@mstuercke/pulumi-modules 0.0.1

package/src/mongodb/MongoDB.ts

@@ -0,0 +1,86 @@
+import {type CustomResourceOptions, type Output, Resource} from '@pulumi/pulumi'
+import {RandomPassword} from '@pulumi/random'
+import {DatabaseUser, Project, ProjectIpAccessList, Provider, ServerlessInstance} from '@pulumi/mongodbatlas'
+
+export type MongoDBArgs = {
+  organizationId: string
+  projectId: string
+  environmentName: string
+}
+
+export class MongoDB extends Resource {
+  readonly connectionString: Output<string>
+  readonly databaseName: string
+  readonly username: string
+  readonly password: Output<string>
+
+  constructor(args: MongoDBArgs, opts?: CustomResourceOptions) {
+    const {organizationId, projectId, environmentName} = args
+    super('mstuercke:mongodb:MongoDB', organizationId, false, undefined, opts)
+
+    new Provider('provider', {}, {parent: this})
+
+    const mongoProject = new Project(
+      'project',
+      {
+        orgId: organizationId,
+        name: `${projectId}-${environmentName}`,
+        tags: {
+          project: projectId,
+        },
+      },
+      {parent: this},
+    )
+
+    new ProjectIpAccessList(
+      'network-access',
+      {
+        projectId: mongoProject.id,
+        cidrBlock: '0.0.0.0/0',
+      },
+      {parent: mongoProject},
+    )
+
+    const mongoInstance = new ServerlessInstance(
+      'database',
+      {
+        projectId: mongoProject.id,
+        name: `${projectId}-${environmentName}`,
+        providerSettingsBackingProviderName: 'AWS',
+        providerSettingsProviderName: 'SERVERLESS',
+        providerSettingsRegionName: 'EU_WEST_1', // Ireland
+      },
+      {parent: mongoProject},
+    )
+
+    const username = `${projectId}-${environmentName}`
+    const password = new RandomPassword(
+      'password',
+      {
+        length: 32,
+      },
+      {parent: mongoProject},
+    )
+
+    const databaseName = projectId
+    new DatabaseUser(
+      'user',
+      {
+        projectId: mongoProject.id,
+        username,
+        password: password.result,
+        authDatabaseName: 'admin',
+        roles: [
+          {roleName: 'dbAdmin', databaseName},
+          {roleName: 'readWrite', databaseName},
+        ],
+      },
+      {parent: mongoProject},
+    )
+
+    this.connectionString = mongoInstance.connectionStringsStandardSrv
+    this.databaseName = databaseName
+    this.username = username
+    this.password = password.result
+  }
+}

package/src/mongodb/index.ts

@@ -0,0 +1,9 @@
+export * from './MongoDB'
+
+import {MongoDB} from './MongoDB'
+
+export * from './MongoDB'
+
+export const mongodb = {
+  MongoDB,
+}

