serverless.yml

# Read the documentation at https://www.serverless.com/framework/docs/providers/aws/guide/serverless.yml/
service: LemmySchedule

provider:
    name: aws
    # The AWS region in which to deploy (us-east-1 is the default)
    region: eu-central-1
    # The stage of the application, e.g. dev, production, staging… ('dev' is the default)
    stage: ${opt:stage, 'prod'}
    runtime: provided.al2
    iam:
        role:
            statements:
                - Effect: Allow
                  Resource:
                      - !GetAtt CacheTable.Arn
                  Action:
                      - dynamodb:DescribeTable
                      - dynamodb:Query
                      - dynamodb:Scan
                      - dynamodb:GetItem
                      - dynamodb:PutItem
                      - dynamodb:UpdateItem
                      - dynamodb:DeleteItem
                - Effect: Allow
                  Resource:
                      - !Sub arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/default/LemmySchedule_Job_*
                  Action:
                      - scheduler:CreateSchedule
                - Effect: Allow
                  Action:
                      - iam:PassRole
                  Resource:
                      - !GetAtt EventBridgeRole.Arn
                - Effect: Allow
                  Action:
                      - s3:PutObject
                      - s3:DeleteObject
                      - s3:GetObject
                  Resource:
                      - !Join ['/', [!GetAtt UploadsBucket.Arn, '*']]
    environment:
        # Symfony environment variables
        APP_ENV: ${self:provider.stage}
        APP_SECRET: !Join [ '', [ '{{resolve:secretsmanager:', !Ref AppSecret, ':SecretString:secret}}' ] ]
        DYNAMODB_CACHE_TABLE: !Ref CacheTable
        MESSENGER_TRANSPORT_DSN: eb://LemmySchedule
        S3_FILE_UPLOADER_BUCKET: !Ref UploadsBucket
        FILE_UPLOADER_CLASS: App\FileUploader\S3FileUploader
        ROLE_ARN: !GetAtt EventBridgeRole.Arn
        SINGLE_INSTANCE_MODE: ${env:SINGLE_INSTANCE_MODE, '0'}
        IMGUR_ACCESS_TOKEN: ${env:IMGUR_ACCESS_TOKEN, ''}
        UNREAD_POSTS_BOT_JWT: ${env:UNREAD_POSTS_BOT_JWT, ''}
        UNREAD_POSTS_BOT_INSTANCE: ${env:UNREAD_POSTS_BOT_INSTANCE, ''}
        ASSETS_URL: https://assets.${self:custom.Domain}
        NEW_VERSION_CHECK: ${env:NEW_VERSION_CHECK, '1'}
        CATBOX_USER_HASH: ${env:CATBOX_USER_HASH, ''}

plugins:
  - ./vendor/bref/bref
  - ./vendor/bref/extra-php-extensions

custom:
    Domain: ${env:DOMAIN_NAME}
    DomainZone: ${env:DOMAIN_ZONE}
    ServiceToken: !Join [':', ['arn:aws:lambda', !Ref AWS::Region, !Ref AWS::AccountId, 'function:AcmCustomResources-prod-customResources']]
    CloudfrontHostedZone: Z2FDTNDATAQYW2

functions:
    # This function runs the Symfony website/API
    web:
        handler: public/index.php
        timeout: 28 # in seconds (API Gateway has a timeout of 29 seconds)
        memorySize: 512
        environment:
            CONSOLE_FUNCTION: !GetAtt ConsoleLambdaFunction.Arn
        layers:
            - ${bref:layer.php-83-fpm}
            - ${bref-extra:imagick-php-83}
        events:
            - httpApi: '*'
    # This function let us run console commands in Lambda
    console:
        handler: bin/console
        timeout: 120 # in seconds
        memorySize: 512
        environment:
            CONSOLE_FUNCTION: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-console
        layers:
            - ${bref:layer.php-83} # PHP
            - ${bref-extra:imagick-php-83}
            - ${bref:layer.console} # The "console" layer

