thumbor.cloudformation.yml

---
Parameters:
  KeyName:
    Type: String
    Default: nikolas
  ThumborSubnets:
    Type: CommaDelimitedList
    Default: subnet-063c705f, subnet-bd6155ca, subnet-fb2c209e
  ALBSubnets:
    Type: CommaDelimitedList
    Default: subnet-063c705f, subnet-bd6155ca, subnet-fb2c209e
  MinSize:
    Type: Number
    Default: 1
  MaxSize:
    Type: Number
    Default: 2
  VPC:
    Type: String
    Default: vpc-ff84de9a
  AMIID:
    Type: String
    Default: ami-0541bd7c
  SecurityKey:
    Type: String
    Default: 'MY_SECURE_KEY'
    NoEcho: true
  CDNAlias:
    Type: String
    Default: images.phz.cloud
Resources:
  ALBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: allow access to ALB from internet
      VpcId:
        Ref: VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '80'
        ToPort: '80'
        CidrIp: 0.0.0.0/0
  ThumborSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: allow access to thumbor from ALB
      VpcId:
        Ref: VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '8888'
        ToPort: '8888'
        SourceSecurityGroupId:
          Ref: ALBSecurityGroup
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: 0.0.0.0/0
  ImageBucket:
    Type: "AWS::S3::Bucket"
  ThumborRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "ec2.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        -
          PolicyName: "allow-image-bucket"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action: "s3:*"
                Resource: !Sub arn:aws:s3:::${ImageBucket}/*
  ThumborInstanceProfile:
    Type: "AWS::IAM::InstanceProfile"
    Properties:
      Roles:
        - Ref: ThumborRole
  ThumborLaunchConfig:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      # AssociatePublicIpAddress: true
      ImageId:
        Ref: AMIID
      InstanceType: t2.medium
      KeyName:
        Ref: KeyName
      SecurityGroups:
        - Ref: ThumborSecurityGroup
      IamInstanceProfile:
        Ref: ThumborInstanceProfile
      UserData:
        "Fn::Base64":
          !Sub |
            #!/bin/bash -xe
            sed -i 's/__AWS_REGION__/${AWS::Region}/' /etc/thumbor.conf
            sed -i 's/__IMAGE_BUCKET__/${ImageBucket}/' /etc/thumbor.conf
            sed -i 's/__SECURITY_KEY__/${SecurityKey}/' /etc/thumbor.conf
            systemctl restart thumbor.service
  ThumborASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      HealthCheckType: ELB
      HealthCheckGracePeriod: 300
      MinSize:
        Ref: MinSize
      MaxSize:
        Ref: MaxSize
      LaunchConfigurationName:
        Ref: ThumborLaunchConfig
      VPCZoneIdentifier:
        Ref: ThumborSubnets
      TargetGroupARNs:
        - Ref: ALBTargetGroup
      Tags:
        - Key: Name
          Value: thumbor
          PropagateAtLaunch: true
  ALBListener:
    Type : AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        -
          Type: forward
          TargetGroupArn:
            Ref: ALBTargetGroup
      LoadBalancerArn:
        Ref: ApplicationLoadBalancer
      Port: 80
      Protocol: HTTP
  ApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internet-facing
      Subnets:
        Ref: ALBSubnets
      SecurityGroups:
        - Ref: ALBSecurityGroup
  ALBTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 30
      UnhealthyThresholdCount: 2
      HealthyThresholdCount: 2
      HealthCheckPath: /healthcheck
      Port: 8888
      Protocol: HTTP
      VpcId:
        Ref: VPC
  CDN:
    Type: "AWS::CloudFront::Distribution"
    Properties:
      DistributionConfig:
        Aliases:
          - !Ref CDNAlias
        Enabled: yes
        Origins:
        - DomainName: !GetAtt ApplicationLoadBalancer.DNSName
          Id: thumbor
          CustomOriginConfig:
            HTTPPort: '80'
            HTTPSPort: '443'
            OriginProtocolPolicy: http-only
        DefaultCacheBehavior:
          TargetOriginId: thumbor
          DefaultTTL: 15552000
          SmoothStreaming: 'false'
          ForwardedValues:
            QueryString: 'false'
            Cookies:
              Forward: none
          ViewerProtocolPolicy: allow-all
Outputs:
  DirectThumborUrl:
    Description: Thumbor URL
    Value: !GetAtt ApplicationLoadBalancer.DNSName
  CDNThumborUrl:
    Description: Thumbor URL
    Value: !GetAtt CDN.DomainName
  ImageBucket:
    Description: S3 Bucket for source images
    Value: !Ref ImageBucket