@fishawack/lab-env 5.6.1 → 5.7.0-beta.1

package/commands/create/libs/vars.js

@@ -250,11 +250,6 @@ module.exports.eb = {
                     Value: "false",
                     Namespace: "aws:ec2:vpc",
                 },
-                {
-                    OptionName: "APP_ENV",
-                    Value: "production",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
             ],
         },
         php: {
@@ -284,233 +279,17 @@ module.exports.eb = {
             high: [],
         },
         wordpress: {
-            shared: [
-                {
-                    OptionName: "AUTH_KEY",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "SECURE_AUTH_KEY",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "LOGGED_IN_KEY",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "NONCE_KEY",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AUTH_SALT",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "SECURE_AUTH_SALT",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "LOGGED_IN_SALT",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "NONCE_SALT",
-                    Value: generateSafeKey({
-                        length: 64,
-                        numbers: true,
-                        symbols: true,
-                    }),
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "S3_UPLOADS_BUCKET",
-                    Value: "<%= s3Slug %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "S3_UPLOADS_REGION",
-                    Value: "<%= AWS_REGION %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "S3_UPLOADS_KEY",
-                    Value: "<%= AccessKeyId %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "S3_UPLOADS_SECRET",
-                    Value: "<%= SecretAccessKey %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-            ],
+            shared: [],
             low: [],
             high: [],
         },
         laravel: {
-            shared: [
-                {
-                    OptionName: "APP_ENV",
-                    Value: "production",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "APP_KEY",
-                    Value: `base64:${Buffer.from(generator.generate({ length: 32, numbers: true, symbols: true })).toString("base64")}`,
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "APP_DEBUG",
-                    Value: "false",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "APP_URL",
-                    Value: "https://<%= DOMAIN_LINK %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_BUCKET",
-                    Value: "<%= s3Slug %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_DEFAULT_REGION",
-                    Value: "<%= AWS_REGION %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_ACCESS_KEY_ID",
-                    Value: "<%= AccessKeyId %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_SECRET_ACCESS_KEY",
-                    Value: "<%= SecretAccessKey %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "FILESYSTEM_DISK",
-                    Value: "s3",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "FILESYSTEM_DISK_PUBLIC",
-                    Value: "s3-public",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-            ],
+            shared: [],
             low: [],
-            high: [
-                {
-                    OptionName: "SESSION_DRIVER",
-                    Value: "cookie",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "SESSION_SECURE_COOKIE",
-                    Value: "true",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-            ],
+            high: [],
         },
         adonis: {
-            shared: [
-                {
-                    OptionName: "NODE_ENV",
-                    Value: "production",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "APP_KEY",
-                    Value: `base64:${Buffer.from(generator.generate({ length: 32, numbers: true, symbols: true })).toString("base64")}`,
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "APP_URL",
-                    Value: "https://<%= DOMAIN_LINK %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "SESSION_DRIVER",
-                    Value: "cookie",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_BUCKET",
-                    Value: "<%= s3Slug %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_DEFAULT_REGION",
-                    Value: "<%= AWS_REGION %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_ACCESS_KEY_ID",
-                    Value: "<%= AccessKeyId %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "AWS_SECRET_ACCESS_KEY",
-                    Value: "<%= SecretAccessKey %>",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "FILESYSTEM_DISK",
-                    Value: "s3",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "FILESYSTEM_DISK_PUBLIC",
-                    Value: "s3-public",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "PORT",
-                    Value: "3333",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-                {
-                    OptionName: "LOG_LEVEL",
-                    Value: "info",
-                    Namespace: "aws:elasticbeanstalk:application:environment",
-                },
-            ],
+            shared: [],
             low: [],
             high: [],
         },
@@ -530,27 +309,6 @@ module.exports.eb = {
                 Value: "aws-elasticbeanstalk-ec2-role",
                 Namespace: "aws:autoscaling:launchconfiguration",
             },
-            ({ database }) =>
-                database && [
-                    {
-                        OptionName: "HasCoupledDatabase",
-                        Value: "true",
-                        Namespace: "aws:rds:dbinstance",
-                    },
-                    {
-                        OptionName: "DBEngineVersion",
-                        Value: "8.0.43",
-                        Namespace: "aws:rds:dbinstance",
-                    },
-                    {
-                        OptionName: "DBPassword",
-                        Value: generator.generate({
-                            length: 10,
-                            numbers: true,
-                        }),
-                        Namespace: "aws:rds:dbinstance",
-                    },
-                ],
         ],
         low: [
             {
@@ -558,16 +316,6 @@ module.exports.eb = {
                 Value: "SingleInstance",
                 Namespace: "aws:elasticbeanstalk:environment",
