stacco 0.1.60 → 0.1.61

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1cb10e6cac839663f4769cff722f74b02c275063
-  data.tar.gz: b0e326fc54393a74e5675ceecc87888590cef3f7
+  metadata.gz: 55ea351649e34bbb3d1b63fe3700ac7ac383da17
+  data.tar.gz: 05bcfd1299b422e4d49c8331cfccbb2afc7e84ab
 SHA512:
-  metadata.gz: 6668515ab11ab77031ce79c0ff71d06e16be9ed7cf4a185c103cc0fd8d0176cc992349fa6be58dcdf7b0176148c4e951902160fce105c208c957145e6e4dfea5
-  data.tar.gz: 1532af4515ac2aec5ad177630b749db24a4dc2fe68c379f560c26eb8e6220f0b8552a2b4bc7d865130c54db3c60910e1f4bc1a9f9b36cc118dff6d34c9281551
+  metadata.gz: abfbb2f8446e1dd209a2ac16d694bb8b2cc0bc3b1020b220b16e950627f14778912fe394da7f74f4bc5e9a83138b84f5480498462b7f5c47659cc6977868f025
+  data.tar.gz: dfa3e691ed3c3de599f9a82b2e8ac55d96933f523f82eb0e77836a3339e2272e72aa9646a1b6ec22801653003b45d0dce2a9a97ed73969ce1b2e3e9448c1d7b2

data/.git/COMMIT_EDITMSG

@@ -1 +1 @@
-Typo
+Allow direct connections to admin API from developer and operator IP ranges

data/.git/logs/HEAD

@@ -153,3 +153,4 @@ fec671e3a732fa81d23817e4f881a46a63996fb4 2fc5c1e9203eae0f705af2a77b752c0d1244f09
 5f708e5cb33d82d29fc82b85f65ad0b5f545973b 00b8b1720aea57a9f0a077d716f869efeeefd444 Levi Aul <levi@leviaul.com> 1406825256 -0700	commit: Fix addressing and variable naming for new template organization
 00b8b1720aea57a9f0a077d716f869efeeefd444 fe15d48b24512d8d52c3bf6a0a613d53c8588915 Levi Aul <levi@leviaul.com> 1408727336 -0700	commit: Check that a CloudFront distribution is owned by the stack before trying to initialize it
 fe15d48b24512d8d52c3bf6a0a613d53c8588915 bf737d4d54e2de569169955e9b1bb5c76b70613b Levi Aul <levi@leviaul.com> 1408732171 -0700	commit: Typo
+bf737d4d54e2de569169955e9b1bb5c76b70613b c1bc4a8d9c305d16d365b8a6a912ca54ef39ffcd Levi Aul <levi@leviaul.com> 1409010960 -0700	commit: Allow direct connections to admin API from developer and operator IP ranges

data/.git/logs/refs/heads/master

@@ -95,3 +95,4 @@ fec671e3a732fa81d23817e4f881a46a63996fb4 2fc5c1e9203eae0f705af2a77b752c0d1244f09
 5f708e5cb33d82d29fc82b85f65ad0b5f545973b 00b8b1720aea57a9f0a077d716f869efeeefd444 Levi Aul <levi@leviaul.com> 1406825256 -0700	commit: Fix addressing and variable naming for new template organization
 00b8b1720aea57a9f0a077d716f869efeeefd444 fe15d48b24512d8d52c3bf6a0a613d53c8588915 Levi Aul <levi@leviaul.com> 1408727336 -0700	commit: Check that a CloudFront distribution is owned by the stack before trying to initialize it
 fe15d48b24512d8d52c3bf6a0a613d53c8588915 bf737d4d54e2de569169955e9b1bb5c76b70613b Levi Aul <levi@leviaul.com> 1408732171 -0700	commit: Typo
+bf737d4d54e2de569169955e9b1bb5c76b70613b c1bc4a8d9c305d16d365b8a6a912ca54ef39ffcd Levi Aul <levi@leviaul.com> 1409010960 -0700	commit: Allow direct connections to admin API from developer and operator IP ranges

