dcl-ops-lib 5.21.2 → 5.23.1

package/acceptAlb.d.ts

@@ -4,5 +4,5 @@ export declare const acceptAlbSecurityGroup: () => Promise<awsx.ec2.SecurityGrou
 /** @deprecated use makeSecurityGroupAccessibleFromSharedAlb instead */
 export declare function acceptAlbSecurityGroupId(): Promise<import("@pulumi/pulumi").Output<string>>;
 /** Makes a given securityGropup accesible by the shared supra ALB */
-export declare function makeSecurityGroupAccessibleFromSharedAlb(securityGroup: awsx.ec2.SecurityGroup): void;
+export declare function makeSecurityGroupAccessibleFromSharedAlb(securityGroup: awsx.ec2.SecurityGroup, ruleName?: string): void;
 export default acceptAlbSecurityGroup;

package/acceptAlb.js

@@ -11,6 +11,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeSecurityGroupAccessibleFromSharedAlb = exports.acceptAlbSecurityGroupId = exports.acceptAlbSecurityGroup = void 0;
 const awsx = require("@pulumi/awsx");
+const utils_1 = require("./utils");
 const values_1 = require("./values");
 const withCache_1 = require("./withCache");
 /** @deprecated use makeSecurityGroupAccessibleFromSharedAlb instead */
@@ -26,8 +27,8 @@ function acceptAlbSecurityGroupId() {
 }
 exports.acceptAlbSecurityGroupId = acceptAlbSecurityGroupId;
 /** Makes a given securityGropup accesible by the shared supra ALB */
-function makeSecurityGroupAccessibleFromSharedAlb(securityGroup) {
-    new awsx.ec2.IngressSecurityGroupRule("accept-alb-ingress-rule", securityGroup, {
+function makeSecurityGroupAccessibleFromSharedAlb(securityGroup, ruleName = "") {
+    new awsx.ec2.IngressSecurityGroupRule((0, utils_1.withRuleName)("accept-alb-ingress-rule", ruleName), securityGroup, {
         sourceSecurityGroupId: (0, values_1.getEnvConfiguration)().then(($) => $.albSecurityGroupId),
         description: `Allow access from the supra ALB`,
         fromPort: 0,

package/acceptBastion.d.ts

@@ -3,5 +3,5 @@ import * as awsx from "@pulumi/awsx";
 export declare const acceptBastionSecurityGroup: () => Promise<awsx.ec2.SecurityGroup>;
 /** @deprecated please use makeSecurityGroupAccessTheInternet */
 export declare function acceptBastionSecurityGroupId(): Promise<import("@pulumi/pulumi").Output<string>>;
-export declare function makeSecurityGroupAccessibleFromBastion(securityGroup: awsx.ec2.SecurityGroup): void;
+export declare function makeSecurityGroupAccessibleFromBastion(securityGroup: awsx.ec2.SecurityGroup, ruleName?: string): void;
 export default acceptBastionSecurityGroup;

package/acceptBastion.js

@@ -14,6 +14,7 @@ const awsx = require("@pulumi/awsx");
 const aws = require("@pulumi/aws");
 const values_1 = require("./values");
 const withCache_1 = require("./withCache");
+const utils_1 = require("./utils");
 /** @deprecated please use makeSecurityGroupAccessTheInternet */
 exports.acceptBastionSecurityGroup = (0, withCache_1.default)(() => __awaiter(void 0, void 0, void 0, function* () {
     const config = yield (0, values_1.getEnvConfiguration)();
@@ -30,15 +31,15 @@ const bastionSecurityGroupId = (0, withCache_1.default)(() => __awaiter(void 0,
     const config = yield (0, values_1.getEnvConfiguration)();
     return config.bastionSecurityGroupId;
 }));
-function makeSecurityGroupAccessibleFromBastion(securityGroup) {
-    new aws.ec2.SecurityGroupRule("accesible-from-bastion", {
+function makeSecurityGroupAccessibleFromBastion(securityGroup, ruleName = "") {
+    new aws.ec2.SecurityGroupRule((0, utils_1.withRuleName)("accesible-from-bastion", ruleName), {
         securityGroupId: securityGroup.id,
         sourceSecurityGroupId: bastionSecurityGroupId(),
         fromPort: -1,
         toPort: -1,
         type: "ingress",
         protocol: "-1",
-    });
+    }, { deleteBeforeReplace: true });
 }
 exports.makeSecurityGroupAccessibleFromBastion = makeSecurityGroupAccessibleFromBastion;
 exports.default = exports.acceptBastionSecurityGroup;

package/accessTheInternet.d.ts

@@ -9,6 +9,6 @@ export default accessTheInternetSecurityGroup;
 /** @deprecated please use makeSecurityGroupAccessibleByCloudflare */
 export declare function accessFromCloudflareSecurityGroup(): Promise<import("@pulumi/pulumi").Output<string>>;
 /** Enables egress traffic to 0.0.0.0/0/all */
-export declare function makeSecurityGroupAccessTheInternet(securityGroup: awsx.ec2.SecurityGroup): void;
+export declare function makeSecurityGroupAccessTheInternet(securityGroup: awsx.ec2.SecurityGroup, ruleName?: string): void;
 /** Enables ingress traffic from cloudflare CIDRs */
 export declare function makeSecurityGroupAccessibleByCloudflare(securityGroup: awsx.ec2.SecurityGroup): Promise<void>;

