = "MUTABLE"
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+
+  encryption_configuration {
+    encryption_type = "AES256"
+  }
+}
+
+resource "aws_ecr_lifecycle_policy" "dumpnet" {
+  repository = aws_ecr_repository.dumpnet.name
+
+  policy = jsonencode({
+    rules = [{
+      rulePriority = 1
+      description  = "Keep last 5 images per tag prefix"
+      selection = {
+        tagStatus     = "any"
+        countType     = "imageCountMoreThan"
+        countNumber   = 5
+      }
+      action = { type = "expire" }
+    }]
+  })
+}
+
+output "ecr_registry" {
+  value = aws_ecr_repository.dumpnet.repository_url
+}

terraform/iam.tf

@@ -57,3 +57,25 @@ resource "aws_iam_role_policy" "node_secrets_manager" {
   })
 }
 
+
+# ECR pull access for node (to pull custom images like mcp-auth-proxy)
+resource "aws_iam_role_policy" "node_ecr" {
+  name = "ecr-pull"
+  role = aws_iam_role.node.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = [
+          "ecr:GetDownloadUrlForLayer",
+          "ecr:BatchGetImage",
+          "ecr:BatchCheckLayerAvailability",
+          "ecr:GetAuthorizationToken"
+        ]
+        Resource = "*"
+      }
+    ]
+  })
+}

terraform/terraform.tfvars

@@ -1,2 +1,2 @@
 hosted_zone_id = "Z068835512G0ZQJ9SJGOI"
-dns_records    = ["argocd", "todo", "git-mcp"]
+dns_records    = ["argocd", "todo", "git-mcp", "git-mcp-oauth"]