data/.git/logs/refs/remotes/origin/master

@@ -63,3 +63,4 @@ a35b7d6be7d227c6a15a009a2acf8bb6196fbc28 7a66a2604d4a1b7ff3ee2ec9a1a839458405f30
 5f708e5cb33d82d29fc82b85f65ad0b5f545973b 00b8b1720aea57a9f0a077d716f869efeeefd444 Levi Aul <levi@leviaul.com> 1406825272 -0700	update by push
 00b8b1720aea57a9f0a077d716f869efeeefd444 fe15d48b24512d8d52c3bf6a0a613d53c8588915 Levi Aul <levi@leviaul.com> 1408727345 -0700	update by push
 fe15d48b24512d8d52c3bf6a0a613d53c8588915 bf737d4d54e2de569169955e9b1bb5c76b70613b Levi Aul <levi@leviaul.com> 1408732180 -0700	update by push
+bf737d4d54e2de569169955e9b1bb5c76b70613b c1bc4a8d9c305d16d365b8a6a912ca54ef39ffcd Levi Aul <levi@leviaul.com> 1409010964 -0700	update by push

data/.git/refs/heads/master

@@ -1 +1 @@
-bf737d4d54e2de569169955e9b1bb5c76b70613b
+c1bc4a8d9c305d16d365b8a6a912ca54ef39ffcd

data/.git/refs/remotes/origin/master

@@ -1 +1 @@
-bf737d4d54e2de569169955e9b1bb5c76b70613b
+c1bc4a8d9c305d16d365b8a6a912ca54ef39ffcd

data/.git/refs/tags/0.1.61

@@ -0,0 +1 @@
+c1bc4a8d9c305d16d365b8a6a912ca54ef39ffcd

data/lib/stacco/stack.rb

@@ -184,6 +184,13 @@ class Stacco::Stack
       'UserDataEnvironmentVar' => env_lns.join
     }
 
+    (self.config['permit_backoffice_access'] || []).each do |rule_name, (auth_type, auth_opts)|
+      case auth_type
+      when :ip_range
+        parameters["#{rule_name.capitalize}IPRange"] = auth_opts
+      end
+    end
+
     scaling_groups = self.config['scale']
     self.enabled_layer_names.each do |layer_name|
       next unless scaling_groups.has_key?(layer_name)

data/priv/layers/app-infrastructure.json

@@ -1,4 +1,9 @@
 {
+  "Conditions" : {
+    "DeveloperCanIngress" : {"Fn::Not": [{"Fn::Equals" : [{"Ref" : "DeveloperIPRange"}, ""]}]},
+    "OperatorCanIngress" : {"Fn::Not": [{"Fn::Equals" : [{"Ref" : "OperatorIPRange"}, ""]}]}
+  },
+
   "Resources": {
 
     "AdminAPISecurityGroup": {"Type": "AWS::EC2::SecurityGroup", "Properties": {
@@ -6,15 +11,33 @@
       "VpcId": {"Ref": "Cloud"},
 
       "SecurityGroupIngress": [
-        {"IpProtocol": "tcp", "FromPort": "443", "ToPort": "443", "CidrIp": "10.0.0.0/16"},
-        {"IpProtocol": "tcp", "FromPort": "51607", "ToPort": "51607", "CidrIp": "10.0.0.0/16"}
+        {"IpProtocol": "tcp", "FromPort": "443", "ToPort": "443", "CidrIp": "10.0.0.0/16"}
       ],
       "SecurityGroupEgress": [
-        {"IpProtocol": "tcp", "FromPort": "80", "ToPort": "80", "CidrIp": "0.0.0.0/0"},
-        {"IpProtocol": "tcp", "FromPort": "51607", "ToPort": "51607", "CidrIp": "0.0.0.0/0"}
+        {"IpProtocol": "tcp", "FromPort": "80", "ToPort": "80", "CidrIp": "0.0.0.0/0"}
       ]
     }},
 
