@mevdragon/vidfarm-devcli 0.1.0 → 0.2.0

package/dist/infra/cdk/lib/vidfarm-prod-stack.js

@@ -0,0 +1,212 @@
+import path from "node:path";
+import { CfnOutput, Duration, RemovalPolicy, Stack } from "aws-cdk-lib";
+import * as acm from "aws-cdk-lib/aws-certificatemanager";
+import * as ec2 from "aws-cdk-lib/aws-ec2";
+import * as ecrAssets from "aws-cdk-lib/aws-ecr-assets";
+import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import * as elbv2Targets from "aws-cdk-lib/aws-elasticloadbalancingv2-targets";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
+import * as s3 from "aws-cdk-lib/aws-s3";
+export class VidfarmProdStack extends Stack {
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        const zone = route53.HostedZone.fromHostedZoneAttributes(this, "HostedZone", {
+            hostedZoneId: props.zoneId,
+            zoneName: props.zoneName
+        });
+        const domainName = `${props.recordName}.${props.zoneName}`;
+        const vpc = new ec2.Vpc(this, "VidfarmVpc", {
+            maxAzs: 2,
+            natGateways: 0,
+            subnetConfiguration: [
+                {
+                    name: "public",
+                    subnetType: ec2.SubnetType.PUBLIC
+                }
+            ]
+        });
+        const instanceSubnet = vpc.publicSubnets[0];
+        const certificate = new acm.Certificate(this, "VidfarmCertificate", {
+            domainName,
+            validation: acm.CertificateValidation.fromDns(zone)
+        });
+        const bucket = new s3.Bucket(this, "VidfarmBucket", {
+            encryption: s3.BucketEncryption.S3_MANAGED,
+            blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+            versioned: true,
+            enforceSSL: true,
+            removalPolicy: RemovalPolicy.RETAIN,
+            autoDeleteObjects: false
+        });
+        const image = new ecrAssets.DockerImageAsset(this, "VidfarmImage", {
+            directory: path.resolve(process.cwd()),
+            platform: ecrAssets.Platform.LINUX_AMD64,
+            exclude: [
+                "cdk.out",
+                "dist",
+                "node_modules",
+                "data",
+                "data-*",
+                ".git",
+                ".claude",
+                ".claude/**",
+                ".vidfarm",
+                ".vidfarm/**",
+                "templates/*/node_modules",
+                "templates/*/dist",
+                "templates/*/.next",
+                "templates/*/.turbo"
+            ]
+        });
+        const role = new iam.Role(this, "VidfarmInstanceRole", {
+            assumedBy: new iam.ServicePrincipal("ec2.amazonaws.com")
+        });
+        role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore"));
+        role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonEC2ContainerRegistryReadOnly"));
+        bucket.grantReadWrite(role);
+        image.repository.grantPull(role);
+        const instanceSecurityGroup = new ec2.SecurityGroup(this, "VidfarmInstanceSecurityGroup", {
+            vpc,
+            allowAllOutbound: true
+        });
+        const albSecurityGroup = new ec2.SecurityGroup(this, "VidfarmAlbSecurityGroup", {
+            vpc,
+            allowAllOutbound: true
+        });
+        albSecurityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(80), "Allow HTTP");
+        albSecurityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), "Allow HTTPS");
+        albSecurityGroup.addIngressRule(ec2.Peer.anyIpv6(), ec2.Port.tcp(80), "Allow HTTP IPv6");
+        albSecurityGroup.addIngressRule(ec2.Peer.anyIpv6(), ec2.Port.tcp(443), "Allow HTTPS IPv6");
