122 lines
4.9 KiB
TypeScript
122 lines
4.9 KiB
TypeScript
import * as cdk from 'aws-cdk-lib';
|
|
import { Construct } from 'constructs';
|
|
import * as ec2 from 'aws-cdk-lib/aws-ec2';
|
|
|
|
export class AwsCdkStack extends cdk.Stack {
|
|
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
|
|
super(scope, id, props);
|
|
|
|
// 1. Look up the existing Default VPC (Free, avoids NAT Gateway charges)
|
|
const vpc = ec2.Vpc.fromLookup(this, 'DefaultVpc', {
|
|
isDefault: true,
|
|
});
|
|
|
|
// 2. Create a Security Group for the Mail Server
|
|
const securityGroup = new ec2.SecurityGroup(this, 'MailServerSG', {
|
|
vpc,
|
|
description: 'Security Group for self-hosted mail server',
|
|
allowAllOutbound: true,
|
|
});
|
|
|
|
// Allow SSH
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(22), 'Allow SSH access');
|
|
|
|
// Mail Protocols (SMTP, SMTPS, Submission)
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(25), 'Allow SMTP');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(465), 'Allow SMTPS');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(587), 'Allow SMTP Submission');
|
|
|
|
// Mail Protocols (IMAP, IMAPS)
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(143), 'Allow IMAP');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(993), 'Allow IMAPS');
|
|
|
|
// Web Traffic (HTTP, HTTPS for Admin UI & Webmail / SSL certificates)
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(80), 'Allow HTTP');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), 'Allow HTTPS');
|
|
|
|
// WireGuard VPN
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.udp(51820), 'Allow WireGuard VPN');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(51821), 'Allow WireGuard Web UI');
|
|
|
|
// 3. Define the EC2 Instance (t3.medium recommended for running ClamAV/Rspamd)
|
|
const instance = new ec2.Instance(this, 'MailServerInstance', {
|
|
vpc,
|
|
vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
|
|
instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.MICRO),
|
|
machineImage: ec2.MachineImage.fromSsmParameter(
|
|
'/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id'
|
|
),
|
|
securityGroup,
|
|
keyName: 'vignesh_tipro',
|
|
blockDevices: [
|
|
{
|
|
deviceName: '/dev/sda1',
|
|
volume: ec2.BlockDeviceVolume.ebs(60, { // 60GB Root Volume
|
|
volumeType: ec2.EbsDeviceVolumeType.GP3,
|
|
}),
|
|
},
|
|
],
|
|
});
|
|
|
|
// 4. Install Docker, Docker Compose, and Run wg-easy
|
|
instance.addUserData(
|
|
'apt-get update -y',
|
|
'apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release',
|
|
'mkdir -m 0755 -p /etc/apt/keyrings',
|
|
'curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg',
|
|
'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null',
|
|
'apt-get update -y',
|
|
'apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin',
|
|
'systemctl enable docker',
|
|
'systemctl start docker',
|
|
// Setup wireguard directory and fetch Elastic IP dynamically using IMDSv2
|
|
'mkdir -p /home/ubuntu/wireguard',
|
|
'cd /home/ubuntu/wireguard',
|
|
'TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")',
|
|
'PUBLIC_IP=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-ipv4)',
|
|
// Write the docker-compose.yml file substituting the resolved public Elastic IP
|
|
'cat <<EOF > docker-compose.yml',
|
|
'services:',
|
|
' wg-easy:',
|
|
' image: weejewel/wg-easy',
|
|
' container_name: wg-easy',
|
|
' environment:',
|
|
' - WG_HOST=${PUBLIC_IP}',
|
|
' - PASSWORD=admin123',
|
|
' volumes:',
|
|
' - ./config:/etc/wireguard',
|
|
' ports:',
|
|
' - "51820:51820/udp"',
|
|
' - "51821:51821/tcp"',
|
|
' cap_add:',
|
|
' - NET_ADMIN',
|
|
' - SYS_MODULE',
|
|
' sysctls:',
|
|
' - net.ipv4.ip_forward=1',
|
|
' - net.ipv4.conf.all.src_valid_mark=1',
|
|
' restart: unless-stopped',
|
|
'EOF',
|
|
// Start the container and adjust directory permissions
|
|
'docker compose up -d',
|
|
'chown -R ubuntu:ubuntu /home/ubuntu/wireguard'
|
|
);
|
|
|
|
|
|
// 5. Provision Elastic IP and Associate with EC2
|
|
const eip = new ec2.CfnEIP(this, 'MailServerEIP', {
|
|
domain: 'vpc',
|
|
});
|
|
|
|
new ec2.CfnEIPAssociation(this, 'MailServerEIPAssociation', {
|
|
allocationId: eip.attrAllocationId,
|
|
instanceId: instance.instanceId,
|
|
});
|
|
|
|
// Outputs
|
|
new cdk.CfnOutput(this, 'MailServerPublicIP', {
|
|
value: eip.ref,
|
|
description: 'The Elastic IP address of your Mail Server',
|
|
});
|
|
}
|
|
}
|
|
|