@stacksjs/cloud 0.58.48 → 0.58.50

package/src/cloud/dashboard.ts

@@ -0,0 +1,85 @@
+/* eslint-disable no-new */
+// TODO: finish this cloudwatch dashboard
+// import type { aws_lambda as lambda } from 'aws-cdk-lib'
+import { Aws, CfnOutput as Output, aws_cloudwatch as cloudwatch } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface DashboardStackProps extends NestedCloudProps {
+  dashboardName?: string
+}
+
+export class DashboardStack {
+  // lambdaFunction: lambda.Function
+  dashboard: cloudwatch.Dashboard
+
+  constructor(scope: Construct, props: DashboardStackProps) {
+    const dashboardName = props.dashboardName || 'StacksDashboard'
+
+    // Create Sample Lambda Function which will create metrics
+    // this.lambdaFunction = new Function(this, 'SampleLambda', {
+    //   handler: 'lambda-handler.handler',
+    //   runtime: Runtime.PYTHON_3_7,
+    //   code: new AssetCode(`./lambda`),
+    //   memorySize: 512,
+    //   timeout: Duration.seconds(10),
+    // })
+
+    // Create CloudWatch Dashboard
+    this.dashboard = new cloudwatch.Dashboard(scope, 'SampleLambdaDashboard', {
+      dashboardName,
+    })
+
+    // Create Title for Dashboard
+    this.dashboard.addWidgets(new cloudwatch.TextWidget({
+      markdown: `# Dashboard: ${this.lambdaFunction.functionName}`,
+      height: 1,
+      width: 24,
+    }))
+
+    // Create CloudWatch Dashboard Widgets: Errors, Invocations, Duration, Throttles
+    this.dashboard.addWidgets(new cloudwatch.GraphWidget({
+      title: 'Invocations',
+      left: [this.lambdaFunction.metricInvocations()],
+      width: 24,
+    }))
+
+    this.dashboard.addWidgets(new cloudwatch.GraphWidget({
+      title: 'Errors',
+      left: [this.lambdaFunction.metricErrors()],
+      width: 24,
+    }))
+
+    this.dashboard.addWidgets(new cloudwatch.GraphWidget({
+      title: 'Duration',
+      left: [this.lambdaFunction.metricDuration()],
+      width: 24,
+    }))
+
+    this.dashboard.addWidgets(new cloudwatch.GraphWidget({
+      title: 'Throttles',
+      left: [this.lambdaFunction.metricThrottles()],
+      width: 24,
+    }))
+
+    // Create Widget to show last 20 Log Entries
+    this.dashboard.addWidgets(new cloudwatch.LogQueryWidget({
+      logGroupNames: [this.lambdaFunction.logGroup.logGroupName],
+      queryLines: [
+        'fields @timestamp, @message',
+        'sort @timestamp desc',
+        'limit 20',
+      ],
+      width: 24,
+    }))
+
+    // Generate Output
+    const cloudwatchDashboardURL = `https://${Aws.REGION}.console.aws.amazon.com/cloudwatch/home?region=${Aws.REGION}#dashboards:name=${dashboardName}`
+
+    new Output(scope, 'DashboardOutput', {
+      value: cloudwatchDashboardURL,
+      description: 'The CloudWatch Dashboard URL',
+      exportName: 'StacksDashboardURL',
+    })
+  }
+}

package/src/cloud/deployment.ts

@@ -0,0 +1,41 @@
+/* eslint-disable no-new */
+import type { aws_cloudfront as cloudfront, aws_s3 as s3 } from 'aws-cdk-lib'
+import { AssetHashType, aws_s3_deployment as s3deploy } from 'aws-cdk-lib'
+import { config } from '@stacksjs/config'
+import { websiteSourceHash } from '@stacksjs/utils'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface DeploymentStackProps extends NestedCloudProps {
+  publicBucket: s3.Bucket
+  privateBucket: s3.Bucket
+  cdn: cloudfront.Distribution
+}
+
+export class DeploymentStack {
+  privateSource: string
+  docsSource: string
+  websiteSource: string
+
+  constructor(scope: Construct, props: DeploymentStackProps) {
+    // following paths are relative to where the command is run from
+    this.privateSource = '../../../private'
+    this.docsSource = '../../docs/dist/'
+    this.websiteSource = config.app.docMode === true ? this.docsSource : '../../views/dist/'
+
+    new s3deploy.BucketDeployment(scope, 'Website', {
+      sources: [s3deploy.Source.asset(this.websiteSource, {
+        assetHash: websiteSourceHash,
+        assetHashType: AssetHashType.CUSTOM,
+      })],
+      destinationBucket: props.publicBucket,
+      distribution: props.cdn,
+      distributionPaths: ['/*'],
+    })
+
+    new s3deploy.BucketDeployment(scope, 'PrivateFiles', {
+      sources: [s3deploy.Source.asset(this.privateSource)],
+      destinationBucket: props.privateBucket,
+    })
+  }
+}

