@ossy/deployment-tools 3.0.8 → 3.1.0

package/src/infrastructure/container-deployment-target/container-deployment-target.js

@@ -1,222 +0,0 @@
-const { Construct } = require('constructs')
-const {
-  Instance,
-  InstanceType,
-  InstanceClass,
-  InstanceSize,
-  GenericLinuxImage,
-  Vpc,
-  SecurityGroup,
-  Peer,
-  Port,
-  UserData,
-  KeyPair,
-  BlockDeviceVolume,
-  CfnEIP,
-  CfnEIPAssociation
-} = require('aws-cdk-lib/aws-ec2')
-const { Role, ServicePrincipal, Policy, PolicyStatement, Effect } = require('aws-cdk-lib/aws-iam')
-const { Source, BucketDeployment } = require('aws-cdk-lib/aws-s3-deployment')
-const { getInstallNodeJs, getInstallNpm, getInstallDocker } = require('./user-data-commands')
-const { CaddyService } = require('./caddy.service')
-const { OssyRuntimeService } = require('./ossy-runtime.service')
-const { OssyApiService } = require('./ossy-api.service')
-const { fromConfig: buildContainerServices } = require('./container-service')
-const { SupportedRegions } = require('../../config')
-
-/**
- * ContainerServerProps
- * @namespace ContainerServer
- * @typedef {Object} ContainerServerProps
- * @property {PlatformConfig} config - platform config
- * @property {Bucket} bucket - s3 bucket
- */
-
-const InstanceImages = {
-  UBUNTU: 'ami-067bcf851477ebb78' // Ubuntu Server 24.04 LTS (HVM), eu-north-1
-}
-
-/**
-  * @class
-*/
-class ContainerDeploymentTarget extends Construct {
-
-  /**
-   * @param {object} scope - scope
-   * @param {string} id - id
-   * @param {ContainerServerProps} props - ContainerServerProps
-   */
-  constructor(scope, id, props) {
-    super(scope, id)
-
-    const vpc = Vpc.fromLookup(this, 'VPC', { isDefault: true })
-    const securityGroup = new SecurityGroup(this, 'SecurityGroup', { vpc, allowAllOutbound: true })
-
-    securityGroup.addIngressRule(
-      Peer.anyIpv4(),
-      Port.tcp(22),
-      'allow SSH access from anywhere'
-    )
-
-    securityGroup.addIngressRule(
-      Peer.anyIpv4(),
-      Port.tcp(80),
-      'allow HTTP traffic from anywhere'
-    )
-
-    securityGroup.addIngressRule(
-      Peer.anyIpv4(),
-      Port.tcp(443),
-      'allow HTTPS traffic from anywhere'
-    )
-
-    // Build container services from config — opens additional security group ports for TCP/UDP services
-    const containerServices = buildContainerServices(props.config.services)
-
-    containerServices.forEach(service => {
-      service.securityGroupPorts.forEach(({ port, protocol }) => {
-        const portRule = protocol === 'udp' ? Port.udp(port) : Port.tcp(port)
-        securityGroup.addIngressRule(Peer.anyIpv4(), portRule, `${service.name} ${protocol.toUpperCase()} ${port}`)
-      })
-    })
-
-    const platformConfigDeployment = new BucketDeployment(this, 'PlatformConfigDeployment', {
-      sources: [Source.jsonData('platform-config.json', { ...props.config, env: undefined })],
-      destinationBucket: props.bucket,
-      // Default prune:true would delete every other object (e.g. media/*) on each infra deploy.
-      prune: false
-    })
-
-    const role = new Role(this, 'role', {
-      assumedBy: new ServicePrincipal('ec2.amazonaws.com')
-    })
-
-    role.attachInlinePolicy(new Policy(this, 'policy', {
-      statements: [
-        new PolicyStatement({
-          effect: Effect.ALLOW,
-          actions: [
-            'route53:ListResourceRecordSets',
-            'route53:GetChange',
-            'route53:ChangeResourceRecordSets'
-          ],
-          resources: [
-            `arn:aws:route53:::hostedzone/*`,
-            'arn:aws:route53:::change/*'
-          ]
-        }),
-        new PolicyStatement({
-          effect: Effect.ALLOW,
-          actions: [
-            'route53:ListHostedZonesByName',
