kestrel.json

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "Launches a Kestrel stack",

  "Parameters" : {
    "InstanceType" : {
      "Description" : "EC2 instance type",
      "Type" : "String",
      "Default" : "m1.small",
      "AllowedValues" : ["m1.small","m1.medium","m1.large","m1.xlarge","m3.medium","m3.large","m3.xlarge","m3.2xlarge","c1.medium","c1.xlarge","c3.large","c3.xlarge","c3.2xlarge","c3.4xlarge","c3.8xlarge","cc2.8xlarge","m2.xlarge","m2.2xlarge","m2.4xlarge","r3.large","r3.xlarge","r3.2xlarge","r3.4xlarge","r3.8xlarge","cr1.8xlarge","hi1.4xlarge","hs1.8xlarge","i2.xlarge","i2.2xlarge","i2.4xlarge","i2.8xlarge","t1.micro","cg1.4xlarge","g2.2xlarge"],
      "ConstraintDescription" : "must be a valid EC2 instance type."
    },
    "KeyName" : {
      "Description" : "Name of an existing EC2 KeyPair to enable SSH access to the instances",
      "Type" : "String"
    },
    "KestrelDockerImage" : {
      "Description" : "Path to the Kestrel image to use (format: '[<registry>[:<port>]/]<repository>[:<version>]')",
      "Type" : "String",
      "Default" : "thefactory/kestrel:2.4.2"
    },
    "Subnets" : {
      "Description" : "List of VPC subnet IDs for the cluster. Note: must match the passed AvailabilityZones.",
      "Type" : "CommaDelimitedList"
    },
    "VpcId" : {
      "Description" : "VPC associated with the provided subnets",
      "Type" : "String"
    },
    "AdminSecurityGroup" : {
      "Description" : "Existing security group that should be granted administrative access (e.g., 'sg-123456')",
      "Type" : "String"
    },
    "AvailabilityZones": {
      "Description" : "(Optional) If passed, only launch nodes in these AZs (e.g., 'us-east-1a,us-east-1b'). Note: these must match the passed Subnets.",
      "Type" : "CommaDelimitedList",
      "Default" : ""
    }
  },

  "Conditions" : {
    "UseAllAvailabilityZones" : {"Fn::Equals" : [{ "Fn::Join" : ["", {"Ref" : "AvailabilityZones"} ]}, ""]}
  },

  "Mappings" : {
    "RegionMap" : {
      "us-east-1" : {
        "AMI" : "ami-f40bbe9c"
      },
      "us-west-1" : {
        "AMI" : "ami-cfe2ea8a"
      },
      "us-west-2" : {
        "AMI" : "ami-3fb1f20f"
      },
      "eu-west-1" : {
        "AMI" : "ami-e0d27397"
      },
      "ap-southeast-1" : {
        "AMI" : "ami-8a7057d8"
      },
      "ap-southeast-2" : {
        "AMI" : "ami-d5c1a2ef"
      },
      "ap-northeast-1" : {
        "AMI" : "ami-a7def7a6"
      },
      "sa-east-1" : {
        "AMI" : "ami-070fa51a"
      }
    }
  },

  "Resources" : {

    "IAMUser" : {
      "Type" : "AWS::IAM::User",
      "Properties" : {
        "Policies" : [{
          "PolicyName" : "IAMAccess",
          "PolicyDocument" : {
            "Statement" : [{
              "Effect"    : "Allow",
              "NotAction" : "iam:*",
              "Resource"  : "*"
            }]
          }
        }]
      }
    },

    "HostKeys" : {
      "Type" : "AWS::IAM::AccessKey",
      "Properties" : {
        "UserName" : { "Ref" : "IAMUser" }
      }
    },

    "ServerGroup" : {
      "Type" : "AWS::AutoScaling::AutoScalingGroup",
      "Properties" : {
        "AvailabilityZones" : {
          "Fn::If" : [
            "UseAllAvailabilityZones",
            { "Fn::GetAZs": "" },
            {"Ref" : "AvailabilityZones"}
          ]
        },
        "LaunchConfigurationName" : { "Ref" : "LaunchConfig" },
        "MinSize" : 1,
        "MaxSize" : 1,
        "DesiredCapacity" : 1,
        "VPCZoneIdentifier" : { "Ref" : "Subnets" }
      }
    },

    "LaunchConfig" : {
      "Type" : "AWS::AutoScaling::LaunchConfiguration",
      "Properties" : {
        "KeyName" : { "Ref" : "KeyName" },
        "ImageId" : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "AMI"] },
        "SecurityGroups" : [ { "Ref" : "ServerSecurityGroup" }, { "Ref" : "AdminSecurityGroup" } ],
        "AssociatePublicIpAddress": "true",
        "InstanceType" : { "Ref" : "InstanceType" },
        "UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
          "#!/bin/bash -ex\n",

          "# Helper function\n",
          "function error_exit\n",
          "{\n",
          "  cfn-signal -e 1 -r \"$1\" '", { "Ref" : "WaitHandle" }, "'\n",
          "  exit 1\n",
          "}\n",

          "# Set up Kestrel\n",
          "mkdir -p /var/lib/kestrel\n",
          "docker run -d --restart=always",
          "   -p 2222:2222",
          "   -p 2223:2223",
          "   -p 2229:2229",
          "   -p 22133:22133",
          "   -v /var/lib/kestrel:/data",
          " ", { "Ref" : "KestrelDockerImage"}, " ",
          "|| error_exit 'Failed to launch Docker container'\n",

          "# All is well so signal success\n",
          "cfn-signal -e 0 -r \"Stack setup complete\" '", { "Ref" : "WaitHandle" }, "'\n",

          "#EOF"
        ]]}}
      }
    },

    "ClientSecurityGroup" : {
      "Type" : "AWS::EC2::SecurityGroup",
      "Properties" : {
        "GroupDescription" : "For kestrel clients. Grants access to kestrel ports.",
        "VpcId" : { "Ref" : "VpcId" }
      }
    },

    "ServerSecurityGroup" : {
      "Type" : "AWS::EC2::SecurityGroup",
      "Properties" : {
        "GroupDescription" : "Kestrel servers",
        "VpcId" : { "Ref" : "VpcId" },
        "SecurityGroupIngress" :  [ 
            { "IpProtocol" : "tcp", "FromPort" : "2222", "ToPort" : "2222", "SourceSecurityGroupId" : { "Ref" : "ClientSecurityGroup"} },
            { "IpProtocol" : "tcp", "FromPort" : "2229", "ToPort" : "2229", "SourceSecurityGroupId" : { "Ref" : "ClientSecurityGroup"} },
            { "IpProtocol" : "tcp", "FromPort" : "22133", "ToPort" : "22133", "SourceSecurityGroupId" : { "Ref" : "ClientSecurityGroup"} }
        ]
      }
    },

    "WaitHandle" : {
      "Type" : "AWS::CloudFormation::WaitConditionHandle"
    }
  },

  "Outputs" : {
    "ClientSecurityGroup" : {
      "Value" : { "Ref" : "ClientSecurityGroup" }
    }
  }
}