cloudformation.yml

---
AWSTemplateFormatVersion: 2010-09-09

Description: Stack template for running OryFM with Hydra

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "EC2 Configuration"
        Parameters:
          - InstanceType
      - Label:
          default: "Domain Configuration"
        Parameters:
          - OryFmDomainName
          - HydraPublicDomainName
          - HydraAdminDomainName
      - Label:
          default: "OryFM Configuration"
        Parameters:
          - OryFmUserLoginRememberTime
          - OryFmDefaultLoginRememberTime
          - OryFmUserConsentRememberTime
          - OryFmDefaultConsentRememberTime
          - OryFmThemeCssUrl
          - OryFmAuthenticationMethod
          - OryFmTestMode
          - OryFmRootRedirectUrl
      - Label:
          default: "FileMaker Configuration"
        Parameters:
          - FileMakerUrl
          - FileMakerDatabase
          - FileMakerUsername
          - FileMakerPassword
          - FileMakerLayout

Parameters:

  InstanceType:
    Description: EC2 instance type
    Type: String
    Default: t2.small

  OryFmDomainName:
    Type: String
    AllowedPattern: (([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])
  HydraPublicDomainName:
    Type: String
    AllowedPattern: (([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])
  HydraAdminDomainName:
    Type: String
    AllowedPattern: (([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])

  OryFmUserLoginRememberTime:
    Description: How long to remember login when user checks box (set to 0 to disable)
    Type: Number
    MinValue: 0
    Default: 2592000
  OryFmDefaultLoginRememberTime:
    Description: How long to remember login when user does not check box (set to 0 to disable)
    Type: Number
    MinValue: 0
    Default: 0
  OryFmUserConsentRememberTime:
    Description: How long to remember consent when user checks box (set to 0 to disable)
    Type: Number
    MinValue: 0
    Default: 2592000
  OryFmDefaultConsentRememberTime:
    Description: How long to remember consent when user does not check box (set to 0 to disable)
    Type: Number
    MinValue: 0
    Default: 0
  OryFmThemeCssUrl:
    Description: Optional URL for custom OryFM theme
    Type: String
  OryFmAuthenticationMethod:
    Description: Whether to run OryFM in test mode
    Type: String
    AllowedValues:
      - password-hash
      - basic-auth
    Default: password-hash
  OryFmTestMode:
    Description: Whether to run OryFM in test mode
    Type: String
    AllowedValues:
      - true
      - ''
    Default: ''
  OryFmRootRedirectUrl:
    Description: Optional URL to redirect to on the root route
    Type: String

  FileMakerUrl:
    Type: String
    AllowedPattern: https?://(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])
  FileMakerDatabase:
    Type: String
  FileMakerUsername:
    Type: String
  FileMakerPassword:
    Type: String
    NoEcho: true
  FileMakerLayout:
    Type: String

Mappings:

  RegionMap:
    us-east-1:
      AMI: ami-00a208c7cdba991ea
    us-east-2:
      AMI: ami-059d836af932792c3
    us-west-1:
      AMI: ami-0f42d8c4eb586ccf7
    us-west-2:
      AMI: ami-0a7d051a1c4b54f65

Resources:
  # CloudFront
  Certificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref OryFmDomainName
      ValidationMethod: DNS
      SubjectAlternativeNames:
        - !Ref HydraPublicDomainName
        - !Ref HydraAdminDomainName

  Distribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Aliases:
          - !Ref OryFmDomainName
          - !Ref HydraPublicDomainName
          - !Ref HydraAdminDomainName
        ViewerCertificate:
          AcmCertificateArn: !Ref Certificate
          SslSupportMethod: sni-only
        Origins:
          - Id: Origin
            DomainName: !GetAtt ["Instance", "PublicDnsName"]
            CustomOriginConfig:
              OriginProtocolPolicy: http-only
        Enabled: true
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
            - PUT
            - PATCH
            - POST
            - DELETE
          TargetOriginId: Origin
          ViewerProtocolPolicy: redirect-to-https
          DefaultTTL: 0
          MinTTL: 0
          MaxTTL: 0
          ForwardedValues:
            Cookies:
              Forward: all
            Headers:
              - Host
              - Authorization
            QueryString: true
          Compress: false
    DependsOn: InstanceIp

# Shall be used instead of ForwardedValues, but is currently broken.
#  CachePolicy:
#    Type: AWS::CloudFront::CachePolicy
#    Properties:
#      CachePolicyConfig:
#        Name: NoCache
#        MinTTL: 0
#        MaxTTL: 0
#        DefaultTTL: 0
#        ParametersInCacheKeyAndForwardedToOrigin:
#          CookiesConfig:
#            CookieBehavior: all
#          EnableAcceptEncodingGzip: true
#          HeadersConfig:
#            HeaderBehavior: whitelist
#            Headers:
#              - Host
#              - Authorization
#          QueryStringsConfig:
#            QueryStringBehavior: all