package:
    patterns:
        # Excluded files and folders for deployment
        - '!assets/**'
        - '!node_modules/**'
        - '!public/build/**'
        - '!tests/**'
        - '!var/**'
        # If you want to include files and folders that are part of excluded folders,
        # add them at the end
        - 'var/cache/prod/**'
        - 'public/build/entrypoints.json'
        - 'public/build/manifest.json'

resources:
    Resources:
        AppSecret:
            Type: AWS::SecretsManager::Secret
            Properties:
                Description: LemmySchedule App secret
                GenerateSecretString:
                    SecretStringTemplate: '{}'
                    GenerateStringKey: "secret"
                    PasswordLength: 32
                    RequireEachIncludedType: true
                    ExcludeUppercase: true
                    ExcludePunctuation: true
                    ExcludeCharacters: ghijklmnopqrstuvwxyz
        CacheTable:
            Type: AWS::DynamoDB::Table
            Properties:
                AttributeDefinitions:
                    - AttributeName: id
                      AttributeType: S
                BillingMode: PAY_PER_REQUEST
                TimeToLiveSpecification:
                    AttributeName: ttl
                    Enabled: true
                KeySchema:
                    - AttributeName: id
                      KeyType: HASH
        Certificate:
            Type: Custom::Certificate
            Properties:
                DomainName: ${self:custom.Domain}
                ValidationMethod: DNS
                ServiceToken: ${self:custom.ServiceToken}
        CertificateBlocker:
            Type: Custom::IssuedCertificate
            DependsOn:
                - DnsRecordsCertificateValidation
            Properties:
                CertificateArn: !Ref Certificate
                ServiceToken: ${self:custom.ServiceToken}
        CertificateDnsRecord:
            Type: Custom::CertificateDNSRecord
            Properties:
                CertificateArn: !Ref Certificate
                DomainName: ${self:custom.Domain}
                ServiceToken: ${self:custom.ServiceToken}
        DnsRecordsCertificateValidation:
            Type: AWS::Route53::RecordSetGroup
            Properties:
                HostedZoneId: ${self:custom.DomainZone}
                RecordSets:
                    - Name: !GetAtt CertificateDnsRecord.Name
                      Type: !GetAtt CertificateDnsRecord.Type
                      TTL: 60
                      Weight: 1
                      SetIdentifier: !Ref Certificate
                      ResourceRecords:
                          - !GetAtt CertificateDnsRecord.Value
        ApiGatewayDomainName:
            DependsOn:
                - CertificateBlocker
            Type: AWS::ApiGatewayV2::DomainName
            Properties:
                DomainName: ${self:custom.Domain}
                DomainNameConfigurations:
                    - CertificateArn: !Ref Certificate
                      EndpointType: REGIONAL
        ApiGatewayDomainMapping:
            DependsOn:
                - ApiGatewayDomainName
            Type: AWS::ApiGatewayV2::ApiMapping
            Properties:
                ApiId: !Ref HttpApi
                DomainName: ${self:custom.Domain}
                Stage: !Ref HttpApiStage
        MainDnsRecords:
            Type: AWS::Route53::RecordSetGroup
            Properties:
                HostedZoneId: ${self:custom.DomainZone}
                RecordSets:
                    - AliasTarget:
                          DNSName: !GetAtt ApiGatewayDomainName.RegionalDomainName
                          HostedZoneId: !GetAtt ApiGatewayDomainName.RegionalHostedZoneId
                      Name: ${self:custom.Domain}
                      Type: A
                    - AliasTarget:
                          DNSName: !GetAtt AssetsCDN.DomainName
                          HostedZoneId: ${self:custom.CloudfrontHostedZone}
                      Name: assets.${self:custom.Domain}
                      Type: A
        AssetsCertificate:
            Type: Custom::Certificate
            Properties:
                DomainName: assets.${self:custom.Domain}
                ValidationMethod: DNS
                Region: us-east-1
                ServiceToken: ${self:custom.ServiceToken}
        AssetsCertificateBlocker:
            Type: Custom::IssuedCertificate
            DependsOn:
                - AssetsDnsRecordsCertificateValidation
            Properties:
                CertificateArn: !Ref AssetsCertificate
                ServiceToken: ${self:custom.ServiceToken}