-            'route53:ListHostedZones'
-          ],
-          resources: ['*']
-        }),
-      ]
-    }))
-
-    const userData = UserData.forLinux()
-
-    // Write platform env vars to /etc/environment so all systemd services pick them up.
-    const envLines = Object.entries(props.config.env ?? {}).map(([k, v]) => `${k}=${v}`)
-
-    userData.addCommands(
-      'sudo groupadd docker',
-      'sudo usermod -aG docker ubuntu',
-      'newgrp docker',
-      'sudo apt update -y',
-      ...getInstallNodeJs(),
-      ...getInstallNpm(),
-      ...getInstallDocker(),
-      'sudo apt-get install awscli --yes',
-      // Write all platform env vars before starting any service
-      `sudo tee /etc/environment << 'ENVEOF'\n${envLines.join('\n')}\nENVEOF`,
-      // Create shared Docker network for inter-container communication
-      'docker network create ossy-network || true',
-      ...CaddyService.install(containerServices.filter(s => s.caddyBlock !== null)),
-      ...OssyRuntimeService.install(),
-      ...OssyApiService.install(),
-      ...containerServices.flatMap(s => s.install())
-    )
-
-    userData.addS3DownloadCommand({
-      bucket: props.bucket,
-      bucketKey: 'platform-config.json',
-      localFile: '/home/ubuntu/platform-config.json'
-    })
-
-    userData.addCommands(
-      'sudo systemctl daemon-reload',
-      ...CaddyService.enable(),
-      ...CaddyService.start(),
-      ...OssyRuntimeService.enable(),
-      ...OssyRuntimeService.start(),
-      ...OssyApiService.enable(),
-      ...OssyApiService.start(),
-      ...containerServices.flatMap(s => [...s.enable(), ...s.start()])
-    )
-
-    const instanceClassMap = {
-      t2: InstanceClass.T2,
-      t3: InstanceClass.T3,
-      t3a: InstanceClass.T3A,
-      t4g: InstanceClass.T4G,
-      m5: InstanceClass.M5,
-      m6i: InstanceClass.M6I,
-      c5: InstanceClass.C5,
-      c6i: InstanceClass.C6I,
-    }
-
-    const instanceSizeMap = {
-      nano: InstanceSize.NANO,
-      micro: InstanceSize.MICRO,
-      small: InstanceSize.SMALL,
-      medium: InstanceSize.MEDIUM,
-      large: InstanceSize.LARGE,
-      xlarge: InstanceSize.XLARGE,
-      '2xlarge': InstanceSize.XLARGE2,
-    }
-
-    const instanceClass = instanceClassMap[props.config.awsInstanceClass ?? 't3']
-    const instanceSize = instanceSizeMap[props.config.awsInstanceSize ?? 'small']
-
-    if (!instanceClass) throw new Error(`[ContainerDeploymentTarget] Unknown awsInstanceClass: ${props.config.awsInstanceClass}`)
-    if (!instanceSize) throw new Error(`[ContainerDeploymentTarget] Unknown awsInstanceSize: ${props.config.awsInstanceSize}`)
-
-    const ec2Instance = new Instance(this, 'Ec2Instance', {
-      vpc,
-      securityGroup,
-      userData,
-      role,
-      instanceType: InstanceType.of(instanceClass, instanceSize),
-      machineImage: new GenericLinuxImage({
-        [SupportedRegions.North]: InstanceImages.UBUNTU
-      }),
-      blockDevices: [
-        {
-          deviceName: '/dev/sda1',
-          volume: BlockDeviceVolume.ebs(50)
-        }
-      ],
-      keyPair: KeyPair.fromKeyPairName(this, 'KeyPair', props.config.awsKeyPairName)
-    })
-
-    props.bucket.grantRead(ec2Instance, '*')
-
-    // Elastic IP gives the instance a stable public IP that survives instance replacements,
-    // preventing CloudFormation cross-stack export conflicts when the EC2 instance is updated.
-    const eip = new CfnEIP(this, 'ElasticIp', { domain: 'vpc' })
-    new CfnEIPAssociation(this, 'EipAssociation', {
-      instanceId: ec2Instance.instanceId,
-      allocationId: eip.attrAllocationId
-    })
-
-    this.instancePublicIp = eip.attrPublicIp
-
-  }
-}
-
-module.exports = {
-  ContainerDeploymentTarget
-}