  # Secrets
  HydraAdminSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description: Secret for Hydra Admin
      GenerateSecretString:
        PasswordLength: 32
        ExcludePunctuation: true

  # EC2
  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Principal:
              Service:
                - ec2.amazonaws.com
            Effect: Allow

  InstancePolicies:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: SecretsRead
      PolicyDocument:
        Statement:
          - Action:
              - secretsmanager:GetSecretValue
            Effect: Allow
            Resource: !Ref HydraAdminSecret
      Roles:
        - !Ref InstanceRole

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref InstanceRole
      Path: /

  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Access to host
      SecurityGroupIngress:
        # Public HTTP access
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        # Public SSH access
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0

  InstanceIp:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      InstanceId: !Ref Instance

  Instance:
    Type: AWS::EC2::Instance
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
        Count: 1
    Properties:
      ImageId:
        Fn::FindInMap:
          - RegionMap
          - !Ref AWS::Region
          - AMI
      InstanceType: !Ref InstanceType
      IamInstanceProfile: !Ref InstanceProfile
      SecurityGroupIds:
        - !Ref InstanceSecurityGroup
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -x
          apt-get update -y
          apt-get install -y python-setuptools
          mkdir -p /opt/aws/bin
          python /usr/lib/python2.7/dist-packages/easy_install.py \
            --script-dir /opt/aws/bin \
            https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz

          /opt/aws/bin/cfn-init -v \
            --stack ${AWS::StackName} \
            --resource Instance \
            --region ${AWS::Region} \
            --configsets full_install

          /opt/aws/bin/cfn-signal -e $? \
            --stack ${AWS::StackName} \
            --resource Instance \
            --region ${AWS::Region}
    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          full_install:
            - install_aws_cli
            - install_and_enable_cfn_hup
            - install_docker
            - install_node
            - install_nginx
            - install_hydra
            - update_hydra
            - configure_oryfm_user
            - install_oryfm
          update:
            - update_hydra
            - install_oryfm

        install_aws_cli:
          packages:
            apt:
              jq: []
              python3-pip: []
          commands:
            01_install_awscli:
              command: yes | pip3 install awscli --upgrade --user

        install_and_enable_cfn_hup:
          files:
            /etc/cfn/cfn-hup.conf:
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
              mode: "000400"
              owner: root
              group: root
            /etc/cfn/hooks.d/cfn-auto-reloader.conf:
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.Instance.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource Instance --configsets update --region ${AWS::Region}
                runas=root
              mode: "000400"
              owner: root
              group: root
            /lib/systemd/system/cfn-hup.service:
              content: !Sub |
                [Unit]
                Description=cfn-hup daemon

                [Service]
                Type=simple
                ExecStart=/opt/aws/bin/cfn-hup
                Restart=always

                [Install]
                WantedBy=multi-user.target
              mode: "000644"
              owner: root
              group: root
          commands:
            01_enable_cfn_hup:
              command: systemctl enable cfn-hup.service
            02_start_cfn_hup:
              command: systemctl start cfn-hup.service

        install_docker:
          packages:
            apt:
              apt-transport-https: []
              ca-certificates: []
              curl: []
              gnupg2: []
              software-properties-common: []
          commands:
            01_add_repository_key:
              command: curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
            02_add_repository:
              command: add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
            03_update_apt_get:
              command: apt-get update
            04_install_docker:
              command: apt-get install -y docker-ce
            05_add_ubuntu_to_group:
              command: usermod -aG docker ubuntu

        install_node:
          commands:
            01_add_repository:
              command: curl -sL https://deb.nodesource.com/setup_12.x | bash -
            02_install_node:
              command: apt-get install -y nodejs

        install_nginx:
          commands:
            01_install:
              command: apt-get install -y nginx

