serverless.yml

service: wagtaillwa

package:  # TODO package each function individually
  exclude:
    - 'node_modules/**'
    - 'db/**'
    - 'media/**'
    - Dockerfile
    - Makefile
    - package-lock.json
    - package.json
    - README.rst
    - TODO.rst

provider:
  name: aws
  region: eu-west-3
  memorySize: 2048 # optional, in MB, default is 1024
  timeout: 60
  ecr:
    images:
      wagtaillwa:
        path: ./
        platform: linux/amd64   # my Mac M1 builds ARM by default,
  iam:
    role:
      statements:
        # See django-storages doc
        - Effect: Allow
          Action:
            - s3:ListBucket
            - s3:GetBucketLocation
            - s3:ListBucketMultipartUploads # needed?
            - s3:ListBucketVersions         # needed?
          Resource: 
            - !Sub ${S3Media.Arn}     # BUCKET
        - Effect: Allow
          Action:
            - s3:DeleteObject
            - s3:GetObject
            - s3:GetObjectAcl
            - s3:PutObject
            - s3:PutObjectAcl
            - s3:ListMultipartUploadParts # needed?
            - s3:AbortMultipartUpload     # needed?
          Resource:
            - !Sub ${S3Media.Arn}/* # OBJECTS
  vpc:  # Put Lambda in the VPC with Aurora.
    securityGroupIds:
      - !Ref SecurityGroupLambda
    subnetIds:
      - !Ref PublicSubnet1
      - !Ref PublicSubnet2

functions:
  # For Django-Storages, set its environment variables 
  s3check:
    environment: 
      AWS_STORAGE_BUCKET_NAME: !Ref S3Media # Bucket name, not DNS
    handler: s3check.handler
    runtime: python3.11
  # Connect to the DB Cluster endpoint, not the Instance. The Instance has an
  # undocumented ``DBName`` attribute, but the Cluster does not.
  wagtail:
    environment: 
      DATABASE_URL: !Sub "postgres://wagtail:ChangeMe@${DBCluster.Endpoint.Address}:${DBCluster.Endpoint.Port}/${DBInstance.DBName}"
      AWS_STORAGE_BUCKET_NAME: !Ref S3Media # Bucket name, not DNS
    image:
      name: ${self:service}
    url: true          # create a Lambda Function URL 
  wagtailjanitor:      # sets flag which start.sh uses to do maintenance
    environment: 
      DATABASE_URL: !Sub "postgres://wagtail:ChangeMe@${DBCluster.Endpoint.Address}:${DBCluster.Endpoint.Port}/${DBInstance.DBName}"
      AWS_STORAGE_BUCKET_NAME: !Ref S3Media
      # It always does createsuperuser, migrate, collectstatic
      WAGTAIL_JANITOR: s3check
    image:
      name: ${self:service}
    timeout: 180  # migration, collectstatic > 30 sec, wake up DB 30-35
    url: false    # run from CLI or web console, not API
  wagtailresetdb:
    environment:
      DATABASE_URL: !Sub "postgres://wagtail:ChangeMe@${DBCluster.Endpoint.Address}:${DBCluster.Endpoint.Port}/${DBInstance.DBName}"
      AWS_STORAGE_BUCKET_NAME: !Ref S3Media
      WAGTAIL_JANITOR: s3check reset_db load_data
    image:
      name: ${self:service}
    timeout: 180  # migration, collectstatic > 30 sec, wake up DB 30-35
    url: false    # run from CLI or web console, not API


