cloudformation.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "BuildBot",
  "Parameters": {
    "ApplicationName": {
      "Type": "String"
    },
    "ApplicationContainer": {
      "Type": "String"
    },
    "ApplicationVersion": {
      "Type": "String"
    },
    "ApiHost": {
      "Type": "String"
    },
    "LoadBalancerHostName": {
      "Type": "String"
    },
    "LoadBalancerPriority": {
      "Type": "Number"
    },
    "AwsContainerRegistry": {
      "Type": "String",
      "Default": "117769150821.dkr.ecr.eu-west-1.amazonaws.com"
    }
  },
  "Mappings": {
    "Settings": {
      "Values": {
        "TaskDefinitionCPU": "512",
        "TaskDefinitionMemory": "1024",
        "DesiredCount": "1",
        "MinimumHealthPercent": "100",
        "MaximumHealthPercent": "200",
        "SecretsManagerArn": "arn:aws:secretsmanager:eu-west-1:117769150821:secret:BuildBot-ph1YIJ",
        "ContainerPort": "8080",
        "ECSClusterName": "DiscordBots",
        "ApplicationContainerOwner": "funfair",
        "TaskExecutionRoleArn": "arn:aws:iam::117769150821:role/ecsTaskExecutionRole",
        "SecurityGroupIDs": "sg-e3e65a9a,sg-0272027302777cb4d",
        "SubnetIDs": "subnet-fabb50b3,subnet-d5ea03b2,subnet-c68aa09e",
        "VpcID": "vpc-ad3bd9ca",
        "LoadBalancerListenerArn": "arn:aws:elasticloadbalancing:eu-west-1:117769150821:listener/app/internal/fbd77c1a39a60f7f/e01c11e315c3ff6e",
        "HostedZoneName": "funfair.io.",
        "ApiCertificateArn": "arn:aws:acm:eu-west-1:117769150821:certificate/d9405a08-95c9-4924-acde-d86cda5f29e8",
        "VpcLinkEgressCidr": "172.31.0.0/16",
        "InternalAlbServerName": "buildbot.funfair.io",
        "ApiThrottlingBurstLimit": "20",
        "ApiThrottlingRateLimit": "10",
        "LogRetentionInDays": "30"
      }
    }
  },
  "Metadata": {
    "Application": {
      "Ref": "ApplicationName"
    },
    "Version": {
      "Ref": "ApplicationVersion"
    }
  },
  "Resources": {
    "TaskDefinition": {
      "Type": "AWS::ECS::TaskDefinition",
      "Properties": {
        "ContainerDefinitions": [
          {
            "Essential": true,
            "Image": {
              "Fn::Sub": [
                "${AwsContainerRegistry}/${Owner}/${ApplicationContainer}:${ApplicationVersion}",
                {
                  "Owner": {
                    "Fn::FindInMap": [
                      "Settings",
                      "Values",
                      "ApplicationContainerOwner"
                    ]
                  }
                }
              ]
            },
            "Name": {
              "Ref": "ApplicationName"
            },
            "Environment": [
              {
                "Name": "CLOUDFORMATION__AWS__REGION",
                "Value": {
                  "Ref": "AWS::Region"
                }
              }
            ],
            "Secrets": [
              {
                "Name": "DISCORD__WEBHOOKURL",
                "ValueFrom": {
                  "Fn::Sub": [
                    "${SecretsManagerArn}:DISCORD_WEBHOOK::",
                    {
                      "SecretsManagerArn": {
                        "Fn::FindInMap": [
                          "Settings",
                          "Values",
                          "SecretsManagerArn"
                        ]
                      }
                    }
                  ]
                }
              },
              {
                "Name": "CLOUDFORMATION__TOPICARN",
                "ValueFrom": {
                  "Fn::Sub": [
                    "${SecretsManagerArn}:SNS_TOPIC_ARN::",
                    {
                      "SecretsManagerArn": {
                        "Fn::FindInMap": [
                          "Settings",
                          "Values",
                          "SecretsManagerArn"
                        ]
                      }
                    }
                  ]
                }
              },
              {
                "Name": "CLOUDFORMATION__AWS__ACCESSKEYID",
                "ValueFrom": {
                  "Fn::Sub": [
                    "${SecretsManagerArn}:AWS_ACCESS_KEY_ID::",
                    {
                      "SecretsManagerArn": {
                        "Fn::FindInMap": [
                          "Settings",
                          "Values",
                          "SecretsManagerArn"
                        ]
                      }
                    }
                  ]
                }
              },
              {
                "Name": "CLOUDFORMATION__AWS__SECRETKEY",
                "ValueFrom": {
                  "Fn::Sub": [
                    "${SecretsManagerArn}:AWS_SECRET_KEY::",
                    {
                      "SecretsManagerArn": {
                        "Fn::FindInMap": [
                          "Settings",
                          "Values",
