@glicogh/healthcare-cdk 0.1.63 → 0.1.64
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/scripts/post-deployment-api-gateway.sh +20 -0
- package/dist/scripts/post-deployment-before-all.sh +3 -0
- package/dist/scripts/post-deployment-portal.sh +20 -0
- package/dist/util/constants.d.ts +14 -0
- package/dist/util/constants.js +9 -1
- package/dist/util/getEc2UserData.js +6 -2
- package/package.json +1 -1
- package/scripts/post-deployment-api-gateway.sh +20 -0
- package/scripts/post-deployment-before-all.sh +3 -0
- package/scripts/post-deployment-portal.sh +20 -0
|
@@ -33,3 +33,23 @@ sudo systemctl restart dnsmasq
|
|
|
33
33
|
|
|
34
34
|
# start nginx server
|
|
35
35
|
sudo systemctl restart nginx
|
|
36
|
+
|
|
37
|
+
# install certbot
|
|
38
|
+
sudo snap refresh core
|
|
39
|
+
sudo apt remove certbot
|
|
40
|
+
sudo snap install --classic certbot
|
|
41
|
+
sudo ln -s /snap/bin/certbot /usr/bin/certbot
|
|
42
|
+
|
|
43
|
+
# sync SSL certificates from S3 bucket to local (if they exist)
|
|
44
|
+
aws s3 cp s3://$public_bucket_name/ssl/ /etc/letsencrypt/live --recursive
|
|
45
|
+
sudo chown -R ubuntu:ubuntu /etc/letsencrypt/live
|
|
46
|
+
|
|
47
|
+
# obtain SSL certificate (if it doesn't exist) and sync to S3 bucket
|
|
48
|
+
if [[ ! -f "/etc/letsencrypt/live/$api_gateway_domain_name/fullchain.pem" ]]; then
|
|
49
|
+
sudo certbot certonly --standalone -d $api_gateway_domain_name --agree-tos --non-interactive -m mistabiggx@gmail.com --no-eff-email --quiet --pre-hook="sudo systemctl stop nginx" --post-hook="sudo systemctl start nginx" --deploy-hook "aws s3 sync /etc/letsencrypt/live s3://$public_bucket_name/ssl/"
|
|
50
|
+
fi
|
|
51
|
+
|
|
52
|
+
# register SSL renewal cron
|
|
53
|
+
certbot_cron_command="/usr/bin/certbot renew --pre-hook=\"sudo systemctl stop nginx\" --post-hook=\"sudo systemctl start nginx\" --deploy-hook \"aws s3 sync /etc/letsencrypt/live s3://$public_bucket_name/ssl/\" >> $logs_dir/{{serviceName}}-ssl-renewal.log"
|
|
54
|
+
certbot_cron_job="0 0,12 * * * $certbot_cron_command"
|
|
55
|
+
( ( crontab -l || true ) | ( grep -v -F "$certbot_cron_command" || true ) ; echo "$certbot_cron_job" ) | crontab -
|
|
@@ -19,6 +19,9 @@ deployment_log_file="$logs_dir/deployment.log"
|
|
|
19
19
|
deployment_git_branch="{{gitDeploymentBranch}}"
|
|
20
20
|
instance_id=$(ec2metadata --instance-id)
|
|
21
21
|
instance_private_ip=$(ec2metadata --local-ipv4)
|
|
22
|
+
portal_domain_name="{{portalDomainName}}"
|
|
23
|
+
api_gateway_domain_name="{{apiGatewayDomainName}}"
|
|
24
|
+
public_bucket_name="{{publicBucketName}}"
|
|
22
25
|
|
|
23
26
|
# create directories
|
|
24
27
|
sudo mkdir -p $microservices_dir
|
|
@@ -32,3 +32,23 @@ sudo NODE_OPTIONS="--max-old-space-size=2048 NUXT_TELEMETRY_DISABLED=1" npm run
|
|
|
32
32
|
|
|
33
33
|
# start nginx server
|
|
34
34
|
sudo systemctl restart nginx
|
|
35
|
+
|
|
36
|
+
# install certbot
|
|
37
|
+
sudo snap refresh core
|
|
38
|
+
sudo apt remove certbot
|
|
39
|
+
sudo snap install --classic certbot