package/accessTheInternet.js

@@ -42,8 +42,8 @@ function accessFromCloudflareSecurityGroup() {
 }
 exports.accessFromCloudflareSecurityGroup = accessFromCloudflareSecurityGroup;
 /** Enables egress traffic to 0.0.0.0/0/all */
-function makeSecurityGroupAccessTheInternet(securityGroup) {
-    securityGroup.createEgressRule("access-the-internet", {
+function makeSecurityGroupAccessTheInternet(securityGroup, ruleName = "") {
+    securityGroup.createEgressRule((0, utils_1.withRuleName)("access-the-internet", ruleName), {
         cidrBlocks: ["0.0.0.0/0"],
         fromPort: -1,
         toPort: -1,

package/createFargateTask.js

@@ -186,12 +186,12 @@ function createFargateTask(serviceName, dockerImage, dockerListeningPort, enviro
                 serviceDiscoveryPort = port;
             });
             // enable prometheus to access fromPort-toPort
-            (0, prometheus_1.makeSecurityGroupAccessibleByPrometheus)(taskSecurityGroup, fromPort, toPort);
+            (0, prometheus_1.makeSecurityGroupAccessibleByPrometheus)(taskSecurityGroup, fromPort, toPort, serviceName);
         }
         // enable egress traffic from the task to the internet
-        (0, accessTheInternet_1.makeSecurityGroupAccessTheInternet)(taskSecurityGroup);
+        (0, accessTheInternet_1.makeSecurityGroupAccessTheInternet)(taskSecurityGroup, serviceName);
         // make the container fully accessible from the bastion of the environment
-        (0, acceptBastion_1.makeSecurityGroupAccessibleFromBastion)(taskSecurityGroup);
+        (0, acceptBastion_1.makeSecurityGroupAccessibleFromBastion)(taskSecurityGroup, serviceName);
         if (dontExpose) {
             const service = yield createInternalService({
                 serviceName,
@@ -230,7 +230,7 @@ function createFargateTask(serviceName, dockerImage, dockerListeningPort, enviro
         }
         const portMapping = exposed.targetGroup;
         // make the service accesible by the ALB
-        (0, acceptAlb_1.makeSecurityGroupAccessibleFromSharedAlb)(taskSecurityGroup);
+        (0, acceptAlb_1.makeSecurityGroupAccessibleFromSharedAlb)(taskSecurityGroup, serviceName);
         const service = yield createInternalService({
             serviceName,
             cluster,

package/exposePublicService.d.ts

@@ -3,8 +3,15 @@ import * as aws from "@pulumi/aws";
 import * as awsx from "@pulumi/awsx";
 import * as cf from "@pulumi/cloudflare";
 import { ApplicationTargetGroupHealthCheck } from "@pulumi/awsx/lb";
-export declare type ExtraExposedServiceOptions = {
-    createCloudflareProxiedSubdomain?: boolean;
+export declare type ProxiedCloudflareDomain = {
+    createCloudflareProxiedSubdomain: true;
+};
+export declare type UnproxiedCloudflareDomain = {
+    createCloudflareDNSWithoutProxy: true;
+    ttl: number;
+};
+export declare type CloudflareDomainOptions = ProxiedCloudflareDomain | UnproxiedCloudflareDomain | {};
+export declare type ExtraExposedServiceOptions = CloudflareDomainOptions & {
     skipInternalDomain?: boolean;
     targetGroupConditions?: pulumi.Input<aws.types.input.alb.ListenerRuleCondition>[];
 };