                          "SecretsManagerArn"
                        ]
                      }
                    }
                  ]
                }
              },
              {
                "Name": "GITHUB__WEBHOOKSECRET",
                "ValueFrom": {
                  "Fn::Sub": [
                    "${SecretsManagerArn}:GITHUB_WEBHOOK_SECRET::",
                    {
                      "SecretsManagerArn": {
                        "Fn::FindInMap": [
                          "Settings",
                          "Values",
                          "SecretsManagerArn"
                        ]
                      }
                    }
                  ]
                }
              }
            ],
            "LogConfiguration": {
              "LogDriver": "awslogs",
              "Options": {
                "awslogs-group": {
                  "Ref": "LogGroup"
                },
                "awslogs-region": {
                  "Ref": "AWS::Region"
                },
                "awslogs-stream-prefix": "ecs"
              }
            },
            "PortMappings": [
              {
                "ContainerPort": {
                  "Fn::FindInMap": [
                    "Settings",
                    "Values",
                    "ContainerPort"
                  ]
                },
                "HostPort": {
                  "Fn::FindInMap": [
                    "Settings",
                    "Values",
                    "ContainerPort"
                  ]
                },
                "Protocol": "tcp"
              }
            ],
            "HealthCheck": {
              "Command": [
                "CMD",
                "/usr/src/app/BuildBot",
                "--health-check",
                "http://127.0.0.1:8080/ping?source=docker"
              ],
              "Interval": "5",
              "Retries": "3",
              "StartPeriod": "5",
              "Timeout": "2"
            },
            "StartTimeout": "15",
            "StopTimeout": "15"
          }
        ],
        "Family": {
          "Ref": "ApplicationName"
        },
        "Cpu": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "TaskDefinitionCPU"
          ]
        },
        "Memory": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "TaskDefinitionMemory"
          ]
        },
        "ExecutionRoleArn": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "TaskExecutionRoleArn"
          ]
        },
        "RequiresCompatibilities": [
          "FARGATE"
        ],
        "NetworkMode": "awsvpc",
        "RuntimePlatform": {
          "CpuArchitecture": "ARM64",
          "OperatingSystemFamily": "LINUX"
        }
      }
    },
    "LogGroup": {
      "Type": "AWS::Logs::LogGroup",
      "DeletionPolicy": "Delete",
      "UpdateReplacePolicy": "Delete",
      "Properties": {
        "LogGroupName": {
          "Fn::Sub": "/ecs/${ApplicationName}/"
        },
        "RetentionInDays": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "LogRetentionInDays"
          ]
        }
      }
    },
    "ECSService": {
      "Type": "AWS::ECS::Service",
      "Properties": {
        "ServiceName": {
          "Ref": "ApplicationName"
        },
        "Cluster": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "ECSClusterName"
          ]
        },
        "TaskDefinition": {
          "Ref": "TaskDefinition"
        },
        "DesiredCount": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "DesiredCount"
          ]
        },
        "EnableECSManagedTags": false,
        "LaunchType": "FARGATE",
        "NetworkConfiguration": {
          "AwsvpcConfiguration": {
            "AssignPublicIp": "ENABLED",
            "SecurityGroups": {
              "Fn::Split": [
                ",",
                {
                  "Fn::FindInMap": [
                    "Settings",
                    "Values",
                    "SecurityGroupIDs"
                  ]
                }
              ]
            },
            "Subnets": {
              "Fn::Split": [
                ",",
                {
                  "Fn::FindInMap": [
                    "Settings",
                    "Values",
                    "SubnetIDs"
                  ]
                }
              ]
            }
          }
        },
        "DeploymentConfiguration": {
          "MaximumPercent": {
            "Fn::FindInMap": [
              "Settings",
              "Values",
              "MaximumHealthPercent"
            ]
          },
          "MinimumHealthyPercent": {
            "Fn::FindInMap": [
              "Settings",
              "Values",
              "MinimumHealthPercent"
            ]
          },
          "DeploymentCircuitBreaker": {
            "Enable": true,
            "Rollback": true
          }
        },
        "LoadBalancers": [
          {
            "ContainerName": {
              "Ref": "ApplicationName"
