serverless.yml

service: externals

provider:
    name: aws
    runtime: provided.al2
    stage: prod
    region: eu-west-1
    environment:
        APP_ENV: prod
        EXTERNALS_APP_VERSION: ${env:SEED_BUILD_ID}
        DB_URL: ${ssm:/externals/db_url}
        ALGOLIA_APP_ID: KSTITII7EC
        ALGOLIA_API_KEY: ${ssm:/externals/algolia_api_key}
        ALGOLIA_INDEX_PREFIX: v2_ # prod
#        ALGOLIA_INDEX_PREFIX: dev_ # staging
        GITHUB_OAUTH_CLIENT_ID: b75b3226c86d801a95cd # prod
#        GITHUB_OAUTH_CLIENT_ID: 422ae3a54f6ebd43895b # staging
        GITHUB_OAUTH_CLIENT_SECRET: ${ssm:/externals/github_oauth_client_secret}
        GITHUB_OAUTH_REDIRECT_URL: 'https://externals.io/login'
        SENTRY_URL: ${ssm:/externals/sentry_url}
        SESSION_SECRET_KEY: ${ssm:/externals/session_secret_key}

package:
    exclude:
        - 'backups/**'
        - 'node_modules/**'
        - 'tests/**'
        - 'var/log/**'
        - 'web/assets/**'

functions:
    website:
        handler: web/index.php
        description: 'externals.io website'
        timeout: 30 # in seconds (API Gateway has a timeout of 30 seconds)
        layers:
            - ${bref:layer.php-74-fpm}
        events:
            -   http: 'ANY /'
            -   http: 'ANY {proxy+}'

    # This script fetches emails from the mailing list and updates our database
    updater:
        handler: updater.php
        description: 'externals.io updater'
        timeout: 900
        layers:
            - ${bref:layer.php-74}
        events:
            -   schedule:
                    rate: rate(15 minutes)
                    # Only enabled in production
                    enabled: ${self:custom.isProd}

plugins:
    - ./vendor/bref/bref
    # This lets us use `#{Assets.Arn}` variables
    - serverless-pseudo-parameters

custom:
    stage: ${opt:stage, self:provider.stage}
    isProd: ${self:custom.isProdMap.${self:custom.stage}, self.enabled.other}
    isProdMap:
        prod: true
        other: false

resources:

    Conditions:
        IsProd:
            Fn::Equals:
                - ${self:custom.stage}
                - prod

    Resources:

        # The S3 bucket that stores the assets
        Assets:
            Type: AWS::S3::Bucket
            Description: 'Public bucket that serves externals.io assets'
            Condition: IsProd
            Properties:
                BucketName: 'externals-assets-${self:custom.stage}'
                # Enables CORS (e.g. when a JS script loads files from S3)
                CorsConfiguration:
                    CorsRules:
                        -   AllowedHeaders: ["*"]
                            AllowedMethods: [GET]
                            AllowedOrigins: ["*"]
        # The policy that makes the bucket publicly readable (necessary for a public website)
        AssetsBucketPolicy:
            Type: AWS::S3::BucketPolicy
            Condition: IsProd
            Properties:
                Bucket: !Ref Assets
                PolicyDocument:
                    Statement:
                        -   Effect: 'Allow'
                            Principal: '*' # everyone
                            Action: 's3:GetObject' # to read
                            Resource: '#{Assets.Arn}/*' # things in the bucket

        # We use CloudFront in front of API Gateway to be able to redirect HTTP to HTTPS
        # because API Gateway does not listen at all to HTTP requests.
        CDN:
            Type: AWS::CloudFront::Distribution
            Condition: IsProd
            Properties:
                DistributionConfig:
                    Enabled: true
                    # Cheapest option by default (https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DistributionConfig.html)
                    PriceClass: PriceClass_100
                    # Origins are where CloudFront fetches content
                    Origins:
                        # The website (AWS Lambda)
                        -   Id: Website
                            DomainName: '#{ApiGatewayRestApi}.execute-api.#{AWS::Region}.amazonaws.com'
                            OriginPath: '/prod'
                            CustomOriginConfig:
                                OriginProtocolPolicy: 'https-only' # API Gateway only supports HTTPS
                        # The assets (S3)
                        -   Id: Assets
                            DomainName: '#{Assets}.s3.amazonaws.com'
                            CustomOriginConfig:
                                OriginProtocolPolicy: 'http-only' # S3 websites only support HTTP
                    # The default behavior is to send everything to AWS Lambda
                    DefaultCacheBehavior:
                        AllowedMethods: [GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE]
                        TargetOriginId: Website # the PHP application
                        # Disable caching for the PHP application https://aws.amazon.com/premiumsupport/knowledge-center/prevent-cloudfront-from-caching-files/
                        DefaultTTL: 0
                        MinTTL: 0
                        MaxTTL: 0
                        # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-forwardedvalues.html
                        ForwardedValues:
                            QueryString: true
                            # We must *not* forward the `Host` header else it messes up API Gateway
                            Headers:
                                - 'Accept'
                                - 'Accept-Language'
                                - 'Origin'
                                - 'Referer'
                            Cookies:
                                Forward: all
                        ViewerProtocolPolicy: redirect-to-https
                    CacheBehaviors:
                        # Assets will be served under the `/assets/` prefix
                        -   PathPattern: 'assets/*'
                            TargetOriginId: Assets # the static files on S3
                            AllowedMethods: [GET, HEAD]
                            ForwardedValues:
                                # No need for all that with assets
                                QueryString: 'false'
                                Cookies:
                                    Forward: none
                            ViewerProtocolPolicy: redirect-to-https
                            Compress: true # Serve files with gzip for browsers that support it (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html)
                    CustomErrorResponses:
                        # Do not cache HTTP errors
                        -   ErrorCode: 500
                            ErrorCachingMinTTL: 0
                        -   ErrorCode: 504
                            ErrorCachingMinTTL: 0
                    # Custom domain name
                    Aliases:
                        - externals.io
                        - v3.externals.io
                    ViewerCertificate:
                        # ARN of the certificate created in ACM
                        AcmCertificateArn: arn:aws:acm:us-east-1:416566615250:certificate/0f28e63d-d3a9-4578-9f8b-14347bfe8326
                        # See https://docs.aws.amazon.com/fr_fr/cloudfront/latest/APIReference/API_ViewerCertificate.html
                        SslSupportMethod: 'sni-only'