serverless.yml

service: fantasy-calendar

provider:
  name: aws
  # The AWS region in which to deploy (us-east-1 is the default)
  region: us-east-1
  # The stage of the application, e.g. dev, production, staging… ('dev' is the default)
  stage: ${opt:stage, 'dev'}
  runtime: provided.al2
  versionFunctions: false
  apiGateway:
    binaryMediaTypes:
      - '*/*'
  # So in short, we have two separate sets of env vars in SSM. Most of what happens below is just resolving between our envs
  # So that the environment variables get pulled from the correct set of vars, based on the stage we're deploying
  environment:
    APP_KEY: ${ssm:/${self:custom.ssm.${self:custom.stage}}/app_key}
    APP_DEBUG: ${self:custom.environment.${self:custom.stage}.APP_DEBUG}
    APP_ENV: ${self:custom.environment.${self:custom.stage}.APP_ENV}
    LOG_LEVEL: ${self:custom.environment.${self:custom.stage}.LOG_LEVEL}
    FLARE_KEY: ${ssm:/${self:custom.ssm.${self:custom.stage}}/flare_key}
    AWS_BUCKET:
      Ref: Assets
    SQS_QUEUE:
      Ref: AlertQueue
    DB_HOST: ${ssm:/${self:custom.ssm.${self:custom.stage}}/db_host}
    DB_PORT: 3306
    DB_USERNAME: ${ssm:/${self:custom.ssm.${self:custom.stage}}/db_username}
    DB_PASSWORD: ${ssm:/${self:custom.ssm.${self:custom.stage}}/db_password}
    DB_DATABASE: ${ssm:/${self:custom.ssm.${self:custom.stage}}/db_name}
    VIEW_COMPILED_PATH: /tmp/storage/framework/views
    PURIFIER_CACHE_PATH: /tmp/purifier
    FILESYSTEM_DRIVER_PUBLIC: s3
    FILESYSTEM_DRIVER: s3
    MIX_ASSET_URL: https://${self:custom.alias}
    ASSET_URL: https://${self:custom.alias}
    APP_URL: https://${self:custom.alias}
    WEBADDRESS: https://${self:custom.alias}/
    COOKIEADDRESS: ${self:custom.alias}
    CACHE_DRIVER: redis
    QUEUE_CONNECTION: sqs
    SESSION_DRIVER: redis
    REDIS_HOST: ${ssm:/${self:custom.ssm.${self:custom.stage}}/redis_host}
    REDIS_PORT: 6379
    MAIL_MAILER: smtp
    MAIL_HOST: ${ssm:/${self:custom.ssm.${self:custom.stage}}/mail_host}
    MAIL_PORT: 587
    MAIL_USERNAME: ${ssm:/${self:custom.ssm.${self:custom.stage}}/mail_username}
    MAIL_PASSWORD: ${ssm:/${self:custom.ssm.${self:custom.stage}}/mail_password}
    MAIL_FROM_ADDRESS: ${ssm:/${self:custom.ssm.${self:custom.stage}}/mail_from}
    MAIL_FROM_NAME: Fantasy Calendar
    MAIL_ENCRYPTION: tls
    STRIPE_KEY: ${ssm:/${self:custom.ssm.${self:custom.stage}}/stripe-key}
    STRIPE_SECRET: ${ssm:/${self:custom.ssm.${self:custom.stage}}/stripe-secret}
    DISCORD_WEBHOOK: ${ssm:/${self:custom.ssm.${self:custom.stage}}/discord-webhook}
    SNS_TOPIC: ${ssm:/${self:custom.ssm.${self:custom.stage}}/sns-topic}
    DISCORD_CLIENT_ID: ${ssm:/${self:custom.ssm.${self:custom.stage}}/discord_client_id}
    DISCORD_CLIENT_SECRET: ${ssm:/${self:custom.ssm.${self:custom.stage}}/discord_client_secret}
    DISCORD_REDIRECT_URI: ${ssm:/${self:custom.ssm.${self:custom.stage}}/discord_redirect_uri}
    DISCORD_PUBLIC_KEY: ${ssm:/${self:custom.ssm.${self:custom.stage}}/discord_public_key}
    DISCORD_COMMAND: ${self:custom.environment.${self:custom.stage}.DISCORD_COMMAND}
    SENTRY_LARAVEL_DSN: ${ssm:/${self:custom.ssm.${self:custom.stage}}/sentry-dsn}
    BREF_BINARY_RESPONSES: '1'
  iamRoleStatements:
    # Allow Lambda to read and write files in the S3 buckets
    -   Effect: Allow
        Action: s3:*
        Resource: !Join ['/', [!GetAtt Assets.Arn, '*']]
    -   Effect: "Allow"
        Action:
          - "ec2:CreateNetworkInterface"
          - "ec2:DescribeNetworkInterfaces"
          - "ec2:DetachNetworkInterface"
          - "ec2:DeleteNetworkInterface"
          - "ses:Publish"
          - "ses:SendEmail"
          - "sns:Publish"
          - "sqs:*"
        Resource: "*"