            },
            "ContainerPort": {
              "Fn::FindInMap": [
                "Settings",
                "Values",
                "ContainerPort"
              ]
            },
            "TargetGroupArn": {
              "Ref": "TargetGroup"
            }
          }
        ]
      },
      "DependsOn": [
        "ListenerRule"
      ]
    },
    "TargetGroup": {
      "Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
      "Properties": {
        "HealthCheckPath": "/ping?source=target-group",
        "Port": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "ContainerPort"
          ]
        },
        "Protocol": "HTTP",
        "TargetType": "ip",
        "HealthCheckEnabled": true,
        "HealthCheckProtocol": "HTTP",
        "HealthCheckPort": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "ContainerPort"
          ]
        },
        "HealthCheckTimeoutSeconds": 4,
        "HealthyThresholdCount": 5,
        "HealthCheckIntervalSeconds": 5,
        "VpcId": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "VpcID"
          ]
        },
        "TargetGroupAttributes": [
          {
            "Key": "deregistration_delay.timeout_seconds",
            "Value": "5"
          }
        ]
      }
    },
    "ListenerRule": {
      "Type": "AWS::ElasticLoadBalancingV2::ListenerRule",
      "Properties": {
        "Actions": [
          {
            "Type": "forward",
            "ForwardConfig": {
              "TargetGroups": [
                {
                  "TargetGroupArn": {
                    "Ref": "TargetGroup"
                  },
                  "Weight": 1
                }
              ],
              "TargetGroupStickinessConfig": {
                "Enabled": false
              }
            }
          }
        ],
        "Conditions": [
          {
            "Field": "host-header",
            "Values": [
              {
                "Ref": "LoadBalancerHostName"
              }
            ]
          }
        ],
        "ListenerArn": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "LoadBalancerListenerArn"
          ]
        },
        "Priority": {
          "Ref": "LoadBalancerPriority"
        }
      }
    },
    "VpcLinkSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": {
          "Fn::Sub": "${ApplicationName} API Gateway VPC Link to the internal load balancer"
        },
        "VpcId": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "VpcID"
          ]
        },
        "SecurityGroupEgress": [
          {
            "Description": "HTTPS to the internal load balancer",
            "IpProtocol": "tcp",
            "FromPort": 443,
            "ToPort": 443,
            "CidrIp": {
              "Fn::FindInMap": [
                "Settings",
                "Values",
                "VpcLinkEgressCidr"
              ]
            }
          }
        ]
      }
    },
    "VpcLink": {
      "Type": "AWS::ApiGatewayV2::VpcLink",
      "Properties": {
        "Name": {
          "Ref": "ApplicationName"
        },
        "SubnetIds": {
          "Fn::Split": [
            ",",
            {
              "Fn::FindInMap": [
                "Settings",
                "Values",
                "SubnetIDs"
              ]
            }
          ]
        },
        "SecurityGroupIds": [
          {
            "Ref": "VpcLinkSecurityGroup"
          }
        ]
      }
    },
    "Api": {
      "Type": "AWS::ApiGatewayV2::Api",
      "Properties": {
        "Name": {
          "Ref": "ApplicationName"
        },
        "ProtocolType": "HTTP"
      }
    },
    "ApiIntegration": {
      "Type": "AWS::ApiGatewayV2::Integration",
      "Properties": {
        "ApiId": {
          "Ref": "Api"
        },
        "IntegrationType": "HTTP_PROXY",
        "IntegrationMethod": "ANY",
        "ConnectionType": "VPC_LINK",
        "ConnectionId": {
          "Ref": "VpcLink"
        },
        "IntegrationUri": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "LoadBalancerListenerArn"
          ]
        },
        "PayloadFormatVersion": "1.0",
        "RequestParameters": {
          "overwrite:header.Host": {
            "Ref": "LoadBalancerHostName"
          },
          "overwrite:header.X-Client-Ip": "$context.identity.sourceIp"
        },
        "TlsConfig": {
          "ServerNameToVerify": {
            "Fn::FindInMap": [
              "Settings",
              "Values",
              "InternalAlbServerName"
            ]
          }
        }
      }
    },
    "PingRoute": {
      "Type": "AWS::ApiGatewayV2::Route",
      "Properties": {
        "ApiId": {
          "Ref": "Api"
        },
        "RouteKey": "GET /ping",
        "Target": {
          "Fn::Sub": "integrations/${ApiIntegration}"
        }
      }
    },
    "GitHubPingRoute": {
      "Type": "AWS::ApiGatewayV2::Route",
      "Properties": {
        "ApiId": {