             },
-            {
-                OptionName: "DOMAIN_LINK",
-                Value: "<%= DOMAIN_LINK %>",
-                Namespace: "aws:elasticbeanstalk:application:environment",
-            },
-            {
-                OptionName: "EMAIL_LINK",
-                Value: "mike.mellor@fishawack.com",
-                Namespace: "aws:elasticbeanstalk:application:environment",
-            },
         ],
         high: [
             {
@@ -612,6 +360,172 @@ module.exports.eb = {
             },
         ],
     },
+    secretPayloads: {
+        shared: {
+            database: ({ database }) =>
+                database && {
+                    RDS_HOSTNAME: "<%= RDS_HOSTNAME %>",
+                    RDS_PORT: "<%= RDS_PORT %>",
+                    RDS_DB_NAME: "ebdb",
+                    RDS_USERNAME: "ebroot",
+                    RDS_PASSWORD: "<%= RDS_PASSWORD %>",
+                    MYSQL_ATTR_SSL_CA: "/opt/rds-certs/global-bundle.pem",
+                },
+        },
+        low: {
+            app: {
+                DOMAIN_LINK: "<%= DOMAIN_LINK %>",
+                EMAIL_LINK: "mike.mellor@fishawack.com",
+            },
+        },
+        high: {},
+        wordpress: {
+            shared: {
+                app: {
+                    AUTH_KEY: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    SECURE_AUTH_KEY: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    LOGGED_IN_KEY: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    NONCE_KEY: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    AUTH_SALT: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    SECURE_AUTH_SALT: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    LOGGED_IN_SALT: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                    NONCE_SALT: generateSafeKey({
+                        length: 64,
+                        numbers: true,
+                        symbols: true,
+                    }),
+                },
+                storage: ({ storage }) =>
+                    storage && {
+                        S3_UPLOADS_BUCKET: "<%= s3Slug %>",
+                        S3_UPLOADS_REGION: "<%= AWS_REGION %>",
+                        S3_UPLOADS_KEY: "<%= AccessKeyId %>",
+                        S3_UPLOADS_SECRET: "<%= SecretAccessKey %>",
+                    },
+            },
+        },
+        laravel: {
+            shared: {
+                app: {
+                    APP_ENV: "production",
+                    APP_KEY: `base64:${Buffer.from(generator.generate({ length: 32, numbers: true, symbols: true })).toString("base64")}`,
+                    APP_DEBUG: "false",
+                    APP_URL: "https://<%= DOMAIN_LINK %>",
+                },
+                storage: ({ storage }) =>
+                    storage && {
+                        AWS_BUCKET: "<%= s3Slug %>",
+                        AWS_DEFAULT_REGION: "<%= AWS_REGION %>",
+                        AWS_ACCESS_KEY_ID: "<%= AccessKeyId %>",
+                        AWS_SECRET_ACCESS_KEY: "<%= SecretAccessKey %>",
+                        FILESYSTEM_DISK: "s3",
+                        FILESYSTEM_DISK_PUBLIC: "s3-public",
+                    },
+            },
+            high: {
+                app: {
+                    SESSION_DRIVER: "database",
+                    SESSION_SECURE_COOKIE: "true",
+                },
+            },
+        },
+        adonis: {
+            shared: {
+                app: {
+                    NODE_ENV: "production",
+                    APP_KEY: `base64:${Buffer.from(generator.generate({ length: 32, numbers: true, symbols: true })).toString("base64")}`,
+                    APP_URL: "https://<%= DOMAIN_LINK %>",
+                    SESSION_DRIVER: "cookie",
+                    PORT: "3333",
+                    LOG_LEVEL: "info",
+                },
+                storage: ({ storage }) =>
+                    storage && {
+                        AWS_BUCKET: "<%= s3Slug %>",
+                        AWS_DEFAULT_REGION: "<%= AWS_REGION %>",
+                        AWS_ACCESS_KEY_ID: "<%= AccessKeyId %>",
+                        AWS_SECRET_ACCESS_KEY: "<%= SecretAccessKey %>",
+                        FILESYSTEM_DISK: "s3",
+                        FILESYSTEM_DISK_PUBLIC: "s3-public",
+                    },
+            },
+        },
+        python: {
+            high: {
+                app: {
+                    APP_ENV: "production",
+                },
+            },
+        },
+    },
+    buildSecretPayloads(config, data = {}) {
+        const { framework, availability = "low", platform, language } = config;
+        const result = { app: {}, storage: {}, database: {} };
+
+        const sources = [
+            this.secretPayloads.shared,
+            this.secretPayloads[availability],
+            this.secretPayloads[platform]?.shared,
+            this.secretPayloads[platform]?.[availability],
+            this.secretPayloads[language]?.shared,
+            this.secretPayloads[language]?.[availability],
+            this.secretPayloads[framework]?.shared,
+            this.secretPayloads[framework]?.[availability],
+        ];
+
+        for (const source of sources) {
+            if (!source) continue;
+            for (const group of ["app", "storage", "database"]) {
+                let values = source[group];
+                if (typeof values === "function") {
+                    values = values(config, data);
+                }
+                if (values) {
+                    Object.assign(result[group], values);
+                }
+            }
+        }
+
+        // Apply lodash template interpolation
+        const templateData = { ...process.env, ...data };
+        for (const group of ["app", "storage", "database"]) {
+            if (Object.keys(result[group]).length) {
+                result[group] = JSON.parse(
+                    template(JSON.stringify(result[group]))(templateData),
+                );
+            }
+        }
+
+        return result;
+    },
     configurations: {
         php: {
             shared: [".ebextensions/php/ini.config"],
@@ -680,6 +594,7 @@ module.exports.eb = {
                 ".platform/nginx/conf.d/elasticbeanstalk/laravel.conf",
                 ".ebextensions/laravel/post-deploy.config",
                 ".ebextensions/laravel/software.config",
+                ".ebextensions/laravel/rds-ssl.config",
             ],
             low: [],
             high: [],