|
|
40
|
+
sudo ln -s /snap/bin/certbot /usr/bin/certbot
|
|
41
|
+
|
|
42
|
+
# sync SSL certificates from S3 bucket to local (if they exist)
|
|
43
|
+
aws s3 cp s3://$public_bucket_name/ssl/ /etc/letsencrypt/live --recursive
|
|
44
|
+
sudo chown -R ubuntu:ubuntu /etc/letsencrypt/live
|
|
45
|
+
|
|
46
|
+
# obtain SSL certificate (if it doesn't exist) and sync to S3 bucket
|
|
47
|
+
if [[ ! -f "/etc/letsencrypt/live/$portal_domain_name/fullchain.pem" ]]; then
|
|
48
|
+
sudo certbot certonly --standalone -d $portal_domain_name --agree-tos --non-interactive -m mistabiggx@gmail.com --no-eff-email --quiet --pre-hook="sudo systemctl stop nginx" --post-hook="sudo systemctl start nginx" --deploy-hook "aws s3 sync /etc/letsencrypt/live s3://$public_bucket_name/ssl/"
|
|
49
|
+
fi
|
|
50
|
+
|
|
51
|
+
# register SSL renewal cron
|
|
52
|
+
certbot_cron_command="/usr/bin/certbot renew --pre-hook=\"sudo systemctl stop nginx\" --post-hook=\"sudo systemctl start nginx\" --deploy-hook \"aws s3 sync /etc/letsencrypt/live s3://$public_bucket_name/ssl/\" >> $logs_dir/{{serviceName}}-ssl-renewal.log"
|
|
53
|
+
certbot_cron_job="0 0,12 * * * $certbot_cron_command"
|
|
54
|
+
( ( crontab -l || true ) | ( grep -v -F "$certbot_cron_command" || true ) ; echo "$certbot_cron_job" ) | crontab -
|
package/dist/util/constants.d.ts
CHANGED
|
@@ -3,8 +3,16 @@ declare const CONSTANTS: {
|
|
|
3
3
|
readonly vpcId: "Microservice-VPC";
|
|
4
4
|
readonly apiGatewaySecurityGroupId: "API-Gateway-SG";
|
|
5
5
|
readonly apiGatewayEIPId: "API-Gateway-EIP";
|
|
6
|
+
readonly apiGatewayDomainName: {
|
|
7
|
+
readonly prod: "api.insurecorehub.com";
|
|
8
|
+
readonly uat: "api.uat.insurecorehub.com";
|
|
9
|
+
};
|
|
6
10
|
readonly portalSecurityGroupId: "Portal-SG";
|
|
7
11
|
readonly portalEIPId: "Portal-EIP";
|
|
12
|
+
readonly portalDomainName: {
|
|
13
|
+
readonly prod: "portal.insurecorehub.com";
|
|
14
|
+
readonly uat: "portal.uat.insurecorehub.com";
|
|
15
|
+
};
|
|
8
16
|
readonly redisSecurityGroupId: "Redis-SG";
|
|
9
17
|
readonly laravelBasedSecurityGroupId: "Laravel-Based-SG";
|
|
10
18
|
readonly notificationServiceSecurityGroupId: "Notification-Service-SG";
|
|
@@ -24,6 +32,12 @@ declare const CONSTANTS: {
|
|
|
24
32
|
};
|
|
25
33
|
};
|
|
26
34
|
export declare function getConstant(key: keyof typeof CONSTANTS): 8 | "gp3" | "Microservice-VPC" | "API-Gateway-SG" | "API-Gateway-EIP" | "Portal-SG" | "Portal-EIP" | "Redis-SG" | "Laravel-Based-SG" | "Notification-Service-SG" | "MySQL-SG" | "Instance-Connect-Endpoint" | "Instance-Connect-Endpoint-SG" | "ami-0e182bc1c32ba03c3" | "t4g.nano" | "isa" | "EC2-Instance-Base-Role" | "glicogh-healthcare-files" | {
|
|
35
|
+
readonly prod: "api.insurecorehub.com";
|
|
36
|
+
readonly uat: "api.uat.insurecorehub.com";
|
|
37
|
+
} | {
|
|
38
|
+
readonly prod: "portal.insurecorehub.com";
|
|
39
|
+
readonly uat: "portal.uat.insurecorehub.com";
|
|
40
|
+
} | {
|
|
27
41
|
readonly githubRepoPaths: RepoUrls;
|
|
28
42
