cloudformation.yml

AWSTemplateFormatVersion: 2010-09-09
Description: >
  Crux Node ECS Stack

Parameters:
  NetworkStackName:
    Type: String
    Description: Name of the Network Stack
    Default: network-stack

  EcsClusterStackName:
    Type: String
    Description: Name of the Ecs Cluster Stack
    Default: ecs-cluster-stack

  SecurityStackName:
    Type: String
    Description: Name of the Security Stack
    Default: security-stack

  LoggingStackName:
    Description: Name of the Logging Stack
    Type: String
    Default: logging-stack

  EcrDockerImage:
    Description: ECR Container Image of the Crux Node
    Type: String
    Default: database/crux:latest

  KafkaBootstrapServer:
    Description: Address of the Kafka bootstrap server
    Type: String
    Default: kafka.callahanwilliam.com:9092

Resources:

  CruxLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      IpAddressType: ipv4
      LoadBalancerAttributes:
        - Key: idle_timeout.timeout_seconds
          Value: 300
        - Key: access_logs.s3.enabled
          Value: false
        - Key: deletion_protection.enabled
          Value: false
      Name: !Sub ${AWS::StackName}-elb
      Scheme: internal
      SecurityGroups:
        - !Ref CruxLoabBalancerSecurityGroup
      Subnets:
        - Fn::ImportValue:
            !Sub ${NetworkStackName}-PublicSubnet1
        - Fn::ImportValue:
            !Sub ${NetworkStackName}-PublicSubnet2
      Tags:
        - Key: Service
          Value: Crux
        - Key: Provider
          Value: Juxt
        - Key: Name
          Value: !Sub ${AWS::StackName}-elb
      Type: application

  CruxListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref CruxTargetGroup
          Type: forward
          Order: 1
      LoadBalancerArn: !Ref CruxLoadBalancer
      Port: 3000
      Protocol: HTTP

  CruxTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: CruxLoadBalancer
    Properties:
      HealthCheckEnabled: true
      HealthCheckIntervalSeconds: 20
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      HealthCheckPort: 3000
      HealthCheckTimeoutSeconds: 15
      HealthyThresholdCount: 2
      Matcher:
        HttpCode: 200
      Name: !Sub ${AWS::StackName}-elb-tg
      TargetType: ip
      Port: 3000
      Protocol: HTTP
      UnhealthyThresholdCount: 5
      VpcId:
        Fn::ImportValue:
          !Sub ${NetworkStackName}-Vpc
      Tags:
        - Key: Service
          Value: Crux
        - Key: Provider
          Value: Juxt
        - Key: Name
          Value: !Sub ${AWS::StackName}-elb-tg

  CruxService:
    Type: AWS::ECS::Service
    Properties:
      ServiceName: !Sub ${AWS::StackName}
      Cluster:
        Fn::ImportValue:
          !Sub ${EcsClusterStackName}-DatabaseClusterArn
      DeploymentConfiguration:
        MaximumPercent: 100
        MinimumHealthyPercent: 50
      DeploymentController:
        Type: ECS
      DesiredCount: 1
      LaunchType: FARGATE
      TaskDefinition: !Ref CruxTaskDefinition
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: DISABLED
          SecurityGroups:
            - !Ref CruxHostSecurityGroup
          Subnets:
            - Fn::ImportValue:
                !Sub ${NetworkStackName}-PublicSubnet1
            - Fn::ImportValue:
                !Sub ${NetworkStackName}-PublicSubnet2
      LoadBalancers:
        - ContainerName: !Sub ${AWS::StackName}-ecs-cd
          ContainerPort: 3000
          TargetGroupArn: !Ref CruxTargetGroup
      Tags:
        - Key: Service
          Value: Crux
        - Key: Provider
          Value: Juxt
        - Key: Name
          Value: !Sub ${AWS::StackName}-ecs-service

  CruxTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub ${AWS::StackName}-task
      Cpu: 1024
      Memory: 2GB
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      ContainerDefinitions:
        - Name: !Sub ${AWS::StackName}-ecs-cd
          DisableNetworking: false
          PortMappings:
            - ContainerPort: 3000
              HostPort: 3000
              Protocol: tcp
          Privileged: false
          ReadonlyRootFilesystem: false
          DockerLabels:
            Name: !Sub ${AWS::StackName}-task
          Essential: true
          Image: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${EcrDockerImage}
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group:
                Fn::ImportValue:
                  !Sub ${LoggingStackName}-DatabaseLogGroupName
              awslogs-region: !Sub ${AWS::Region}
              awslogs-stream-prefix: !Sub ${AWS::StackName}
          Environment:
            - Name: HEALTH_CHECK_THRESHOLD
              Value: 5
            - Name: HEALTH_CHECK_INTERVAL
              Value: 6
            - Name: HEALTH_CHECK_WAIT_TIME
              Value: 5
            - Name: KAFKA_BOOTSTRAP_SERVER
              Value: !Ref KafkaBootstrapServer
            - Name: SERVER_PORT
              Value: 3000
      ExecutionRoleArn:
        Fn::ImportValue:
          !Sub ${SecurityStackName}-FargateReadonlyRoleArn
      TaskRoleArn:
        Fn::ImportValue:
          !Sub ${SecurityStackName}-FargateReadonlyRoleArn
      Tags:
        - Key: Service
          Value: Crux
        - Key: Provider
          Value: Juxt
        - Key: Name
          Value: !Sub ${AWS::StackName}-ecs-cd

  CruxLoabBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${AWS::StackName}-elb-sg
      GroupDescription: Seciruty Group for the Crux Elastic Load Balancer
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3000
          ToPort: 3000
          SourceSecurityGroupId: !Ref CruxSecurityClientGroup
      VpcId:
        Fn::ImportValue:
          !Sub ${NetworkStackName}-Vpc
      Tags:
        - Key: Service
          Value: Crux
        - Key: Provider
          Value: Juxt
        - Key: Name
          Value: !Sub ${AWS::StackName}-elb-sg

  CruxHostSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${AWS::StackName}-host-sg
      GroupDescription: Seciruty Group for the Crux Node
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3000
          ToPort: 3000
          SourceSecurityGroupId: !Ref CruxLoabBalancerSecurityGroup
      VpcId:
        Fn::ImportValue:
          !Sub ${NetworkStackName}-Vpc
      Tags:
        - Key: Service
          Value: Crux
        - Key: Provider
          Value: Juxt
        - Key: Name
          Value: !Sub ${AWS::StackName}-host-sg

  CruxSecurityClientGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub ${AWS::StackName}-client-sg
      GroupDescription: Seciruty Group to acceess the Crux Node
      VpcId:
        Fn::ImportValue:
          !Sub ${NetworkStackName}-Vpc
      Tags:
        - Key: Service
          Value: Crux
        - Key: Provider
          Value: Juxt
        - Key: Name
          Value: !Sub ${AWS::StackName}-client-sq

Outputs:
  CruxSecurityClientGroupName:
    Description: Crux Node Client Security Group Name
    Value: !Ref CruxSecurityClientGroup
    Export:
      Name: !Sub ${AWS::StackName}-CruxSecurityClientGroupName

  CruxSecurityClientGroupId:
    Description: Crux Node Client Security Group Id
    Value: !GetAtt CruxSecurityClientGroup.GroupId
    Export:
      Name: !Sub ${AWS::StackName}-CruxSecurityClientGroupId

  CruxLoadBalancerDnsName:
    Description: Crux Load Balancer Dns Name
    Value: !GetAtt CruxLoadBalancer.DNSName