senza-go-server.yaml

Description: Go Continuous Delivery Server ({{Arguments.DockerImage}})
SenzaInfo:
  StackName: go-server
  Parameters:
  - DockerImage:
      Description: go-server Docker image to use.
  - HostedZone:
      Description: Domain to setup for this go-server.
  - SSLCertificateId:
      Description: The SSL certificate to use on the load balancer.
  - AvailabilityZone:
      Description: The availability zone of your storage EBS.
  - InstanceType:
      Description: AWS instance type of your go-server.
  - AccessTokenUrl:
      Description: URL of your OAuth2 access_token endpoint.
  - TeamServiceUrl:
      Description: URL to your team service endpoint.
  - Teams:
      Description: Comma separated list of teams to find in the user search.
  - ApplicationId:
      Description: ID of the registered application to use for robot access.
  - MintBucket:
      Description: Name of the application's mint bucket.
  - Files:
      Description: Comma separated list of <file>:<base64 content> tuples.
      Default: ""
  - ScalyrKey:
      Description: Optional key for scalyr logging.
      Default: ""
  - LogentriesKey:
      Description: Optional key for logentries logging.
      Default: ""
  - AppdynamicsApplication:
      Description: Optional AppDynamics application name.
      Default: ""

SenzaComponents:
- Configuration:
    Type: Senza::StupsAutoConfiguration
    AvailabilityZones:
    - "{{Arguments.AvailabilityZone}}"

Resources:
  GoServerAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:
        "Fn::FindInMap":
        - "ServerSubnets"
        - Ref: "AWS::Region"
        - "Subnets"
      LaunchConfigurationName:
        Ref: "GoServerLaunchConfig"
      MinSize: 1
      MaxSize: 1
      LoadBalancerNames:
      - Ref: "GoServerLoadBalancer"

  GoServerLaunchConfig:
    Type: "AWS::AutoScaling::LaunchConfiguration"
    Properties:
      UserData:
        "Fn::Base64":
          "Fn::Join":
          - "\n"
          - - "#taupage-ami-config"
            - "application_id: {{Arguments.ApplicationId}}"
            - "application_version: {{SenzaInfo.StackVersion}}"
            - "runtime: Docker"
            - "source: '{{Arguments.DockerImage}}'"
            - "root: true"
            - "mint_bucket: {{Arguments.MintBucket}}"
            - "ports:"
            - "  9153: 9153"
            - "  9154: 9154"
            - "volumes:"
            - "  ebs:"
            - "    /dev/sdf: go-server-volume"
            - "mounts:"
            - "  /data:"
            - "    partition: /dev/xvdf"
            - "    erase_on_boot: false"
            - "{{#Arguments.ScalyrKey}}scalyr_account_key: '{{Arguments.ScalyrKey}}'{{/Arguments.ScalyrKey}}"
            - "{{#Arguments.LogentriesKey}}logentries_account_key: '{{Arguments.LogentriesKey}}'{{/Arguments.LogentriesKey}}"
            - "{{#Arguments.AppdynamicsApplication}}appdynamics_application: '{{Arguments.AppdynamicsAplication}}'{{/Arguments.AppdynamicsApplication}}"
            - "environment:"
            - "  STUPS_ACCESS_TOKEN_URL: '{{Arguments.AccessTokenUrl}}'"
            - "  STUPS_TEAM_SERVICE_URL: '{{Arguments.TeamServiceUrl}}'"
            - "  STUPS_TEAMS: '{{Arguments.Teams}}'"
            - "  STUPS_FILES: '{{Arguments.Files}}'"
      ImageId:
        "Fn::FindInMap":
        - "Images"
        - Ref: "AWS::Region"
        - "LatestTaupageImage"
      InstanceType: "{{Arguments.InstanceType}}"
      IamInstanceProfile:
        Ref: GoServerProfile
      SecurityGroups:
      - "Fn::GetAtt":
        - "GoServerSecurityGroup"
        - "GroupId"

  GoServerLoadBalancer:
    Type: "AWS::ElasticLoadBalancing::LoadBalancer"
    Properties:
      LoadBalancerName: "GoServerLoadBalancer"
      Subnets:
        "Fn::FindInMap":
        - "LoadBalancerSubnets"
        - Ref: "AWS::Region"
        - "Subnets"
      Listeners:
      - LoadBalancerPort: "443"
        InstancePort: "9153"
        Protocol: "HTTPS"
        SSLCertificateId: "{{Arguments.SSLCertificateId}}"
      - LoadBalancerPort: "9153"
        InstancePort: "9153"
        Protocol: "TCP"
      - LoadBalancerPort: "9154"
        InstancePort: "9154"
        Protocol: "TCP"
      SecurityGroups:
      - "Fn::GetAtt":
        - "GoServerLBSecurityGroup"
        - "GroupId"

  GoServerLBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: go-server load balancer security group
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 9153
        ToPort: 9154
        CidrIp: 0.0.0.0/0

  GoServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: go-server security group
      SecurityGroupIngress:
      # for debugging via piu
      - IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        CidrIp: 0.0.0.0/0
      # HTTP from load balancer
      - IpProtocol: tcp
        FromPort: 9153
        ToPort: 9153
        SourceSecurityGroupId:
          "Fn::GetAtt":
          - "GoServerLBSecurityGroup"
          - "GroupId"
      # HTTPS from load balancer
      - IpProtocol: tcp
        FromPort: 9154
        ToPort: 9154
        SourceSecurityGroupId:
          "Fn::GetAtt":
          - "GoServerLBSecurityGroup"
          - "GroupId"
      # Prometheus monitoring
      - IpProtocol: tcp
        FromPort: 9100
        ToPort: 9100
        CidrIp: 0.0.0.0/0

  GoServerDomain:
    Type: "AWS::Route53::RecordSet"
    Properties:
      Name: "delivery.{{Arguments.HostedZone}}."
      HostedZoneName: "{{Arguments.HostedZone}}."
      Type: "CNAME"
      ResourceRecords:
      - "Fn::GetAtt":
        - "GoServerLoadBalancer"
        - "DNSName"
      TTL: 30

  GoServerProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Roles:
      - Ref: GoServerRole

  GoServerRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action:
          - "sts:AssumeRole"
      Policies:
      - PolicyName: GoServerAllowEBSAttach
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Sid: "AllowEBSAttach"
            Action:
            - "ec2:AttachVolume"
            - "ec2:DescribeVolumes"
            Effect: Allow
            Resource: "*"  # TODO make access less broad
      - PolicyName: GoServerAllowMintRead
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Sid: "AllowMintRead"
            Action:
            - "s3:GetObject"
            - "s3:ListBucket"
            Effect: Allow
            Resource:
            - "arn:aws:s3:::{{Arguments.MintBucket}}"
            - "arn:aws:s3:::{{Arguments.MintBucket}}/{{Arguments.ApplicationId}}/*"