feat!: initial commit

.commitlintrc.yaml

@@ -0,0 +1 @@
+extends: ['@commitlint/config-conventional']

.editorconfig

@@ -0,0 +1,12 @@
+; This file is for unifying the coding style for different editors and IDEs.
+; More information at http://editorconfig.org
+
+root = true
+
+[*]
+charset = utf-8
+indent_size = 2
+indent_style = space
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true

.gitattributes

@@ -0,0 +1 @@
+CHANGELOG.md linguist-generated=true

.github/release-please.yml

@@ -0,0 +1,2 @@
+handleGHRelease: true
+manifest: true

.github/workflows/release.yml

@@ -0,0 +1,31 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  push:
+    tags: ['**']
+    branches: ['main']
+    paths:
+      - src/**/*.ts
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          registry-url: https://npm.pkg.github.com
+          node-version-file: .nvmrc
+
+      - if: github.ref_type == 'branch'
+        run: npm pkg set "version=${{ format('0.0.0-next-{0}', github.sha) }}"
+
+      - run: npm publish --tag ${{ github.ref_type == 'tag' && 'latest' || 'next' }}
+        env:
+          NODE_AUTH_TOKEN: ${{ github.token }}

.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+
+package-lock.json

.nvmrc

@@ -0,0 +1 @@
+18

.pre-commit-config.yaml

@@ -0,0 +1,57 @@
+exclude: ^CHANGELOG.md$
+
+repos:
+  - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
+    rev: v9.18.0
+    hooks:
+      - id: commitlint
+        stages: [commit-msg]
+        additional_dependencies: ["@commitlint/config-conventional"]
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: check-added-large-files
+      - id: check-case-conflict
+      - id: check-executables-have-shebangs
+      - id: check-json
+      - id: check-merge-conflict
+      - id: check-shebang-scripts-are-executable
+      - id: check-symlinks
+      - id: check-toml
+      - id: check-vcs-permalinks
+      - id: check-xml
+      - id: check-yaml
+        args: [ --unsafe ]
+      - id: destroyed-symlinks
+      - id: detect-aws-credentials
+        args: [ --allow-missing-credentials ]
+      - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: fix-byte-order-marker
+      - id: file-contents-sorter
+      - id: forbid-new-submodules
+      - id: mixed-line-ending
+      - id: pretty-format-json
+        args: [ --autofix, --no-sort-keys ]
+      - id: trailing-whitespace
+  - repo: https://github.com/editorconfig-checker/editorconfig-checker.python
+    rev: 3.0.3
+    hooks:
+      - id: editorconfig-checker
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.1
+    hooks:
+      - id: actionlint
+  - repo: https://github.com/igorshubovych/markdownlint-cli
+    rev: v0.41.0
+    hooks:
+      - id: markdownlint
+  - repo: local
+    hooks:
+      - id: tsc
+        name: tsc
+        language: system
+        entry: npx tsc --noEmit
+        types: [ file ]
+        types_or: [ ts, tsx ]
+        pass_filenames: false

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.0"
+}

LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2024 Chatloop
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,3 @@
+# Pulumi Bref
+
+A Pulumi construct to deploy a Laravel application using brefphp

package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@chatloop/pulumi-bref",
+  "description": "A Pulumi construct to deploy a Laravel application using brefphp",
+  "type": "module",
+  "version": "0.0.0",
+  "files": [
+    "src"
+  ],
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "dependencies": {
+    "@bref.sh/layers": "^2.0.88",
+    "@pulumi/aws": "^6.51.1",
+    "@pulumi/pulumi": "^3.132.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.2"
+  }
+}

release-please-config.json

@@ -0,0 +1,54 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "node",
+  "include-component-in-tag": false,
+  "packages": {
+    ".": {}
+  },
+  "changelog-sections": [
+    {
+      "type": "feat",
+      "section": "Features"
+    },
+    {
+      "type": "fix",
+      "section": "Bug Fixes"
+    },
+    {
+      "type": "perf",
+      "section": "Performance Improvements"
+    },
+    {
+      "type": "reverts",
+      "section": "Reverts"
+    },
+    {
+      "type": "chore",
+      "section": "Miscellaneous Chores"
+    },
+    {
+      "type": "docs",
+      "section": "Documentation"
+    },
+    {
+      "type": "styles",
+      "section": "Styles"
+    },
+    {
+      "type": "refactor",
+      "section": "Code Refactoring"
+    },
+    {
+      "type": "test",
+      "section": "Tests"
+    },
+    {
+      "type": "build",
+      "section": "Build System"
+    },
+    {
+      "type": "ci",
+      "section": "Continuous Integration"
+    }
+  ]
+}

src/index.ts

@@ -0,0 +1 @@
+export * from './laravel'

