infra.yaml

Parameters:
  BranchName:
    Type: String
    Description: The name of the branch being deployed
  LimulusDotNetZoneId:
    Type: String
    Description: The Route 53 hosted zone ID for limulus.net
  LimulusDotNetCertificateArn:
    Type: String
    Description: The ARN of the certificate for limulus.net (and www and *)

Outputs:
  StaticSiteBucketName:
    Description: 'Name of the static site S3 bucket'
    Value: !Ref StaticSiteBucket
  CloudFrontDistributionLogsBucketName:
    Description: 'Name of the CloudFront distribution logs S3 bucket'
    Value: !Ref CloudFrontDistributionLogsBucket

Conditions:
  IsMainBranch:
    Fn::Equals:
      - !Ref BranchName
      - 'main'

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Comment: !Sub 'limulus-dot-net ${BranchName}'
        Aliases: !If
          - IsMainBranch
          - - 'limulus.net'
            - 'www.limulus.net'
          - - !Sub '${BranchName}.limulus.net'
        CacheBehaviors:
          - PathPattern: /.well-known/webfinger
            CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
            Compress: true
            OriginRequestPolicyId: 216adef6-5c7f-47e4-b989-5492eafa07d3
            TargetOriginId: mastodon.limulus.net
            ViewerProtocolPolicy: redirect-to-https
          - PathPattern: /.well-known/host-meta
            CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
            Compress: true
            OriginRequestPolicyId: 216adef6-5c7f-47e4-b989-5492eafa07d3
            TargetOriginId: mastodon.limulus.net
            ViewerProtocolPolicy: redirect-to-https
          - PathPattern: /.well-known/nodeinfo
            CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
            Compress: true
            OriginRequestPolicyId: 216adef6-5c7f-47e4-b989-5492eafa07d3
            TargetOriginId: mastodon.limulus.net
            ViewerProtocolPolicy: redirect-to-https
          - PathPattern: /assets/immutable/*
            CachePolicyId: !Ref CloudFrontDistributionForeverCachePolicy
            Compress: true
            OriginRequestPolicyId: 88a5eaf4-2fd4-4709-b370-b4c650ea3fcf
            TargetOriginId: static-site-bucket-origin
            ResponseHeadersPolicyId: !Ref CloudFrontImmutableResponseHeadersPolicy
            ViewerProtocolPolicy: redirect-to-https
          - PathPattern: /*.????????.*
            CachePolicyId: !Ref CloudFrontDistributionForeverCachePolicy
            Compress: true
            OriginRequestPolicyId: 88a5eaf4-2fd4-4709-b370-b4c650ea3fcf
            TargetOriginId: static-site-bucket-origin
            ResponseHeadersPolicyId: !Ref CloudFrontImmutableResponseHeadersPolicy
            ViewerProtocolPolicy: redirect-to-https
        CustomErrorResponses:
          - ErrorCachingMinTTL: 30
            ErrorCode: 404
            ResponseCode: 404
            ResponsePagePath: /404/index.html
        DefaultCacheBehavior:
          CachePolicyId: !Ref CloudFrontDistributionDefaultCachePolicy
          Compress: true
          FunctionAssociations:
            - EventType: viewer-request
              FunctionARN: !GetAtt CloudFrontRequestFunction.FunctionMetadata.FunctionARN
          MaxTTL: 31536000
          MinTTL: 0
          OriginRequestPolicyId: 88a5eaf4-2fd4-4709-b370-b4c650ea3fcf
          ResponseHeadersPolicyId: !Ref CloudFrontResponseHeadersPolicy
          TargetOriginId: static-site-bucket-origin
          ViewerProtocolPolicy: redirect-to-https
        DefaultRootObject: index.html
        Enabled: true
        HttpVersion: http2and3
        IPV6Enabled: true
        Logging:
          Bucket: !GetAtt CloudFrontDistributionLogsBucket.DomainName
          IncludeCookies: false
          Prefix: 'limulus-dot-net/'
        Origins:
          - Id: static-site-bucket-origin
            DomainName: !GetAtt StaticSiteBucket.RegionalDomainName
            OriginAccessControlId: !Ref StaticSiteBucketOriginAccessControl
            S3OriginConfig:
              OriginAccessIdentity: ''
          - Id: mastodon.limulus.net
            DomainName: mastodon.limulus.net
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        PriceClass: PriceClass_All
        ViewerCertificate:
          AcmCertificateArn: !Ref LimulusDotNetCertificateArn
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only

  CloudFrontDistributionDefaultCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: !Sub 'limulus-dot-net-cache-${BranchName}'
        Comment: Default cache policy for limulus.net
        DefaultTTL: 60
        MaxTTL: 31536000
        MinTTL: 0
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: none
          EnableAcceptEncodingGzip: true
          EnableAcceptEncodingBrotli: true
          HeadersConfig:
            HeaderBehavior: none
          QueryStringsConfig:
            QueryStringBehavior: none

  CloudFrontDistributionForeverCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: !Sub 'limulus-dot-net-forever-cache-${BranchName}'
        Comment: Cache policy for immutable assets
        DefaultTTL: 31536000
        MaxTTL: 31536000
        MinTTL: 31536000
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: none
          EnableAcceptEncodingGzip: true
          EnableAcceptEncodingBrotli: true
          HeadersConfig:
            HeaderBehavior: none
          QueryStringsConfig:
            QueryStringBehavior: none

