PHP stack template for AWS Cloudformation¶

# -*- coding: utf-8 -*-
from __future__ import print_function
import troposphere.ec2 as ec2
import os
from troposphere import Base64, Join, ImportValue
from troposphere import Parameter, Ref, Tags, Template
from troposphere.ec2 import SecurityGroupRule, SecurityGroup

#
# Troposphere template - https://github.com/cloudtools/troposphere
#

#
# ┌───────────────────────────────────────────────────────────────────────────┐
# │                         Template & Parameters                             │
# └───────────────────────────────────────────────────────────────────────────┘
#
template = Template()
template.add_description("PHP stack | anil.io")


def make_name(component_name):
    return Join('', [component_name, ' - ', Ref('AWS::StackName')])


#
# Linux AMI ID - We build of a AWS AMI, create your own image and add it here
#
LinuxAmi = template.add_parameter(Parameter(
    "LinuxAmi",
    Type="AWS::EC2::Image::Id",
    Description="The AMI ID for our Linux Web server instance. (default: Amazon Linux AMI 2017 - ami-489f8e2c)",
    Default="ami-489f8e2c",
))

#
# ┌───────────────────────────────────────────────────────────────────────────┐
# │                               SSH Key pair                                │
# │     1) add keypair via AWS Console        2) reference it here            │
# └───────────────────────────────────────────────────────────────────────────┘
#
keyname_param = template.add_parameter(Parameter(
    "KeyPairName",
    Description="Name of an existing EC2 KeyPair to enable SSH access to the instance",
    Type="AWS::EC2::KeyPair::KeyName",
    Default="nld_aws_london"
))


#
# ┌───────────────────────────────────────────────────────────────────────────┐
# │                              Security Groups                              │
# │ When creating a Security Group, a default "Main" group is also created.   │
# │ We can ignore the empty group, we provide our own.                        │
# └───────────────────────────────────────────────────────────────────────────┘
#
instanceSecurityGroup = template.add_resource(
    SecurityGroup(
        'InstanceSecurityGroup',
        GroupDescription='Enable EC2 HTTP, HTTPS',
        SecurityGroupIngress=[
            # SSH
            SecurityGroupRule(IpProtocol='tcp', FromPort='22', ToPort='22', CidrIp='0.0.0.0/0'),

            # HTTP
            SecurityGroupRule(IpProtocol='tcp', FromPort='80', ToPort='80', CidrIp='0.0.0.0/0'),

            # HTTPS
            SecurityGroupRule(IpProtocol='tcp', FromPort='443', ToPort='443', CidrIp='0.0.0.0/0'),

            # Github - https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/
            # SecurityGroupRule(IpProtocol='tcp', FromPort='9418', ToPort='9418', CidrIp='192.30.252.0/22'),
        ],
        VpcId=ImportValue('VPC'),
        Tags=Tags(Name=make_name('Linux Web Server Sec-Group'))
    )
)


#
# ┌───────────────────────────────────────────────────────────────────────────┐
# │                               EC2 Instance                                │
# └───────────────────────────────────────────────────────────────────────────┘
#
# We have 1 instance. Linux (Amazon Linux AMI) built from an AMI
# You should create and setup this instance manually and reference it here
#
# An Elastic IP (required to expose it publicly), must be launched within a
# Subnet with an IGW. To expose a server publicly we need to have one of:
#
#   a) An elastic IP
#   b) An Elastic Load Balancer serving traffic to our instance
#
# View UserData files and output here:
#   cd /var/lib/cloud/instances/**/
#   /var/log/cloud-init-output.log
#

user_data_v_host = """ cat << EOF > /etc/httpd/conf.d/virtualhosts.conf
<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    <Directory "/var/www/html">
        AuthType Basic
        AuthName "Restricted Content"
        AuthUserFile /var/www/html/.htpasswd
        Require valid-user
    </Directory>
</VirtualHost>
EOF"""