package/exposePublicService.js

@@ -24,6 +24,12 @@ const DEFAULT_HEALTHCHECK_VALUES = {
     unhealthyThreshold: 5,
     healthyThreshold: 5,
 };
+function isProxiedDomain(v) {
+    return typeof v == "object" && v && v.createCloudflareProxiedSubdomain;
+}
+function isUnProxiedDomain(v) {
+    return typeof v == "object" && v && v.createCloudflareDNSWithoutProxy;
+}
 /**
  * Publicly expose a service on a given domain (with SSL). This will create a
  * Target Group and a Listener for your microservice. Additionally, it will
@@ -37,7 +43,9 @@ function exposePublicService(name, domain, port, healthCheck = {}, vpc, extraOpt
     return __awaiter(this, void 0, void 0, function* () {
         const { alb, listener } = yield (0, alb_1.getAlb)();
         const healthCheckValue = Object.assign({}, DEFAULT_HEALTHCHECK_VALUES, healthCheck);
-        const createCFProxy = extraOptions && extraOptions.createCloudflareProxiedSubdomain || domain.endsWith(`.${domain_1.publicDomain}`);
+        const isProxied = isProxiedDomain(extraOptions);
+        const isUnproxied = isUnProxiedDomain(extraOptions);
+        const createCloudflareRecord = isProxied || isUnproxied || domain.endsWith(`.${domain_1.publicDomain}`);
         const onlyCloudflare = (extraOptions && extraOptions.skipInternalDomain) || false;
         const createInternalDomain = !onlyCloudflare;
         const certificate = (0, certificate_1.getCertificateFor)(domain);
@@ -71,14 +79,25 @@ function exposePublicService(name, domain, port, healthCheck = {}, vpc, extraOpt
             });
             enabledHostnames.push(domain);
         }
-        if (createCFProxy) {
+        if (createCloudflareRecord) {
             enabledHostnames.push(domainParts.subdomain + "." + domain_1.publicDomain);
-            cloudflareRecord = yield (0, cloudflare_1.setRecord)({
-                recordName: domainParts.subdomain,
-                type: "CNAME",
-                value: alb.loadBalancer.dnsName,
-                proxied: true,
-            });
+            if (isUnProxiedDomain(extraOptions)) {
+                cloudflareRecord = yield (0, cloudflare_1.setRecord)({
+                    recordName: domainParts.subdomain,
+                    type: "CNAME",
+                    value: alb.loadBalancer.dnsName,
+                    proxied: false,
+                    ttl: extraOptions.ttl || 600,
+                });
+            }
+            else {
+                cloudflareRecord = yield (0, cloudflare_1.setRecord)({
+                    recordName: domainParts.subdomain,
+                    type: "CNAME",
+                    value: alb.loadBalancer.dnsName,
+                    proxied: true,
+                });
+            }
         }
         if (enabledHostnames.length) {
             new aws.alb.ListenerRule(`${domain_1.env}-ls-${slug}`, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dcl-ops-lib",
-  "version": "5.21.2",
+  "version": "5.23.1",
   "scripts": {
     "build": "tsc && cp bin/* .",
     "clean": "rm *.d.ts *.js *.js.map"

package/prometheus.d.ts

@@ -2,4 +2,4 @@ import * as pulumi from "@pulumi/pulumi";
 import * as awsx from "@pulumi/awsx";
 export declare const prometheusStack: () => Promise<pulumi.StackReference>;
 export declare const prometheusSecurityGroupId: () => Promise<string>;
-export declare function makeSecurityGroupAccessibleByPrometheus(securityGroup: awsx.ec2.SecurityGroup, fromPort?: number, toPort?: number): void;
+export declare function makeSecurityGroupAccessibleByPrometheus(securityGroup: awsx.ec2.SecurityGroup, fromPort?: number, toPort?: number, ruleName?: string): void;

package/prometheus.js

@@ -14,6 +14,7 @@ const pulumi = require("@pulumi/pulumi");
 const awsx = require("@pulumi/awsx");
 const domain_1 = require("./domain");
 const withCache_1 = require("./withCache");
+const utils_1 = require("./utils");
 exports.prometheusStack = (0, withCache_1.default)(() => __awaiter(void 0, void 0, void 0, function* () {
     return new pulumi.StackReference(`prometheus-${domain_1.env}`);
 }));
@@ -21,8 +22,8 @@ exports.prometheusSecurityGroupId = (0, withCache_1.default)(() => __awaiter(voi
     const prom = yield (0, exports.prometheusStack)();
     return (yield prom.requireOutputValue("prometheusSecurityGroupId"));
 }));
-function makeSecurityGroupAccessibleByPrometheus(securityGroup, fromPort = 0, toPort = 0) {
-    new awsx.ec2.IngressSecurityGroupRule(`accept-prom-${fromPort}-${toPort}`, securityGroup, {
+function makeSecurityGroupAccessibleByPrometheus(securityGroup, fromPort = 0, toPort = 0, ruleName = "") {
+    new awsx.ec2.IngressSecurityGroupRule((0, utils_1.withRuleName)(`accept-prom-${fromPort}-${toPort}`, ruleName), securityGroup, {
         sourceSecurityGroupId: (0, exports.prometheusSecurityGroupId)(),
         description: `Allow access from prometheus`,
         fromPort,

package/utils.d.ts

@@ -1 +1,2 @@
 export declare function sha256hash(s: string): string;
+export declare function withRuleName(name: string, ruleName?: string): string;

package/utils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sha256hash = void 0;
+exports.withRuleName = exports.sha256hash = void 0;
 const crypto = require("crypto");
 function sha256hash(s) {
     const shasum = crypto.createHash("sha256");
@@ -8,4 +8,11 @@ function sha256hash(s) {
     return shasum.digest("hex").substring(0, 8);
 }
 exports.sha256hash = sha256hash;
+function withRuleName(name, ruleName) {
+    if (ruleName === null || ruleName === void 0 ? void 0 : ruleName.length) {
+        return `${ruleName}-${name}`;
+    }
+    return name;
+}
+exports.withRuleName = withRuleName;
 //# sourceMappingURL=utils.js.map