serverless.yml

service: docs-worker-pool-api
variablesResolutionMode: 20210326

plugins:
  - serverless-prune-plugin
  - serverless-iam-roles-per-function
  - serverless-esbuild
provider:
  name: aws
  runtime: nodejs18.x
  stage: ${opt:stage, 'stg'}
  iamRoleStatements:
    - Effect: Allow
      Action:
        - "ssm:PutParameter"
        - "ssm:GetParameter"
      Resource:
        - "*"
  deploymentBucket: ${self:custom.deploymentBucket.${opt:stage, 'stg'}}
  deploymentPrefix: serverless
  region: us-east-2
package:
  individually: true
  patterns:
    api/config/**
custom:
  esbuild:
    plugins: './api/config/plugins.js'

  deploymentBucket:
    dev: worker-pool-deployment
    stg: worker-pool-deployment
    prd: worker-pool-deployment
    dotcomstg: worker-pool-deployment
    dotcomprd: worker-pool-deployment
  searchIndexBucket:
    dev: "" # I'm just here so I don't get fined
    # TODO: When satisfied with manifest generation, remove the '-test'
    dotcomstg: docs-search-indexes-test/preprd
    dotcomprd: docs-search-indexes-test/prd
  fastlyDochubToken: ${ssm:/env/${self:provider.stage}/docs/worker_pool/fastly/docs/dochub/token}
  fastlyDochubServiceId: ${ssm:/env/${self:provider.stage}/docs/worker_pool/fastly/docs/dochub/service_id}
  fastlyDochubMap: ${ssm:/env/${self:provider.stage}/docs/worker_pool/fastly/dochub_map}
  docuhubEventSource:
    stg: aws.partner/mongodb.com/stitch.trigger/5e00b7afec293c6507679c4d
    prd: aws.partner/mongodb.com/stitch.trigger/5e00b7afec293c6507679c4d
    dev: aws.partner/mongodb.com/stitch.trigger/5e00b7afec293c6507679c4d
    dotcomstg: aws.partner/mongodb.com/stitch.trigger/5e00b7afec293c6507679c4d
    dotcomprd: aws.partner/mongodb.com/stitch.trigger/5e00b7afec293c6507679c4d
  dochubEventBus: arn:aws:events:${aws:region}:${aws:accountId}:event-bus/${self:custom.docuhubEventSource.${self:provider.stage}}
  dbUsername: ${ssm:/env/${self:provider.stage}/docs/worker_pool/atlas/username}
  dbPassword: ${ssm:/env/${self:provider.stage}/docs/worker_pool/atlas/password}
  dbName: ${ssm:/env/${self:provider.stage}/docs/worker_pool/atlas/dbname}
  snootyDbName: ${ssm:/env/${self:provider.stage}/docs/worker_pool/atlas/collections/snooty}
  dbhost: ${ssm:/env/${self:provider.stage}/docs/worker_pool/atlas/host}
  jobCollection:  ${ssm:/env/${self:provider.stage}/docs/worker_pool/atlas/collections/job/queue}
  entitlementCollection: ${ssm:/env/${self:provider.stage}/docs/worker_pool/atlas/collections/user/entitlements}
  repoBranchesCollection: ${ssm:/env/${self:provider.stage}/docs/worker_pool/atlas/collections/repo}
  docsetsCollection: ${ssm:/env/${self:provider.stage}/docs/worker_pool/atlas/collections/docsets}
  githubSecret: ${ssm:/env/${self:provider.stage}/docs/worker_pool/github/webhook/secret}
  githubDeletionSecret: ${ssm:/env/${self:provider.stage}/docs/worker_pool/github/webhook/deletionSecret}
  githubBotPW: ${ssm:/env/${self:provider.stage}/docs/worker_pool/github/bot/password}
  slackSecret: ${ssm:/env/${self:provider.stage}/docs/worker_pool/slack/webhook/secret}
  slackAuthToken: ${ssm:/env/${self:provider.stage}/docs/worker_pool/slack/auth/token}
  snootySecret: ${ssm:/env/${self:provider.stage}/docs/worker_pool/snooty/webhook/secret}
  featureFlagMonorepoPath: ${ssm:/env/${self:provider.stage}/docs/worker_pool/flag/monorepo_path}
  JobsQueueName: autobuilder-jobs-queue-${self:provider.stage}
  JobsDLQueueName: autobuilder-jobs-dlqueue-${self:provider.stage}
  JobUpdatesQueueName: autobuilder-job-updates-queue-${self:provider.stage}
  JobUpdatesDLQueueName: autobuilder-job-updates-dlqueue-${self:provider.stage}
  dashboardUrl:
    stg: https://workerpoolstaging-qgeyp.mongodbstitch.com/pages/job.html?collName=${self:custom.jobCollection}&jobId=
    prd: https://workerpool-boxgs.mongodbstitch.com/pages/job.html?collName=${self:custom.jobCollection}&jobId=
    dotcomstg: https://workerpoolstaging-qgeyp.mongodbstitch.com/pages/job.html?collName=${self:custom.jobCollection}&jobId=
    dotcomprd: https://workerpool-boxgs.mongodbstitch.com/pages/job.html?collName=${self:custom.jobCollection}&jobId=
    dev: https://workerpoolstaging-qgeyp.mongodbstitch.com/pages/job.html?collName=${self:custom.jobCollection}&jobId=
  env:
    stg: "staging"
    prd: "production"
    dev: "staging"
  jobsQueueUrl: https://sqs.${aws:region}.amazonaws.com/${aws:accountId}/${self:custom.JobsQueueName}
  jobUpdatesQueueUrl: https://sqs.${aws:region}.amazonaws.com/${aws:accountId}/${self:custom.JobUpdatesQueueName}
  cdnClientID: ${ssm:/env/${self:provider.stage}/docs/worker_pool/cdn/client/id}
  cdnClientSecret: ${ssm:/env/${self:provider.stage}/docs/worker_pool/cdn/client/secret}