+    "DeveloperAdminAPIIngress": {
+      "Type": "AWS::EC2::SecurityGroupIngress",
+      "Condition": "DeveloperCanIngress",
+      "Properties": {
+        "GroupId": {"Fn::GetAtt": ["AdminAPISecurityGroup", "GroupId"]},
+        "IpProtocol": "-1",
+        "CidrIp": {"Ref": "DeveloperIPRange"}
+      }
+    },
+
+    "OperatorAdminAPIIngress": {
+      "Type": "AWS::EC2::SecurityGroupIngress",
+      "Condition": "OperatorCanIngress",
+      "Properties": {
+        "GroupId": {"Fn::GetAtt": ["AdminAPISecurityGroup", "GroupId"]},
+        "IpProtocol": "-1",
+        "CidrIp": {"Ref": "OperatorIPRange"}
+      }
+    },
+
     "BackendSecurityGroup" : {
       "Type" : "AWS::EC2::SecurityGroup",
       "Properties" : {
@@ -22,7 +45,7 @@
         "VpcId" : { "Ref" : "Cloud" },
         "SecurityGroupIngress": [
           {"IpProtocol": "tcp", "FromPort": "22", "ToPort": "22", "CidrIp": "0.0.0.0/0"},
-          {"IpProtocol": "tcp", "FromPort": "51607", "ToPort": "51607", "SourceSecurityGroupId": {"Ref": "AdminAPISecurityGroup"}},
+          {"IpProtocol": "tcp", "FromPort": "51607", "ToPort": "51607", "SourceSecurityGroupId": {"Ref": "FrontendToBackendSecurityGroup"}},
           {"IpProtocol": "tcp", "FromPort": "80", "ToPort": "80", "SourceSecurityGroupId": {"Ref": "AdminAPISecurityGroup"}}
         ],
         "SecurityGroupEgress": [
@@ -40,13 +63,56 @@
       }
     },
 
-    "AdminAPILoadBalancer": {"Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": {
+    "FrontendToBackendSecurityGroup": {"Type": "AWS::EC2::SecurityGroup", "Properties": {
+      "GroupDescription": "Frontend-to-Backend security group",
+      "VpcId": {"Ref": "Cloud"},
+
+      "SecurityGroupIngress": [
+        {"IpProtocol": "tcp", "FromPort": "51607", "ToPort": "51607", "CidrIp": "10.0.0.0/16"}
+      ],
+      "SecurityGroupEgress": [
+        {"IpProtocol": "tcp", "FromPort": "51607", "ToPort": "51607", "CidrIp": "10.0.0.0/16"}
+      ]
+    }},
+
+    "FrontendToBackendLoadBalancer": {"Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": {
       "Subnets": [
         {"Ref": "SubnetA"},
         {"Ref": "SubnetB"},
         {"Ref": "SubnetC"}
       ],
       "Scheme": "internal",
+      "SecurityGroups": [{"Ref": "FrontendToBackendSecurityGroup"}],
+
+      "HealthCheck": {
+        "HealthyThreshold": "3",
+        "Interval": "60",
+        "Target": "TCP:51607",
+        "Timeout": "5",
+        "UnhealthyThreshold": "10"
+      },
+
+      "Listeners": [{
+        "LoadBalancerPort": "51607",
+        "InstancePort": "51607",
+        "Protocol": "TCP",
+        "InstanceProtocol": "TCP"
+      }]
+    }},
+
+    "FrontendToBackendDNSRecord": {"Type": "AWS::Route53::RecordSet", "Properties": {
+      "HostedZoneId": {"Fn::FindInMap": ["StackZoneRecords", "AdminAPI", "HostedZoneId" ]},
+      "Name": {"Fn::FindInMap": ["StackZoneRecords", "FrontendToBackend", "DNSName" ]},
+      "Type": "CNAME", "TTL": "300",
+      "ResourceRecords": [{"Fn::GetAtt": ["FrontendToBackendLoadBalancer", "DNSName"]}]
+    }},
+
+    "AdminAPILoadBalancer": {"Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": {
+      "Subnets": [
+        {"Ref": "SubnetA"},
+        {"Ref": "SubnetB"},
+        {"Ref": "SubnetC"}
+      ],
       "SecurityGroups": [{"Ref": "AdminAPISecurityGroup"}],
 