package/src/cloud/dns.ts

@@ -0,0 +1,34 @@
+/* eslint-disable no-new */
+import { RemovalPolicy, aws_route53 as route53, aws_s3 as s3, aws_route53_targets as targets } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export class DnsStack {
+  zone: route53.IHostedZone
+
+  constructor(scope: Construct, props: NestedCloudProps) {
+    // lets see if the zone already exists because Buddy should have created it already
+    this.zone = route53.PublicHostedZone.fromLookup(scope, 'AppUrlHostedZone', {
+      domainName: props.domain,
+    })
+
+    // setup the www redirect
+    // Create a bucket for www.yourdomain.com and configure it to redirect to yourdomain.com
+    const wwwBucket = new s3.Bucket(scope, 'WwwBucket', {
+      bucketName: `www.${props.domain}`,
+      websiteRedirect: {
+        hostName: props.domain,
+        protocol: s3.RedirectProtocol.HTTPS,
+      },
+      removalPolicy: RemovalPolicy.DESTROY,
+      autoDeleteObjects: true,
+    })
+
+    // Create a Route53 record for www.yourdomain.com
+    new route53.ARecord(scope, 'WwwAliasRecord', {
+      recordName: `www.${props.domain}`,
+      zone: this.zone,
+      target: route53.RecordTarget.fromAlias(new targets.BucketWebsiteTarget(wwwBucket)),
+    })
+  }
+}

package/src/cloud/docs.ts

@@ -0,0 +1,51 @@
+/* eslint-disable no-new */
+import type { CfnResource } from 'aws-cdk-lib'
+import { AssetHashType, CfnOutput as Output, RemovalPolicy, aws_lambda as lambda } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import { config } from '@stacksjs/config'
+import { path as p } from '@stacksjs/path'
+import { storage } from '@stacksjs/storage'
+import { originRequestFunctionHash } from '@stacksjs/utils'
+import type { NestedCloudProps } from '../types'
+
+export interface DocsStackProps extends NestedCloudProps {
+  //
+}
+
+export class DocsStack {
+  originRequestFunction: lambda.Function
+
+  constructor(scope: Construct, props: DocsStackProps) {
+    // if docsPrefix is not set, then we know we are in docsMode and the documentation lives at the root of the domain
+    const docsPrefix = config.app.docMode ? '' : config.docs.base
+
+    // this edge function ensures pretty docs urls
+    // soon to be reused for our Meema features
+    this.originRequestFunction = new lambda.Function(scope, 'OriginRequestFunction', {
+      // this needs to have timestamp to ensure uniqueness. Since Origin Request (Lambda@Edge) functions are replicated functions, the
+      // deletion process takes a "long time". This way, the function is always unique in cases of quick recreations.
+      functionName: `${props.slug}-${props.appEnv}-origin-request-${props.timestamp}`,
+      description: 'The Stacks Origin Request function that prettifies URLs',
+      runtime: lambda.Runtime.NODEJS_18_X,
+      handler: 'dist/origin-request.handler',
+      code: lambda.Code.fromAsset(p.corePath('cloud/dist.zip'), {
+        assetHash: originRequestFunctionHash,
+        assetHashType: AssetHashType.CUSTOM,
+      }),
+    })
+
+    // applying this is a workaround for failing deployments due to the following DELETE_FAILED error:
+    // > Resource handler returned message: "Lambda was unable to delete arn:aws:lambda:us-east-1:92330274019:function:stacks-cloud-production-OriginRequestFunction4FA39-XQadJcSWY8Lz:1 because it is a replicated function. Please see our documentation for Deleting Lambda@Edge Functions and Replicas. (Service: Lambda, Status Code: 400, Request ID: 83bd3112-aaa4-4980-bfcf-3ee2052a0435)" (RequestToken: c91aed31-1a62-9425-c25d-4fc0fccfa45f, HandlerErrorCode: InvalidRequest)
+    // if we do not delete this resource, then it circumvents trying to delete the function and the deployment succeeds
+    // buddy cloud:cleanup is what will be suggested running after user ensured no more sensitive data is in the buckets
+    const cfnOriginRequestFunction = this.originRequestFunction.node.defaultChild as CfnResource
+    cfnOriginRequestFunction.applyRemovalPolicy(RemovalPolicy.RETAIN)
+
+    if (!config.app.docMode && storage.hasFiles(p.projectPath('docs'))) {
+      new Output(scope, 'DocsUrl', {
+        value: `https://${props.domain}/${docsPrefix}`,
+        description: 'The URL of the deployed documentation',
+      })
+    }
+  }
+}