package/src/rest/RestApi.ts

@@ -0,0 +1,226 @@
+import * as aws from '@pulumi/aws'
+import {apigateway, lambda} from '@pulumi/aws'
+import type {CustomResourceOptions, Input} from '@pulumi/pulumi'
+import {Record} from '@pulumi/aws/route53'
+import {BasePathMapping, DomainName} from '@pulumi/aws/apigateway'
+import type {NodeLambdaFunction} from '../lambda'
+
+export interface RestApiArgs {
+  name: string
+  projectId: string
+  lambdaFunction: NodeLambdaFunction
+  timeoutSeconds?: number
+  stageName?: string
+  domain: {
+    zoneId: Input<string>
+    fullName: Input<string>
+    usEast1CertificateArn: Input<string>
+  }
+}
+
+export class RestApi extends aws.apigateway.RestApi {
+  readonly url: string
+
+  constructor(id: string, args: RestApiArgs, opts?: CustomResourceOptions) {
+    const {name, projectId, stageName = 'v1', domain} = args
+    super(
+      id,
+      {
+        name,
+        tags: {
+          project: projectId,
+        },
+      },
+      opts,
+    )
+
+    const {lambdaFunction, timeoutSeconds = 29} = args
+
+    const proxyResource = new apigateway.Resource(
+      `proxy`,
+      {
+        restApi: this.id,
+        parentId: this.rootResourceId,
+        pathPart: '{proxy+}',
+      },
+      {parent: this},
+    )
+
+    const proxyMethod = new apigateway.Method(
+      `proxy`,
+      {
+        restApi: this.id,
+        resourceId: proxyResource.id,
+        httpMethod: 'ANY',
+        authorization: 'NONE',
+      },
+      {parent: proxyResource},
+    )
+
+    const lambdaIntegration = new apigateway.Integration(
+      `proxy`,
+      {
+        restApi: this.id,
+        resourceId: proxyResource.id,
+        httpMethod: proxyMethod.httpMethod,
+        integrationHttpMethod: 'POST',
+        type: 'AWS_PROXY',
+        uri: lambdaFunction.invokeArn,
+        timeoutMilliseconds: timeoutSeconds * 1000,
+      },
+      {parent: proxyMethod},
+    )
+
+    const proxyOptionsMethod = new apigateway.Method(
+      `options`,
+      {
+        restApi: this.id,
+        resourceId: proxyResource.id,
+        httpMethod: 'OPTIONS',
+        authorization: 'NONE',
+      },
+      {parent: proxyResource},
+    )
+
+    const lambdaIntegrationOptions = new apigateway.Integration(
+      `options`,
+      {
+        restApi: this.id,
+        resourceId: proxyResource.id,
+        httpMethod: proxyOptionsMethod.httpMethod,
+        integrationHttpMethod: 'POST',
+        type: 'AWS_PROXY',
+        uri: lambdaFunction.invokeArn,
+        timeoutMilliseconds: timeoutSeconds * 1000,
+      },
+      {parent: proxyOptionsMethod},
+    )
+
+    const proxyRootMethod = new apigateway.Method(
+      `proxy-root`,
+      {
+        restApi: this.id,
+        resourceId: this.rootResourceId,
+        httpMethod: 'ANY',
+        authorization: 'NONE',
+      },
+      {parent: this},
+    )
+
+    const lambdaRootIntegration = new apigateway.Integration(
+      `proxy-root`,
+      {
+        restApi: this.id,
+        resourceId: proxyRootMethod.resourceId,
+        httpMethod: proxyRootMethod.httpMethod,
+        integrationHttpMethod: 'POST',
+        type: 'AWS_PROXY',
+        uri: lambdaFunction.invokeArn,
+        timeoutMilliseconds: timeoutSeconds * 1000,
+      },
+      {parent: proxyRootMethod},
+    )
+
+    const proxyRootOptionsMethod = new apigateway.Method(
+      `proxy-root-options`,
+      {
+        restApi: this.id,
+        resourceId: this.rootResourceId,
+        httpMethod: 'OPTIONS',
+        authorization: 'NONE',
+      },
+      {parent: this},
+    )
+
+    const lambdaRootIntegrationOptions = new apigateway.Integration(
+      `proxy-root-options`,
+      {
+        restApi: this.id,
+        resourceId: proxyRootOptionsMethod.resourceId,
+        httpMethod: proxyRootOptionsMethod.httpMethod,
+        integrationHttpMethod: 'POST',
+        type: 'AWS_PROXY',
+        uri: lambdaFunction.invokeArn,
+        timeoutMilliseconds: timeoutSeconds * 1000,
+      },
+      {parent: proxyRootOptionsMethod},
+    )
+
+    new lambda.Permission(
+      `rest-api`,
+      {
+        statementId: 'AllowRestApiInvoke',
+        action: 'lambda:InvokeFunction',
+        function: lambdaFunction.name,
+        principal: 'apigateway.amazonaws.com',
+        sourceArn: this.executionArn.apply((executionArn) => `${executionArn}/*`),
+      },
+      {parent: lambdaFunction},
+    )
+
+    const deployment = new apigateway.Deployment(
+      stageName,
+      {restApi: this.id},
+      {
+        dependsOn: [
+          proxyMethod,
+          lambdaIntegration,
+          lambdaIntegrationOptions,
+          proxyRootMethod,
+          lambdaRootIntegration,
+          lambdaRootIntegrationOptions,
+        ],
+        parent: this,
+      },
+    )
+
+    const stage = new apigateway.Stage(
+      stageName,
+      {
+        restApi: this.id,
+        stageName: stageName,
+        deployment: deployment.id,
+      },
+      {parent: deployment},
+    )
+
+    const domainName = new DomainName(
+      'domain',
+      {
+        domainName: domain.fullName,
+        certificateArn: domain.usEast1CertificateArn,
+      },
+      {parent: this},
+    )
+
+    new Record(
+      'redirect',
+      {
+        zoneId: domain.zoneId,
+        name: domain.fullName,
+        type: 'A',
+        aliases: [
+          {
+            zoneId: domainName.cloudfrontZoneId,
+            name: domainName.cloudfrontDomainName,
+            evaluateTargetHealth: true,
+          },
+        ],
+        allowOverwrite: true,
+      },
+      {parent: domainName},
+    )
+
+    new BasePathMapping(
+      'root',
+      {
+        restApi: this.id,
+        stageName: stage.stageName,
+        domainName: domainName.domainName,
+      },
+      {parent: stage},
+    )
+
+    this.url = `https://${domain.fullName}/`
+  }
+}