       "HealthCheck": {
@@ -65,13 +131,6 @@
           "InstanceProtocol": "TCP",
 
           "SSLCertificateId": {"Fn::FindInMap": ["StackZoneRecords", "AdminAPI", "ServerCertificateARN" ]}
-        },
-
-        {
-          "LoadBalancerPort": "51607",
-          "InstancePort": "51607",
-          "Protocol": "TCP",
-          "InstanceProtocol": "TCP"
         }
       ]
     }},
@@ -188,10 +247,10 @@
       }
     },
 
-    "FrontendAdminAPIIngress": {
+    "FrontendToBackendIngress": {
       "Type": "AWS::EC2::SecurityGroupIngress",
       "Properties": {
-        "GroupId": { "Ref": "AdminAPISecurityGroup" },
+        "GroupId": { "Ref": "FrontendToBackendSecurityGroup" },
         "IpProtocol": "tcp",
         "FromPort": "51607",
         "ToPort": "51607",

data/priv/layers/backends.json

@@ -39,7 +39,8 @@
     "HealthCheckType": "ELB",
     "HealthCheckGracePeriod": "6000",
     "LoadBalancerNames": [
-      {"Ref": "AdminAPILoadBalancer"}
+      {"Ref": "AdminAPILoadBalancer"},
+      {"Ref": "FrontendToBackendLoadBalancer"}
     ],
 
     "TerminationPolicies": ["OldestLaunchConfiguration", "OldestInstance"],

data/priv/layers/frontends.json

@@ -74,7 +74,7 @@
       "export CFN_STACK_NAME='", {"Ref": "AWS::StackName"}, "'\n",
       "export CFN_INSTANCE_LOGICAL_NAME='FrontendLaunchConfiguration'\n",
       "export CFN_INSTANCE_HOSTNAME='", {"Fn::FindInMap": ["StackZoneRecords", "ClientAPI", "DNSName"]}, "'\n",
-      "export BEXNG_ADMIN_API_HOST='", {"Fn::FindInMap": ["StackZoneRecords", "AdminAPI", "DNSName" ]}, "'\n",
+      "export BEXNG_ADMIN_API_HOST='", {"Fn::FindInMap": ["StackZoneRecords", "FrontendToBackend", "DNSName" ]}, "'\n",
       {"Ref": "UserDataEnvironmentVar"}, "\n",
       {"Ref": "CommonRoleScriptVar"}, "\n",
       {"Ref": "FrontendRoleScriptVar"}, "\n"

data/priv/roles/Backend.sh

@@ -12,7 +12,7 @@ cat >"/etc/bexng/secrets.exs" <<EOF
 
   mandrill: "${MANDRILL_KEY}",
 
-  admin_user: "${BEXNG_DEFAULT_ADMIN_EMAIL}",
+  admin: "${BEXNG_DEFAULT_ADMIN_EMAIL}",
   admin_password: "${BEXNG_DEFAULT_ADMIN_PASSWORD}",
 
 