user_data_bashrc = """ cat << EOF >> /home/ec2-user/.bashrc

# User
export PATH=./bin:$PATH
alias l='ls -alh'

# .pm2
export USER=ec2-user
export HOME=/home/ec2-user
export PM2_HOME=/home/ec2-user/.pm2
EOF"""

ec2_instance = template.add_resource(ec2.Instance(
    "Ec2Instance",
    ImageId=Ref(LinuxAmi),
    InstanceType="t2.small",
    KeyName=Ref(keyname_param),
    SecurityGroupIds=[Ref(instanceSecurityGroup)],
    SubnetId=ImportValue('Subnet1'),
    Tags=Tags(Name=make_name('Linux Web Server')),
    UserData=Base64(Join('', [
        "#!/bin/bash\n"

        # Set the timezone - picked up on next reboot
        "sed -i '/ZONE=\"UTC\"/c\ZONE=\"Europe/London\"' /etc/sysconfig/clock \n",
        "ln -sf /usr/share/zoneinfo/Europe/London /etc/localtime\n",

        "echo [UserData] Updating Packages\n",
        "yum update -y\n",

        # Update bashrc with exports
        user_data_bashrc,
        ". /home/ec2-user/.bashrc\n",

        "echo [UserData] Installing LAMP\n",
        "yum install -y httpd24 php56 mysql56-server php56-mysqlnd php56-intl git\n",

        # Set PHP timezone
        "sed -i \'/date.timezone =.*/a date.timezone = Europe\/London\' /etc/php.ini\n",

        "service httpd start\n",
        "chkconfig httpd on\n",

        # Add a www group and add ec2-user to that group.
        "groupadd www\n",
        "usermod -a -G www ec2-user\n",
        "chown -R ec2-user:www /var/www\n",
        "chmod 2775 /var/www\n",
        "find /var/www -type d -exec chmod 2775 {} +\n",
        "find /var/www -type f -exec chmod 0664 {} +\n",
        "echo \"<?php phpinfo(); ?>\" > /var/www/html/phpinfo.php\n",

        # Add .htpasswd with user:pass demo:demo
        "echo 'demo:$apr1$SHoPBfcN$httsSshmBhTe2pTOybwl3.' > /var/www/html/.htpasswd\n"
        "touch /etc/httpd/conf.d/virtualhosts.conf\n"
        "mkdir /var/www/html/logs\n"
        "APACHE_LOG_DIR=/var/www/html/logs\n",

        user_data_v_host,

        "\nservice httpd restart\n"

        # # Install Composer
        # "curl -sS https://getcomposer.org/installer | php\n",
        # "mv composer.phar /usr/bin/composer\n",
        # "chmod +x /usr/bin/composer\n",
        # "mkdir -p /home/ec2-user/.composer\n",

        # # Install Redis
        # "sudo yum-config-manager --enable epel -y\n",
        # "sudo yum install redis -y\n",
        # "sudo yum-config-manager --disable epel -y\n",
        # "sudo service redis start -y\n",

        # # Install Node.js - v6.x - http://stackoverflow.com/a/35165401/711308
        # "curl --silent --location https://rpm.nodesource.com/setup_6.x | bash -\n",
        # "sudo yum -y install nodejs npm\n\n",

        # Go to: http://dev.lakhman.com/phpinfo.php
        ]
     ))
))

#
# Associate our ElasticIP (from Domain-Stack) to our instance
#
eip_association = template.add_resource(ec2.EIPAssociation(
    "EIPEC2Association",
    EIP=ImportValue('ElasticIP'),
    InstanceId=Ref(ec2_instance),
))


#
# ┌───────────────────────────────────────────────────────────────────────────┐
# │                                 JSON DUMP                                 │
# └───────────────────────────────────────────────────────────────────────────┘
#
with open(os.path.realpath(__file__)[:-2] + 'json', 'w') as the_file:
    print(template.to_json(), file=the_file)
    print('Generated: ' + __file__)