package/src/rest/index.ts

@@ -0,0 +1,7 @@
+import {RestApi} from './RestApi'
+
+export * from './RestApi'
+
+export const rest = {
+  RestApi,
+}

package/src/s3/PublicS3Bucket.ts

@@ -0,0 +1,92 @@
+import {
+  Bucket,
+  BucketAclV2,
+  type BucketArgs,
+  BucketCorsConfigurationV2,
+  BucketOwnershipControls,
+  BucketPolicy,
+  BucketPublicAccessBlock,
+} from '@pulumi/aws/s3'
+import type {CustomResourceOptions} from '@pulumi/pulumi'
+
+type PublicS3BucketArgs = {
+  name: string
+  allowPresignedPost?: boolean
+  tags?: BucketArgs['tags']
+}
+
+export class PublicS3Bucket extends Bucket {
+  constructor(id: string, args: PublicS3BucketArgs, opts?: CustomResourceOptions) {
+    const {name, allowPresignedPost = false, tags} = args
+
+    super(id, {bucket: name, tags}, opts)
+
+    const accessBlock = new BucketPublicAccessBlock(
+      'public-access',
+      {
+        bucket: this.id,
+        blockPublicAcls: false,
+        blockPublicPolicy: false,
+        ignorePublicAcls: false,
+        restrictPublicBuckets: false,
+      },
+      {parent: this},
+    )
+
+    const ownershipControls = new BucketOwnershipControls(
+      'ownership',
+      {
+        bucket: this.id,
+        rule: {objectOwnership: 'BucketOwnerPreferred'},
+      },
+      {parent: this, dependsOn: [accessBlock]},
+    )
+
+    new BucketAclV2(
+      'acl',
+      {
+        bucket: this.id,
+        acl: 'public-read',
+      },
+      {parent: this, dependsOn: [ownershipControls]},
+    )
+
+    new BucketPolicy(
+      'policy',
+      {
+        bucket: this.id,
+        policy: this.arn.apply((arn) =>
+          JSON.stringify({
+            Version: '2012-10-17',
+            Statement: [
+              {
+                Sid: 'Allow Public Access',
+                Effect: 'Allow',
+                Principal: '*',
+                Action: 's3:GetObject',
+                Resource: `${arn}/*`,
+              },
+            ],
+          }),
+        ),
+      },
+      {parent: this, dependsOn: [accessBlock]},
+    )
+
+    new BucketCorsConfigurationV2(
+      'allowAll',
+      {
+        bucket: this.bucket,
+        corsRules: [
+          {
+            maxAgeSeconds: 3000,
+            allowedMethods: allowPresignedPost ? ['GET', 'POST'] : ['GET'],
+            allowedHeaders: ['*'],
+            allowedOrigins: ['*'],
+          },
+        ],
+      },
+      {parent: this},
+    )
+  }
+}

package/src/s3/index.ts

@@ -0,0 +1,7 @@
+import {PublicS3Bucket} from './PublicS3Bucket'
+
+export * from './PublicS3Bucket'
+
+export const s3 = {
+  PublicS3Bucket,
+}