data/priv/stack.json.erb

@@ -8,6 +8,9 @@
 
     "IAMKeypairNameVar": {"Type": "String", "MinLength": "5"},
 
+    "DeveloperIPRange": {"Type": "String", "Default": ""},
+    "OperatorIPRange": {"Type": "String", "Default": ""},
+
     <% stack.roles.each do |role_name| %>
       <%= j "#{role_name}RoleScriptVar" %>: {"Type": "String"},
     <% end %>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: stacco
 version: !ruby/object:Gem::Version
-  version: 0.1.60
+  version: 0.1.61
 platform: ruby
 authors:
 - Levi Aul
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-08-22 00:00:00.000000000 Z
+date: 2014-08-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk
@@ -124,6 +124,7 @@ files:
 - "./.git/objects/07/aa6257e236ff574d02570f56c7142d99e14fb0"
 - "./.git/objects/07/ccbe7deba806a5e3045276d5c56d70bfcd1144"
 - "./.git/objects/08/d390fad8629347b01e81e36389b6445bb7be6e"
+- "./.git/objects/09/6ea3bde4dada1785f393c0d91f2d43bc7d7156"
 - "./.git/objects/0a/28342f575dbb656027091d278de50c38749bbc"
 - "./.git/objects/0a/e804aae1d90b10a729c2068afb73ce574bb87b"
 - "./.git/objects/0a/fe5b91af3f9a9f325013fb80fb424382bdafa1"
@@ -136,7 +137,9 @@ files:
 - "./.git/objects/0c/4fb9cf34eec86daaa1dbadee1893c46a05714c"
 - "./.git/objects/0c/7faf1aa66b06f513447af1bd133a36982f2fc9"
 - "./.git/objects/0c/9c227d2198c7456daa4fc97b94ca4a22085244"
+- "./.git/objects/0c/cf9117020326f0101facc82df6504769771da5"
 - "./.git/objects/0c/dad0dd2276579f09c7775b86a5f57de3430c08"
+- "./.git/objects/0d/87d31588b653da46766713dea1f5cb7ee59bd0"
 - "./.git/objects/0d/9f73c1bd248cb73a3d0bc0d6fa725b9190d768"
 - "./.git/objects/0e/b90325cf38be8580b7ee79ba3cacc4c2560fc0"
 - "./.git/objects/0f/ca3c7384c6a747a7cb3ace03e2b74a8502031c"
@@ -168,6 +171,7 @@ files:
 - "./.git/objects/18/ec0e701dcbdb487c91265f32d6d0e12a1cce42"
 - "./.git/objects/19/64cf97324d1b8d70c33e9a0cc1cfc04584edff"
 - "./.git/objects/19/b3f3fd00867549b948898baf60b31931daae63"
+- "./.git/objects/1a/25f27532c31703f8bf0a566ed464d3959d8815"
 - "./.git/objects/1a/4d5c77bb2fe5e66232d78509e9c2964ac379ac"
 - "./.git/objects/1a/5f357815183af87aff3d37b325de60fb036477"
 - "./.git/objects/1a/7dc91c02932654ebb5ad877504f6ef5ced337f"
@@ -325,6 +329,7 @@ files:
 - "./.git/objects/4d/d0ffb78ac5a5e9c4a5983db4567330a8716c53"
 - "./.git/objects/4e/22c4721a1d2d8d51eb61b0bba996256630e1a3"
 - "./.git/objects/4e/489da16c48856eefd116a63d5a469bf3446cfb"
+- "./.git/objects/4e/6a09ca91aa5fc95dca2f0d7e50e08d9823ac97"
 - "./.git/objects/4e/a5fcde29a07173d22bd2e4fcb52399906b4845"
 - "./.git/objects/4e/ab43d6277245776a5fe13179ef8703b47ae781"
 - "./.git/objects/4f/4fae184e6e68f8382f9234c283451fecdbf5df"
@@ -449,6 +454,7 @@ files:
 - "./.git/objects/78/a6d90b8e3275c3c8c9556a7b30ab6a1c4a9c28"
 - "./.git/objects/79/47526f0f3bc0e41576835c158e21d10b5e970a"
 - "./.git/objects/79/69c4940d597d5f3e2e8236ddb8f9f2975af9be"
+- "./.git/objects/79/9125f1dc901ddedfa60a65320dc62b849fda20"
 - "./.git/objects/79/9f44f71b0f39c64e6b861d432aca0585ec3422"
