@ossy/deployment-tools 1.19.0 → 1.20.1

package/src/infrastructure/container-deployment-target/container-service.js

@@ -0,0 +1,163 @@
+/**
+ * @typedef {'http'|'tcp'} ServiceType
+ *
+ * @typedef {Object} HttpServiceConfig
+ * @property {'http'} [type]   - defaults to 'http'
+ * @property {string} name     - unique name, used for container name and systemd unit
+ * @property {string} domain   - domain this service handles (Caddy block + Route53)
+ * @property {string} image    - Docker image to run
+ *
+ * @typedef {Object} TcpServiceConfig
+ * @property {'tcp'} type      - marks this as a raw TCP/UDP service (no HTTP/Caddy)
+ * @property {string} name     - unique name, used for container name and systemd unit
+ * @property {string} image    - Docker image to run
+ * @property {number[]} ports  - ports to expose directly (same inside and outside container)
+ * @property {'tcp'|'udp'|'both'} [protocol] - defaults to 'tcp'
+ *
+ * @typedef {HttpServiceConfig|TcpServiceConfig} ContainerServiceConfig
+ */
+
+const BASE_HTTP_PORT = 3002 // 3000 = platform runtime, 3001 = API
+
+// ---------------------------------------------------------------------------
+// HTTP service — reverse-proxied through Caddy, container listens on port 3000
+// ---------------------------------------------------------------------------
+
+class HttpContainerService {
+  constructor({ name, domain, image }, httpIndex) {
+    this.name = name
+    this.domain = domain
+    this.image = image
+    this.hostPort = BASE_HTTP_PORT + httpIndex
+  }
+
+  get systemdUnitFile() {
+    return `
+[Unit]
+Description=Container service: ${this.name} (${this.domain})
+After=network.target docker.service
+Requires=docker.service
+
+[Service]
+EnvironmentFile=/etc/environment
+ExecStartPre=-/usr/bin/docker rm -f ${this.name}
+ExecStartPre=/usr/bin/docker pull ${this.image}
+ExecStart=/usr/bin/docker run --name ${this.name} \\
+  --network ossy-network \\
+  -p ${this.hostPort}:3000 \\
+  --env-file /etc/environment \\
+  ${this.image}
+ExecStop=/usr/bin/docker stop ${this.name}
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+`
+  }
+
+  get caddyBlock() {
+    return `
+${this.domain} {
+  tls {
+    dns route53 {
+      max_retries 10
+      profile ci-client
+    }
+  }
+  reverse_proxy localhost:${this.hostPort}
+}`
+  }
+
+  /** Ports to open in the EC2 security group. HTTP services use Caddy on 80/443 — no extra rules needed. */
+  get securityGroupPorts() {
+    return []
+  }
+
+  get unitName() { return `${this.name}.service` }
+  install() { return [`sudo tee /etc/systemd/system/${this.unitName} > /dev/null << 'EOF'\n${this.systemdUnitFile}\nEOF`] }
+  enable()  { return [`sudo systemctl enable ${this.name}`] }
+  start()   { return [`sudo systemctl start ${this.name}`] }
+}
+
+// ---------------------------------------------------------------------------
+// TCP/UDP service — bypasses Caddy, ports exposed directly on the host.
+// Used for game servers and any other raw socket services.
+// ---------------------------------------------------------------------------
+
+class TcpContainerService {
+  constructor({ name, image, ports, protocol = 'tcp' }) {
+    this.name = name
+    this.image = image
+    this.ports = ports
+    this.protocol = protocol // 'tcp' | 'udp' | 'both'
+  }
+
+  get systemdUnitFile() {
+    const portMappings = this.ports.map(p => `-p ${p}:${p}`).join(' \\\n  ')
+    return `
+[Unit]
+Description=Container service: ${this.name} (${this.protocol.toUpperCase()} ${this.ports.join(', ')})
+After=network.target docker.service
+Requires=docker.service
+
+[Service]
+EnvironmentFile=/etc/environment
+ExecStartPre=-/usr/bin/docker rm -f ${this.name}
+ExecStartPre=/usr/bin/docker pull ${this.image}
+ExecStart=/usr/bin/docker run --name ${this.name} \\
+  --network ossy-network \\
+  ${portMappings} \\
+  --env-file /etc/environment \\
+  ${this.image}
+ExecStop=/usr/bin/docker stop ${this.name}
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+`
+  }
+
+  /** TCP services bypass Caddy — no Caddy block. */
+  get caddyBlock() { return null }
+
+  /** Each port needs an explicit security group ingress rule. */
+  get securityGroupPorts() {
+    return this.ports.flatMap(port => {
+      if (this.protocol === 'both') return [{ port, protocol: 'tcp' }, { port, protocol: 'udp' }]
+      return [{ port, protocol: this.protocol }]
+    })
+  }
+
+  get unitName() { return `${this.name}.service` }
+  install() { return [`sudo tee /etc/systemd/system/${this.unitName} > /dev/null << 'EOF'\n${this.systemdUnitFile}\nEOF`] }
+  enable()  { return [`sudo systemctl enable ${this.name}`] }
+  start()   { return [`sudo systemctl start ${this.name}`] }
+}
+
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+
+/**
+ * Build service instances from the `services` array in platforms.json.
+ * HTTP services auto-assign host ports starting at 3002 (counted separately
+ * from TCP services so reordering TCP entries doesn't shift HTTP ports).
+ *
+ * @param {ContainerServiceConfig[]} services
+ * @returns {(HttpContainerService|TcpContainerService)[]}
+ */
+const fromConfig = (services = []) => {
+  let httpIndex = 0
+  return services.map(s => {
+    if (s.type === 'tcp') return new TcpContainerService(s)
+    return new HttpContainerService(s, httpIndex++)
+  })
+}
+
+module.exports = {
+  HttpContainerService,
+  TcpContainerService,
+  fromConfig
+}