package/commands/create/services/aws/ec2.js

@@ -1,4 +1,12 @@
-const { EC2Client, DescribeKeyPairsCommand } = require("@aws-sdk/client-ec2");
+const {
+    EC2Client,
+    DescribeKeyPairsCommand,
+    CreateSecurityGroupCommand,
+    AuthorizeSecurityGroupIngressCommand,
+    RevokeSecurityGroupIngressCommand,
+    DeleteSecurityGroupCommand,
+    DescribeSecurityGroupsCommand,
+} = require("@aws-sdk/client-ec2");
 const { Spinner } = require("../../libs/utilities");
 
 module.exports.getKeyPair = async (KeyName) => {
@@ -15,3 +23,144 @@ module.exports.getKeyPair = async (KeyName) => {
 
     return res;
 };
+
+module.exports.createRDSSecurityGroup = async (name, tags = []) => {
+    const client = new EC2Client({});
+
+    const groupName = `${name}-rds`;
+
+    const sg = await Spinner.prototype.simple(
+        `Creating security group ${groupName}`,
+        () => {
+            return client.send(
+                new CreateSecurityGroupCommand({
+                    GroupName: groupName,
+                    Description: `RDS access for ${name}`,
+                    TagSpecifications: [
+                        {
+                            ResourceType: "security-group",
+                            Tags: [
+                                {
+                                    Key: "Name",
+                                    Value: groupName,
+                                },
+                                {
+                                    Key: "client",
+                                    Value: process.env.AWS_PROFILE,
+                                },
+                            ].concat(tags),
+                        },
+                    ],
+                }),
+            );
+        },
+    );
+
+    return sg.GroupId;
+};
+
+module.exports.authorizeRDSIngress = async (
+    rdsSecurityGroupId,
+    sourceSecurityGroupId,
+) => {
+    const client = new EC2Client({});
+
+    await Spinner.prototype.simple(
+        `Adding MySQL inbound rule from EB security group`,
+        () => {
+            return client.send(
+                new AuthorizeSecurityGroupIngressCommand({
+                    GroupId: rdsSecurityGroupId,
+                    IpPermissions: [
+                        {
+                            IpProtocol: "tcp",
+                            FromPort: 3306,
+                            ToPort: 3306,
+                            UserIdGroupPairs: [
+                                {
+                                    GroupId: sourceSecurityGroupId,
+                                    Description:
+                                        "MySQL access for EB instances",
+                                },
+                            ],
+                        },
+                    ],
+                }),
+            );
+        },
+    );
+};
+
+module.exports.revokeRDSIngress = async (
+    rdsSecurityGroupId,
+    sourceSecurityGroupId,
+) => {
+    const client = new EC2Client({});
+
+    await Spinner.prototype.simple(
+        `Removing MySQL inbound rule from RDS security group`,
+        () => {
+            return client.send(
+                new RevokeSecurityGroupIngressCommand({
+                    GroupId: rdsSecurityGroupId,
+                    IpPermissions: [
+                        {
+                            IpProtocol: "tcp",
+                            FromPort: 3306,
+                            ToPort: 3306,
+                            UserIdGroupPairs: [
+                                {
+                                    GroupId: sourceSecurityGroupId,
