refactor: simplify instance user data and update infrastructure configuration for ap-south-2 migration

.github/workflows/deploy.yml

@@ -1,49 +0,0 @@
-name: Deploy AWS CDK Stack
-
-on:
-  push:
-    branches:
-      - main
-
-permissions:
-  id-token: write # Required for OIDC role assumption
-  contents: read
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: 'aws_cdk/package-lock.json'
-
-      - name: Install dependencies
-        run: |
-          cd aws_cdk
-          npm ci
-
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ secrets.AWS_REGION || 'ap-south-1' }}
-
-      - name: Bootstrap CDK Environment
-        run: |
-          cd aws_cdk
-          npx cdk bootstrap aws://${{ secrets.AWS_ACCOUNT_ID }}/${{ secrets.AWS_REGION || 'ap-south-1' }}
-
-      - name: Deploy CDK Stack
-        run: |
-          cd aws_cdk
-          npx cdk deploy --require-approval never
-        env:
-          CDK_DEFAULT_ACCOUNT: ${{ secrets.AWS_ACCOUNT_ID }}
-          CDK_DEFAULT_REGION: ${{ secrets.AWS_REGION || 'ap-south-1' }}

aws_cdk/cdk.context.json

@@ -1 +1,34 @@
-{}
+{
+  "vpc-provider:account=764709663363:filter.isDefault=true:region=ap-south-2:returnAsymmetricSubnets=true": {
+    "vpcId": "vpc-0d03dd80d367f6aad",
+    "vpcCidrBlock": "172.31.0.0/16",
+    "ownerAccountId": "764709663363",
+    "availabilityZones": [],
+    "subnetGroups": [
+      {
+        "name": "Public",
+        "type": "Public",
+        "subnets": [
+          {
+            "subnetId": "subnet-00a6428f5e757acfe",
+            "cidr": "172.31.0.0/20",
+            "availabilityZone": "ap-south-2a",
+            "routeTableId": "rtb-0216fb8441861f4d8"
+          },
+          {
+            "subnetId": "subnet-031d8c6c7343d74c6",
+            "cidr": "172.31.32.0/20",
+            "availabilityZone": "ap-south-2b",
+            "routeTableId": "rtb-0216fb8441861f4d8"
+          },
+          {
+            "subnetId": "subnet-006f070818cf6d7d7",
+            "cidr": "172.31.16.0/20",
+            "availabilityZone": "ap-south-2c",
+            "routeTableId": "rtb-0216fb8441861f4d8"
+          }
+        ]
+      }
+    ]
+  }
+}

aws_cdk/lib/aws_cdk-stack.ts

@@ -58,7 +58,7 @@ export class AwsCdkStack extends cdk.Stack {
       ),
       securityGroup,
       role,
-      keyName: 'vignesh_tipro',
+      keyName: 'vignesh_tipro_apsouth2',
       detailedMonitoring: true,
       blockDevices: [
         {
@@ -74,114 +74,23 @@ export class AwsCdkStack extends cdk.Stack {
     instance.addUserData(
       // Ensure folder structures exist
       'mkdir -p /home/ubuntu/basic_requirements',
-      'mkdir -p /home/ubuntu/wireguard',
       'mkdir -p /home/ubuntu/build_tools',
 
-      // 4.1 Write and run installation for basic requirements (Docker, Python 3, etc.)
+      // 4.1 Write and run installation for basic requirements (Python 3, pip, venv, git, build-essential)
       'cat <<\'EOF\' > /home/ubuntu/basic_requirements/install.sh',
       '#!/bin/bash',
       'set -e',
       'apt-get update -y',
-      'apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release wget python3 python3-pip python3-venv git',
+      'apt-get install -y ca-certificates curl gnupg lsb-release wget python3 python3-pip python3-venv git build-essential',
-      'mkdir -m 0755 -p /etc/apt/keyrings',
-      'curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg',
-      'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null',
-      'apt-get update -y',
-      'apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin',
-      'systemctl enable docker',
-      'systemctl start docker',
       'EOF',
       'chmod +x /home/ubuntu/basic_requirements/install.sh',
       '/home/ubuntu/basic_requirements/install.sh',
 