          "Ref": "Api"
        },
        "RouteKey": "POST /github/ping",
        "Target": {
          "Fn::Sub": "integrations/${ApiIntegration}"
        }
      }
    },
    "GitHubPushRoute": {
      "Type": "AWS::ApiGatewayV2::Route",
      "Properties": {
        "ApiId": {
          "Ref": "Api"
        },
        "RouteKey": "POST /github/push",
        "Target": {
          "Fn::Sub": "integrations/${ApiIntegration}"
        }
      }
    },
    "GitHubStatusRoute": {
      "Type": "AWS::ApiGatewayV2::Route",
      "Properties": {
        "ApiId": {
          "Ref": "Api"
        },
        "RouteKey": "POST /github/status",
        "Target": {
          "Fn::Sub": "integrations/${ApiIntegration}"
        }
      }
    },
    "WatchtowerDeployRoute": {
      "Type": "AWS::ApiGatewayV2::Route",
      "Properties": {
        "ApiId": {
          "Ref": "Api"
        },
        "RouteKey": "POST /watchtower/deploy",
        "Target": {
          "Fn::Sub": "integrations/${ApiIntegration}"
        }
      }
    },
    "CloudFormationDeployRoute": {
      "Type": "AWS::ApiGatewayV2::Route",
      "Properties": {
        "ApiId": {
          "Ref": "Api"
        },
        "RouteKey": "POST /cloudformation/deploy",
        "Target": {
          "Fn::Sub": "integrations/${ApiIntegration}"
        }
      }
    },
    "ApiStage": {
      "Type": "AWS::ApiGatewayV2::Stage",
      "Properties": {
        "ApiId": {
          "Ref": "Api"
        },
        "StageName": "$default",
        "AutoDeploy": true,
        "DefaultRouteSettings": {
          "ThrottlingBurstLimit": {
            "Fn::FindInMap": [
              "Settings",
              "Values",
              "ApiThrottlingBurstLimit"
            ]
          },
          "ThrottlingRateLimit": {
            "Fn::FindInMap": [
              "Settings",
              "Values",
              "ApiThrottlingRateLimit"
            ]
          }
        },
        "AccessLogSettings": {
          "DestinationArn": {
            "Fn::GetAtt": [
              "ApiAccessLogGroup",
              "Arn"
            ]
          },
          "Format": "{\"requestId\":\"$context.requestId\",\"ip\":\"$context.identity.sourceIp\",\"requestTime\":\"$context.requestTime\",\"httpMethod\":\"$context.httpMethod\",\"routeKey\":\"$context.routeKey\",\"status\":\"$context.status\",\"responseLength\":\"$context.responseLength\",\"integrationStatus\":\"$context.integrationStatus\",\"integrationErrorMessage\":\"$context.integrationErrorMessage\"}"
        }
      }
    },
    "ApiAccessLogGroup": {
      "Type": "AWS::Logs::LogGroup",
      "DeletionPolicy": "Delete",
      "UpdateReplacePolicy": "Delete",
      "Properties": {
        "LogGroupName": {
          "Fn::Sub": "/apigateway/${ApplicationName}/"
        },
        "RetentionInDays": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "LogRetentionInDays"
          ]
        }
      }
    },
    "ApiDomainName": {
      "Type": "AWS::ApiGatewayV2::DomainName",
      "Properties": {
        "DomainName": {
          "Ref": "ApiHost"
        },
        "DomainNameConfigurations": [
          {
            "CertificateArn": {
              "Fn::FindInMap": [
                "Settings",
                "Values",
                "ApiCertificateArn"
              ]
            },
            "EndpointType": "REGIONAL",
            "SecurityPolicy": "TLS_1_2"
          }
        ]
      }
    },
    "ApiMapping": {
      "Type": "AWS::ApiGatewayV2::ApiMapping",
      "Properties": {
        "ApiId": {
          "Ref": "Api"
        },
        "DomainName": {
          "Ref": "ApiDomainName"
        },
        "Stage": {
          "Ref": "ApiStage"
        }
      }
    },
    "ApiDnsRecord": {
      "Type": "AWS::Route53::RecordSet",
      "DeletionPolicy": "Retain",
      "UpdateReplacePolicy": "Retain",
      "Properties": {
        "HostedZoneName": {
          "Fn::FindInMap": [
            "Settings",
            "Values",
            "HostedZoneName"
          ]
        },
        "Name": {
          "Ref": "ApiHost"
        },
        "Type": "A",
        "AliasTarget": {
          "DNSName": {
            "Fn::GetAtt": [
              "ApiDomainName",
              "RegionalDomainName"
            ]
          },
          "HostedZoneId": {
            "Fn::GetAtt": [
              "ApiDomainName",
              "RegionalHostedZoneId"
            ]
          },
          "EvaluateTargetHealth": false
        }
      }
    }
  },
  "Outputs": {
    "ApiEndpoint": {
      "Description": "Default endpoint of the HTTP API",
      "Value": {
        "Fn::GetAtt": [
          "Api",
          "ApiEndpoint"
        ]
      }
    },
    "ApiRegionalDomainName": {
      "Description": "Regional domain name targeted by the API host alias record",
      "Value": {
        "Fn::GetAtt": [
          "ApiDomainName",
          "RegionalDomainName"
        ]
      }
    }
  }
}