Fix prod login by enabling ALB sticky sessions for SQLite backend

infrastructure/environments/prod/main.tf

@@ -172,6 +172,10 @@ module "alb" {
   frontend_container_port    = var.frontend_container_port
   frontend_health_check_path = var.frontend_health_check_path
 
+  # Sticky sessions required: backend uses SQLite (local file DB) so all
+  # requests from a client must route to the same task to preserve sessions.
+  enable_stickiness = true
+
   enable_deletion_protection = true # Protect production ALB
 }
 

infrastructure/modules/alb/main.tf

@@ -1,4 +1,4 @@
 # =============================================================================
 # ALB Module
 # Creates Application Load Balancer with optional HTTPS
 # =============================================================================
@@ -8,7 +8,7 @@
 # -----------------------------------------------------------------------------
 
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 
 # ELB service account for access logs (varies by region)
 data "aws_elb_service_account" "main" {}
@@ -342,6 +342,15 @@
     matcher             = "200"
   }
 
+  dynamic "stickiness" {
+    for_each = var.enable_stickiness ? [1] : []
+    content {
+      type            = "lb_cookie"
+      cookie_duration = var.stickiness_duration
+      enabled         = true
+    }
+  }
+
   tags = merge(var.tags, {
     Name = "${var.project_name}-${var.environment}-tg"
   })
@@ -496,7 +505,7 @@
 # Route53 Record (optional)
 # -----------------------------------------------------------------------------
 
 data "aws_route53_zone" "main" {
   count = var.domain_name != "" && var.route53_zone_id != "" ? 1 : 0
 
   zone_id = var.route53_zone_id
@@ -533,7 +542,7 @@
   ttl     = 60
 }
 
 resource "aws_acm_certificate_validation" "main" {
   count = var.domain_name != "" && var.certificate_arn == "" && var.route53_zone_id != "" ? 1 : 0
 
   certificate_arn         = aws_acm_certificate.main[0].arn

infrastructure/modules/alb/variables.tf

@@ -107,6 +107,18 @@ variable "access_logs_prefix" {
 # Frontend Configuration (Optional)
 # -----------------------------------------------------------------------------
 
+variable "enable_stickiness" {
+  description = "Enable sticky sessions on backend target group (required when using SQLite with multiple backend tasks)"
+  type        = bool
+  default     = false
+}
+
+variable "stickiness_duration" {
+  description = "Duration (in seconds) for sticky session cookies"
+  type        = number
+  default     = 86400
+}
+
 variable "frontend_container_port" {
   description = "Port the frontend container listens on (set > 0 to enable frontend routing)"
   type        = number