        install_hydra:
          packages:
            apt:
              pwgen: []
          commands:
            01_create_postgres_secret:
              command: echo "POSTGRES_SECRET=$(pwgen -s 32 1)" >> /etc/hydra-secrets.env
            02_create_system_secret:
              command: echo "SYSTEM_SECRET=$(pwgen -s 32 1)" >> /etc/hydra-secrets.env
            03_create_database_url:
              command: env $(cat /etc/hydra-secrets.env | xargs) bash -c 'echo "POSTGRES_URL=postgres://hydra:$POSTGRES_SECRET@ory-postgres:5432/hydra?sslmode=disable" >> /etc/hydra-secrets.env'
            04_setup_internal_host:
              command: echo "127.0.0.1 hydra-admin.local" >> /etc/hosts
            05_create_hydra_network:
              command: docker network create hydra
            06_install_postgres:
              command: !Sub |
                env $(cat /etc/hydra-secrets.env | xargs) bash -c 'docker run \
                  --network hydra \
                  --name ory-postgres \
                  --restart always \
                  -e POSTGRES_USER=hydra \
                  -e POSTGRES_PASSWORD=$POSTGRES_SECRET \
                  -e POSTGRES_DB=hydra \
                  -d postgres:9.6 \
                '

        update_hydra:
          packages:
            apt:
              apache2-utils: []
          files:
            /etc/nginx/sites-available/hydra-public.conf:
              content: !Sub |
                server {
                    listen 80;
                    server_name ${HydraPublicDomainName};

                    location / {
                        proxy_pass http://127.0.0.1:9000;
                        proxy_set_header X-Forwarded-Proto https;
                    }
                }
              mode: "000644"
              owner: root
              group: root
            /etc/nginx/sites-enabled/hydra-public.conf:
              content: /etc/nginx/sites-available/hydra-public.conf
              mode: "120644"
              owner: root
              group: root
            /etc/nginx/sites-available/hydra-admin.conf:
              content: !Sub |
                server {
                    listen 80;
                    server_name ${HydraAdminDomainName};

                    location /clients {
                        auth_basic 'Client Administration';
                        auth_basic_user_file /etc/hydra-admin.htpasswd;

                        proxy_pass http://127.0.0.1:9001/clients;
                        proxy_set_header X-Forwarded-Proto https;
                    }

                    location /oauth2/introspect {
                        proxy_pass http://127.0.0.1:9001/oauth2/introspect;
                        proxy_set_header X-Forwarded-Proto https;
                    }
                }
              mode: "000644"
              owner: root
              group: root
            /etc/nginx/sites-enabled/hydra-admin.conf:
              content: /etc/nginx/sites-available/hydra-admin.conf
              mode: "120644"
              owner: root
              group: root
            /etc/nginx/sites-available/hydra-admin-local.conf:
              content: !Sub |
                server {
                  listen 127.0.0.1:80;
                  server_name hydra-admin.local;

                  location / {
                    proxy_pass http://127.0.0.1:9001;
                    proxy_set_header X-Forwarded-Proto https;
                  }
                }
              mode: "000644"
              owner: root
              group: root
            /etc/nginx/sites-enabled/hydra-admin-local.conf:
              content: /etc/nginx/sites-available/hydra-admin-local.conf
              mode: "120644"
              owner: root
              group: root
          commands:
            01_stop_hydra:
              command: docker stop ory-hydra || true
            02_remove_hydra:
              command: docker rm ory-hydra || true
            03_pull_hydra:
              command: docker pull oryd/hydra:v1.7
            04_migrate_database:
              command: env $(cat /etc/hydra-secrets.env | xargs) bash -c 'docker run --rm --network hydra oryd/hydra:v1.7 migrate sql "$POSTGRES_URL" --yes'
            05_start_hydra:
              command: !Sub |
                env $(cat /etc/hydra-secrets.env | xargs) bash -c 'docker run -d \
                  --name ory-hydra \
                  --network hydra \
                  --restart always \
                  -p 127.0.0.1:9000:4444 \
                  -p 127.0.0.1:9001:4445 \
                  -e SERVE_TLS_ALLOW_TERMINATION_FROM=172.18.0.0/16 \
                  -e SERVE_PUBLIC_CORS_ENABLED=true \
                  -e SECRETS_SYSTEM=$SYSTEM_SECRET \
                  -e DSN=$POSTGRES_URL \
                  -e URLS_SELF_ISSUER=https://${HydraPublicDomainName}/ \
                  -e URLS_CONSENT=https://${OryFmDomainName}/consent \
                  -e URLS_LOGIN=https://${OryFmDomainName}/login \
                  -e URLS_LOGOUT=https://${OryFmDomainName}/logout \
                  -e URLS_ERROR=https://${OryFmDomainName}/error \
                  oryd/hydra:v1.7 serve all \
                '
            06_create_htpasswd:
              command: !Sub |
                /root/.local/bin/aws secretsmanager get-secret-value --region ${AWS::Region} \
                  --secret-id ${HydraAdminSecret} --query SecretString --output text \
                  | htpasswd -ci /etc/hydra-admin.htpasswd admin
            07_reload_nginx:
              command: systemctl reload nginx