default-env: &default-env
  STAGE: ${self:provider.stage}
  ENVIRONMENT: ${self:provider.stage}
  FASTLY_DOCHUB_MAP: ${self:custom.fastlyDochubMap}
  FASTLY_DOCHUB_SERVICE_ID: ${self:custom.fastlyDochubServiceId}
  FASTLY_DOCHUB_TOKEN: ${self:custom.fastlyDochubToken}
  GITHUB_WEBHOOK_SECRET: REPLACE-WITH-YOUR-SECRET-HERE
  NODE_CONFIG_DIR: './api/config'
  CDN_CLIENT_ID: ${self:custom.cdnClientID}
  CDN_CLIENT_SECRET: ${self:custom.cdnClientSecret}

webhook-env-core: &webhook-env-core
  STAGE: ${self:provider.stage}
  ENVIRONMENT: ${self:provider.stage}
  MONGO_ATLAS_USERNAME: ${self:custom.dbUsername}
  MONGO_ATLAS_PASSWORD: ${self:custom.dbPassword}
  MONGO_ATLAS_HOST: ${self:custom.dbhost}
  MONGO_ATLAS_URL: mongodb+srv://${self:custom.dbUsername}:${self:custom.dbPassword}@${self:custom.dbhost}/admin?retryWrites=true
  DB_NAME: ${self:custom.dbName}
  SNOOTY_DB_NAME: ${self:custom.snootyDbName}
  USER_ENTITLEMENT_COL_NAME: ${self:custom.entitlementCollection}
  JOB_QUEUE_COL_NAME: ${self:custom.jobCollection}
  GITHUB_SECRET: ${self:custom.githubSecret}
  GITHUB_DELETION_SECRET: ${self:custom.githubDeletionSecret}
  GITHUB_BOT_PASSWORD: ${self:custom.githubBotPW}
  REPO_BRANCHES_COL_NAME: ${self:custom.repoBranchesCollection}
  DOCSETS_COL_NAME: ${self:custom.docsetsCollection}
  SLACK_SECRET: ${self:custom.slackSecret}
  SLACK_TOKEN: ${self:custom.slackAuthToken}
  SNOOTY_SECRET: ${self:custom.snootySecret}
  FEATURE_FLAG_MONOREPO_PATH: ${self:custom.featureFlagMonorepoPath}
  DASHBOARD_URL: ${self:custom.dashboardUrl.${self:provider.stage}}
  NODE_CONFIG_DIR: './api/config'
  TASK_DEFINITION_FAMILY: docs-worker-pool-${self:provider.stage}
  JOB_UPDATES_QUEUE_URL: ${self:custom.jobUpdatesQueueUrl}
  JOBS_QUEUE_URL: ${self:custom.jobsQueueUrl}

resources:
  - ${file(./queues.yml)}

functions:
    v1GithubDeployRepo:
      handler: api/controllers/v1/github.TriggerBuild
      events:
        - http:
            path: /webhook/github/trigger/build
            method: POST
            cors: true
      environment:
        <<: *webhook-env-core

    v1DochubDeployRepo:
      handler: api/controllers/v1/dochub.TriggerBuild
      events:
        - http:
            path: /webhook/dochub/trigger/build
            method: POST
            cors: true
            public: true
      environment:
        <<: *webhook-env-core

    v1UpsertEdgeDictionaryItem:
      handler: api/controllers/v1/dochub.UpsertEdgeDictionaryItem
      events:
        - http:
            path: /webhook/dochub/trigger/upsert
            method: POST
            cors: true
            public: true
      environment:
        <<: *default-env

    v1SlackDisplayRepoOptions:
      handler: api/controllers/v1/slack.DisplayRepoOptions
      events:
        - http:
            path:  /webhook/slack/display/repos
            method: POST
            cors: true
      environment:
        <<: *webhook-env-core