package/src/infrastructure/container-deployment-target/container-service.js

@@ -1,162 +0,0 @@
-/**
- * @typedef {'http'|'tcp'} ServiceType
- *
- * @typedef {Object} HttpServiceConfig
- * @property {'http'} [type]   - defaults to 'http'
- * @property {string} name     - unique name, used for container name and systemd unit
- * @property {string} domain   - domain this service handles (Caddy block + Route53)
- * @property {string} image    - Docker image to run
- *
- * @typedef {Object} TcpServiceConfig
- * @property {'tcp'} type      - marks this as a raw TCP/UDP service (no HTTP/Caddy)
- * @property {string} name     - unique name, used for container name and systemd unit
- * @property {string} image    - Docker image to run
- * @property {number[]} ports  - ports to expose directly (same inside and outside container)
- * @property {'tcp'|'udp'|'both'} [protocol] - defaults to 'tcp'
- *
- * @typedef {HttpServiceConfig|TcpServiceConfig} ContainerServiceConfig
- */
-
-const BASE_HTTP_PORT = 3002 // 3000 = platform runtime, 3001 = API
-
-// ---------------------------------------------------------------------------
-// HTTP service — reverse-proxied through Caddy, container listens on port 3000
-// ---------------------------------------------------------------------------
-
-class HttpContainerService {
-  constructor({ name, domain, image }, httpIndex) {
-    this.name = name
-    this.domain = domain
-    this.image = image
-    this.hostPort = BASE_HTTP_PORT + httpIndex
-  }
-
-  get systemdUnitFile() {
-    return `
-[Unit]
-Description=Container service: ${this.name} (${this.domain})
-After=network.target docker.service
-Requires=docker.service
-
-[Service]
-EnvironmentFile=/etc/environment
-ExecStartPre=-/usr/bin/docker rm -f ${this.name}
-ExecStartPre=/usr/bin/docker pull ${this.image}
-ExecStart=/usr/bin/docker run --name ${this.name} \\
-  --network ossy-network \\
-  -p ${this.hostPort}:3000 \\
-  --env-file /etc/environment \\
-  ${this.image}
-ExecStop=/usr/bin/docker stop ${this.name}
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-`
-  }
-
-  get caddyBlock() {
-    return `
-${this.domain} {
-  tls {
-    dns route53 {
-      max_retries 10
-    }
-  }
-  reverse_proxy localhost:${this.hostPort}
-}`
-  }
-
-  /** Ports to open in the EC2 security group. HTTP services use Caddy on 80/443 — no extra rules needed. */
-  get securityGroupPorts() {
-    return []
-  }
-
-  get unitName() { return `${this.name}.service` }
-  install() { return [`sudo tee /etc/systemd/system/${this.unitName} > /dev/null << 'EOF'\n${this.systemdUnitFile}\nEOF`] }
-  enable()  { return [`sudo systemctl enable ${this.name}`] }
-  start()   { return [`sudo systemctl start ${this.name}`] }
-}
-
-// ---------------------------------------------------------------------------
-// TCP/UDP service — bypasses Caddy, ports exposed directly on the host.
-// Used for game servers and any other raw socket services.
-// ---------------------------------------------------------------------------
-
-class TcpContainerService {
-  constructor({ name, image, ports, protocol = 'tcp' }) {
-    this.name = name
-    this.image = image
-    this.ports = ports
-    this.protocol = protocol // 'tcp' | 'udp' | 'both'
-  }
-
-  get systemdUnitFile() {
-    const portMappings = this.ports.map(p => `-p ${p}:${p}`).join(' \\\n  ')
-    return `
-[Unit]
-Description=Container service: ${this.name} (${this.protocol.toUpperCase()} ${this.ports.join(', ')})
-After=network.target docker.service
-Requires=docker.service
-
-[Service]
-EnvironmentFile=/etc/environment
-ExecStartPre=-/usr/bin/docker rm -f ${this.name}
-ExecStartPre=/usr/bin/docker pull ${this.image}
-ExecStart=/usr/bin/docker run --name ${this.name} \\
-  --network ossy-network \\
-  ${portMappings} \\
-  --env-file /etc/environment \\
-  ${this.image}
-ExecStop=/usr/bin/docker stop ${this.name}
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-`
-  }
-
-  /** TCP services bypass Caddy — no Caddy block. */
-  get caddyBlock() { return null }
-
-  /** Each port needs an explicit security group ingress rule. */
-  get securityGroupPorts() {
-    return this.ports.flatMap(port => {
-      if (this.protocol === 'both') return [{ port, protocol: 'tcp' }, { port, protocol: 'udp' }]
-      return [{ port, protocol: this.protocol }]
-    })
-  }
-
-  get unitName() { return `${this.name}.service` }
-  install() { return [`sudo tee /etc/systemd/system/${this.unitName} > /dev/null << 'EOF'\n${this.systemdUnitFile}\nEOF`] }
-  enable()  { return [`sudo systemctl enable ${this.name}`] }
-  start()   { return [`sudo systemctl start ${this.name}`] }
-}
-
-// ---------------------------------------------------------------------------
-// Factory
-// ---------------------------------------------------------------------------
-
-/**
- * Build service instances from the `services` array in platforms.json.
- * HTTP services auto-assign host ports starting at 3002 (counted separately
- * from TCP services so reordering TCP entries doesn't shift HTTP ports).
- *
- * @param {ContainerServiceConfig[]} services
- * @returns {(HttpContainerService|TcpContainerService)[]}
- */
-const fromConfig = (services = []) => {
-  let httpIndex = 0
-  return services.map(s => {
-    if (s.type === 'tcp') return new TcpContainerService(s)
-    return new HttpContainerService(s, httpIndex++)
-  })
-}
-
-module.exports = {
-  HttpContainerService,
-  TcpContainerService,
-  fromConfig
-}

