Skip to content

Commit c06ade2

Browse files
cnusscnuss
committed
initial self hosted configuration
0 parents  commit c06ade2

File tree

7 files changed

+4150
-0
lines changed

7 files changed

+4150
-0
lines changed

‎.github/workflows/push-main.yml

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Deploy
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
9+
env:
10+
NODE_ENV: nonlive
11+
12+
permissions:
13+
id-token: write
14+
15+
jobs:
16+
deploy:
17+
runs-on: ubuntu-latest
18+
if: >-
19+
!startsWith(github.event.head_commit.message, 'Initial commit') &&
20+
!startsWith(github.event.head_commit.message, '🤖') &&
21+
!contains(github.event.head_commit.message, '[skip ci]')
22+
steps:
23+
- uses: actions/checkout@v4
24+
25+
- uses: actions/setup-node@v4
26+
with:
27+
node-version: "18"
28+
cache: yarn
29+
30+
- run: yarn
31+
32+
- uses: aws-actions/configure-aws-credentials@v4
33+
with:
34+
role-to-assume: arn:aws:iam::339712900631:role/OrganizationAccountAccessRole
35+
aws-region: us-east-1
36+
37+
- run: yarn deploy --stage $NODE_ENV

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
node_modules/

‎INSTALLATION.md

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# SAML.to Self Hosted Installation
2+
3+
## AWS IAM RBAC
4+
5+
### GitHub Identity Provider
6+
7+
1. Provider URL: `https://token.actions.githubusercontent.com`
8+
1. Audience: `sts.amazonaws.com`
9+
10+
### AWS IAM Role
11+
12+
Trust Relationship:
13+
14+
```json
15+
{
16+
"Version": "2012-10-17",
17+
"Statement": [
18+
{
19+
"Effect": "Allow",
20+
"Principal": {
21+
"Federated": "arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"
22+
},
23+
"Action": "sts:AssumeRoleWithWebIdentity",
24+
"Condition": {
25+
"StringLike": {
26+
"token.actions.githubusercontent.com:sub": "repo:saml-to/self-hosted:*"
27+
},
28+
"StringEquals": {
29+
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
30+
}
31+
}
32+
}
33+
]
34+
}
35+
```

‎README.md

Whitespace-only changes.

‎package.json

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"name": "@saml-to/self-hosted",
3+
"version": "1.0.0",
4+
"description": "Host SAML.to in your own AWS Account",
5+
"main": "index.js",
6+
"repository": "[email protected]:saml-to/self-hosted.git",
7+
"author": "SAML.to",
8+
"license": "BUSL-1.1",
9+
"private": false,
10+
"scripts": {
11+
"deploy": "serverless deploy"
12+
},
13+
"devDependencies": {
14+
"serverless": "3.38.0"
15+
}
16+
}