package/src/website/StaticWebsite.ts

@@ -0,0 +1,159 @@
+import {type CustomResourceOptions, type Input, Resource} from '@pulumi/pulumi'
+import {type PublicS3Bucket, s3} from '../s3'
+import {BucketObject} from '@pulumi/aws/s3'
+import {Distribution} from '@pulumi/aws/cloudfront'
+import {Record} from '@pulumi/aws/route53'
+import {readFilesRecursive} from './readFilesRecursive'
+
+export interface StaticWebsiteArgs {
+  projectId: string
+  environmentName: string
+  filesPath: string
+  customDomain?: {
+    fullName: Input<string>
+    zoneId: Input<string>
+    usEast1CertificateArn: Input<string>
+  }
+}
+
+export class StaticWebsite extends Resource {
+  public url: string
+  public bucket: PublicS3Bucket
+
+  constructor(id: string, args: StaticWebsiteArgs, opts?: CustomResourceOptions) {
+    super('mstuercke:website:StaticWebsite', id, false, undefined, opts)
+
+    const {projectId, environmentName, filesPath, customDomain} = args
+
+    const bucket = new s3.PublicS3Bucket(
+      'bucket',
+      {
+        name: `${projectId}-web-${environmentName}`,
+        allowPresignedPost: false,
+        tags: {
+          project: projectId,
+        },
+      },
+      {parent: this},
+    )
+
+    for (const file of readFilesRecursive(filesPath)) {
+      new BucketObject(
+        file.relativePath,
+        {
+          key: file.relativePath,
+          bucket: bucket.id,
+          source: file.absolutePath,
+          contentType: file.mimeType,
+          etag: file.md5,
+          tags: {
+            project: projectId,
+          },
+        },
+        {parent: bucket},
+      )
+    }
+
+    const cloudfront = new Distribution(
+      `website`,
+      {
+        enabled: true,
+        comment: `${projectId} (${environmentName})`,
+        defaultRootObject: 'index.html',
+
+        origins: [
+          {
+            domainName: bucket.bucketRegionalDomainName,
+            originId: bucket.id,
+          },
+        ],
+
+        defaultCacheBehavior: {
+          allowedMethods: ['GET', 'HEAD', 'OPTIONS'],
+          cachedMethods: ['GET', 'HEAD'],
+          targetOriginId: bucket.id,
+          viewerProtocolPolicy: 'redirect-to-https',
+
+          forwardedValues: {
+            queryString: false,
+            cookies: {
+              forward: 'none',
+            },
+          },
+        },
+
+        orderedCacheBehaviors: [
+          {
+            pathPattern: 'index.html',
+            allowedMethods: ['GET', 'HEAD', 'OPTIONS'],
+            cachedMethods: ['GET', 'HEAD'],
+            targetOriginId: bucket.id,
+            viewerProtocolPolicy: 'redirect-to-https',
+            defaultTtl: 0,
+            maxTtl: 0,
+
+            forwardedValues: {
+              queryString: false,
+              cookies: {
+                forward: 'none',
+              },
+            },
+          },
+        ],
+
+        customErrorResponses: [
+          {
+            errorCode: 404,
+            responsePagePath: '/index.html',
+            responseCode: 200,
+            errorCachingMinTtl: 0,
+          },
+        ],
+
+        restrictions: {
+          geoRestriction: {
+            restrictionType: 'none',
+          },
+        },
+
+        viewerCertificate: customDomain
+          ? {
+              acmCertificateArn: customDomain?.usEast1CertificateArn,
+              sslSupportMethod: 'sni-only',
+              minimumProtocolVersion: 'TLSv1.2_2019',
+            }
+          : {cloudfrontDefaultCertificate: true},
+
+        aliases: customDomain ? [customDomain?.fullName] : undefined,
+
+        tags: {
+          project: projectId,
+        },
+      },
+      {parent: this},
+    )
+
+    if (customDomain) {
+      new Record(
+        'redirect',
+        {
+          zoneId: customDomain?.zoneId,
+          name: customDomain?.fullName,
+          type: 'A',
+          allowOverwrite: true,
+          aliases: [
+            {
+              zoneId: cloudfront.hostedZoneId,
+              name: cloudfront.domainName,
+              evaluateTargetHealth: false,
+            },
+          ],
+        },
+        {parent: this},
+      )
+    }
+
+    this.url = `https://${customDomain?.fullName || cloudfront.domainName}`
+    this.bucket = bucket
+  }
+}

package/src/website/index.ts

@@ -0,0 +1,7 @@
+import {StaticWebsite} from './StaticWebsite'
+
+export * from './StaticWebsite'
+
+export const website = {
+  StaticWebsite,
+}

package/src/website/readFilesRecursive.ts

@@ -0,0 +1,33 @@
+import {createHash} from 'crypto'
+import * as fs from 'fs'
+import * as mime from 'mime'
+import {globSync} from 'glob'
+
+interface File {
+  absolutePath: string
+  relativePath: string
+  md5: string
+  mimeType: string
+}
+
+export function readFilesRecursive(dir: string): File[] {
+  const files = globSync(`${dir}/**/*`, {nodir: true})
+
+  return files.reduce((previousValue, fullPath) => {
+    const content = fs.readFileSync(fullPath, 'base64')
+    const md5 = createHash('md5').update(content, 'base64').digest('hex')
+
+    const mimeType = mime.getType(fullPath)
+    if (!mimeType) throw `Cannot determine mimeType for ${fullPath}`
+
+    return [
+      ...previousValue,
+      {
+        absolutePath: fullPath,
+        relativePath: fullPath.replace(`${dir}/`, '').replace(dir, ''),
+        md5,
+        mimeType,
+      },
+    ]
+  }, [] as File[])
+}