package/src/infrastructure/container-deployment-target/index.js

@@ -1,3 +0,0 @@
-const { ContainerDeploymentTarget } = require('./container-deployment-target')
-
-module.exports = { ContainerDeploymentTarget }

package/src/infrastructure/container-deployment-target/ossy-api.service.js

@@ -1,54 +0,0 @@
-const systemdServiceFile = `
-[Unit]
-Description=Ossy API
-After=network.target docker.service
-Requires=docker.service
-
-[Service]
-EnvironmentFile=/etc/environment
-ExecStartPre=-/usr/bin/docker rm -f ossy-api
-ExecStartPre=/usr/bin/docker pull ghcr.io/ossy-se/api:latest
-ExecStart=/usr/bin/docker run --name ossy-api \\
-  --network ossy-network \\
-  -p 3001:3000 \\
-  -e DB_URL=\${DB_URL} \\
-  -e DB_NAME=\${DB_NAME} \\
-  -e TOKEN_SECRET=\${TOKEN_SECRET} \\
-  -e MEDIA_REPOSITORY=\${MEDIA_REPOSITORY} \\
-  -e MEDIA_CDN_DOMAIN_NAME=\${MEDIA_CDN_DOMAIN_NAME} \\
-  -e AWS_ACCESS_KEY_ID=\${AWS_ACCESS_KEY_ID} \\
-  -e AWS_SECRET_ACCESS_KEY=\${AWS_SECRET_ACCESS_KEY} \\
-  ghcr.io/ossy-se/api:latest
-ExecStop=/usr/bin/docker stop ossy-api
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-`
-
-// The image is pulled automatically on every start via ExecStartPre, so the
-// service always runs the latest published version. To redeploy: systemctl restart ossy-api
-
-/**
-  * @class
-*/
-class OssyApiService {
-
-  static install() {
-    return [`sudo tee /etc/systemd/system/ossy-api.service > /dev/null << 'EOF'\n${systemdServiceFile}\nEOF`]
-  }
-
-  static enable() {
-    return ['sudo systemctl enable ossy-api']
-  }
-
-  static start() {
-    return ['sudo systemctl start ossy-api']
-  }
-
-}
-
-module.exports = {
-  OssyApiService
-}