‎serverless.yml

+188
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
service: saml-to
2+
3+
frameworkVersion: 3.38.0
4+
variablesResolutionMode: "20210326"
5+
configValidationMode: off
6+
disabledDeprecations:
7+
- "*"
8+
9+
# plugins:
10+
# - serverless-esbuild
11+
# - serverless-react
12+
# - serverless-dotenv-plugin
13+
# - serverless-offline-resources
14+
# - serverless-offline
15+
16+
provider:
17+
name: aws
18+
runtime: nodejs18.x
19+
iam:
20+
role:
21+
statements:
22+
- Effect: Allow
23+
Action:
24+
- "dynamodb:*"
25+
- "secretsmanager:*"
26+
- "sns:*"
27+
- "sqs:*"
28+
Resource: "*"
29+
stage: ${opt:stage, "local"}
30+
logRetentionInDays: 1
31+
tracing:
32+
apiGateway: true
33+
lambda: true
34+
environment:
35+
STAGE: ${self:provider.stage}
36+
37+
functions:
38+
github:
39+
handler: src/lambda.handler
40+
timeout: 29
41+
layers:
42+
- arn:aws:lambda:us-east-1:034541671702:layer:openssl-lambda:1
43+
- arn:aws:lambda:us-east-1:580360238192:layer:nonlive-github-sls-rest-api:3
44+
environment:
45+
SERVICE_NAME: github-sls-rest-api
46+
SERVICE_SLUG: github
47+
events:
48+
- httpApi:
49+
method: "*"
50+
path: /github/{proxy+}
51+
# - sns:
52+
# arn: ${file(serverless.config.js):topic-arn}
53+
# - sns:
54+
# arn: ${file(serverless.config.js):auth-topic-arn}
55+
# - sns:
56+
# arn: arn:aws:sns:us-east-1:580360238192:cf-hook
57+
- stream:
58+
type: dynamodb
59+
batchSize: 1
60+
maximumRecordAgeInSeconds: 600
61+
arn:
62+
Fn::GetAtt: [GithubTable, StreamArn]
63+
# - stream:
64+
# type: kinesis
65+
# batchSize: 1
66+
# maximumRecordAgeInSeconds: 86400
67+
# arn:
68+
# Fn::GetAtt: [Stream, Arn]
69+
70+
resources:
71+
Resources:
72+
# Secret:
73+
# Type: AWS::SecretsManager::Secret
74+
# Properties:
75+
# Name: ${self:service}-${self:provider.stage}
76+
# SecretString: ${file(scripts/config.js):SECRETS}
77+
78+
# Topic:
79+
# Type: AWS::SNS::Topic
80+
# Properties:
81+
# TopicName: ${self:service}-${self:provider.stage}
82+
83+
# Queue:
84+
# Type: AWS::SQS::Queue
85+
# Properties:
86+
# QueueName: ${self:service}-${self:provider.stage}
87+
88+
GithubTable:
89+
Type: AWS::DynamoDB::Table
90+
Properties:
91+
TableName: ${self:provider.stage}-github-sls-rest-api
92+
KeySchema:
93+
- AttributeName: pk
94+
KeyType: HASH
95+
- AttributeName: sk
96+
KeyType: RANGE
97+
AttributeDefinitions:
98+
- AttributeName: pk
99+
AttributeType: S
100+
- AttributeName: sk
101+
AttributeType: S
102+
GlobalSecondaryIndexes:
103+
- IndexName: sk-pk-index
104+
KeySchema:
105+
- AttributeName: sk
106+
KeyType: HASH
107+
- AttributeName: pk
108+
KeyType: RANGE
109+
Projection:
110+
ProjectionType: ALL
111+
StreamSpecification:
112+
StreamViewType: NEW_AND_OLD_IMAGES
113+
TimeToLiveSpecification:
114+
AttributeName: expires
115+
Enabled: true
116+
PointInTimeRecoverySpecification:
117+
PointInTimeRecoveryEnabled: true
118+
SSESpecification:
119+
SSEEnabled: true
120+
BillingMode: PAY_PER_REQUEST
121+
122+
IdpRequestsTable:
123+
Type: AWS::DynamoDB::Table
124+
Properties:
125+
TableName: ${self:provider.stage}-github-sls-rest-api-idp-requests
126+
KeySchema:
127+
- AttributeName: pk
128+
KeyType: HASH
129+
- AttributeName: sk
130+
KeyType: RANGE
131+
AttributeDefinitions:
132+
- AttributeName: pk
133+
AttributeType: S
134+
- AttributeName: sk
135+
AttributeType: S
136+
GlobalSecondaryIndexes:
137+
- IndexName: sk-pk-index
138+
KeySchema:
139+
- AttributeName: sk
140+
KeyType: HASH
141+
- AttributeName: pk
142+
KeyType: RANGE
143+
Projection:
144+
ProjectionType: ALL
145+
StreamSpecification:
146+
StreamViewType: NEW_AND_OLD_IMAGES
147+
TimeToLiveSpecification:
148+
AttributeName: expires
149+
Enabled: true
150+
PointInTimeRecoverySpecification:
151+
PointInTimeRecoveryEnabled: true
152+
SSESpecification:
153+
SSEEnabled: true
154+
BillingMode: PAY_PER_REQUEST
155+
156+
CachedConfigTable:
157+
Type: AWS::DynamoDB::Table
158+
Properties:
159+
TableName: ${self:provider.stage}-github-sls-rest-api-cached-config
160+
KeySchema:
161+
- AttributeName: pk
162+
KeyType: HASH
163+
- AttributeName: sk
164+
KeyType: RANGE
165+
AttributeDefinitions:
166+
- AttributeName: pk
167+
AttributeType: S
168+
- AttributeName: sk
169+
AttributeType: S
170+
GlobalSecondaryIndexes:
171+
- IndexName: sk-pk-index
172+
KeySchema:
173+
- AttributeName: sk
174+
KeyType: HASH
175+
- AttributeName: pk
176+
KeyType: RANGE
177+
Projection:
178+
ProjectionType: ALL
179+
StreamSpecification:
180+
StreamViewType: NEW_AND_OLD_IMAGES
181+
TimeToLiveSpecification:
182+
AttributeName: expires
183+
Enabled: true
184+
PointInTimeRecoverySpecification:
185+
PointInTimeRecoveryEnabled: true
186+
SSESpecification:
187+
SSEEnabled: true
188+
BillingMode: PAY_PER_REQUEST

0 commit comments

Comments
 (0)