src/laravel/cdn/index.ts

@@ -0,0 +1,139 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as aws from '@pulumi/aws';
+
+enum CachePolicy {
+  'Managed-CachingOptimized' = '658327ea-f89d-4fab-a63d-7e88639e58f6'
+}
+
+enum OriginRequestPolicy {
+  'Managed-AllViewerExceptHostHeader' = 'b689b0a8-53d0-40ab-baf2-68738e2966ac',
+  'Managed-CORS-S3Origin' = '88a5eaf4-2fd4-4709-b370-b4c650ea3fcf',
+}
+
+enum ResponseHeadersPolicy {
+  'Managed-SecurityHeadersPolicy' = '67f7725c-6f97-4210-82d7-5512b31e9d03'
+}
+
+type CDNArgs = {
+  assets: {
+    paths: string[],
+    s3DomainName: pulumi.Input<string>,
+  },
+  comment: string,
+  domain: {
+    name: pulumi.Input<string>,
+    aliases?: pulumi.Input<string[]>,
+    cert: pulumi.Input<string>,
+  }
+  name: string,
+  webFunctionUrl: pulumi.Output<string>,
+}
+
+export class CDN extends pulumi.ComponentResource {
+  private readonly distribution: aws.cloudfront.Distribution
+
+  constructor(name: string, args: CDNArgs) {
+    super('bref:laravel:cdn', name, args);
+
+    const originAccessControlLambda = new aws.cloudfront.OriginAccessControl('Lambda', {
+      name: `${args.name}-lambda`,
+      originAccessControlOriginType: 'lambda',
+      signingBehavior: 'always',
+      signingProtocol: 'sigv4',
+    });
+
+    const originAccessControlS3 = new aws.cloudfront.OriginAccessControl('S3', {
+      name: `${args.name}-s3`,
+      originAccessControlOriginType: 's3',
+      signingBehavior: 'always',
+      signingProtocol: 'sigv4',
+    });
+
+    const cachePolicy = new aws.cloudfront.CachePolicy('CachePolicy', {
+      name: args.name,
+      comment: 'UseOriginCacheControlHeaders Excluding Host Header',
+      minTtl: 0,
+      defaultTtl: 0,
+      maxTtl: 31536000,
+      parametersInCacheKeyAndForwardedToOrigin: {
+        enableAcceptEncodingBrotli: true,
+        enableAcceptEncodingGzip: true,
+        cookiesConfig: {
+          cookieBehavior: 'none',
+        },
+        headersConfig: {
+          headerBehavior: 'none',
+        },
+        queryStringsConfig: {
+          queryStringBehavior: 'none',
+        }
+      }
+    });
+
+    this.distribution = new aws.cloudfront.Distribution('CDN', {
+      aliases: pulumi.all([args.domain.name, args.domain.aliases]).apply(([ name, aliases ]) => [
+        name, ...aliases ?? [],
+      ]),
+      comment: args.comment,
+      defaultCacheBehavior: {
+        allowedMethods: ['POST', 'PUT', 'PATCH', 'HEAD', 'GET', 'OPTIONS', 'DELETE'],
+        cachedMethods: ['HEAD', 'GET', 'OPTIONS'],
+        cachePolicyId: cachePolicy.id,
+        compress: true,
+        originRequestPolicyId: OriginRequestPolicy['Managed-AllViewerExceptHostHeader'],
+        responseHeadersPolicyId: ResponseHeadersPolicy['Managed-SecurityHeadersPolicy'],
+        targetOriginId: 'api-lambda',
+        viewerProtocolPolicy: 'redirect-to-https',
+      },
+      enabled: true,
+      httpVersion: 'http2and3',
+      isIpv6Enabled: true,
+      orderedCacheBehaviors: args.assets.paths.map((pathPattern) => ({
+        allowedMethods: ['HEAD', 'GET', 'OPTIONS'],
+        cachedMethods: ['HEAD', 'GET', 'OPTIONS'],
+        cachePolicyId: CachePolicy['Managed-CachingOptimized'],
+        compress: true,
+        originRequestPolicyId: OriginRequestPolicy['Managed-CORS-S3Origin'],
+        responseHeadersPolicyId: ResponseHeadersPolicy['Managed-SecurityHeadersPolicy'],
+        pathPattern,
+        targetOriginId: 'assets-s3',
+        viewerProtocolPolicy: 'redirect-to-https',
+      })),
+      origins: [
+        {
+          customOriginConfig: {
+            httpPort: 80,
+            httpsPort: 443,
+            originProtocolPolicy: 'https-only',
+            originSslProtocols: ['TLSv1.2'],
+          },
+          domainName: args.webFunctionUrl.apply(url => new URL(url).hostname),
+          originAccessControlId: originAccessControlLambda.id,
+          originId: 'api-lambda',
+        },
+        {
+          domainName: args.assets.s3DomainName,
+          originAccessControlId: originAccessControlS3.id,
+          originId: 'assets-s3',
+        }
+      ],
+      priceClass: 'PriceClass_100',
+      restrictions: {
+        geoRestriction: {
+          restrictionType: 'none',
+        },
+      },
+      viewerCertificate: {
+        acmCertificateArn: args.domain.cert,
+        minimumProtocolVersion: 'TLSv1.2_2021',
+        sslSupportMethod: 'sni-only',
+      }
+    });
+  }
+
+  public get nodes() {
+    return {
+      distribution: this.distribution,
+    }
+  }
+}