+                                },
+                            ],
+                        },
+                    ],
+                }),
+            );
+        },
+    );
+};
+
+module.exports.findSecurityGroupByTag = async (filters = []) => {
+    const client = new EC2Client({});
+
+    const res = await Spinner.prototype.simple(
+        `Looking up security group by filters`,
+        () => {
+            return client.send(
+                new DescribeSecurityGroupsCommand({
+                    Filters: filters,
+                }),
+            );
+        },
+    );
+
+    return res.SecurityGroups[0] || null;
+};
+
+module.exports.findSecurityGroupByName = async (name) => {
+    const client = new EC2Client({});
+
+    const res = await Spinner.prototype.simple(
+        `Looking up security group ${name}`,
+        () => {
+            return client.send(
+                new DescribeSecurityGroupsCommand({
+                    Filters: [{ Name: "group-name", Values: [name] }],
+                }),
+            );
+        },
+    );
+
+    return res.SecurityGroups[0] || null;
+};
+
+module.exports.deleteSecurityGroup = async (groupId) => {
+    const client = new EC2Client({});
+
+    await Spinner.prototype.simple(`Deleting security group ${groupId}`, () => {
+        return client.send(
+            new DeleteSecurityGroupCommand({ GroupId: groupId }),
+        );
+    });
+};

package/commands/create/services/aws/elasticbeanstalk.js

@@ -10,6 +10,8 @@ const {
     DescribeEnvironmentsCommand,
     DescribeApplicationsCommand,
     DescribeApplicationVersionsCommand,
+    DescribeConfigurationSettingsCommand,
+    UpdateEnvironmentCommand,
     CreateApplicationVersionCommand,
     ListAvailableSolutionStacksCommand,
 } = require("@aws-sdk/client-elastic-beanstalk");
@@ -31,6 +33,16 @@ module.exports.createElasticBeanstalkApplication = async (name) => {
     return res;
 };
 
+module.exports.describeEnvironment = async (name) => {
+    const client = new ElasticBeanstalkClient({});
+
+    return client.send(
+        new DescribeEnvironmentsCommand({
+            EnvironmentNames: [name],
+        }),
+    );
+};
+
 module.exports.createElasticBeanstalkEnvironment = async (
     name,
     { language },
@@ -230,3 +242,45 @@ module.exports.deleteApplicationVersion = async (
         }),
     );
 };
+
+module.exports.describeConfigurationSettings = async (
+    applicationName,
+    environmentName,
+) => {
+    const client = new ElasticBeanstalkClient({});
+
+    const res = await Spinner.prototype.simple(
+        `Retrieving configuration for ${environmentName}`,
+        () => {
+            return client.send(
+                new DescribeConfigurationSettingsCommand({
+                    ApplicationName: applicationName,
+                    EnvironmentName: environmentName,
+                }),
+            );
+        },
+    );
+
+    return res.ConfigurationSettings[0]?.OptionSettings || [];
+};
+
+module.exports.updateEnvironmentSettings = async (
+    environmentName,
+    optionSettings = [],
+    optionsToRemove = [],
+) => {
+    const client = new ElasticBeanstalkClient({});
+
+    await Spinner.prototype.simple(
+        `Updating environment ${environmentName}`,
+        () => {
+            return client.send(
+                new UpdateEnvironmentCommand({
+                    EnvironmentName: environmentName,
+                    OptionSettings: optionSettings,
+                    OptionsToRemove: optionsToRemove,
+                }),
+            );
+        },
+    );
+};