+        instanceSecurityGroup.addIngressRule(albSecurityGroup, ec2.Port.tcp(3000), "ALB to Vidfarm");
+        const instance = new ec2.Instance(this, "VidfarmInstance", {
+            vpc,
+            vpcSubnets: { subnets: [instanceSubnet] },
+            securityGroup: instanceSecurityGroup,
+            role,
+            machineImage: ec2.MachineImage.latestAmazonLinux2023(),
+            instanceType: new ec2.InstanceType(props.instanceType),
+            userDataCausesReplacement: true
+        });
+        const dataVolume = new ec2.CfnVolume(this, "VidfarmDataVolume", {
+            availabilityZone: instanceSubnet.availabilityZone,
+            encrypted: true,
+            size: props.dataVolumeSizeGiB,
+            volumeType: "gp3",
+            tags: [
+                {
+                    key: "Name",
+                    value: `${this.stackName}-data`
+                }
+            ]
+        });
+        dataVolume.applyRemovalPolicy(RemovalPolicy.RETAIN);
+        const volumeAttachment = new ec2.CfnVolumeAttachment(this, "VidfarmDataVolumeAttachment", {
+            device: "/dev/sdf",
+            instanceId: instance.instanceId,
+            volumeId: dataVolume.ref
+        });
+        instance.instance.addPropertyOverride("BlockDeviceMappings", [{
+                DeviceName: "/dev/xvda",
+                Ebs: {
+                    DeleteOnTermination: false,
+                    Encrypted: true,
+                    VolumeSize: 30,
+                    VolumeType: "gp3"
+                }
+            }]);
+        const envFile = [
+            "NODE_ENV=production",
+            "PORT=3000",
+            "VIDFARM_DATA_DIR=/app/data",
+            "VIDFARM_DB_PATH=/app/data/vidfarm.sqlite",
+            "TEMPLATE_SOURCE_ROOT=/app/data/template-sources",
+            `PUBLIC_BASE_URL=${props.publicBaseUrl}`,
+            `VIDFARM_ADMIN_EMAILS=${props.adminEmails}`,
+            `VIDFARM_DEVELOPER_EMAILS=${props.developerEmails}`,
+            "STORAGE_DRIVER=s3",
+            `AWS_REGION=${this.region}`,
+            `AWS_S3_BUCKET=${bucket.bucketName}`,
+            "AWS_S3_PUBLIC_READ=false",
+            `ENCRYPTION_SECRET=${props.encryptionSecret}`,
+            `API_KEY_SALT=${props.apiKeySalt}`,
+            `WEBHOOK_SECRET=${props.webhookSecret}`,
+            `RESEND_API_KEY=${props.resendApiKey ?? ""}`,
+            `RESEND_FROM_EMAIL=${props.resendFromEmail}`,
+            `SUPERAGENCY_KEY=${props.superagencyKey ?? ""}`,
+            `OPENAI_API_KEY=${props.openAiApiKey ?? ""}`,
+            `OPENROUTER_API_KEY=${props.openRouterApiKey ?? ""}`,
+            `GEMINI_API_KEY=${props.geminiApiKey ?? ""}`,
+            `PERPLEXITY_API_KEY=${props.perplexityApiKey ?? ""}`,
+            `REMOTION_MODE=${props.remotionMode}`,
+            `REMOTION_REGION=${props.remotionRegion}`,
+            `REMOTION_BUCKET_NAME=${props.remotionBucketName ?? ""}`,
+            `REMOTION_SITE_NAME=${props.remotionSiteName ?? ""}`,
+            `REMOTION_FUNCTION_NAME=${props.remotionFunctionName ?? ""}`,
+            `REMOTION_SERVE_URL=${props.remotionServeUrl ?? ""}`,
+            `REMOTION_COMPOSITION_ID=${props.remotionCompositionId}`,
+            `REMOTION_AWS_ACCESS_KEY_ID=${props.remotionAwsAccessKeyId ?? ""}`,
+            `REMOTION_AWS_SECRET_ACCESS_KEY=${props.remotionAwsSecretAccessKey ?? ""}`,
+            `MOCK_PROVIDER_RESPONSES=${props.mockProviderResponses}`,
+            `WORKER_POLL_MS=${props.workerPollMs}`,
+            `WORKER_BATCH_SIZE=${props.workerBatchSize}`,
+            `WORKER_MAX_CONCURRENT_JOBS=${props.workerMaxConcurrentJobs}`,
+            `DEFAULT_JOB_DELAY_SECONDS=${props.defaultJobDelaySeconds}`,
