@appliance.sh/infra 1.11.1 → 1.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appliance.sh/infra",
-  "version": "1.11.1",
+  "version": "1.12.1",
   "description": "Deploy the Appliance Infrastructure",
   "repository": "https://github.com/appliance-sh/appliance.sh",
   "license": "MIT",
@@ -14,6 +14,7 @@
   },
   "dependencies": {
     "@pulumi/aws": "^7.15.0",
+    "@pulumi/aws-native": "^1.46.0",
     "@pulumi/awsx": "^3.1.0",
     "@pulumi/pulumi": "^3.213.0"
   }

package/src/lib/appliance-infra.ts

@@ -1,4 +1,5 @@
 import * as aws from '@pulumi/aws';
+import * as awsNative from '@pulumi/aws-native';
 import * as pulumi from '@pulumi/pulumi';
 import { lookup } from './controller';
 import { applianceBaseConfigInput } from '@appliance.sh/sdk';
@@ -27,10 +28,21 @@ export async function applianceInfra() {
 
     const baseGlobalProvider = new aws.Provider(`${base}-global-provider`, { region: 'us-east-1' });
     const baseRegionalProvider = new aws.Provider(`${base}-region-provider`, { region: baseConfig.data.region });
+
+    const baseNativeGlobalProvider = new awsNative.Provider(`${base}-native-global-provider`, { region: 'us-east-1' });
+    const baseNativeRegionalProvider = new awsNative.Provider(`${base}-native-region-provider`, {
+      region: baseConfig.data.region as awsNative.Region,
+    });
     const applianceBase = new baseController(
       `${base}`,
-      { config: baseConfig.data },
-      { globalProvider: baseGlobalProvider, provider: baseRegionalProvider }
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      { config: baseConfig.data as any },
+      {
+        globalProvider: baseGlobalProvider,
+        provider: baseRegionalProvider,
+        nativeProvider: baseNativeRegionalProvider,
+        nativeGlobalProvider: baseNativeGlobalProvider,
+      }
     );
 
     applianceBases.push(applianceBase);

package/src/lib/aws/ApplianceBaseAwsPublic.ts

@@ -1,5 +1,7 @@
 import * as pulumi from '@pulumi/pulumi';
 import * as aws from '@pulumi/aws';
+import * as awsNative from '@pulumi/aws-native';
+
 import { ApplianceBaseAwsPublicInput } from '@appliance.sh/sdk';
 
 export type ApplianceBaseAwsPublicArgs = {
@@ -8,11 +10,17 @@ export type ApplianceBaseAwsPublicArgs = {
 
 export interface ApplianceBaseAwsPublicOpts extends pulumi.ComponentResourceOptions {
   globalProvider?: pulumi.ProviderResource;
+  nativeProvider?: pulumi.ProviderResource;
+  nativeGlobalProvider?: pulumi.ProviderResource;
 }
 
 export class ApplianceBaseAwsPublic extends pulumi.ComponentResource {
-  public readonly zoneId?: pulumi.Output<string>;
+  public readonly zoneId: pulumi.Output<string>;
   public readonly zone?: aws.route53.Zone;
+  public readonly globalCert?: aws.acm.Certificate;
+  public readonly certificateArn?: pulumi.Output<string>;
+  public readonly cloudfrontDistribution?: aws.cloudfront.Distribution;
+
   constructor(name: string, args: ApplianceBaseAwsPublicArgs, opts?: ApplianceBaseAwsPublicOpts) {
     super('appliance-infra:appliance-base-aws-public', name, args, opts);
 
@@ -26,6 +34,195 @@ export class ApplianceBaseAwsPublic extends pulumi.ComponentResource {
       );
 
       this.zoneId = this.zone.zoneId;
+    } else {
+      this.zoneId = aws.route53.getZoneOutput({
+        name: args.config.dns.domainName,
+      }).id;
     }
+
+    const wildcardDomain = `*.${args.config.dns.domainName}`;
+    const createCertificate = true;
+    if (createCertificate) {
+      this.globalCert = new aws.acm.Certificate(
+        `${name}-global-certificate`,
+        {
+          domainName: wildcardDomain,
+          subjectAlternativeNames: [wildcardDomain],
+          validationMethod: 'DNS',
+          region: 'us-east-1',
+        },
+        { parent: this, provider: opts?.globalProvider }
+      );
+
+      const globalCertValidationRecords = this.globalCert.domainValidationOptions.apply((certValOpts) => {
+        return certValOpts.map((certValOpt, idx) => {
+          return new aws.route53.Record(
+            `${name}-global-cert-val-${idx}`,
+            {
+              zoneId: this.zoneId,
+              name: certValOpt.resourceRecordName,
+              type: certValOpt.resourceRecordType,
+              records: [certValOpt.resourceRecordValue],
+              ttl: 60,
+            },
+            { parent: this, provider: opts?.globalProvider }
+          );
+        });
+      });
+
+      new aws.acm.CertificateValidation(
+        `${name}-global-cert-validation`,
+        {
+          region: 'us-east-1',
+          validationRecordFqdns: globalCertValidationRecords.apply((records) => records.map((record) => record.fqdn)),
+          certificateArn: this.globalCert.arn,
+        },
+        { parent: this, provider: opts?.globalProvider }
+      );
+
+      this.certificateArn = this.globalCert.arn;
+    } else {
+      this.certificateArn = aws.acm.getCertificateOutput(
+        {
+          region: 'us-east-1',
+          domain: wildcardDomain,
+        },
+        { parent: this, provider: opts?.globalProvider }
+      ).arn;
+    }
+
+    const lambdaOrigin = new aws.lambda.CallbackFunction(
+      `${name}-origin`,
+      {
+        name: `${name}-origin`.replaceAll('.', '-'),
+        runtime: 'nodejs22.x',
+        callback: async () => {
+          const result = {
+            message: 'Hello world!',
+            time: new Date().toISOString(),
+          };
+          return { statusCode: 200, body: JSON.stringify(result) };
+        },
+      },
+      { parent: this, provider: opts?.provider }
+    );
+
+    const lambdaOriginFunctionUrl = new aws.lambda.FunctionUrl(
+      `${name}-origin-url`,
+      {
+        functionName: lambdaOrigin.name,
+        authorizationType: 'AWS_IAM',
+        invokeMode: 'BUFFERED',
+        cors: {
+          allowCredentials: true,
+          allowOrigins: [`https://api.${args.config.dns.domainName}`],
+          allowMethods: ['GET', 'POST'],
+          allowHeaders: ['date', 'keep-alive'],
+          exposeHeaders: ['keep-alive', 'date'],
+          maxAge: 60,
+        },
+        region: 'ap-southeast-1',
+      },
+      { parent: this, provider: opts?.provider }
+    );
+
+    const lambdaOac = new aws.cloudfront.OriginAccessControl(
+      `${name}-origin-access-control`,
+      {
+        name: 'MyLambdaOAC',
+        originAccessControlOriginType: 'lambda',
+        signingBehavior: 'always',
+        signingProtocol: 'sigv4',
+      },
+      { parent: this, provider: opts?.globalProvider }
+    );
+
+    this.cloudfrontDistribution = new aws.cloudfront.Distribution(
+      `${name}-distribution`,
+      {
+        defaultCacheBehavior: {
+          cachePolicyId: aws.cloudfront
+            .getCachePolicyOutput(
+              { name: 'Managed-CachingDisabled' },
+              {
+                parent: this,
+                provider: opts?.globalProvider,
+              }
+            )
+            .apply((res) => res.id ?? ''),
+          originRequestPolicyId: aws.cloudfront
+            .getOriginRequestPolicyOutput(
+              { name: 'Managed-AllViewerExceptHostHeader' },
+              {
+                parent: this,
+                provider: opts?.globalProvider,
+              }
+            )
+            .apply((res) => res.id ?? ''),
+          allowedMethods: ['HEAD', 'GET'],
+          cachedMethods: ['HEAD', 'GET'],
+          targetOriginId: 'LambdaOrigin',
+          viewerProtocolPolicy: 'redirect-to-https',
+        },
+        origins: [
+          {
+            originId: 'LambdaOrigin',
+            domainName: lambdaOriginFunctionUrl.functionUrl.apply((url) => new URL(url).hostname),
+            originAccessControlId: lambdaOac.id,
+            customOriginConfig: {
+              httpPort: 80,
+              httpsPort: 443,
+              originProtocolPolicy: 'https-only',
+              originSslProtocols: ['TLSv1', 'TLSv1.1', 'TLSv1.2'],
+            },
+          },
+        ],
+        restrictions: { geoRestriction: { restrictionType: 'none' } },
+        viewerCertificate: {
+          acmCertificateArn: this.certificateArn,
+          sslSupportMethod: 'sni-only',
+          minimumProtocolVersion: 'TLSv1',
+        },
+        enabled: true,
+        aliases: [wildcardDomain],
+      },
+      { parent: this, provider: opts?.globalProvider }
+    );
+
+    new aws.lambda.Permission(
+      `${name.replaceAll('.', '-')}-origin-invoke-function-url-permission`,
+      {
+        action: 'lambda:InvokeFunctionUrl',
+        principal: 'cloudfront.amazonaws.com',
+        function: lambdaOrigin.name,
+        functionUrlAuthType: 'AWS_IAM',
+        sourceArn: this.cloudfrontDistribution.arn,
+      },
+      { parent: this, provider: opts?.provider }
+    );
+
+    new awsNative.lambda.Permission(
+      `${name.replaceAll('.', '-')}-origin-invoke-function-permission`,
+      {
+        action: 'lambda:InvokeFunction',
+        principal: 'cloudfront.amazonaws.com',
+        sourceArn: this.cloudfrontDistribution.arn,
+        functionName: lambdaOrigin.name,
+        invokedViaFunctionUrl: true,
+      },
+      { parent: this, provider: opts?.nativeProvider }
+    );
+
+    new aws.route53.Record(
+      `${name}-wildcard-cloudfront-record`,
+      {
+        name: wildcardDomain,
+        zoneId: this.zoneId,
+        type: 'CNAME',
+        records: [this.cloudfrontDistribution.domainName],
+        ttl: 60,
+      },
+      { parent: this, provider: opts?.globalProvider }
+    );
   }
 }

package/src/lib/aws/ApplianceBaseAwsVpc.ts

@@ -7,6 +7,8 @@ export type ApplianceBaseAwsVpcArgs = {
 
 export interface ApplianceBaseAwsVpcOpts extends pulumi.ComponentResourceOptions {
   globalProvider?: pulumi.ProviderResource;
+  nativeProvider?: pulumi.ProviderResource;
+  nativeGlobalProvider?: pulumi.ProviderResource;
 }
 
 export class ApplianceBaseAwsVpc extends pulumi.ComponentResource {