custom:
  stage: ${opt:stage, 'dev'}
  alias: ${self:custom.domain.${self:custom.stage}}
  domain:
    prod: 'app.fantasy-calendar.com'
    dev: 'beta.fantasy-calendar.com'
  environment:
    prod:
      APP_DEBUG: 'false'
      APP_ENV: 'production'
      LOG_LEVEL: 'info'
      DISCORD_COMMAND: 'fc'
    dev:
      APP_DEBUG: 'true'
      APP_ENV: 'development'
      LOG_LEVEL: 'debug'
      DISCORD_COMMAND: 'fc-beta'
  ssm:
    prod: 'fantasy-calendar'
    dev: 'fantasy-calendar-dev'
  s3Sync:
    # A simple configuration for copying static assets
    - bucketNameKey: AssetsOutputKey
      localDir: public # required
      deleteRemoved: true

package:
  exclude:
    - .git/**
    - .idea/**
    - setup/**
    - dist/**
    - cache/**
    - node_modules/**
    - public/storage/**
    - public/fonts/**
    - public/js/**
    - public/css/**
    - public/resources/**
    - public/vendor/sharp/fonts/*
    - public/vendor/sharp/vendor.js
    - resources/js/**
    - resources/sass/**
    - resources/images/**
    - resources/image-sourcefiles/**
    - storage/**
    - tests/**

functions:
  # This function runs the Laravel website/API
  web:
    handler: public/index.php
    timeout: 28 # in seconds (API Gateway has a timeout of 29 seconds)
    layers:
      - ${bref:layer.php-82-fpm}
      - ${bref-extra:redis-php-82}
      - ${bref-extra:gmp-php-82}
      - ${bref-extra:imagick-php-82}
    events:
      -   http: 'ANY /'
      -   http: 'ANY /{proxy+}'
    vpc:
      securityGroupIds: { 'Fn::Split': [",", "${ssm:/${self:custom.ssm.${self:custom.stage}}/security_group_ids}"] }
      subnetIds: { 'Fn::Split': [",", "${ssm:/${self:custom.ssm.${self:custom.stage}}/subnet_ids}"] }
  # This function lets us run artisan commands on lambda
  artisan:
    handler: artisan
    timeout: 120 # in seconds
    layers:
      - ${bref:layer.php-82} # PHP
      - ${bref-extra:gmp-php-82}
      - ${bref-extra:redis-php-82}
      - ${bref-extra:imagick-php-82}
      - ${bref:layer.console} # The "console" layer
    vpc:
      securityGroupIds: { 'Fn::Split': [",", "${ssm:/${self:custom.ssm.${self:custom.stage}}/security_group_ids}"] }
      subnetIds: { 'Fn::Split': [",", "${ssm:/${self:custom.ssm.${self:custom.stage}}/subnet_ids}"] }
  worker:
    handler: Bref\LaravelBridge\Queue\QueueHandler
    timeout: 59 # seconds
    layers:
      - ${bref:layer.php-82} # PHP
      - ${bref-extra:gmp-php-82}
      - ${bref-extra:redis-php-82}
      - ${bref-extra:imagick-php-82}
    events:
      -   sqs:
            arn:
              Fn::GetAtt: [ AlertQueue, Arn ]
            batchSize: 1
    vpc:
      securityGroupIds: { 'Fn::Split': [",", "${ssm:/${self:custom.ssm.${self:custom.stage}}/security_group_ids}"] }
      subnetIds: { 'Fn::Split': [",", "${ssm:/${self:custom.ssm.${self:custom.stage}}/subnet_ids}"] }
  console:
    timeout: 6
    handler: artisan
    layers:
      - ${bref:layer.php-82} # PHP runtime
      - ${bref-extra:gmp-php-82}
      - ${bref-extra:redis-php-82}
      - ${bref-extra:imagick-php-82}
      - ${bref:layer.console} # Console layer
    events:
      - schedule:
          rate: cron(* * * * ? *)
          input: '"schedule:run"'
    vpc:
      securityGroupIds: { 'Fn::Split': [",", "${ssm:/${self:custom.ssm.${self:custom.stage}}/security_group_ids}"] }
      subnetIds: { 'Fn::Split': [",", "${ssm:/${self:custom.ssm.${self:custom.stage}}/subnet_ids}"] }