package/src/infrastructure/container-deployment-target/ossy-runtime.service.js

@@ -1,49 +0,0 @@
-const systemdServiceFile = `
-[Unit]
-Description=Ossy Runtime
-After=network.target docker.service
-Requires=docker.service
-
-[Service]
-EnvironmentFile=/etc/environment
-ExecStartPre=-/usr/bin/docker rm -f ossy-runtime
-ExecStartPre=/usr/bin/docker pull ghcr.io/ossy-se/platform:latest
-ExecStart=/usr/bin/docker run --name ossy-runtime \\
-  --network ossy-network \\
-  -p 3000:3000 \\
-  -e OSSY_API_KEY=\${OSSY_API_KEY} \\
-  -e OSSY_API_URL=http://ossy-api:3001/api/v0 \\
-  ghcr.io/ossy-se/platform:latest
-ExecStop=/usr/bin/docker stop ossy-runtime
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-`
-
-// The image is pulled automatically on every start via ExecStartPre, so the
-// service always runs the latest published version. To redeploy: systemctl restart ossy-runtime
-
-/**
-  * @class
-*/
-class OssyRuntimeService {
-
-  static install() {
-    return [`sudo tee /etc/systemd/system/ossy-runtime.service > /dev/null << 'EOF'\n${systemdServiceFile}\nEOF`]
-  }
-
-  static enable() {
-    return ['sudo systemctl enable ossy-runtime']
-  }
-
-  static start() {
-    return ['sudo systemctl start ossy-runtime']
-  }
-
-}
-
-module.exports = {
-  OssyRuntimeService
-}

package/src/infrastructure/container-deployment-target/user-data-commands.js

@@ -1,31 +0,0 @@
-const getInstallDocker = () => [
-  'apt-get remove docker docker-engine docker.io containerd runc',
-  `apt-get install \
-    apt-transport-https \
-    ca-certificates \
-    curl \
-    gnupg-agent \
-    software-properties-common -y`,
-  'curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -',
-  `sudo add-apt-repository \
-     "deb [arch=amd64] https://download.docker.com/linux/ubuntu \
-     $(lsb_release -cs) \
-     stable"`,
-  'sudo apt-get update',
-  'sudo apt-get install docker-ce docker-ce-cli containerd.io -y'
-]
-
-const getInstallNodeJs = () => [
-  'curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -',
-  'sudo apt-get -y install nodejs'
-]
-
-const getInstallNpm = () => [
-  'sudo apt install npm'
-]
-
-module.exports = {
-  getInstallDocker,
-  getInstallNodeJs,
-  getInstallNpm
-}

package/src/infrastructure/deployment-target-stack.js

@@ -1,53 +0,0 @@
-/* eslint-disable no-new */
-const { CfnOutput, Stack } = require('aws-cdk-lib')
-const { ContainerDeploymentTarget } = require('./container-deployment-target')
-
-/**
- * DeploymentTargetStackProps
- * @typedef {Object} DeploymentTargetStackProps
- * @property {PlatformConfig} config - platform config
- * @property {import('aws-cdk-lib/aws-s3').IBucket} bucket - static assets bucket (from StorageStaticStack)
- * @property {string} cdnDomainName - CloudFront domain name (from StorageStaticStack)
- */
-
-/**
- * DeploymentTargetStack provisions the EC2 instance (with Elastic IP) that runs the
- * platform services. The S3 bucket lives in StorageStaticStack so that EC2 replacements
- * never trigger CloudFormation cross-stack export conflicts on storage resources.
- *
- * MEDIA_REPOSITORY and MEDIA_CDN_DOMAIN_NAME are derived from the actual bucket and CDN
- * resources rather than being hardcoded in platforms.json.
- */
-class DeploymentTargetStack extends Stack {
-  constructor(scope, id, props) {
-    super(scope, id, props)
-
-    if (!props?.config) {
-      throw ('[DeploymentTargetStack] No config provided')
-    }
-
-    const containerDeploymentTarget = new ContainerDeploymentTarget(this, 'ContainerDeploymentTarget', {
-      config: {
-        ...props.config,
-        env: {
-          ...props.config.env,
-          MEDIA_REPOSITORY: props.bucket.bucketName,
-          MEDIA_CDN_DOMAIN_NAME: `https://${props.cdnDomainName}`
-        }
-      },
-      bucket: props.bucket
-    })
-
-    this.containerDeploymentTargetPublicIp = containerDeploymentTarget.instancePublicIp
-
-    new CfnOutput(this, 'ContainerDeploymentTargetPublicIp', {
-      value: containerDeploymentTarget.instancePublicIp,
-      description: 'Public IP of the EC2 instance (Elastic IP)',
-      exportName: `${props.config.platformName}-ContainerDeploymentTargetPublicIp`
-    })
-  }
-}
-
-module.exports = {
-  DeploymentTargetStack
-}