    v1SlackDeployRepo:
      handler: api/controllers/v1/slack.DeployRepo
      events:
        - http:
            path: /webhook/slack/trigger/build
            method: POST
            cors: true
      iamRoleStatementsName: 'dwpapi-v1SlackDeployRepo-lr-${self:provider.region}-${self:provider.stage}'
      iamRoleStatements:
      - Effect: Allow
        Action:
          - "sqs:SendMessage"
        Resource:
          - "*"
      environment:
        <<: *webhook-env-core

    v1TriggerLocalBuild:
      handler: api/controllers/v1/jobs.TriggerLocalBuild
      events:
        - http:
            path: /webhook/local/trigger/build
            method: POST
            cors: true
            batchSize: 1
      iamRoleStatementsName: 'dwpapi-v1TriggerLocalBuild-lr-${self:provider.region}-${self:provider.stage}'
      iamRoleStatements:
        - Effect: Allow
          Action:
            - "sqs:SendMessage"
            - "sqs:GetQueueAttributes"
          Resource:
            - Fn::GetAtt: [AutobuilderJobUpdatesQueue, Arn]
            - Fn::GetAtt: [AutobuilderJobsQueue, Arn]
      environment:
        <<: *webhook-env-core

    v1HandleJobs:
      handler: api/controllers/v1/jobs.HandleJobs
      timeout: 180
      events:
        - sqs:
            arn: !GetAtt AutobuilderJobsQueue.Arn
            batchSize: 1
        - sqs:
            arn: !GetAtt AutobuilderJobUpdatesQueue.Arn
            batchSize: 1
      iamRoleStatementsName: 'dwpapi-v1HandleJobs-ecs-execution-lr-${self:provider.region}-${self:provider.stage}'
      iamRoleStatements:
      - Effect: Allow
        Action:
          - "sqs:ReceiveMessage"
          - "sqs:DeleteMessage"
          - "sqs:SendMessage"
          - "sqs:GetQueueAttributes"
        Resource:
          - Fn::GetAtt: [AutobuilderJobUpdatesQueue, Arn]
          - Fn::GetAtt: [JobUpdatesDLQ, Arn]
          - Fn::GetAtt: [AutobuilderJobsQueue, Arn]
          - Fn::GetAtt: [JobsDLQ, Arn]
      - Effect: Allow
        Action:
          - "ecs:RunTask"
          - "ecs:StopTask"
          - "ecs:DescribeTasks"
        Resource:
          - arn:aws:ecs:${aws:region}:${aws:accountId}:task-definition/docs-worker-pool-${self:provider.stage}:*
          - arn:aws:ecs:${aws:region}:${aws:accountId}:task/docs-worker-pool-${self:provider.stage}/*
      - Effect: Allow
        Action:
          - ecs:DescribeTaskDefinition
          - ecr:GetAuthorizationToken
          - ecr:BatchCheckLayerAvailability
          - ecr:GetDownloadUrlForLayer
          - ecr:BatchGetImage
        Resource: "*"
      - Effect: Allow
        Action:
          - iam:PassRole
        Resource: "*"
      - Effect: Allow
        Action:
          - batch:SubmitJob
        Resource:
          - arn:aws:batch:${aws:region}:${aws:accountId}:job-queue/docs-archive-${self:provider.stage}
          - arn:aws:batch:${aws:region}:${aws:accountId}:job-definition/docs-archive-${self:provider.stage}
          - arn:aws:batch:${aws:region}:${aws:accountId}:job-definition/docs-archive-${self:provider.stage}:*
      environment:
        <<: *webhook-env-core

    v1FailStuckJobs:
      handler: api/controllers/v1/jobs.FailStuckJobs
      events:
        - schedule: rate(8 hours)
      environment:
        <<: *webhook-env-core

    v1SnootyBuildComplete:
      handler: api/controllers/v1/jobs.SnootyBuildComplete
      events:
        - http:
            path: /webhook/snooty/trigger/complete
            method: POST
            cors: true
      environment:
        <<: *webhook-env-core
    
    v1GithubDeleteArtifacts:
      handler: api/controllers/v1/github.MarkBuildArtifactsForDeletion
      events:
        - http:
            path: /webhook/github/trigger/delete
            method: POST
            cors: true
      environment:
        <<: *webhook-env-core

Outputs:
  JobsQueueURL:
    Description: Jobs Queue Url
    Value: ${self:custom.jobsQueueUrl}
    Export:
      Name:  docs-worker-pool-${self:provider.stage}-jobs-queue

  JobsUpdateQueueURL:
    Description: Job updates Queue URL
    Value: ${self:custom.jobUpdatesQueueUrl}
    Export:
      Name: docs-worker-pool-${self:provider.stage}-job-updates-queue