+            `MAX_PENDING_JOBS_GLOBAL=${props.maxPendingJobsGlobal}`,
+            `MAX_PENDING_JOBS_PER_CUSTOMER=${props.maxPendingJobsPerCustomer}`
+        ].join("\n");
+        instance.userData.addCommands("set -euxo pipefail", "dnf update -y", "dnf install -y docker awscli", "systemctl enable docker", "systemctl start docker", `VOL_ID="${dataVolume.ref}"`, "MOUNT_POINT=/var/lib/vidfarm", "mkdir -p ${MOUNT_POINT}", "DEVICE_PATH=/dev/xvdf", "if [ -e /dev/nvme1n1 ]; then DEVICE_PATH=/dev/nvme1n1; fi", "if ! blkid -L VIDFARM_DATA >/dev/null 2>&1; then mkfs -t ext4 ${DEVICE_PATH}; e2label ${DEVICE_PATH} VIDFARM_DATA; fi", "grep -q 'LABEL=VIDFARM_DATA /var/lib/vidfarm ext4 defaults,nofail 0 2' /etc/fstab || echo 'LABEL=VIDFARM_DATA /var/lib/vidfarm ext4 defaults,nofail 0 2' >> /etc/fstab", "mount -a", "mkdir -p /var/lib/vidfarm", "mkdir -p /opt/vidfarm", "cat > /opt/vidfarm/vidfarm.env <<'EOF'", envFile, "EOF", `aws ecr get-login-password --region ${this.region} | docker login --username AWS --password-stdin ${this.account}.dkr.ecr.${this.region}.amazonaws.com`, `docker pull ${image.imageUri}`, "cat > /etc/systemd/system/vidfarm.service <<'EOF'", "[Unit]", "Description=Vidfarm Docker Container", "After=docker.service network-online.target", "Requires=docker.service", "", "[Service]", "Restart=always", "RestartSec=10", `ExecStartPre=/usr/bin/docker pull ${image.imageUri}`, "ExecStartPre=-/usr/bin/docker rm -f vidfarm", `ExecStart=/usr/bin/docker run --name vidfarm --env-file /opt/vidfarm/vidfarm.env -p 3000:3000 -v /var/lib/vidfarm:/app/data ${image.imageUri}`, "ExecStop=/usr/bin/docker stop vidfarm", "", "[Install]", "WantedBy=multi-user.target", "EOF", "systemctl daemon-reload", "systemctl enable vidfarm", "systemctl restart vidfarm");
+        const alb = new elbv2.ApplicationLoadBalancer(this, "VidfarmAlb", {
+            vpc,
+            internetFacing: true,
+            securityGroup: albSecurityGroup
+        });
+        alb.addListener("HttpListener", {
+            port: 80,
+            open: true,
+            defaultAction: elbv2.ListenerAction.redirect({
+                protocol: "HTTPS",
+                port: "443",
+                permanent: true
+            })
+        });
+        const httpsListener = alb.addListener("HttpsListener", {
+            port: 443,
+            open: true,
+            certificates: [certificate]
+        });
+        httpsListener.addTargets("VidfarmInstanceTarget", {
+            protocol: elbv2.ApplicationProtocol.HTTP,
+            port: 3000,
+            targets: [new elbv2Targets.InstanceTarget(instance)],
+            healthCheck: {
+                path: "/health",
+                healthyHttpCodes: "200",
+                interval: Duration.seconds(30)
+            }
+        });
+        new route53.ARecord(this, "VidfarmAliasRecord", {
+            zone,
+            recordName: props.recordName,
+            target: route53.RecordTarget.fromAlias(new route53Targets.LoadBalancerTarget(alb))
+        });
+        new route53.AaaaRecord(this, "VidfarmAliasRecordIpv6", {
+            zone,
+            recordName: props.recordName,
+            target: route53.RecordTarget.fromAlias(new route53Targets.LoadBalancerTarget(alb))
+        });
+        new CfnOutput(this, "VidfarmUrl", {
+            value: `https://${domainName}`
+        });
+        new CfnOutput(this, "VidfarmBucketName", {
+            value: bucket.bucketName
+        });
+        new CfnOutput(this, "VidfarmInstanceId", {
+            value: instance.instanceId
+        });
+        new CfnOutput(this, "VidfarmDataVolumeId", {
+            value: dataVolume.ref
+        });
+    }
+}