|
readonly gitBranches: RepoBranches;
|
|
29
43
|
};
|
package/dist/util/constants.js
CHANGED
|
@@ -21,8 +21,16 @@ const CONSTANTS = {
|
|
|
21
21
|
vpcId: 'Microservice-VPC',
|
|
22
22
|
apiGatewaySecurityGroupId: 'API-Gateway-SG',
|
|
23
23
|
apiGatewayEIPId: 'API-Gateway-EIP',
|
|
24
|
+
apiGatewayDomainName: {
|
|
25
|
+
prod: 'api.insurecorehub.com',
|
|
26
|
+
uat: 'api.uat.insurecorehub.com',
|
|
27
|
+
},
|
|
24
28
|
portalSecurityGroupId: 'Portal-SG',
|
|
25
29
|
portalEIPId: 'Portal-EIP',
|
|
30
|
+
portalDomainName: {
|
|
31
|
+
prod: 'portal.insurecorehub.com',
|
|
32
|
+
uat: 'portal.uat.insurecorehub.com',
|
|
33
|
+
},
|
|
26
34
|
redisSecurityGroupId: 'Redis-SG',
|
|
27
35
|
laravelBasedSecurityGroupId: 'Laravel-Based-SG',
|
|
28
36
|
notificationServiceSecurityGroupId: 'Notification-Service-SG',
|
|
@@ -47,4 +55,4 @@ function getConstant(key) {
|
|
|
47
55
|
function getEnvConstant(key) {
|
|
48
56
|
return `${getConstant(key)}-${initBuildConfig_1.buildConfig?.envName}`;
|
|
49
57
|
}
|
|
50
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
58
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3RhbnRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdXRpbC9jb25zdGFudHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFvREEsa0NBRUM7QUFFRCx3Q0FFQztBQXpERCx1REFBZ0Q7QUFFaEQsTUFBTSxTQUFTLEdBQWE7SUFDMUIsT0FBTyxFQUFFLDZDQUE2QztJQUN0RCxJQUFJLEVBQUUsMENBQTBDO0lBQ2hELE1BQU0sRUFBRSw0Q0FBNEM7SUFDcEQsTUFBTSxFQUFFLDRDQUE0QztJQUNwRCxTQUFTLEVBQUUsK0NBQStDO0lBQzFELFlBQVksRUFBRSxrREFBa0Q7SUFDaEUsYUFBYSxFQUFFLG9DQUFvQztJQUNuRCxNQUFNLEVBQUUsK0JBQStCO0NBQ3hDLENBQUM7QUFFRixNQUFNLFlBQVksR0FBaUI7SUFDakMsR0FBRyxFQUFFLFFBQVE7SUFDYixJQUFJLEVBQUUsU0FBUztDQUNoQixDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUc7SUFDaEIsS0FBSyxFQUFFLGtCQUFrQjtJQUN6Qix5QkFBeUIsRUFBRSxnQkFBZ0I7SUFDM0MsZUFBZSxFQUFFLGlCQUFpQjtJQUNsQyxvQkFBb0IsRUFBRTtRQUNwQixJQUFJLEVBQUUsdUJBQXVCO1FBQzdCLEdBQUcsRUFBRSwyQkFBMkI7S0FDakM7SUFDRCxxQkFBcUIsRUFBRSxXQUFXO0lBQ2xDLFdBQVcsRUFBRSxZQUFZO0lBQ3pCLGdCQUFnQixFQUFFO1FBQ2hCLElBQUksRUFBRSwwQkFBMEI7UUFDaEMsR0FBRyxFQUFFLDhCQUE4QjtLQUNwQztJQUNELG9CQUFvQixFQUFFLFVBQVU7SUFDaEMsMkJBQTJCLEVBQUUsa0JBQWtCO0lBQy9DLGtDQUFrQyxFQUFFLHlCQUF5QjtJQUM3RCxvQkFBb0IsRUFBRSxVQUFVO0lBQ2hDLDRCQUE0QixFQUFFLDJCQUEyQjtJQUN6RCx5Q0FBeUMsRUFBRSw4QkFBOEI7SUFDekUsZUFBZSxFQUFFLHVCQUF1QixFQUFFLFlBQVk7SUFDdEQsbUJBQW1CLEVBQUUsVUFBVSxFQUFFLFlBQVk7SUFDN0Msa0JBQWtCLEVBQUUsQ0FBQztJQUNyQixrQkFBa0IsRUFBRSxLQUFLO0lBQ3pCLFdBQVcsRUFBRSxLQUFLO0lBQ2xCLFlBQVksRUFBRSx3QkFBd0I7SUFDdEMsZ0JBQWdCLEVBQUUsMEJBQTBCO0lBQzVDLFVBQVUsRUFBRTtRQUNWLGVBQWUsRUFBRSxTQUFTO1FBQzFCLFdBQVcsRUFBRSxZQUFZO0tBQzFCO0NBQ08sQ0FBQztBQUVYLFNBQWdCLFdBQVcsQ0FBQyxHQUEyQjtJQUNyRCxPQUFPLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUN4QixDQUFDO0FBRUQsU0FBZ0IsY0FBYyxDQUFDLEdBQTJCO0lBQ3hELE9BQU8sR0FBRyxXQUFXLENBQUMsR0FBRyxDQUFDLElBQUksNkJBQVcsRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUN2RCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgUmVwb0JyYW5jaGVzLCBSZXBvVXJscyB9IGZyb20gJy4uL0B0eXBlcy9jb21tb24nO1xuaW1wb3J0IHsgYnVpbGRDb25maWcgfSBmcm9tICcuL2luaXRCdWlsZENvbmZpZyc7XG5cbmNvbnN0IHJlcG9QYXRoczogUmVwb1VybHMgPSB7XG4gIGFjY291bnQ6ICdnbGljb2doL2hlYWx0aGNhcmUtbWljcm9zZXJ2aWNlLWFjY291bnQuZ2l0JyxcbiAgcGxhbjogJ2dsaWNvZ2gvaGVhbHRoY2FyZS1taWNyb3NlcnZpY2UtcGxhbi5naXQnLFxuICBwb2xpY3k6ICdnbGljb2doL2hlYWx0aGNhcmUtbWljcm9zZXJ2aWNlLXBvbGljeS5naXQnLFxuICBjbGFpbXM6ICdnbGljb2doL2hlYWx0aGNhcmUtbWljcm9zZXJ2aWNlLWNsYWltcy5naXQnLFxuICByZXBvcnRpbmc6ICdnbGljb2doL2hlYWx0aGNhcmUtbWljcm9zZXJ2aWNlLXJlcG9ydGluZy5naXQnLFxuICBub3RpZmljYXRpb246ICdnbGljb2doL2hlYWx0aGNhcmUtbWljcm9zZXJ2aWNlLW5vdGlmaWNhdGlvbi5naXQnLFxuICAnYXBpLWdhdGV3YXknOiAnZ2xpY29naC9oZWFsdGhjYXJlLWFwaS1nYXRld2F5LmdpdCcsXG4gIHBvcnRhbDogJ2dsaWNvZ2gvaGVhbHRoY2FyZS1wb3J0YWwuZ2l0Jyxcbn07XG5cbmNvbnN0IHJlcG9CcmFuY2hlczogUmVwb0JyYW5jaGVzID0ge1xuICB1YXQ6ICdtYXN0ZXInLFxuICBwcm9kOiAncmVsZWFzZScsXG59O1xuXG5jb25zdCBDT05TVEFOVFMgPSB7XG4gIHZwY0lkOiAnTWljcm9zZXJ2aWNlLVZQQycsXG4gIGFwaUdhdGV3YXlTZWN1cml0eUdyb3VwSWQ6ICdBUEktR2F0ZXdheS1TRycsXG4gIGFwaUdhdGV3YXlFSVBJZDogJ0FQSS1HYXRld2F5LUVJUCcsXG4gIGFwaUdhdGV3YXlEb21haW5OYW1lOiB7XG4gICAgcHJvZDogJ2FwaS5pbnN1cmVjb3JlaHViLmNvbScsXG4gICAgdWF0OiAnYXBpLnVhdC5pbnN1cmVjb3JlaHViLmNvbScsXG4gIH0sXG4gIHBvcnRhbFNlY3VyaXR5R3JvdXBJZDogJ1BvcnRhbC1TRycsXG4gIHBvcnRhbEVJUElkOiAnUG9ydGFsLUVJUCcsXG4gIHBvcnRhbERvbWFpbk5hbWU6IHtcbiAgICBwcm9kOiAncG9ydGFsLmluc3VyZWNvcmVodWIuY29tJyxcbiAgICB1YXQ6ICdwb3J0YWwudWF0Lmluc3VyZWNvcmVodWIuY29tJyxcbiAgfSxcbiAgcmVkaXNTZWN1cml0eUdyb3VwSWQ6ICdSZWRpcy1TRycsXG4gIGxhcmF2ZWxCYXNlZFNlY3VyaXR5R3JvdXBJZDogJ0xhcmF2ZWwtQmFzZWQtU0cnLFxuICBub3RpZmljYXRpb25TZXJ2aWNlU2VjdXJpdHlHcm91cElkOiAnTm90aWZpY2F0aW9uLVNlcnZpY2UtU0cnLFxuICBteXNxbFNlY3VyaXR5R3JvdXBJZDogJ015U1FMLVNHJyxcbiAgZWMySW5zdGFuY2VDb25uZWN0RW5kcG9pbnRJZDogJ0luc3RhbmNlLUNvbm5lY3QtRW5kcG9pbnQnLFxuICBlYzJJbnN0YW5jZUNvbm5lY3RFbmRwb2ludFNlY3VyaXR5R3JvdXBJZDogJ0luc3RhbmNlLUNvbm5lY3QtRW5kcG9pbnQtU0cnLFxuICBkZWZhdWx0SW1hZ2VBbWk6ICdhbWktMGUxODJiYzFjMzJiYTAzYzMnLCAvLyBBUk0gYmFzZWRcbiAgZGVmYXVsdEluc3RhbmNlU2l6ZTogJ3Q0Zy5uYW5vJywgLy8gQVJNIGJhc2VkXG4gIGRlZmF1bHRTdG9yYWdlU2l6ZTogOCxcbiAgZGVmYXVsdFN0b3JhZ2VUeXBlOiAnZ3AzJyxcbiAga2V5UGFpck5hbWU6ICdpc2EnLFxuICBiYXNlUm9sZU5hbWU6ICdFQzItSW5zdGFuY2UtQmFzZS1Sb2xlJyxcbiAgcHVibGljQnVja2V0TmFtZTogJ2dsaWNvZ2gtaGVhbHRoY2FyZS1maWxlcycsXG4gIGRlcGxveW1lbnQ6IHtcbiAgICBnaXRodWJSZXBvUGF0aHM6IHJlcG9QYXRocyxcbiAgICBnaXRCcmFuY2hlczogcmVwb0JyYW5jaGVzLFxuICB9LFxufSBhcyBjb25zdDtcblxuZXhwb3J0IGZ1bmN0aW9uIGdldENvbnN0YW50KGtleToga2V5b2YgdHlwZW9mIENPTlNUQU5UUykge1xuICByZXR1cm4gQ09OU1RBTlRTW2tleV07XG59XG5cbmV4cG9ydCBmdW5jdGlvbiBnZXRFbnZDb25zdGFudChrZXk6IGtleW9mIHR5cGVvZiBDT05TVEFOVFMpIHtcbiAgcmV0dXJuIGAke2dldENvbnN0YW50KGtleSl9LSR7YnVpbGRDb25maWc/LmVudk5hbWV9YDtcbn1cbiJdfQ==
|
|
@@ -7,6 +7,7 @@ const isMicroservice_1 = require("./isMicroservice");
|
|
|
7
7
|
const isLaravelBased_1 = require("./isLaravelBased");
|
|
8
8
|
const constants_1 = require("./constants");
|
|
9
9
|
const getGithubRepo_1 = require("./getGithubRepo");
|
|
10
|
+
const getPublicBucketName_1 = require("./getPublicBucketName");
|
|
10
11
|
function getEc2UserData(service) {
