210 lines
8.2 KiB
TypeScript
210 lines
8.2 KiB
TypeScript
import * as cdk from 'aws-cdk-lib';
|
|
import { Construct } from 'constructs';
|
|
import * as ec2 from 'aws-cdk-lib/aws-ec2';
|
|
import * as iam from 'aws-cdk-lib/aws-iam';
|
|
|
|
export class AwsCdkStack extends cdk.Stack {
|
|
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
|
|
super(scope, id, props);
|
|
|
|
// 1. Look up the existing Default VPC (Free, avoids NAT Gateway charges)
|
|
const vpc = ec2.Vpc.fromLookup(this, 'DefaultVpc', {
|
|
isDefault: true,
|
|
});
|
|
|
|
// 2. Create a Security Group for the Mail Server
|
|
const securityGroup = new ec2.SecurityGroup(this, 'internalsSG', {
|
|
vpc,
|
|
description: 'Security Group for self-hosted mail server',
|
|
allowAllOutbound: true,
|
|
});
|
|
|
|
// Allow SSH
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(22), 'Allow SSH access');
|
|
|
|
// Mail Protocols (SMTP, SMTPS, Submission)
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(25), 'Allow SMTP');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(465), 'Allow SMTPS');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(587), 'Allow SMTP Submission');
|
|
|
|
// Mail Protocols (IMAP, IMAPS)
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(143), 'Allow IMAP');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(993), 'Allow IMAPS');
|
|
|
|
// Web Traffic (HTTP, HTTPS for Admin UI & Webmail / SSL certificates)
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(80), 'Allow HTTP');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), 'Allow HTTPS');
|
|
|
|
// WireGuard VPN
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.udp(51820), 'Allow WireGuard VPN');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(51821), 'Allow WireGuard Web UI');
|
|
|
|
// Create IAM Role for EC2 Instance (to allow CloudWatch Agent to write logs & metrics)
|
|
const role = new iam.Role(this, 'internalsRole', {
|
|
assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
|
|
managedPolicies: [
|
|
iam.ManagedPolicy.fromAwsManagedPolicyName('CloudWatchAgentServerPolicy'),
|
|
],
|
|
});
|
|
|
|
// 3. Define the EC2 Instance (t4g.medium)
|
|
const instance = new ec2.Instance(this, 'internalsInstance', {
|
|
vpc,
|
|
vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
|
|
instanceType: ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.MEDIUM),
|
|
machineImage: ec2.MachineImage.fromSsmParameter(
|
|
'/aws/service/canonical/ubuntu/server/24.04/stable/current/arm64/hvm/ebs-gp3/ami-id'
|
|
),
|
|
securityGroup,
|
|
role,
|
|
keyName: 'vignesh_tipro',
|
|
detailedMonitoring: true,
|
|
blockDevices: [
|
|
{
|
|
deviceName: '/dev/sda1',
|
|
volume: ec2.BlockDeviceVolume.ebs(50, { // 50GB Root Volume
|
|
volumeType: ec2.EbsDeviceVolumeType.GP3,
|
|
}),
|
|
},
|
|
],
|
|
});
|
|
|
|
// 4. Structured User Data installation
|
|
instance.addUserData(
|
|
// Ensure folder structures exist
|
|
'mkdir -p /home/ubuntu/basic_requirements',
|
|
'mkdir -p /home/ubuntu/wireguard',
|
|
'mkdir -p /home/ubuntu/email_server',
|
|
'mkdir -p /home/ubuntu/build_tools',
|
|
|
|
// 4.1 Write and run installation for basic requirements (Docker, Python 3, etc.)
