bbb.config.yaml

# if you wish to figure out Ubuntu 16.04 ami within given region, ruby snippet below will help
#
# ami_name = 'ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-20200129'
# cannonical_id = '099720109477'
# regional_client = Aws::EC2::Client.new(region: region_name)
# regional_ami = regional_client.describe_images({ filters: [
#      { name: 'name', values: [ami_name] },
#      { name: 'owner-id', values: [cannonical_id] }
#  ] }).images[0].image_id

# Ubuntu 16.04 AMI, from cannonical within ap-southeast-2
image_id: ami-02d7e25c1cfdd5695

# VPC for BBB server is rendered by default. If you want to supply your
# own subnets through cfn parameter, set this to false.
render_vpc: true

# enable if you need ElasticIP provided to cloudformation, rather then passed in as a parameter
external_eip: false

# location for Greenlight web interface admin password
default_ssm_path: /bigbluebutton/config

# tags will be used to tag and backup instances
tags:
  Name: BigBlueButton-Server
  createdBy: 'https://github.com/toshke/'
  renderedBy: cfhighlander

# name for the backup plan
backup_plan_name: BigBlueButton

# default value for instance type parameter, applicable to both
# EC2 and ASG deployments
instance_type_default: t3.xlarge


# IAM policies for the instances
# IAM policies for the instance within AutoScalingGroup
# instance needs to manage Elastic IPs
policies:
  - PolicyName: EIPManage
    PolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Action:
            - ec2:DescribeAddresses
            - ec2:AssociateAddress
            - ec2:DisassociateAddress
          Resource: '*'
  - PolicyName: SSMStoreAdmin
    PolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Action:
            - ssm:PutParameter
          Resource:
            - Fn::Sub: 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter${ConfigSSMPath}/admin_password'
            - Fn::Sub: 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter${ConfigSSMPath}/admin_user'
            - Fn::Sub: 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter${ConfigSSMPath}/server_url'


# connect to instance using session manager
allow_ssh: false

# allow ports according to bbb doco
# if you want to ssh into instance instead of using SSM session manager add your home/work IP address and port 22 below,
# in addition to setting allow_ssh: true, which will add cloudformation parameter for ec2 key pair name
allow_incoming:
  - port: 443
    range: 0.0.0.0/0
    protocol: tcp
  - port: 80
    range: 0.0.0.0/0
    protocol: tcp
  - port: 16384-32768
    range: 0.0.0.0/0
    protocol: udp

# we need to be publicly accessible for bbb to work
# setting this to false you will need to make sure that route53 domain is resolvable on local network, and
# most likely you will be using private hosted zone
public_ip: true

# device mappings - encrypt by default, take size as parameter
# add any additional drives you may want to use as data drives. Any data drives should
# have DeleteOnTermination: false (aside from the fact they are backed up by AWS Backup)
device_mappings:
  - DeviceName: '/dev/sda1'
    Ebs:
      DeleteOnTermination: true
      Encrypted: true
      KmsKeyId: 'alias/aws/ebs'
      VolumeSize:
        Ref: RootVolumeSpace

# grace period of ASG health check
health_check_grace: 1800