package/src/infrastructure/deployment-target-stack.js

@@ -1,97 +1,50 @@
 /* eslint-disable no-new */
-const { CfnOutput, Stack, RemovalPolicy } = require('aws-cdk-lib')
-const { BackupPlan, BackupVault, BackupResource } = require('aws-cdk-lib/aws-backup')
-const { Bucket, BlockPublicAccess } = require('aws-cdk-lib/aws-s3')
-const { Distribution, PriceClass, ResponseHeadersPolicy } = require('aws-cdk-lib/aws-cloudfront')
-const { S3BucketOrigin } = require('aws-cdk-lib/aws-cloudfront-origins')
+const { CfnOutput, Stack } = require('aws-cdk-lib')
 const { ContainerDeploymentTarget } = require('./container-deployment-target')
 
 /**
-  * @class
-*/
+ * DeploymentTargetStackProps
+ * @typedef {Object} DeploymentTargetStackProps
+ * @property {PlatformConfig} config - platform config
+ * @property {import('aws-cdk-lib/aws-s3').IBucket} bucket - static assets bucket (from StorageStaticStack)
+ * @property {string} cdnDomainName - CloudFront domain name (from StorageStaticStack)
+ */
+
+/**
+ * DeploymentTargetStack provisions the EC2 instance (with Elastic IP) that runs the
+ * platform services. The S3 bucket lives in StorageStaticStack so that EC2 replacements
+ * never trigger CloudFormation cross-stack export conflicts on storage resources.
+ *
+ * MEDIA_REPOSITORY and MEDIA_CDN_DOMAIN_NAME are derived from the actual bucket and CDN
+ * resources rather than being hardcoded in platforms.json.
+ */
 class DeploymentTargetStack extends Stack {
   constructor(scope, id, props) {
     super(scope, id, props)
 
     if (!props?.config) {
-      throw ('[DeploymentTargetStack] No template provided')
+      throw ('[DeploymentTargetStack] No config provided')
     }
 