# VPC, Aurora Serverless v1 DB, S3 Media 

resources:
  Resources:
    VPC:
      Type: AWS::EC2::VPC
      Properties:
        CidrBlock: 10.192.0.0/16
        EnableDnsSupport: true
        EnableDnsHostnames: true
        Tags:
          - Key: Name
            Value: !Ref AWS::StackName
    InternetGateway:
      Type: AWS::EC2::InternetGateway
      Properties:
        Tags:
          - Key: Name
            Value: !Ref AWS::StackName
    InternetGatewayAttachment:
      Type: AWS::EC2::VPCGatewayAttachment
      Properties:
        InternetGatewayId: !Ref InternetGateway
        VpcId: !Ref VPC
    PublicSubnet1:
      Type: AWS::EC2::Subnet
      Properties:
        VpcId: !Ref VPC
        AvailabilityZone: !Select [ 0, !GetAZs '' ]
        CidrBlock: 10.192.10.0/24
        MapPublicIpOnLaunch: true
        Tags:
          - Key: Name
            Value: !Sub ${AWS::StackName} Public Subnet (AZ1)
    PublicSubnet2:
      Type: AWS::EC2::Subnet
      Properties:
        VpcId: !Ref VPC
        AvailabilityZone: !Select [ 1, !GetAZs  '' ]
        CidrBlock: 10.192.11.0/24
        MapPublicIpOnLaunch: true
        Tags:
          - Key: Name
            Value: !Sub ${AWS::StackName} Public Subnet (AZ2)
    PublicRouteTable:
      Type: AWS::EC2::RouteTable
      Properties:
        VpcId: !Ref VPC
        Tags:
          - Key: Name
            Value: !Sub ${AWS::StackName} Public Routes
    DefaultPublicRoute:
      Type: AWS::EC2::Route
      DependsOn: InternetGatewayAttachment
      Properties:
        RouteTableId: !Ref PublicRouteTable
        DestinationCidrBlock: 0.0.0.0/0
        GatewayId: !Ref InternetGateway
    PublicSubnet1RouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        RouteTableId: !Ref PublicRouteTable
        SubnetId: !Ref PublicSubnet1
    PublicSubnet2RouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        RouteTableId: !Ref PublicRouteTable
        SubnetId: !Ref PublicSubnet2
    SecurityGroupLambda:
      Type: AWS::EC2::SecurityGroup
      Properties:
        GroupName: !Sub "${AWS::StackName}-lambda-sg"
        GroupDescription: "Security group marking the lambda instance"
        VpcId: !Ref VPC
    SecurityGroupDb:
      Type: AWS::EC2::SecurityGroup
      Properties:
        GroupName: !Sub "${AWS::StackName}-db-sg-2"
        GroupDescription: "Security group on DB allowing lambda access"
        SecurityGroupIngress:
          - IpProtocol: tcp
            SourceSecurityGroupId: !GetAtt SecurityGroupLambda.GroupId
            FromPort: 5432 # postgres
            ToPort:   5432
          - IpProtocol: tcp
            SourceSecurityGroupId: !GetAtt SecurityGroupLambda.GroupId
            FromPort: 3306 # mysql
            ToPort:   3306
        VpcId: !Ref VPC

    DBSubnetGroup:
      Type: AWS::RDS::DBSubnetGroup
      Properties:
        DBSubnetGroupDescription: Subnet for Database
        DBSubnetGroupName: !Sub "${AWS::StackName}-db-subnet-group"
        SubnetIds:
          - !Ref PublicSubnet1
          - !Ref PublicSubnet2
    DBCluster:
      Type: AWS::RDS::DBCluster
      Properties:
        Engine: aurora-postgresql
        EngineMode: provisioned  # Serverless v2 (v1 is deprecated)
        EngineVersion: 16.4  # v2 on PG>16.1, AWS default 16.4
        #EngineVersion: 13.16  # 13.1 used for v1 on PG<16.1, AWS default 13.16
        DatabaseName:        ${self:service}
        DBClusterIdentifier: ${self:service}
        DBSubnetGroupName:   !Ref DBSubnetGroup
        MasterUsername:      wagtail
        MasterUserPassword:  ChangeMe
        # DANGER: Aurora Serverless v1 defaults to 3306 for MySQL, 5432 for PG.
        # But for v2, it sets Postgres port to 3306, not 5432!
        Port: 5432  # Aurora Serverless v2 default PG DB to 3306 (MySQL!)
        ServerlessV2ScalingConfiguration:   # only for Serverless v2
          MaxCapacity: 2  # will this be enough for Wagtail? 4 seemed fine
          MinCapacity: 0  # MinACU=0 allows v2 to be paused when inactive
          SecondsUntilAutoPause: 300 # default is 300, requires MinCapacity=0
        VpcSecurityGroupIds:
          - !Ref SecurityGroupDb
    DBInstance: # required for v2
      Type: AWS::RDS::DBInstance
      Properties: 
        Engine: aurora-postgresql
        DBInstanceClass: db.serverless
        DBClusterIdentifier: !Ref DBCluster

    S3Media:
      Type: AWS::S3::Bucket
      Properties:
        # BucketName generated like: wagtaillwa-dev-s3media-12vbehqv6osgh
        CorsConfiguration:
          CorsRules:
          - AllowedHeaders: ['*']
            AllowedMethods: [GET]
            AllowedOrigins: ['*']
            ExposedHeaders: [Date]
            MaxAge: '300'
        PublicAccessBlockConfiguration: # needed to set acl=public-read
          BlockPublicAcls: false
        OwnershipControls:        # needed if we want to set acl=public-read
          Rules:
            - ObjectOwnership: ObjectWriter
        # LifecycleConfiguration:
        #   Rules:
        #     - Id: ExpireOldVersions
        #       Status: Enabled
        #       NoncurrentVersionExpirationInDays: 100
        # VersioningConfiguration:
        #   Status: Enabled
    S3VpcEndpoint:
      # Serverless created VPCEndpoint type=Interface: wagtail-dev but
      # we need this VPCE type=Gateway so Lambda in VPC can reach S3.
      # See https://www.alexdebrie.com/posts/aws-lambda-vpc/#set-up-a-vpc-endpoint-for-your-aws-service
      Type: AWS::EC2::VPCEndpoint
      Properties:
        RouteTableIds:
          - !Ref PublicRouteTable
        ServiceName: com.amazonaws.${self:provider.region}.s3
        VpcId: !Ref VPC