package/src/cloud/email.ts

@@ -0,0 +1,339 @@
+/* eslint-disable no-new */
+import { Duration, RemovalPolicy, Stack, Tags, aws_iam as iam, aws_lambda as lambda, aws_route53 as route53, aws_s3 as s3, aws_s3_notifications as s3n, aws_ses as ses } from 'aws-cdk-lib'
+import { config } from '@stacksjs/config'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface EmailStackProps extends NestedCloudProps {
+  zone: route53.IHostedZone
+}
+
+export class EmailStack {
+  emailBucket: s3.Bucket
+
+  constructor(scope: Construct, props: EmailStackProps) {
+    const bucketPrefix = `${props.slug}-${props.appEnv}`
+    this.emailBucket = new s3.Bucket(scope, 'EmailBucket', {
+      bucketName: `${bucketPrefix}-email-${props.timestamp}`,
+      versioned: true,
+      removalPolicy: RemovalPolicy.DESTROY,
+      autoDeleteObjects: true,
+      // encryptionKey: this.encryptionKey,
+      encryption: s3.BucketEncryption.S3_MANAGED,
+      lifecycleRules: [
+        {
+          id: '24h',
+          enabled: true,
+          expiration: Duration.days(1),
+          noncurrentVersionExpiration: Duration.days(1),
+          prefix: 'today/',
+        },
+        {
+          id: 'Intelligent transition for Inbox',
+          enabled: true,
+          prefix: 'inbox/',
+          transitions: [
+            {
+              storageClass: s3.StorageClass.INTELLIGENT_TIERING,
+              transitionAfter: Duration.days(0),
+            },
+          ],
+        },
+        {
+          id: 'Intelligent transition for Sent',
+          enabled: true,
+          prefix: 'sent/',
+          transitions: [
+            {
+              storageClass: s3.StorageClass.INTELLIGENT_TIERING,
+              transitionAfter: Duration.days(0),
+            },
+          ],
+        },
+      ],
+    })
+
+    Tags.of(this.emailBucket).add('daily-backup', 'true')
+
+    const sesPrincipal = new iam.ServicePrincipal('ses.amazonaws.com')
+    const ruleSetName = `${props.slug}-${props.appEnv}-email-receipt-rule-set`
+    const receiptRuleName = `${props.slug}-${props.appEnv}-email-receipt-rule`
+
+    const ruleSet = new ses.CfnReceiptRuleSet(scope, 'SESReceiptRuleSet', {
+      ruleSetName,
+    })
+
+    this.emailBucket.addToResourcePolicy(
+      new iam.PolicyStatement({
+        sid: 'AllowSESPuts',
+        effect: iam.Effect.ALLOW,
+        principals: [sesPrincipal],
+        actions: [
+          's3:PutObject',
+        ],
+        resources: [
+            `${this.emailBucket.bucketArn}/*`,
+        ],
+        conditions: {
+          StringEquals: {
+            'aws:SourceAccount': Stack.of(scope).account,
+          },
+          ArnLike: {
+            'aws:SourceArn': `arn:aws:ses:${Stack.of(scope).region}:${Stack.of(scope).account}:receipt-rule-set/${ruleSetName}:receipt-rule/${receiptRuleName}`,
+          },
+        },
+      }),
+    )
+
+    const receiptRule = new ses.CfnReceiptRule(scope, 'SESReceiptRule', {
+      ruleSetName: ruleSet.ref,
+      rule: {
+        name: receiptRuleName,
+        enabled: true,
+        actions: [
+          {
+            s3Action: {
+              bucketName: this.emailBucket.bucketName,
+              objectKeyPrefix: 'tmp/email_in/',
+            },
+          },
+        ],
+        recipients: config.email.mailboxes || [],
+        scanEnabled: config.email.server?.scan || true,
+        tlsPolicy: 'Require',
+      },
+    })
+
+    // this line is important to make sure the bucket is created before the receipt rule
+    // do not remove it, unless you want a hell of a time debugging randomness
+    receiptRule.node.addDependency(this.emailBucket)
+
+    const iamGroup = new iam.Group(scope, 'IAMGroup', {
+      groupName: `${props.slug}-${props.appEnv}-email-management-s3-group`,
+    })
+
+    const listBucketsPolicyStatement = new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      actions: ['s3:ListAllMyBuckets'],
+      resources: ['*'],
+    })
+