|
|
'cat <<\'EOF\' > /home/ubuntu/basic_requirements/install.sh',
|
|
'#!/bin/bash',
|
|
'set -e',
|
|
'apt-get update -y',
|
|
'apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release wget python3 python3-pip python3-venv git',
|
|
'mkdir -m 0755 -p /etc/apt/keyrings',
|
|
'curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg',
|
|
'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null',
|
|
'apt-get update -y',
|
|
'apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin',
|
|
'systemctl enable docker',
|
|
'systemctl start docker',
|
|
'EOF',
|
|
'chmod +x /home/ubuntu/basic_requirements/install.sh',
|
|
'/home/ubuntu/basic_requirements/install.sh',
|
|
|
|
// 4.2 Set up Wireguard
|
|
'cat <<\'EOF\' > /home/ubuntu/wireguard/docker-compose.yml',
|
|
'services:',
|
|
' wg-easy:',
|
|
' image: weejewel/wg-easy',
|
|
' container_name: wg-easy',
|
|
' environment:',
|
|
' - WG_HOST=13.205.93.190',
|
|
' - PASSWORD=admin123',
|
|
' volumes:',
|
|
' - ./config:/etc/wireguard',
|
|
' ports:',
|
|
' - "51820:51820/udp"',
|
|
' - "51821:51821/tcp"',
|
|
' cap_add:',
|
|
' - NET_ADMIN',
|
|
' - SYS_MODULE',
|
|
' sysctls:',
|
|
' - net.ipv4.ip_forward=1',
|
|
' - net.ipv4.conf.all.src_valid_mark=1',
|
|
' restart: unless-stopped',
|
|
'EOF',
|
|
'cd /home/ubuntu/wireguard && docker compose up -d',
|
|
|
|
// 4.3 Set up Mailcow (Email Server)
|
|
'cat <<\'EOF\' > /home/ubuntu/email_server/install_mailcow.sh',
|
|
'#!/bin/bash',
|
|
'set -e',
|
|
'cd /home/ubuntu/email_server',
|
|
'git clone https://github.com/mailcow/mailcow-dockerized.git mailcow',
|
|
'cd mailcow',
|
|
'# Run generate_config.sh non-interactively for mail.tiproemail.com, timezone UTC',
|
|
'export MAILCOW_HOSTNAME="mail.tipro.in"',
|
|
'export MAILCOW_TZ="Asia/Kolkata"',
|
|
'# Pipe answers to generate_config.sh: Hostname (mail.tipro.in), Timezone (Asia/Kolkata), Stable Branch (1)',
|
|
'echo -e "mail.tipro.in\nAsia/Kolkata\n1" | ./generate_config.sh',
|
|
'',
|
|
'# Apply Memory Optimizations for t4g.medium (4GB RAM)',
|
|
'# Disable ClamAV (Saves ~1.5 GB RAM)',
|
|
'sed -i "s/SKIP_CLAMAV=n/SKIP_CLAMAV=y/g" mailcow.conf',
|
|
'# Disable Solr (Saves ~1 GB RAM)',
|
|
'sed -i "s/SKIP_SOLR=n/SKIP_SOLR=y/g" mailcow.conf',
|
|
'',
|
|
'# Start Mailcow',
|
|
'docker compose up -d',
|
|
'EOF',
|
|
'chmod +x /home/ubuntu/email_server/install_mailcow.sh',
|
|
'/home/ubuntu/email_server/install_mailcow.sh',
|
|
|
|
// 4.4 Setup permissions for all user folders
|
|
'chown -R ubuntu:ubuntu /home/ubuntu/basic_requirements',
|
|
'chown -R ubuntu:ubuntu /home/ubuntu/wireguard',
|
|
'chown -R ubuntu:ubuntu /home/ubuntu/email_server',
|
|
'chown -R ubuntu:ubuntu /home/ubuntu/build_tools',
|
|
|
|
// 4.5 Install CloudWatch Agent (ARM64 package for Graviton instance)
|
|
'wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb',
|
|
'dpkg -i -E ./amazon-cloudwatch-agent.deb',
|
|
'mkdir -p /opt/aws/amazon-cloudwatch-agent/etc',
|
|
'cat <<\'EOF\' > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json',
|
|
'{',
|
|
' "agent": {',
|
|
' "metrics_collection_interval": 60,',
|
|
' "run_as_user": "root"',
|
|
' },',
|
|
' "metrics": {',
|
|
' "metrics_collected": {',
|
|
' "disk": {',
|
|
' "measurement": ["used_percent"],',
|
|
' "metrics_collection_interval": 60,',
|
|
' "resources": ["/"]',
|
|
' },',
|
|
' "mem": {',
|
|
' "measurement": ["mem_used_percent"],',
|
|
' "metrics_collection_interval": 60',
|
|
' }',
|
|
' }',
|
|
' },',
|
|
' "logs": {',
|
|
' "logs_collected": {',
|
|
' "files": {',
|
|
' "collect_list": [',
|
|
' {',
|
|
' "file_path": "/var/lib/docker/containers/*/*.log",',
|
|
' "log_group_name": "WireGuard-Logs",',
|
|
' "log_stream_name": "{instance_id}",',
|
|
' "retention_in_days": 7',
|
|
' }',
|
|
' ]',
|
|
' }',
|
|
' }',
|
|
' }',
|
|
'}',
|
|
'EOF',
|
|
'/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json'
|
|
);
|
|
|
|
// 5. Associate your pre-created Elastic IP using its Allocation ID
|
|
new ec2.CfnEIPAssociation(this, 'internalsEIPAssociation', {
|
|
allocationId: 'eipalloc-06bea32c3a787c2b1',
|
|
instanceId: instance.instanceId,
|
|
});
|
|
|
|
// Outputs
|
|
new cdk.CfnOutput(this, 'internalsPublicIP', {
|
|
value: '13.205.93.190',
|
|
description: 'The Elastic IP address of your Mail Server',
|
|
});
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|