        AssetsCertificateDnsRecord:
            Type: Custom::CertificateDNSRecord
            Properties:
                CertificateArn: !Ref AssetsCertificate
                DomainName: assets.${self:custom.Domain}
                ServiceToken: ${self:custom.ServiceToken}
        AssetsDnsRecordsCertificateValidation:
            Type: AWS::Route53::RecordSetGroup
            Properties:
                HostedZoneId: ${self:custom.DomainZone}
                RecordSets:
                    - Name: !GetAtt AssetsCertificateDnsRecord.Name
                      Type: !GetAtt AssetsCertificateDnsRecord.Type
                      TTL: 60
                      Weight: 1
                      SetIdentifier: !Ref AssetsCertificate
                      ResourceRecords:
                          - !GetAtt AssetsCertificateDnsRecord.Value
        UploadsBucket:
            Type: AWS::S3::Bucket
            Properties:
        AssetsBucket:
            Type: AWS::S3::Bucket
            Properties:
                CorsConfiguration:
                    CorsRules:
                        - AllowedHeaders: [ "*" ]
                          AllowedMethods: [ GET ]
                          AllowedOrigins: [ "*" ]
                PublicAccessBlockConfiguration:
                    BlockPublicAcls: false
                    BlockPublicPolicy: false
                    IgnorePublicAcls: false
                    RestrictPublicBuckets: false
        AssetsBucketPolicy:
            Type: AWS::S3::BucketPolicy
            Properties:
                Bucket: !Ref AssetsBucket
                PolicyDocument:
                    Statement:
                        - Effect: Allow
                          Principal: '*' # everyone
                          Action: 's3:GetObject' # to read
                          Resource: !Join [ '/', [ !GetAtt AssetsBucket.Arn, '*' ] ]
        AssetsCDN:
            DependsOn:
                - AssetsCertificateBlocker
            Type: AWS::CloudFront::Distribution
            Properties:
                DistributionConfig:
                    Aliases:
                        - assets.${self:custom.Domain}
                    Enabled: true
                    PriceClass: PriceClass_100
                    HttpVersion: http2
                    Origins:
                        - Id: AssetsBucket
                          DomainName: !GetAtt AssetsBucket.RegionalDomainName
                          S3OriginConfig: { } # this key is required to tell CloudFront that this is an S3 origin, even though nothing is configured
                    DefaultCacheBehavior:
                        TargetOriginId: AssetsBucket
                        AllowedMethods: [ GET, HEAD ]
                        ForwardedValues:
                            QueryString: 'false'
                            Cookies:
                                Forward: none
                        ViewerProtocolPolicy: redirect-to-https
                        Compress: true
                    CustomErrorResponses:
                        - ErrorCode: 500
                          ErrorCachingMinTTL: 0
                        - ErrorCode: 504
                          ErrorCachingMinTTL: 0
                    ViewerCertificate:
                        AcmCertificateArn: !Ref AssetsCertificate
                        MinimumProtocolVersion: TLSv1.2_2019
                        SslSupportMethod: sni-only
        EventBridgeRole:
            Type: AWS::IAM::Role
            Properties:
                AssumeRolePolicyDocument:
                    Version: '2012-10-17'
                    Statement:
                        - Effect: Allow
                          Principal:
                              Service: scheduler.amazonaws.com
                          Action:
                              - sts:AssumeRole
                Policies:
                    - PolicyName: ExecuteLambda
                      PolicyDocument:
                          Version: '2012-10-17'
                          Statement:
                              - Effect: Allow
                                Action:
                                    - lambda:InvokeFunction
                                Resource:
                                    - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-console
                                    - !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-console:*
    Outputs:
        TestUrl:
            Value: https://${self:custom.Domain}
        AssetsBucket:
            Value: !Ref AssetsBucket
        Cdn:
            Value: !Ref AssetsCDN