vignesh/cdkinfracode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: add IP access restrictions for Caddy, expose Woodpecker server port, and implement daily EC2 snapshot lifecycle policy

Browse source
This commit is contained in:
vickytechkey 2026-08-06 18:14:53 +05:30
parent 4c00575ab7
commit ae059c342d
1 changed files with 58 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

58
aws_cdk/lib/aws_cdk-stack.ts
View file

@ -2,6 +2,7 @@ import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as dlm from 'aws-cdk-lib/aws-dlm';
export class AwsCdkStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
@ -100,6 +101,9 @@ export class AwsCdkStack extends cdk.Stack {
'}',
'',
'ci.tipro.in {',
' # Restrict access to local, server IP, and VPN subnets',
' @blocked not remote_ip 13.205.93.190 127.0.0.1 ::1 10.8.0.0/24 10.252.1.0/24 172.16.0.0/12',
' respond @blocked "Access Denied" 403',
' reverse_proxy woodpecker-server:8000',
'}',
'EOF',
@ -127,6 +131,8 @@ export class AwsCdkStack extends cdk.Stack {
' image: woodpeckerci/woodpecker-server:latest',
' container_name: woodpecker-server',
' restart: unless-stopped',
' ports:',
' - "5000:8000"',
' volumes:',
' - woodpecker-data:/var/lib/woodpecker',
' environment:',
@ -223,6 +229,58 @@ export class AwsCdkStack extends cdk.Stack {
instanceId: instance.instanceId,
});
// 6. Automated Backup: Tag the EC2 instance and configure DLM Lifecycle Policy
cdk.Tags.of(instance).add('Backup', 'Daily');
// Create the IAM Role for DLM to manage snapshots
const dlmRole = new iam.Role(this, 'DLMLifecycleRole', {
assumedBy: new iam.ServicePrincipal('dlm.amazonaws.com'),
description: 'Role for DLM to manage EC2 daily snapshots',
});
dlmRole.addToPolicy(new iam.PolicyStatement({
actions: [
'ec2:CreateSnapshot',
'ec2:CreateSnapshots',
'ec2:DeleteSnapshot',
'ec2:DescribeInstances',
'ec2:DescribeVolumes',
'ec2:DescribeSnapshots',
'ec2:CreateTags',
],
resources: ['*'],
}));
// Create the DLM Lifecycle Policy (snapshots are stored automatically in S3)
new dlm.CfnLifecyclePolicy(this, 'DailySnapshotPolicy', {
description: 'Daily EC2 Instance Snapshot Policy',
executionRoleArn: dlmRole.roleArn,
state: 'ENABLED',
policyDetails: {
resourceTypes: ['INSTANCE'],
targetTags: [
{
key: 'Backup',
value: 'Daily',
},
],
schedules: [
{
name: 'DailySnapshotSchedule',
createRule: {
interval: 24,
intervalUnit: 'HOURS',
times: ['20:00'], // Runs daily at 20:00 UTC (1:30 AM IST)
},
retainRule: {
count: 7, // Keep the last 7 daily snapshots
},
copyTags: true,
},
],
},
});
// Outputs
new cdk.CfnOutput(this, 'internalsPublicIP', {
value: '13.205.93.190',