+    const policyStatement = new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      actions: [
+        's3:ListBucket',
+        's3:GetObject',
+        's3:PutObject',
+        's3:DeleteObject',
+        's3:GetObjectAcl',
+        's3:GetObjectVersionAcl',
+        's3:PutObjectAcl',
+        's3:PutObjectVersionAcl',
+      ],
+      resources: [
+        this.emailBucket.bucketArn,
+          `${this.emailBucket.bucketArn}/*`,
+      ],
+    })
+
+    const policy = new iam.Policy(scope, 'EmailAccessPolicy', {
+      policyName: `${props.slug}-${props.appEnv}-email-management-s3-policy`,
+      statements: [policyStatement, listBucketsPolicyStatement],
+    })
+
+    iamGroup.attachInlinePolicy(policy)
+
+    // Create a SES domain identity
+    const sesIdentity = new ses.CfnEmailIdentity(scope, 'DomainIdentity', {
+      emailIdentity: props.domain,
+
+      dkimSigningAttributes: {
+        nextSigningKeyLength: 'RSA_2048_BIT',
+      },
+
+      dkimAttributes: {
+        signingEnabled: true,
+      },
+
+      mailFromAttributes: {
+        behaviorOnMxFailure: 'USE_DEFAULT_VALUE',
+        mailFromDomain: `mail.${props.domain}`,
+      },
+
+      feedbackAttributes: {
+        emailForwardingEnabled: true,
+      },
+    })
+
+    // Create a Route53 records for the SES domain identity
+    // https://github.com/aws/aws-cdk/issues/21306
+    new route53.CfnRecordSet(scope, 'DkimRecord1', {
+      hostedZoneName: `${props.zone.zoneName}.`,
+      name: sesIdentity.attrDkimDnsTokenName1,
+      type: 'CNAME',
+      resourceRecords: [sesIdentity.attrDkimDnsTokenValue1],
+      ttl: '1800',
+    })
+
+    new route53.CfnRecordSet(scope, 'DkimRecord2', {
+      hostedZoneName: `${props.zone.zoneName}.`,
+      name: sesIdentity.attrDkimDnsTokenName2,
+      type: 'CNAME',
+      resourceRecords: [sesIdentity.attrDkimDnsTokenValue2],
+      ttl: '1800',
+    })
+
+    new route53.CfnRecordSet(scope, 'DkimRecord3', {
+      hostedZoneName: `${props.zone.zoneName}.`,
+      name: sesIdentity.attrDkimDnsTokenName3,
+      type: 'CNAME',
+      resourceRecords: [sesIdentity.attrDkimDnsTokenValue3],
+      ttl: '1800',
+    })
+
+    new route53.MxRecord(scope, 'MxRecord', {
+      zone: props.zone,
+      recordName: 'mail',
+      values: [{
+        priority: 10,
+        hostName: 'feedback-smtp.us-east-1.amazonses.com',
+      }],
+    })
+
+    new route53.TxtRecord(scope, 'TxtSpfRecord', {
+      zone: props.zone,
+      recordName: 'mail',
+      values: ['v=spf1 include:amazonses.com ~all'],
+    })
+
+    new route53.TxtRecord(scope, 'TxtDmarcRecord', {
+      zone: props.zone,
+      recordName: '_dmarc',
+      values: [`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${props.domain}`],
+    })
+
+    const lambdaEmailOutboundRole = new iam.Role(scope, 'LambdaEmailOutboundRole', {
+      roleName: `${props.slug}-${props.appEnv}-email-outbound`,
+      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+      managedPolicies: [
+        iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
+      ],
+    })
+
+    const lambdaEmailOutbound = new lambda.Function(scope, 'LambdaEmailOutbound', {
+      functionName: `${props.slug}-${props.appEnv}-email-outbound`,
+      description: 'Take the JSON and convert it in to an raw email.',
+      code: lambda.Code.fromInline('exports.handler = async (event) => {return true;};'), // this needs to be updated with the real lambda code
+      handler: 'index.handler',
+      memorySize: 256,
+      runtime: lambda.Runtime.NODEJS_18_X,
+      timeout: Duration.seconds(60),
+      environment: {
+        BUCKET: this.emailBucket.bucketName,
+      },
+      role: lambdaEmailOutboundRole,
+    })
+
+    lambdaEmailOutboundRole.addToPolicy(policyStatement)
+
+    const sesPolicyStatement = new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      actions: ['ses:SendRawEmail'],
+      resources: ['*'],
+    })
+
+    lambdaEmailOutboundRole.addToPolicy(sesPolicyStatement)