-    // TODO: Check if the bucket already exists and use it
-    // instead of having the whole deployment fail
-    const staticDeploymentTarget =
-      new Bucket(this, 'StaticDeploymentTarget', {
-        bucketName: props.config.awsStaticBucketName,
-        blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
-        removalPolicy: RemovalPolicy.RETAIN,
-        autoDeleteObjects: false,
-        versioned: true,
-        cors: [{
-          allowedHeaders: ['*'],
-          allowedMethods: ['GET', 'PUT', 'POST' ],
-          allowedOrigins: [ '*' ],
-          exposeHeaders: []
-        }]
-      })
-
-    const mediaBackupVault = new BackupVault(this, 'StaticMediaBackupVault', {
-      backupVaultName: `${props.config.platformName}-static-media`,
-      removalPolicy: RemovalPolicy.RETAIN
-    })
-
-    const mediaBackupPlan = BackupPlan.daily35DayRetention(this, 'StaticMediaBackupPlan', mediaBackupVault)
-
-    mediaBackupPlan.addSelection('StaticDeploymentTargetBucket', {
-      backupSelectionName: `${props.config.platformName}-s3-static-media`,
-      resources: [BackupResource.fromArn(staticDeploymentTarget.bucketArn)],
-      allowRestores: true
-    })
-
-    const mediaCDN = new Distribution(this, 'Media', {
-        defaultBehavior: {
-          origin: S3BucketOrigin.withOriginAccessControl(staticDeploymentTarget, { originPath: '/media' }),
-          // S3 bucket CORS does not add headers on viewer responses; without this, browser fetch()
-          // to the CDN is cross-origin and Chrome may block with net::ERR_BLOCKED_BY_ORB.
-          responseHeadersPolicy:
-            ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT
-        },
-        priceClass: PriceClass.PRICE_CLASS_100
-      })
-
-    const containerDeploymentTarget =
-      new ContainerDeploymentTarget(this, 'ContainerDeploymentTarget', {
-      config: props.config,
-      bucket: staticDeploymentTarget
+    const containerDeploymentTarget = new ContainerDeploymentTarget(this, 'ContainerDeploymentTarget', {
+      config: {
+        ...props.config,
+        env: {
+          ...props.config.env,
+          MEDIA_REPOSITORY: props.bucket.bucketName,
+          MEDIA_CDN_DOMAIN_NAME: `https://${props.cdnDomainName}`
+        }
+      },
+      bucket: props.bucket
     })
 
     this.containerDeploymentTargetPublicIp = containerDeploymentTarget.instancePublicIp
-    this.staticDeploymentTargetBucketName = staticDeploymentTarget.bucketName
-    this.staticDeploymentTargetBucketArn = staticDeploymentTarget.bucketArn
-
-    new CfnOutput(this, 'MediaCDNDomainName', {
-      value: mediaCDN.domainName,
-      description: 'Domain name of CDN distribution',
-      exportName: 'MediaCDNDomainName'
-    })
 
     new CfnOutput(this, 'ContainerDeploymentTargetPublicIp', {
       value: containerDeploymentTarget.instancePublicIp,
-      description: 'Public ip of the ec2 instance',
-      exportName: 'awsContainerDeploymentTargetPublicIp'
-    })
-
-    new CfnOutput(this, 'StaticDeploymentTargetBucketName', {
-      value: staticDeploymentTarget.bucketName,
-      description: 'Name of static deployment target bucket',
-      exportName: 'awsStaticDeploymentTargetBucketName'
-    })
-
-    new CfnOutput(this, 'StaticDeploymentTargetBucketArn', {
-      value: staticDeploymentTarget.bucketArn,
-      description: 'Name of static deployment target bucket',
-      exportName: 'awsStaticDeploymentTargetBucketArn'
+      description: 'Public IP of the EC2 instance (Elastic IP)',
+      exportName: `${props.config.platformName}-ContainerDeploymentTargetPublicIp`
     })
-
   }
 }
 

package/src/infrastructure/platform-stage.js

@@ -0,0 +1,40 @@
+/* eslint-disable no-new */
+const { Stage } = require('aws-cdk-lib')
+const { StorageStaticStack } = require('./storage-static-stack')
+const { DeploymentTargetStack } = require('./deployment-target-stack')
+const { DnsStack } = require('./dns-stack')
+const { SesStack } = require('./ses-stack')
+
+/**
+ * PlatformStage groups all stacks that make up a single platform deployment.
+ * Using a Stage lets you target one platform at a time:
+ *
+ *   cdk deploy 'ossybot/**' --profile ossybot
+ *
+ * Stack names within the stage are automatically prefixed with the platform name,
+ * e.g. ossybot/trust-ci, ossybot/storage-static, ossybot/deployment-target, etc.
+ */
+class PlatformStage extends Stage {
+  constructor(scope, id, props) {
+    super(scope, id, props)
+
+    const storageStatic = new StorageStaticStack(this, 'storage-static', props)
+
+    const deploymentTarget = new DeploymentTargetStack(this, 'deployment-target', {
+      ...props,
+      bucket: storageStatic.bucket,
+      cdnDomainName: storageStatic.cdnDomainName
+    })
+
+    new DnsStack(this, 'dns', {
+      ...props,
+      containerDeploymentTargetPublicIp: deploymentTarget.containerDeploymentTargetPublicIp
+    })
+
+    new SesStack(this, 'ses', props)
+  }
+}
+
+module.exports = {
+  PlatformStage
+}