|
|
11
12
|
const serviceName = service ?? initBuildConfig_1.buildConfig?.serviceName;
|
|
12
13
|
const beforeAllScript = (0, fs_1.readFileSync)(__dirname + '/../scripts/post-deployment-before-all.sh', 'utf8');
|
|
@@ -30,7 +31,10 @@ function getEc2UserData(service) {
|
|
|
30
31
|
.replace(/{{envName}}/g, initBuildConfig_1.buildConfig?.envName ?? 'uat')
|
|
31
32
|
.replace(/{{serviceName}}/g, serviceName ?? '')
|
|
32
33
|
.replace(/{{githubRepoPath}}/g, (0, getGithubRepo_1.getGithubRepo)(serviceName) ?? '')
|
|
33
|
-
.replace(/{{gitDeploymentBranch}}/g, getGitDeploymentBranch(initBuildConfig_1.buildConfig?.envName) ?? 'release')
|
|
34
|
+
.replace(/{{gitDeploymentBranch}}/g, getGitDeploymentBranch(initBuildConfig_1.buildConfig?.envName) ?? 'release')
|
|
35
|
+
.replace(/{{portalDomainName}}/g, (0, constants_1.getConstant)('portalDomainName')[initBuildConfig_1.buildConfig?.envName ?? 'uat'])
|
|
36
|
+
.replace(/{{apiGatewayDomainName}}/g, (0, constants_1.getConstant)('apiGatewayDomainName')[initBuildConfig_1.buildConfig?.envName ?? 'uat'])
|
|
37
|
+
.replace(/{{publicBucketName}}/g, (0, getPublicBucketName_1.getPublicBucketName)());
|
|
34
38
|
return output;
|
|
35
39
|
}
|
|
36
40
|
function getGitDeploymentBranch(env) {
|
|
@@ -43,4 +47,4 @@ function getGitDeploymentBranch(env) {
|
|
|
43
47
|
return branches[env];
|
|
44
48
|
}
|
|
45
49
|
}
|
|
46
|
-
//# sourceMappingURL=data:application/json;base64,
|
|
50
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2V0RWMyVXNlckRhdGEuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi91dGlsL2dldEVjMlVzZXJEYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBU0Esd0NBcUNDO0FBOUNELDJCQUE4QztBQUU5Qyx1REFBZ0Q7QUFDaEQscURBQWtEO0FBQ2xELHFEQUFrRDtBQUNsRCwyQ0FBMEM7QUFDMUMsbURBQWdEO0FBQ2hELCtEQUE0RDtBQUU1RCxTQUFnQixjQUFjLENBQUMsT0FBb0M7SUFDakUsTUFBTSxXQUFXLEdBQUcsT0FBTyxJQUFJLDZCQUFXLEVBQUUsV0FBVyxDQUFDO0lBRXhELE1BQU0sZUFBZSxHQUFHLElBQUEsaUJBQVksRUFBQyxTQUFTLEdBQUcsMkNBQTJDLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFFdEcsTUFBTSxjQUFjLEdBQUcsSUFBQSxpQkFBWSxFQUFDLFNBQVMsR0FBRywwQ0FBMEMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUVwRyxNQUFNLGVBQWUsR0FBRyxJQUFBLGlCQUFZLEVBQUMsU0FBUyxHQUFHLDJDQUEyQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBRXRHLE1BQU0saUJBQWlCLEdBQUcsSUFBQSwrQkFBYyxFQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLFdBQVcsVUFBVSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUM7SUFFdkYsTUFBTSxlQUFlLEdBQUcsSUFBQSwrQkFBYyxHQUFFLENBQUMsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDO0lBRWxFLE1BQU0saUJBQWlCLEdBQUcsU0FBUyxHQUFHLCtCQUErQixpQkFBaUIsS0FBSyxDQUFDO0lBQzVGLE1BQU0sYUFBYSxHQUFHLGlCQUFpQixJQUFJLElBQUEsZUFBVSxFQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUEsaUJBQVksRUFBQyxpQkFBaUIsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBRXhILE1BQU0sZUFBZSxHQUFHLFNBQVMsR0FBRywrQkFBK0IsZUFBZSxLQUFLLENBQUM7SUFDeEYsTUFBTSxXQUFXLEdBQUcsZUFBZSxJQUFJLElBQUEsZUFBVSxFQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFBLGlCQUFZLEVBQUMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFFaEgsTUFBTSxPQUFPLEdBQUc7UUFDZCxlQUFlO1FBQ2YsR0FBRyxDQUFDLElBQUEsK0JBQWMsRUFBQyxPQUFPLENBQUMsSUFBSSxXQUFXLEtBQUssYUFBYSxJQUFJLFdBQVcsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsZUFBZSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNsSCxXQUFXO1FBQ1gsYUFBYTtRQUNiLGNBQWM7S0FDZixDQUFDO0lBRUYsTUFBTSxNQUFNLEdBQUcsT0FBTztTQUNuQixJQUFJLENBQUMsSUFBSSxDQUFDO1NBQ1YsT0FBTyxDQUFDLGNBQWMsRUFBRSw2QkFBVyxFQUFFLE9BQU8sSUFBSSxLQUFLLENBQUM7U0FDdEQsT0FBTyxDQUFDLGtCQUFrQixFQUFFLFdBQVcsSUFBSSxFQUFFLENBQUM7U0FDOUMsT0FBTyxDQUFDLHFCQUFxQixFQUFFLElBQUEsNkJBQWEsRUFBQyxXQUFXLENBQUMsSUFBSSxFQUFFLENBQUM7U0FDaEUsT0FBTyxDQUFDLDBCQUEwQixFQUFFLHNCQUFzQixDQUFDLDZCQUFXLEVBQUUsT0FBTyxDQUFDLElBQUksU0FBUyxDQUFDO1NBQzlGLE9BQU8sQ0FBQyx1QkFBdUIsRUFBRyxJQUFBLHVCQUFXLEVBQUMsa0JBQWtCLENBQTRCLENBQUMsNkJBQVcsRUFBRSxPQUFPLElBQUksS0FBSyxDQUFDLENBQUM7U0FDNUgsT0FBTyxDQUFDLDJCQUEyQixFQUFHLElBQUEsdUJBQVcsRUFBQyxzQkFBc0IsQ0FBNEIsQ0FBQyw2QkFBVyxFQUFFLE9BQU8sSUFBSSxLQUFLLENBQUMsQ0FBQztTQUNwSSxPQUFPLENBQUMsdUJBQXVCLEVBQUUsSUFBQSx5Q0FBbUIsR0FBRSxDQUFDLENBQUM7SUFDM0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVELFNBQVMsc0JBQXNCLENBQUMsR0FBNEI7SUFDMUQsSUFBSSw2QkFBVyxFQUFFLE1BQU0sRUFBRSxDQUFDO1FBQ3hCLE9BQU8sNkJBQVcsQ0FBQyxNQUFNLENBQUM7SUFDNUIsQ0FBQztJQUNELElBQUksR0FBRyxFQUFFLENBQUM7UUFDUixNQUFNLGdCQUFnQixHQUFHLElBQUEsdUJBQVcsRUFBQyxZQUFZLENBQTRCLENBQUM7UUFDOUUsTUFBTSxRQUFRLEdBQUcsZ0JBQWdCLENBQUMsV0FBcUMsQ0FBQztRQUN4RSxPQUFPLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN2QixDQUFDO0FBQ0gsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGV4aXN0c1N5bmMsIHJlYWRGaWxlU3luYyB9IGZyb20gJ2ZzJztcbmltcG9ydCB7IEJ1aWxkQ29uZmlnIH0gZnJvbSAnLi4vQHR5cGVzL2NvbW1vbic7XG5pbXBvcnQgeyBidWlsZENvbmZpZyB9IGZyb20gJy4vaW5pdEJ1aWxkQ29uZmlnJztcbmltcG9ydCB7IGlzTWljcm9zZXJ2aWNlIH0gZnJvbSAnLi9pc01pY3Jvc2VydmljZSc7XG5pbXBvcnQgeyBpc0xhcmF2ZWxCYXNlZCB9IGZyb20gJy4vaXNMYXJhdmVsQmFzZWQnO1xuaW1wb3J0IHsgZ2V0Q29uc3RhbnQgfSBmcm9tICcuL2NvbnN0YW50cyc7XG5pbXBvcnQgeyBnZXRHaXRodWJSZXBvIH0gZnJvbSAnLi9nZXRHaXRodWJSZXBvJztcbmltcG9ydCB7IGdldFB1YmxpY0J1Y2tldE5hbWUgfSBmcm9tICcuL2dldFB1YmxpY0J1Y2tldE5hbWUnO1xuXG5leHBvcnQgZnVuY3Rpb24gZ2V0RWMyVXNlckRhdGEoc2VydmljZT86IEJ1aWxkQ29uZmlnWydzZXJ2aWNlTmFtZSddKTogc3RyaW5nIHtcbiAgY29uc3Qgc2VydmljZU5hbWUgPSBzZXJ2aWNlID8/IGJ1aWxkQ29uZmlnPy5zZXJ2aWNlTmFtZTtcblxuICBjb25zdCBiZWZvcmVBbGxTY3JpcHQgPSByZWFkRmlsZVN5bmMoX19kaXJuYW1lICsgJy8uLi9zY3JpcHRzL3Bvc3QtZGVwbG95bWVudC1iZWZvcmUtYWxsLnNoJywgJ3V0ZjgnKTtcblxuICBjb25zdCBhZnRlckFsbFNjcmlwdCA9IHJlYWRGaWxlU3luYyhfX2Rpcm5hbWUgKyAnLy4uL3NjcmlwdHMvcG9zdC1kZXBsb3ltZW50LWFmdGVyLWFsbC5zaCcsICd1dGY4Jyk7XG5cbiAgY29uc3QgY2xvbmVSZXBvU2NyaXB0ID0gcmVhZEZpbGVTeW5jKF9fZGlybmFtZSArICcvLi4vc2NyaXB0cy9wb3N0LWRlcGxveW1lbnQtY2xvbmUtcmVwby5zaCcsICd1dGY4Jyk7XG5cbiAgY29uc3Qgc2VydmljZVNjcmlwdE5hbWUgPSBpc01pY3Jvc2VydmljZShzZXJ2aWNlKSA/IGAke3NlcnZpY2VOYW1lfS1zZXJ2aWNlYCA6IHNlcnZpY2U7XG5cbiAgY29uc3QgZ3JvdXBTY3JpcHROYW1lID0gaXNMYXJhdmVsQmFzZWQoKSA/ICdsYXJhdmVsLWJhc2VkJyA6IG51bGw7XG5cbiAgY29uc3Qgc2VydmljZVNjcmlwdFBhdGggPSBfX2Rpcm5hbWUgKyBgLy4uL3NjcmlwdHMvcG9zdC1kZXBsb3ltZW50LSR7c2VydmljZVNjcmlwdE5hbWV9LnNoYDtcbiAgY29uc3Qgc2VydmljZVNjcmlwdCA9IHNlcnZpY2VTY3JpcHROYW1lICYmIGV4aXN0c1N5bmMoc2VydmljZVNjcmlwdFBhdGgpID8gcmVhZEZpbGVTeW5jKHNlcnZpY2VTY3JpcHRQYXRoLCAndXRmOCcpIDogJyc7XG5cbiAgY29uc3QgZ3JvdXBTY3JpcHRQYXRoID0gX19kaXJuYW1lICsgYC8uLi9zY3JpcHRzL3Bvc3QtZGVwbG95bWVudC0ke2dyb3VwU2NyaXB0TmFtZX0uc2hgO1xuICBjb25zdCBncm91cFNjcmlwdCA9IGdyb3VwU2NyaXB0TmFtZSAmJiBleGlzdHNTeW5jKGdyb3VwU2NyaXB0UGF0aCkgPyByZWFkRmlsZVN5bmMoZ3JvdXBTY3JpcHRQYXRoLCAndXRmOCcpIDogJyc7XG5cbiAgY29uc3Qgc2NyaXB0cyA9IFtcbiAgICBiZWZvcmVBbGxTY3JpcHQsXG4gICAgLi4uKGlzTWljcm9zZXJ2aWNlKHNlcnZpY2UpIHx8IHNlcnZpY2VOYW1lID09PSAnYXBpLWdhdGV3YXknIHx8IHNlcnZpY2VOYW1lID09PSAncG9ydGFsJyA/IFtjbG9uZVJlcG9TY3JpcHRdIDogW10pLFxuICAgIGdyb3VwU2NyaXB0LFxuICAgIHNlcnZpY2VTY3JpcHQsXG4gICAgYWZ0ZXJBbGxTY3JpcHQsXG4gIF07XG5cbiAgY29uc3Qgb3V0cHV0ID0gc2NyaXB0c1xuICAgIC5qb2luKGBcXG5gKVxuICAgIC5yZXBsYWNlKC97e2Vudk5hbWV9fS9nLCBidWlsZENvbmZpZz8uZW52TmFtZSA/PyAndWF0JylcbiAgICAucmVwbGFjZSgve3tzZXJ2aWNlTmFtZX19L2csIHNlcnZpY2VOYW1lID8/ICcnKVxuICAgIC5yZXBsYWNlKC97e2dpdGh1YlJlcG9QYXRofX0vZywgZ2V0R2l0aHViUmVwbyhzZXJ2aWNlTmFtZSkgPz8gJycpXG4gICAgLnJlcGxhY2UoL3t7Z2l0RGVwbG95bWVudEJyYW5jaH19L2csIGdldEdpdERlcGxveW1lbnRCcmFuY2goYnVpbGRDb25maWc/LmVudk5hbWUpID8/ICdyZWxlYXNlJylcbiAgICAucmVwbGFjZSgve3twb3J0YWxEb21haW5OYW1lfX0vZywgKGdldENvbnN0YW50KCdwb3J0YWxEb21haW5OYW1lJykgYXMgUmVjb3JkPHN0cmluZywgc3RyaW5nPilbYnVpbGRDb25maWc/LmVudk5hbWUgPz8gJ3VhdCddKVxuICAgIC5yZXBsYWNlKC97e2FwaUdhdGV3YXlEb21haW5OYW1lfX0vZywgKGdldENvbnN0YW50KCdhcGlHYXRld2F5RG9tYWluTmFtZScpIGFzIFJlY29yZDxzdHJpbmcsIHN0cmluZz4pW2J1aWxkQ29uZmlnPy5lbnZOYW1lID8/ICd1YXQnXSlcbiAgICAucmVwbGFjZSgve3twdWJsaWNCdWNrZXROYW1lfX0vZywgZ2V0UHVibGljQnVja2V0TmFtZSgpKTtcbiAgcmV0dXJuIG91dHB1dDtcbn1cblxuZnVuY3Rpb24gZ2V0R2l0RGVwbG95bWVudEJyYW5jaChlbnY/OiBCdWlsZENvbmZpZ1snZW52TmFtZSddKTogc3RyaW5nIHwgdm9pZCB7XG4gIGlmIChidWlsZENvbmZpZz8uYnJhbmNoKSB7XG4gICAgcmV0dXJuIGJ1aWxkQ29uZmlnLmJyYW5jaDtcbiAgfVxuICBpZiAoZW52KSB7XG4gICAgY29uc3QgZGVwbG95bWVudENvbmZpZyA9IGdldENvbnN0YW50KCdkZXBsb3ltZW50JykgYXMgUmVjb3JkPHN0cmluZywgdW5rbm93bj47XG4gICAgY29uc3QgYnJhbmNoZXMgPSBkZXBsb3ltZW50Q29uZmlnLmdpdEJyYW5jaGVzIGFzIFJlY29yZDxzdHJpbmcsIHN0cmluZz47XG4gICAgcmV0dXJuIGJyYW5jaGVzW2Vudl07XG4gIH1cbn1cbiJdfQ==
|
package/package.json
CHANGED
|
@@ -33,3 +33,23 @@ sudo systemctl restart dnsmasq
|
|
|
33
33
|
|
|
34
34
|
# start nginx server
|
|
35
35
|
sudo systemctl restart nginx
|
|
36
|
+
|
|
37
|
+
# install certbot
|
|
38
|
+
sudo snap refresh core
|
|
39
|
+
sudo apt remove certbot
|
|
40
|
+
sudo snap install --classic certbot
|
|
41
|
+
sudo ln -s /snap/bin/certbot /usr/bin/certbot
|
|
42
|
+
|
|
43
|
+
# sync SSL certificates from S3 bucket to local (if they exist)
|
|
44
|
+
aws s3 cp s3://$public_bucket_name/ssl/ /etc/letsencrypt/live --recursive
|
|
45
|
+
sudo chown -R ubuntu:ubuntu /etc/letsencrypt/live
|
|
46
|
+
|
|
47
|
+
# obtain SSL certificate (if it doesn't exist) and sync to S3 bucket
|
|
48
|
+
if [[ ! -f "/etc/letsencrypt/live/$api_gateway_domain_name/fullchain.pem" ]]; then