plugins:
  # We need to include the Bref plugin
  - ./vendor/bref/bref
  - ./vendor/bref/extra-php-extensions
  - serverless-s3-sync

resources:
  Resources:
    # The S3 bucket that stores the assets
    Assets:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: fantasy-calendar-${opt:stage, 'dev'}
        # Set the CORS policy
        CorsConfiguration:
          CorsRules:
            - AllowedOrigins:
                - '*'
              AllowedHeaders:
                - '*'
              AllowedMethods:
                - GET
                - PUT
                - POST
                - DELETE
                - HEAD
              MaxAge: 3000
    # The policy that makes the bucket publicly readable
    AssetsBucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: !Ref Assets # References the bucket we defined above
        PolicyDocument:
          Statement:
            -   Effect: Allow
                Principal: '*' # everyone
                Action: 's3:GetObject' # to read
                Resource: !Join ['/', [!GetAtt Assets.Arn, '*']] # things in the bucket
            # alternatively you can write out Resource: 'arn:aws:s3:::<bucket-name>/*'
    # The queue
    AlertQueue:
      Type: AWS::SQS::Queue
      Properties:
        RedrivePolicy:
          maxReceiveCount: 1 # jobs will be retried up to 3 times
          # Failed jobs (after the retries) will be moved to the other queue for storage
          deadLetterTargetArn:
            Fn::GetAtt: [ DeadLetterQueue, Arn ]
    # Failed jobs will go into that SQS queue to be stored, until a developer looks at these errors
    DeadLetterQueue:
      Type: AWS::SQS::Queue
      Properties:
        MessageRetentionPeriod: 1209600 # maximum retention: 14 days
    CloudFrontDistribution:
      Type: AWS::CloudFront::Distribution
      Properties:
        DistributionConfig:
          Enabled: true
          # Cheapest option by default (https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DistributionConfig.html)
          PriceClass: PriceClass_100
          # Enable http2 transfer for better performances
          HttpVersion: http2
          # Origins are where CloudFront fetches content
          Origins:
            # The website (AWS Lambda)
            - Id: Website
              DomainName: !Join ['.', [!Ref ApiGatewayRestApi, 'execute-api', !Ref AWS::Region, 'amazonaws.com']]
              # This is the stage
              OriginPath: "/${opt:stage, 'dev'}"
              CustomOriginConfig:
                OriginProtocolPolicy: 'https-only' # API Gateway only supports HTTPS
              OriginCustomHeaders:
                - HeaderName: 'X-Forwarded-Host'
                  HeaderValue: ${self:custom.alias}
            # The assets (S3)
            - Id: Assets
              DomainName: !GetAtt Assets.RegionalDomainName
              S3OriginConfig: {} # this key is required to tell CloudFront that this is an S3 origin, even though nothing is configured
            # If you host a static website, like a SPA, use s3-website URLs instead of the config above
            # See https://stackoverflow.com/questions/15309113/amazon-cloudfront-doesnt-respect-my-s3-website-buckets-index-html-rules#15528757
            # DomainName: !Select [2, !Split ["/", !GetAtt Assets.WebsiteURL]]
            # CustomOriginConfig:
            #     OriginProtocolPolicy: 'http-only' # S3 websites only support HTTP
            # You'll also need to enable website hosting on your s3 bucket by configuring the WebsiteConfiguration property
            # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html#cfn-s3-bucket-websiteconfiguration
          # The default behavior is to send everything to AWS Lambda
          DefaultCacheBehavior:
            AllowedMethods: [GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE]
            TargetOriginId: Website # the PHP application
            # Disable caching for the PHP application https://aws.amazon.com/premiumsupport/knowledge-center/prevent-cloudfront-from-caching-files/
            DefaultTTL: 0
            MinTTL: 0
            MaxTTL: 0
            # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-forwardedvalues.html
            ForwardedValues:
              QueryString: true