package/src/infrastructure/storage-static-stack.js

@@ -0,0 +1,87 @@
+/* eslint-disable no-new */
+const { CfnOutput, Stack, RemovalPolicy } = require('aws-cdk-lib')
+const { BackupPlan, BackupVault, BackupResource } = require('aws-cdk-lib/aws-backup')
+const { Bucket, BlockPublicAccess } = require('aws-cdk-lib/aws-s3')
+const { Distribution, PriceClass, ResponseHeadersPolicy } = require('aws-cdk-lib/aws-cloudfront')
+const { S3BucketOrigin } = require('aws-cdk-lib/aws-cloudfront-origins')
+
+/**
+ * StorageStaticStack provisions the S3 bucket used for static assets and media,
+ * a CloudFront CDN distribution serving the /media prefix, and a daily backup plan.
+ *
+ * This stack is intentionally kept separate from the deployment-target stack so that
+ * the long-lived storage resources are never touched when the EC2 instance is updated
+ * or replaced, avoiding CloudFormation cross-stack export conflicts.
+ *
+ * Exports (consumed by deployment-target-stack via cross-stack reference):
+ *   - `bucket`          — the S3 Bucket construct
+ *   - `cdnDomainName`   — the CloudFront distribution domain name
+ */
+class StorageStaticStack extends Stack {
+  constructor(scope, id, props) {
+    super(scope, id, props)
+
+    if (!props?.config) {
+      throw ('[StorageStaticStack] No config provided')
+    }
+
+    const bucket = new Bucket(this, 'StaticDeploymentTarget', {
+      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+      removalPolicy: RemovalPolicy.RETAIN,
+      autoDeleteObjects: false,
+      versioned: true,
+      cors: [{
+        allowedHeaders: ['*'],
+        allowedMethods: ['GET', 'PUT', 'POST'],
+        allowedOrigins: ['*'],
+        exposeHeaders: []
+      }]
+    })
+
+    const backupVault = new BackupVault(this, 'StaticMediaBackupVault', {
+      removalPolicy: RemovalPolicy.RETAIN
+    })
+
+    const backupPlan = BackupPlan.daily35DayRetention(this, 'StaticMediaBackupPlan', backupVault)
+
+    backupPlan.addSelection('StaticDeploymentTargetBucket', {
+      resources: [BackupResource.fromArn(bucket.bucketArn)],
+      allowRestores: true
+    })
+
+    const mediaCDN = new Distribution(this, 'Media', {
+      defaultBehavior: {
+        origin: S3BucketOrigin.withOriginAccessControl(bucket, { originPath: '/media' }),
+        // S3 bucket CORS does not add headers on viewer responses; without this, browser fetch()
+        // to the CDN is cross-origin and Chrome may block with net::ERR_BLOCKED_BY_ORB.
+        responseHeadersPolicy: ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT
+      },
+      priceClass: PriceClass.PRICE_CLASS_100
+    })
+
+    this.bucket = bucket
+    this.cdnDomainName = mediaCDN.domainName
+
+    new CfnOutput(this, 'MediaCDNDomainName', {
+      value: mediaCDN.domainName,
+      description: 'Domain name of CDN distribution',
+      exportName: `${props.config.platformName}-MediaCDNDomainName`
+    })
+
+    new CfnOutput(this, 'StaticDeploymentTargetBucketName', {
+      value: bucket.bucketName,
+      description: 'Name of static deployment target bucket',
+      exportName: `${props.config.platformName}-StaticDeploymentTargetBucketName`
+    })
+
+    new CfnOutput(this, 'StaticDeploymentTargetBucketArn', {
+      value: bucket.bucketArn,
+      description: 'ARN of static deployment target bucket',
+      exportName: `${props.config.platformName}-StaticDeploymentTargetBucketArn`
+    })
+  }
+}
+
+module.exports = {
+  StorageStaticStack
+}

package/src/template/platform-template.js

@@ -10,10 +10,7 @@ const { logError, logInfo } = require('../log')
  * @property {string} awsAccountId - Aws account id
  * @property {string=} awsRegion - ?
  * @property {string=} awsKeyPairName - ?
- * @property {string} awsRoleToAssume - ?
  * @property {string=} awsDeploymentSqsArn - ?
- *
- * @property {string} ciGithubActionsRepo - organisation/repoName
  */
 