-      // 4.2 Set up Caddy, Wireguard, and Woodpecker CI
+      // 4.2 Setup permissions for all user folders
-      'cat <<\'EOF\' > /home/ubuntu/wireguard/Caddyfile',
-      'vpn.tipro.in {',
-      '    reverse_proxy wg-easy:51821',
-      '}',
-      '',
-      'ci.tipro.in {',
-      '    # Restrict access to local, server IP, and VPN subnets',
-      '    @blocked not remote_ip 13.205.93.190 127.0.0.1 ::1 10.8.0.0/24 10.252.1.0/24 172.16.0.0/12',
-      '    respond @blocked "Access Denied" 403',
-      '    reverse_proxy woodpecker-server:8000',
-      '}',
-      'EOF',
-      '',
-      'cat <<\'EOF\' > /home/ubuntu/wireguard/docker-compose.yml',
-      'version: "3"',
-      'services:',
-      '  wg-easy:',
-      '    image: weejewel/wg-easy',
-      '    container_name: wg-easy',
-      '    environment:',
-      '      - WG_HOST=13.205.93.190',
-      '      - PASSWORD=admin123',
-      '    volumes:',
-      '      - ./config:/etc/wireguard',
-      '    cap_add:',
-      '      - NET_ADMIN',
-      '      - SYS_MODULE',
-      '    sysctls:',
-      '      - net.ipv4.ip_forward=1',
-      '      - net.ipv4.conf.all.src_valid_mark=1',
-      '    restart: unless-stopped',
-      '',
-      '  woodpecker-server:',
-      '    image: woodpeckerci/woodpecker-server:v3',
-      '    container_name: woodpecker-server',
-      '    restart: unless-stopped',
-      '    ports:',
-      '      - "5000:8000"',
-      '    volumes:',
-      '      - woodpecker-data:/var/lib/woodpecker',
-      '    environment:',
-      '      - WOODPECKER_HOST=https://ci.tipro.in',
-      '      - WOODPECKER_OPEN=true',
-      '      - WOODPECKER_AGENT_SECRET=secret_agent_token_123',
-      '      # GitHub Integration settings',
-      '      - WOODPECKER_GITHUB=true',
-      '      - WOODPECKER_GITHUB_CLIENT=${GITHUB_CLIENT_ID:-replace_me}',
-      '      - WOODPECKER_GITHUB_SECRET=${GITHUB_CLIENT_SECRET:-replace_me}',
-      '',
-      '  woodpecker-agent:',
-      '    image: woodpeckerci/woodpecker-agent:v3',
-      '    container_name: woodpecker-agent',
-      '    restart: unless-stopped',
-      '    depends_on:',
-      '      - woodpecker-server',
-      '    volumes:',
-      '      - /var/run/docker.sock:/var/run/docker.sock',
-      '    environment:',
-      '      - WOODPECKER_SERVER=woodpecker-server:9000',
-      '      - WOODPECKER_SHARED_SECRET=secret_agent_token_123',
-      '',
-      '  caddy:',
-      '    image: caddy:latest',
-      '    container_name: caddy',
-      '    restart: unless-stopped',
-      '    ports:',
-      '      - "80:80"',
-      '      - "443:443"',
-      '      - "51820:51820/udp"',
-      '    volumes:',
-      '      - ./Caddyfile:/etc/caddy/Caddyfile',
-      '      - caddy_data:/data',
-      '      - caddy_config:/config',
-      '',
-      'volumes:',
-      '  woodpecker-data:',
-      '  caddy_data:',
-      '  caddy_config:',
-      'EOF',
-      'cd /home/ubuntu/wireguard && docker compose up -d',
-
-      // 4.3 Setup permissions for all user folders
       'chown -R ubuntu:ubuntu /home/ubuntu/basic_requirements',
-      'chown -R ubuntu:ubuntu /home/ubuntu/wireguard',
       'chown -R ubuntu:ubuntu /home/ubuntu/build_tools',
 
-      // 4.5 Install CloudWatch Agent (ARM64 package for Graviton instance)
+      // 4.3 Install CloudWatch Agent (ARM64 package for Graviton instance)
       'wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb',
       'dpkg -i -E ./amazon-cloudwatch-agent.deb',
       'mkdir -p /opt/aws/amazon-cloudwatch-agent/etc',
@@ -203,20 +112,6 @@ export class AwsCdkStack extends cdk.Stack {
       '        "metrics_collection_interval": 60',
       '      }',
       '    }',
-      '  },',
-      '  "logs": {',
-      '    "logs_collected": {',
-      '      "files": {',
-      '        "collect_list": [',
-      '          {',
-      '            "file_path": "/var/lib/docker/containers/*/*.log",',
-      '            "log_group_name": "WireGuard-Logs",',
-      '            "log_stream_name": "{instance_id}",',
-      '            "retention_in_days": 7',
-      '          }',
-      '        ]',
-      '      }',
-      '    }',
       '  }',
       '}',
       'EOF',
@@ -225,7 +120,7 @@ export class AwsCdkStack extends cdk.Stack {
 
     // 5. Associate your pre-created Elastic IP using its Allocation ID
     new ec2.CfnEIPAssociation(this, 'internalsEIPAssociation', {
-      allocationId: 'eipalloc-06bea32c3a787c2b1',
+      allocationId: 'eipalloc-0d1630fa0633874cb',
       instanceId: instance.instanceId,
     });
 
@@ -283,7 +178,7 @@ export class AwsCdkStack extends cdk.Stack {
 
     // Outputs
     new cdk.CfnOutput(this, 'internalsPublicIP', {
-      value: '13.205.93.190',
+      value: '16.113.57.127',
       description: 'The Elastic IP address of your Mail Server',
     });
   }