+
+    const lambdaEmailInboundRole = new iam.Role(scope, 'LambdaEmailInboundRole', {
+      roleName: `${props.slug}-${props.appEnv}-email-inbound`,
+      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+      managedPolicies: [
+        iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
+      ],
+    })
+
+    const lambdaEmailInbound = new lambda.Function(scope, 'LambdaEmailInbound', {
+      functionName: `${props.slug}-${props.appEnv}-email-inbound`,
+      description: 'This Lambda organizes all the incoming emails based on the From and To field.',
+      code: lambda.Code.fromInline('exports.handler = async (event) => {return true;};'), // this needs to be updated with the real lambda code
+      handler: 'index.handler',
+      memorySize: 256,
+      role: lambdaEmailInboundRole,
+      runtime: lambda.Runtime.NODEJS_18_X,
+      timeout: Duration.seconds(60),
+      environment: {
+        BUCKET: this.emailBucket.bucketName,
+      },
+    })
+
+    new lambda.CfnPermission(scope, 'S3InboundPermission', {
+      action: 'lambda:InvokeFunction',
+      functionName: lambdaEmailInbound.functionName,
+      principal: 's3.amazonaws.com',
+    })
+
+    const inboundS3PolicyStatement = new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      actions: ['s3:*'],
+      resources: [
+        this.emailBucket.bucketArn,
+          `${this.emailBucket.bucketArn}/*`,
+      ],
+    })
+
+    lambdaEmailInboundRole.addToPolicy(inboundS3PolicyStatement)
+
+    const sesInboundPolicyStatement = new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      actions: ['ses:ListIdentities'],
+      resources: ['*'],
+    })
+
+    lambdaEmailInboundRole.addToPolicy(sesInboundPolicyStatement)
+
+    const lambdaEmailConverterRole = new iam.Role(scope, 'LambdaEmailConverterRole', {
+      roleName: `${props.slug}-${props.appEnv}-email-converter`,
+      assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+      managedPolicies: [
+        iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
+      ],
+    })
+
+    const lambdaEmailConverter = new lambda.Function(scope, 'LambdaEmailConverter', {
+      functionName: `${props.slug}-${props.appEnv}-email-converter`,
+      description: 'This Lambda converts raw emails files in to HTML and text.',
+      code: lambda.Code.fromInline('exports.handler = async (event) => {console.log("hello world email converter");return true;};'), // this needs to be updated with the real lambda code
+      handler: 'index.handler',
+      memorySize: 256,
+      role: lambdaEmailConverterRole,
+      runtime: lambda.Runtime.NODEJS_18_X,
+      timeout: Duration.seconds(60),
+      environment: {
+        BUCKET: this.emailBucket.bucketName,
+      },
+    })
+
+    const converterS3PolicyStatement = new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      actions: ['s3:*'],
+      resources: [
+        this.emailBucket.bucketArn,
+          `${this.emailBucket.bucketArn}/*`,
+      ],
+    })
+
+    new lambda.CfnPermission(scope, 'S3ConverterPermission', {
+      action: 'lambda:InvokeFunction',
+      functionName: lambdaEmailConverter.functionName,
+      principal: 's3.amazonaws.com',
+    })
+
+    lambdaEmailConverterRole.addToPolicy(converterS3PolicyStatement)
+
+    this.emailBucket.addEventNotification(s3.EventType.OBJECT_CREATED_PUT, new s3n.LambdaDestination(lambdaEmailInbound), { prefix: 'tmp/email_in/' })
+    this.emailBucket.addEventNotification(s3.EventType.OBJECT_CREATED_PUT, new s3n.LambdaDestination(lambdaEmailOutbound), { prefix: 'tmp/email_out/json/' })
+    this.emailBucket.addEventNotification(s3.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: 'sent/' })
+    this.emailBucket.addEventNotification(s3.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: 'inbox/' })
+    this.emailBucket.addEventNotification(s3.EventType.OBJECT_CREATED_COPY, new s3n.LambdaDestination(lambdaEmailConverter), { prefix: 'today/' })
+  }
+}