|
|
49
|
+
sudo certbot certonly --standalone -d $api_gateway_domain_name --agree-tos --non-interactive -m mistabiggx@gmail.com --no-eff-email --quiet --pre-hook="sudo systemctl stop nginx" --post-hook="sudo systemctl start nginx" --deploy-hook "aws s3 sync /etc/letsencrypt/live s3://$public_bucket_name/ssl/"
|
|
50
|
+
fi
|
|
51
|
+
|
|
52
|
+
# register SSL renewal cron
|
|
53
|
+
certbot_cron_command="/usr/bin/certbot renew --pre-hook=\"sudo systemctl stop nginx\" --post-hook=\"sudo systemctl start nginx\" --deploy-hook \"aws s3 sync /etc/letsencrypt/live s3://$public_bucket_name/ssl/\" >> $logs_dir/{{serviceName}}-ssl-renewal.log"
|
|
54
|
+
certbot_cron_job="0 0,12 * * * $certbot_cron_command"
|
|
55
|
+
( ( crontab -l || true ) | ( grep -v -F "$certbot_cron_command" || true ) ; echo "$certbot_cron_job" ) | crontab -
|
|
@@ -19,6 +19,9 @@ deployment_log_file="$logs_dir/deployment.log"
|
|
|
19
19
|
deployment_git_branch="{{gitDeploymentBranch}}"
|
|
20
20
|
instance_id=$(ec2metadata --instance-id)
|
|
21
21
|
instance_private_ip=$(ec2metadata --local-ipv4)
|
|
22
|
+
portal_domain_name="{{portalDomainName}}"
|
|
23
|
+
api_gateway_domain_name="{{apiGatewayDomainName}}"
|
|
24
|
+
public_bucket_name="{{publicBucketName}}"
|
|
22
25
|
|
|
23
26
|
# create directories
|
|
24
27
|
sudo mkdir -p $microservices_dir
|
|
@@ -32,3 +32,23 @@ sudo NODE_OPTIONS="--max-old-space-size=2048 NUXT_TELEMETRY_DISABLED=1" npm run
|
|
|
32
32
|
|
|
33
33
|
# start nginx server
|
|
34
34
|
sudo systemctl restart nginx
|
|
35
|
+
|
|
36
|
+
# install certbot
|
|
37
|
+
sudo snap refresh core
|
|
38
|
+
sudo apt remove certbot
|
|
39
|
+
sudo snap install --classic certbot
|
|
40
|
+
sudo ln -s /snap/bin/certbot /usr/bin/certbot
|
|
41
|
+
|
|
42
|
+
# sync SSL certificates from S3 bucket to local (if they exist)
|
|
43
|
+
aws s3 cp s3://$public_bucket_name/ssl/ /etc/letsencrypt/live --recursive
|
|
44
|
+
sudo chown -R ubuntu:ubuntu /etc/letsencrypt/live
|
|
45
|
+
|
|
46
|
+
# obtain SSL certificate (if it doesn't exist) and sync to S3 bucket
|
|
47
|
+
if [[ ! -f "/etc/letsencrypt/live/$portal_domain_name/fullchain.pem" ]]; then
|
|
48
|
+
sudo certbot certonly --standalone -d $portal_domain_name --agree-tos --non-interactive -m mistabiggx@gmail.com --no-eff-email --quiet --pre-hook="sudo systemctl stop nginx" --post-hook="sudo systemctl start nginx" --deploy-hook "aws s3 sync /etc/letsencrypt/live s3://$public_bucket_name/ssl/"
|
|
49
|
+
fi
|
|
50
|
+
|
|
51
|
+
# register SSL renewal cron
|
|
52
|
+
certbot_cron_command="/usr/bin/certbot renew --pre-hook=\"sudo systemctl stop nginx\" --post-hook=\"sudo systemctl start nginx\" --deploy-hook \"aws s3 sync /etc/letsencrypt/live s3://$public_bucket_name/ssl/\" >> $logs_dir/{{serviceName}}-ssl-renewal.log"
|
|
53
|
+
certbot_cron_job="0 0,12 * * * $certbot_cron_command"
|
|
54
|
+
( ( crontab -l || true ) | ( grep -v -F "$certbot_cron_command" || true ) ; echo "$certbot_cron_job" ) | crontab -
|