  CloudFrontDistributionLogsBucket:
    Type: AWS::S3::Bucket
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - BucketKeyEnabled: true
            ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      LifecycleConfiguration:
        Rules:
          - Id: MoveToInfrequentAccess
            Status: Enabled
            Transitions:
              - StorageClass: STANDARD_IA
                TransitionInDays: 30
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerPreferred

  CloudFrontResponseHeadersPolicy:
    Type: AWS::CloudFront::ResponseHeadersPolicy
    Properties:
      ResponseHeadersPolicyConfig:
        Name: !Sub 'limulus-dot-net-response-headers-${BranchName}'
        Comment: Add headers to allow fine grained timers in JS runtime
        CustomHeadersConfig:
          Items:
            - Header: Cross-Origin-Opener-Policy
              Override: false
              Value: same-origin
            - Header: Cross-Origin-Embedder-Policy
              Override: false
              Value: require-corp

  CloudFrontImmutableResponseHeadersPolicy:
    Type: AWS::CloudFront::ResponseHeadersPolicy
    Properties:
      ResponseHeadersPolicyConfig:
        Name: !Sub 'limulus-dot-net-immutable-response-headers-${BranchName}'
        Comment: Add headers to cache resources forever
        CustomHeadersConfig:
          Items:
            - Header: Cache-Control
              Override: true
              Value: 'public, max-age=31536000, immutable'
            - Header: Cross-Origin-Opener-Policy
              Override: false
              Value: same-origin
            - Header: Cross-Origin-Embedder-Policy
              Override: false
              Value: require-corp

  CloudFrontRequestFunction:
    Type: AWS::CloudFront::Function
    Properties:
      Name: !Sub 'limulus-dot-net-rewrite-${BranchName}'
      AutoPublish: true
      FunctionCode: !Sub |
        const needsIndexHtmlRe = /(\/[^\/.]+)\/*$/
        const penumbraJournalRedirectRe = /^\/penumbra\/journal\/00[1-5]-/
        const mastodonProfileRedirectRe = /^\/@eric\/?/

        function handler(event) {
          const request = event.request
          const host = request.headers.host

          if (host && host.value === 'www.limulus.net') {
            return {
              statusCode: 301,
              statusDescription: 'Moved Permanently',
              headers: {
                location: {
                  value: 'https://limulus.net' + request.uri
                }
              }
            }
          }

          if (penumbraJournalRedirectRe.test(request.uri)) {
            return {
              statusCode: 301,
              statusDescription: 'Moved Permanently',
              headers: {
                location: {
                  value: request.uri.replace(/00[1-5]-/, ''),
                },
              },
            }
          }

          if (mastodonProfileRedirectRe.test(request.uri)) {
            return {
              statusCode: 302,
              statusDescription: 'Found',
              headers: {
                location: {
                  value: 'https://mastodon.limulus.net' + request.uri
                }
              }
            }
          }

          request.uri = request.uri.replace(needsIndexHtmlRe, '$1/index.html')
          return request
        }
      FunctionConfig:
        Comment: Default request handler
        Runtime: cloudfront-js-2.0

  Route53RecordSetGroup:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneId: !Ref LimulusDotNetZoneId
      RecordSets: !If
        - IsMainBranch
        - - Name: 'limulus.net'
            Type: A
            AliasTarget:
              DNSName: !GetAtt CloudFrontDistribution.DomainName
              HostedZoneId: Z2FDTNDATAQYW2
          - Name: 'limulus.net'
            Type: AAAA
            AliasTarget:
              DNSName: !GetAtt CloudFrontDistribution.DomainName
              HostedZoneId: Z2FDTNDATAQYW2
          - Name: 'www.limulus.net'
            Type: A
            AliasTarget:
              DNSName: !GetAtt CloudFrontDistribution.DomainName
              HostedZoneId: Z2FDTNDATAQYW2
          - Name: 'www.limulus.net'
            Type: AAAA
            AliasTarget:
              DNSName: !GetAtt CloudFrontDistribution.DomainName
              HostedZoneId: Z2FDTNDATAQYW2
        - - Name: !Sub '${BranchName}.limulus.net'
            Type: A
            AliasTarget:
              DNSName: !GetAtt CloudFrontDistribution.DomainName
              HostedZoneId: Z2FDTNDATAQYW2
          - Name: !Sub '${BranchName}.limulus.net'
            Type: AAAA
            AliasTarget:
              DNSName: !GetAtt CloudFrontDistribution.DomainName
              HostedZoneId: Z2FDTNDATAQYW2

  StaticSiteBucket:
    Type: AWS::S3::Bucket
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete

  StaticSiteBucketOriginAccessControl:
    Type: AWS::CloudFront::OriginAccessControl
    Properties:
      OriginAccessControlConfig:
        Name: !Sub 'limulus-dot-net-oac-${BranchName}'
        OriginAccessControlOriginType: s3
        SigningBehavior: always
        SigningProtocol: sigv4

  StaticSiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref StaticSiteBucket
      PolicyDocument:
        Id: PolicyForCloudFrontPrivateContent
        Version: '2008-10-17'
        Statement:
          - Sid: AllowCloudFrontGetObject
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub 'arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution.Id}'
            Resource: !Sub '${StaticSiteBucket.Arn}/*'
            Action: s3:GetObject
            Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
          - Sid: AllowCloudFrontListBucket
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub 'arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution.Id}'
            Resource: !Sub '${StaticSiteBucket.Arn}'
            Action: s3:ListBucket
            Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com