package/src/cloud/file-system.ts

@@ -0,0 +1,35 @@
+import type { aws_ec2 as ec2 } from 'aws-cdk-lib'
+import { RemovalPolicy, aws_efs as efs } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface FileSystemStackProps extends NestedCloudProps {
+  vpc: ec2.Vpc
+}
+
+export class FileSystemStack {
+  fileSystem: efs.FileSystem
+  accessPoint: efs.AccessPoint
+
+  constructor(scope: Construct, props: FileSystemStackProps) {
+    this.fileSystem = new efs.FileSystem(scope, 'FileSystem', {
+      fileSystemName: `${props.slug}-${props.appEnv}-efs`,
+      vpc: props.vpc,
+      removalPolicy: RemovalPolicy.DESTROY,
+      lifecyclePolicy: efs.LifecyclePolicy.AFTER_7_DAYS,
+      performanceMode: efs.PerformanceMode.GENERAL_PURPOSE,
+      throughputMode: efs.ThroughputMode.BURSTING,
+      enableAutomaticBackups: true, // TODO: ensure this is documented
+      encrypted: true,
+    })
+
+    this.accessPoint = new efs.AccessPoint(scope, 'FileSystemAccessPoint', {
+      fileSystem: this.fileSystem,
+      path: '/',
+      posixUser: {
+        uid: '1000',
+        gid: '1000',
+      },
+    })
+  }
+}

package/src/cloud/index.ts

@@ -0,0 +1,103 @@
+/* eslint-disable no-new */
+import { Stack } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import { config } from '@stacksjs/config'
+import type { CloudOptions } from '../types'
+import { AiStack } from './ai'
+import { CdnStack } from './cdn'
+import { CliStack } from './cli'
+import { DnsStack } from './dns'
+import { DocsStack } from './docs'
+import { StorageStack } from './storage'
+import { SecurityStack } from './security'
+import { DeploymentStack } from './deployment'
+import { JumpBoxStack } from './jump-box'
+import { FileSystemStack } from './file-system'
+import { NetworkStack } from './network'
+import { RedirectsStack } from './redirects'
+import { EmailStack } from './email'
+import { PermissionsStack } from './permissions'
+import { ComputeStack } from './compute'
+
+// import { DashboardStack } from './dashboard'
+
+export class Cloud extends Stack {
+  constructor(scope: Construct, id: string, props: CloudOptions) {
+    super(scope, id, props)
+    // please beware: be careful changing the order of the stack creations below
+    const dns = new DnsStack(this, props)
+
+    const security = new SecurityStack(this, {
+      ...props,
+      zone: dns.zone,
+    })
+
+    const storage = new StorageStack(this, {
+      ...props,
+      kmsKey: security.kmsKey,
+    })
+
+    const network = new NetworkStack(this, props)
+
+    const fileSystem = new FileSystemStack(this, {
+      ...props,
+      vpc: network.vpc,
+    })
+
+    new JumpBoxStack(this, {
+      ...props,
+      vpc: network.vpc,
+      fileSystem: fileSystem.fileSystem,
+    })
+
+    const docs = new DocsStack(this, props)
+
+    new EmailStack(this, {
+      ...props,
+      zone: dns.zone,
+    })
+
+    new RedirectsStack(this, props)
+
+    new PermissionsStack(this)
+
+    // new DashboardStack(this)
+
+    let api
+    if (config.cloud.api?.deploy) {
+      api = new ComputeStack(this, {
+        ...props,
+        vpc: network.vpc,
+        fileSystem: fileSystem.fileSystem,
+        zone: dns.zone,
+        certificate: security.certificate,
+      })
+    }
+
+    const ai = new AiStack(this, props)
+
+    const cli = new CliStack(this, props)
+
+    const cdn = new CdnStack(this, {
+      ...props,
+      publicBucket: storage.publicBucket,
+      logBucket: storage.logBucket,
+      certificate: security.certificate,
+      firewall: security.firewall,
+      originRequestFunction: docs.originRequestFunction,
+      zone: dns.zone,
+      cliSetupUrl: cli.cliSetupUrl,
+      askAiUrl: ai.askAiUrl,
+      summarizeAiUrl: ai.summarizeAiUrl,
+      webServer: api?.apiServer,
+      webServerUrl: api?.apiServerUrl,
+    })
+
+    new DeploymentStack(this, {
+      ...props,
+      publicBucket: storage.publicBucket,
+      privateBucket: storage.privateBucket,
+      cdn: cdn.distribution,
+    })
+  }
+}