 /**

package/src/aws-credentials/aws-credentials.js

@@ -1,87 +0,0 @@
-const core = require('@actions/core')
-const { STSClient, AssumeRoleWithWebIdentityCommand } = require('@aws-sdk/client-sts')
-
-const { logInfo, logError } = require('../log')
-
-/**
-  * @class
-*/
-class AwsCredentialsService {
-
-  static resolveAwsCredentials(platformConfig) {
-    // If awsRoleToAssume is present, then we assume we run in a github workflow
-    // If awsRoleToAssume is not present, then we assume they are resolved localy by aws-sdk
-    if (!platformConfig.awsRoleToAssume) {
-      logInfo({ message: '[AwsCredentialsService] No aws role to assume was found, leaving auth logic to @aws-sdk package' })
-      return Promise.resolve(undefined)
-    }
-
-    const stsClient = new STSClient({ region: platformConfig.awsRegion })
-
-    logInfo({ message: '[AwsCredentialsService] Fetching GitHub ID token' })
-    return core.getIDToken('sts.amazonaws.com')
-      .then(webIdentityToken => {
-        logInfo({ message: `[AwsCredentialsService] Attempting to resolve aws credentials by assuming the role: ${platformConfig.awsRoleToAssume}` })
-        return stsClient.send(new AssumeRoleWithWebIdentityCommand({
-          RoleArn: `arn:aws:iam::${platformConfig.awsAccountId}:role/${platformConfig.awsRoleToAssume}`,
-          RoleSessionName: 'GitHubActions',
-          DurationSeconds: 15 * 60,
-          WebIdentityToken: webIdentityToken
-        }))
-      })
-      .then(responseData => ({
-        // Don't ask
-        AccessKeyId: responseData.Credentials.AccessKeyId,
-        SessionToken: responseData.Credentials.SessionToken,
-        SecretAccessKey: responseData.Credentials.SecretAccessKey,
-        accessKeyId: responseData.Credentials.AccessKeyId,
-        sessionToken: responseData.Credentials.SessionToken,
-        secretAccessKey: responseData.Credentials.SecretAccessKey
-      }))
-      .then(x => AwsCredentialsService.exportCredentialsToGithubWorkflow({ ...x, awsRegion: platformConfig.awsRegion }))
-      .catch(error => {
-        logError({ message: '[AwsCredentialsService] Could not resolve temporary credentials', error })
-        return undefined
-      })
-  }
-
-  static exportCredentialsToGithubWorkflow(params) {
-    // Configure the AWS CLI and AWS SDKs using environment variables and set them as secrets.
-    // Setting the credentials as secrets masks them in Github Actions logs
-    const { accessKeyId, secretAccessKey, sessionToken, awsRegion } = params
-
-    // AWS_ACCESS_KEY_ID:
-    // Specifies an AWS access key associated with an IAM user or role
-    core.setSecret(accessKeyId)
-    core.exportVariable('AWS_ACCESS_KEY_ID', accessKeyId)
-
-    // AWS_SECRET_ACCESS_KEY:
-    // Specifies the secret key associated with the access key. This is essentially the "password" for the access key.
-    core.setSecret(secretAccessKey)
-    core.exportVariable('AWS_SECRET_ACCESS_KEY', secretAccessKey)
-
-    // AWS_SESSION_TOKEN:
-    // Specifies the session token value that is required if you are using temporary security credentials.
-    if (sessionToken) {
-      core.setSecret(sessionToken)
-      core.exportVariable('AWS_SESSION_TOKEN', sessionToken)
-    } else if (process.env.AWS_SESSION_TOKEN) {
-      // clear session token from previous credentials action
-      core.exportVariable('AWS_SESSION_TOKEN', '')
-    }
-
-    if (awsRegion) {
-      core.exportVariable('AWS_REGION', awsRegion)
-    } else if (process.env.AWS_REGION) {
-      // clear AWS_REGION from previous credentials action
-      core.exportVariable('AWS_REGION', '')
-    }
-
-    return params
-  }
-
-}
-
-module.exports = {
-  AwsCredentialsService
-}