 - "./.git/objects/79/b78df8abb2703e35a607c5b083bfaf1ebe1545"
 - "./.git/objects/7a/3d0238f68331516604a5ad0af97cc08a8f2dba"
@@ -586,10 +592,12 @@ files:
 - "./.git/objects/a5/62e7c9d3ada1d9323c7b354c3b9b7a6f48ba4f"
 - "./.git/objects/a5/f2bf529f1392f53cc2fe0e6f46395d178742c2"
 - "./.git/objects/a6/236056b6eb554475bd2e5163badce6804f73b4"
+- "./.git/objects/a6/5d10b2c6e70a8083fefb4ee883a595a96ae52c"
 - "./.git/objects/a6/91c826ef7d39142e3c2c38caa57ac976b51ce6"
 - "./.git/objects/a6/99ddf81c7347fbbfce7a8bf2383e1046991c82"
 - "./.git/objects/a6/ef0d4b0ed432ed7551549d97b6687aed948eb6"
 - "./.git/objects/a6/f7a718562d979ef0eb6c90cf6a85a0f260cb20"
+- "./.git/objects/a7/027d79ead552ea5c3e5f40eff998381e13e3fe"
 - "./.git/objects/a7/4368a861be3c0712ad60379ca6cccd2647cbd6"
 - "./.git/objects/a7/98095f76f9ffd2fd8653a55b278ce4db7d8087"
 - "./.git/objects/a7/c33f7ce80cb6c96ffb75ae23f4a362695386ec"
@@ -675,6 +683,7 @@ files:
 - "./.git/objects/bf/d5869be4f2f7981bf2ba732bcb0f1d57619743"
 - "./.git/objects/bf/df2e1ff6a2624f4a8e8c7bb67a35c233680182"
 - "./.git/objects/c0/3882a1fcd3514f959d120a2ffba38bf57b38f2"
+- "./.git/objects/c1/bc4a8d9c305d16d365b8a6a912ca54ef39ffcd"
 - "./.git/objects/c1/e9e19d419b9dd7742e1b0ba9d3eb5054e0c172"
 - "./.git/objects/c1/f00cec69690eb81bb3be1d452048006a732d94"
 - "./.git/objects/c2/17393985203312c295bdbc9d7ad1c9be10f79e"
@@ -723,6 +732,7 @@ files:
 - "./.git/objects/cc/6d9ff1c31aef5ea0736d2faef48ffcc501f3b3"
 - "./.git/objects/cc/d1bbab75782cdda520d3f7bcefb5e3c99cb82c"
 - "./.git/objects/cc/fa30fa70e56db81b80a0b4674d0633ffe21ef4"
+- "./.git/objects/cd/25624ea064ae1357365d1017c9289b2a5804ba"
 - "./.git/objects/cd/52c8a14cf0b36b8f2ad5bca615ec8e3883ac43"
 - "./.git/objects/cd/8391d58b70f75f85151faea0f0bbc890100ebb"
 - "./.git/objects/cd/96b15f2b7b9159f864cbe98ebbd60e79395dc9"
@@ -772,6 +782,7 @@ files:
 - "./.git/objects/dc/bcb2004a0fe58247744f83c7b9ee815566fad4"
 - "./.git/objects/dd/11f4a70a4656ed4d662da5e6ef97f06979fef3"
 - "./.git/objects/dd/1dd372527a3f87c59ebe7902805fc3d752012c"
+- "./.git/objects/dd/fbead7ac9b513152e01e0c8c6b852eba4b3635"
 - "./.git/objects/de/2444aaa895c7ee0df154bfa8cce0f92ce80929"
 - "./.git/objects/de/37f8dd9aa0f89ae4572379dd5043b504470693"
 - "./.git/objects/de/883c21aa3a20265f9b0938f26f60ed9082f0ba"
@@ -780,6 +791,7 @@ files:
 - "./.git/objects/de/e466b16ae3ac70bb5f1a4addad6a4b484d9ae8"
 - "./.git/objects/df/102328122c4d77469f75c6cc283b00108bd1ed"
 - "./.git/objects/df/a6b8fe938bca1d45ee3cc3fc54dcad41ba7638"
+- "./.git/objects/df/bfb4d51beca0d2bef79b2ec4aefe4a30b3fc1f"
 - "./.git/objects/e0/00c6e760f84c7ffa982192aa08673be34a70cd"
 - "./.git/objects/e0/25280ec493575d2176fa61c6a90d3262566227"
 - "./.git/objects/e0/bb46327d0309abfc4270f1a08236ac553f6904"
@@ -949,6 +961,7 @@ files:
 - "./.git/refs/tags/0.1.58"
 - "./.git/refs/tags/0.1.59"
 - "./.git/refs/tags/0.1.60"
+- "./.git/refs/tags/0.1.61"
 - "./.gitignore"
 - "./Dockerfile"
 - "./README.md"