        configure_oryfm_user:
          users:
            oryfm:
              homeDir:
                /opt/oryfm
          commands:
            01_create:
              command: mkdir -p /opt/oryfm && chown oryfm:oryfm /opt/oryfm
            02_install_pm2:
              command: npm i -g pm2
            03_startup_pm2:
              command: pm2 startup -u oryfm

        install_oryfm:
          packages:
            apt:
              unzip: []
          files:
            /opt/oryfm/oryfm.env:
              content: !Sub |
                FILEMAKER_URL=${FileMakerUrl}
                FILEMAKER_DATABASE=${FileMakerDatabase}
                FILEMAKER_USERNAME=${FileMakerUsername}
                FILEMAKER_PASSWORD=${FileMakerPassword}
                FILEMAKER_LAYOUT=${FileMakerLayout}
                LOGIN_USER_REMEMBER_TIME=${OryFmUserLoginRememberTime}
                LOGIN_DEFAULT_REMEMBER_TIME=${OryFmDefaultLoginRememberTime}
                CONSENT_USER_REMEMBER_TIME=${OryFmUserConsentRememberTime}
                CONSENT_DEFAULT_REMEMBER_TIME=${OryFmDefaultConsentRememberTime}
                HYDRA_ADMIN_URL=http://hydra-admin.local
                THEME_CSS_URL=${OryFmThemeCssUrl}
                AUTHENTICATION_METHOD=${OryFmAuthenticationMethod}
                TEST_MODE=${OryFmTestMode}
                ROOT_REDIRECT_URL=${OryFmRootRedirectUrl}
                NODE_ENV=production
              mode: "000644"
              owner: oryfm
              group: oryfm
            /opt/oryfm/ecosystem.config.js:
              content: !Sub |
                module.exports = {
                    apps: [{
                        name: 'oryfm',
                        script: `${!process.env.PWD}/server/dist/serve.js`,
                        cwd: `${!process.env.PWD}/server`,
                        watch: false,
                        autorestart: true,
                        restart_delay: 1000,
                        kill_timeout: 3000,
                        exec_mode: 'cluster',
                        instances: -1,
                        instance_var: 'INSTANCE_ID',
                        env: {
                            NODE_ENV: 'development',
                        },
                        env_production: {
                            NODE_ENV: 'production',
                            PORT: '3000',
                        },
                    }],
                };
              mode: "000644"
              owner: oryfm
              group: oryfm
            /usr/local/sbin/reload-oryfm:
              content: !Sub |
                runuser -s /bin/bash -l oryfm -c 'cd /opt/oryfm && pm2 startOrGracefulReload ./ecosystem.config.js --env production'
              mode: "000700"
              owner: root
              group: root
            /etc/nginx/sites-available/oryfm.conf:
              content: !Sub |
                server {
                  listen 80;
                  server_name ${OryFmDomainName};

                  location / {
                    proxy_set_header X-Forwarded-Host $host;
                    proxy_set_header X-Forwarded-Proto https;
                    proxy_pass http://127.0.0.1:3000;
                  }
                }
              mode: "000644"
              owner: root
              group: root
            /etc/nginx/sites-enabled/oryfm.conf:
              content: /etc/nginx/sites-available/oryfm.conf
              mode: "120644"
              owner: root
              group: root
          commands:
            01_clean:
              command: rm -rf /opt/oryfm/oryfm-main /opt/oryfm/oryfm-main.zip /opt/oryfm/server
            02_download:
              command: wget -O /opt/oryfm/oryfm-main.zip https://github.com/soliantconsulting/oryfm/archive/main.zip
            03_unzip:
              command: cd /opt/oryfm && unzip oryfm-main.zip && chown oryfm:oryfm -R oryfm-main
            04_install:
              command: runuser -s /bin/bash -l oryfm -c 'cd /opt/oryfm/oryfm-main && npm install && npm run build'
            05_move:
              command: mv /opt/oryfm/oryfm-main /opt/oryfm/server
            06_setup_custom_labels:
              command: cp -u /opt/oryfm/server/custom-labels.json.dist /opt/oryfm/custom-labels.json
            07_configure:
              command: ln -s /opt/oryfm/oryfm.env /opt/oryfm/server/.env && ln -s /opt/oryfm/custom-labels.json /opt/oryfm/server/custom-labels.json
            08_startup:
              command: reload-oryfm
            09_reload_nginx:
              command: systemctl reload nginx

Outputs:
  HydraAdminSecret:
    Value: !Ref HydraAdminSecret
    Description: "Hydra Admin Secret ARN"
  DistributionDomainName:
    Value: !GetAtt Distribution.DomainName
    Description: "Distribution domain name"