package/src/aws-credentials/cli.js

@@ -1,55 +0,0 @@
-const arg = require('arg')
-const { AwsCredentialsService } = require('./aws-credentials')
-const { PlatformTemplateService } = require('../template')
-const { PlatformConfigService } = require('../config')
-const { logInfo, logError } = require('../log')
-
-const resolveCredentials = options => {
-  logInfo({ message: 'resolve-credentials' })
-
-  const parsedArgs = arg({
-    '--access-key-id': String,
-    '--session-token': String,
-    '--secret-access-key': String
-  }, { argv: options })
-
-  AwsCredentialsService.exportCredentialsToGithubWorkflow({
-    accessKeyId: parsedArgs['--access-key-id'],
-    sessionToken: parsedArgs['--session-token'],
-    secretAccessKey: parsedArgs['--secret-access-key']
-  })
-}
-
-const assumeRole = options => {
-  logInfo({ message: 'assume-role' })
-
-  const parsedArgs = arg({
-    '--platforms': String,
-    '--target-platform': String
-  }, { argv: options })
-
-  const platformName = parsedArgs['--target-platform'] || ''
-
-  PlatformTemplateService.readFromFile(parsedArgs['--platforms'] || process.env.PLATFORMS)
-    .then(templates => templates.map(PlatformConfigService.from))
-    .then(configs => configs.find(x => x.platformName === platformName))
-    .then(targetConfig => {
-
-      if (!targetConfig) {
-        return logError({ message: 'No configuration found' })
-      }
-
-      AwsCredentialsService.resolveAwsCredentials(targetConfig)
-        .then(() => logInfo({ message: `Assumed role for ${targetConfig.platformName}` }))
-
-    })
-
-}
-
-module.exports = {
-  handler: ([command, ...options]) => {
-    !!command
-      ? { 'resolve-credentials': resolveCredentials, 'assume-role': assumeRole }[command](options)
-      : logError({ message: 'No command provided' })
-  }
-}

package/src/aws-credentials/index.js

@@ -1 +0,0 @@
-module.exports = require('./aws-credentials')

package/src/index.cli.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env node
-/* eslint-disable global-require, no-unused-vars */
-
-const [_, __, handlerName, ...restArgs] = process.argv
-
-const loadHandler = {
-  aws: () => require('./aws-credentials/cli.js'),
-  template: () => require('./template/cli.js'),
-}[handlerName]
-
-!!loadHandler && loadHandler().handler(restArgs)

package/src/infrastructure/container-deployment-target/ossy-website-ossy.service.js

@@ -1,52 +0,0 @@
-// TODO: remove this service once ossy.se traffic flows through the platform runtime.
-// The platform runtime (ghcr.io/ossy-se/platform) is the long-term host for all
-// tenant sites including ossy.se. This service is a stopgap while the CMS-based
-// publish flow is validated in production.
-
-const systemdServiceFile = `
-[Unit]
-Description=Ossy Website (ossy.se)
-After=network.target docker.service
-Requires=docker.service
-
-[Service]
-EnvironmentFile=/etc/environment
-ExecStartPre=-/usr/bin/docker rm -f ossy-website-ossy
-ExecStartPre=/usr/bin/docker pull ghcr.io/ossy-se/website-ossy:latest
-ExecStart=/usr/bin/docker run --name ossy-website-ossy \\
-  --network ossy-network \\
-  -p 3002:3000 \\
-  -e PORT=3000 \\
-  -e OSSY_API_URL=http://ossy-api:3001 \\
-  -e OSSY_COOKIE_SECRET=\${OSSY_COOKIE_SECRET} \\
-  ghcr.io/ossy-se/website-ossy:latest
-ExecStop=/usr/bin/docker stop ossy-website-ossy
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-`
-
-/**
-  * @class
-*/
-class OssyWebsiteOssyService {
-
-  static install() {
-    return [`sudo tee /etc/systemd/system/ossy-website-ossy.service > /dev/null << 'EOF'\n${systemdServiceFile}\nEOF`]
-  }
-
-  static enable() {
-    return ['sudo systemctl enable ossy-website-ossy']
-  }
-
-  static start() {
-    return ['sudo systemctl start ossy-website-ossy']
-  }
-
-}
-
-module.exports = {
-  OssyWebsiteOssyService
-}