              Cookies:
                Forward: all # Forward cookies to use them in PHP
              # We must *not* forward the `Host` header else it messes up API Gateway
              Headers:
                - 'Accept'
                - 'Accept-Language'
                - 'Origin'
                - 'Referer'
            ViewerProtocolPolicy: redirect-to-https
            ResponseHeadersPolicyId: !GetAtt CloudFormationHeadersPolicy.Id
          CacheBehaviors:
            - PathPattern: '/vendor/sharp/lang.js'
              AllowedMethods: [GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE]
              TargetOriginId: Website # the PHP application
              # Disable caching for the PHP application https://aws.amazon.com/premiumsupport/knowledge-center/prevent-cloudfront-from-caching-files/
              DefaultTTL: 0
              MinTTL: 0
              MaxTTL: 0
              # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-forwardedvalues.html
              ForwardedValues:
                QueryString: true
                Cookies:
                  Forward: all # Forward cookies to use them in PHP
                # We must *not* forward the `Host` header else it messes up API Gateway
                Headers:
                  - 'Accept'
                  - 'Accept-Language'
                  - 'Origin'
                  - 'Referer'
              ViewerProtocolPolicy: redirect-to-https
            # Assets will be served under the `/assets/` prefix
            - PathPattern: '/.well-known/apple-developer-merchantid-domain-association'
              AllowedMethods: [GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE]
              TargetOriginId: Assets # the PHP application
              # Disable caching for the PHP application https://aws.amazon.com/premiumsupport/knowledge-center/prevent-cloudfront-from-caching-files/
              DefaultTTL: 0
              MinTTL: 0
              MaxTTL: 0
              # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-forwardedvalues.html
              ForwardedValues:
                QueryString: true
                Cookies:
                  Forward: all # Forward cookies to use them in PHP
                # We must *not* forward the `Host` header else it messes up API Gateway
                Headers:
                  - 'Accept'
                  - 'Accept-Language'
                  - 'Origin'
                  - 'Referer'
              ViewerProtocolPolicy: redirect-to-https
            # Assets will be served under the `/assets/` prefix
            - PathPattern: 'favicon.ico'
              TargetOriginId: Assets # the static files on S3
              AllowedMethods: [GET, HEAD]
              ForwardedValues:
                # No need for all that with assets
                QueryString: 'false'
                Cookies:
                  Forward: none
              ViewerProtocolPolicy: redirect-to-https
              Compress: true # Serve files with gzip for browsers that support it (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html)
            - PathPattern: 'robots.txt'
              TargetOriginId: Assets # the static files on S3
              AllowedMethods: [GET, HEAD]
              ForwardedValues:
                # No need for all that with assets
                QueryString: 'false'
                Cookies:
                  Forward: none
              ViewerProtocolPolicy: redirect-to-https
              Compress: true # Serve files with gzip for browsers that support it (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html)
            - PathPattern: 'css/*'
              TargetOriginId: Assets # the static files on S3
              AllowedMethods: [GET, HEAD]
              ForwardedValues:
                # No need for all that with assets
                QueryString: 'false'
                Cookies:
                  Forward: none
              ViewerProtocolPolicy: redirect-to-https
              Compress: true # Serve files with gzip for browsers that support it (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html)
            - PathPattern: 'fonts/*'
              TargetOriginId: Assets # the static files on S3
              AllowedMethods: [GET, HEAD]
              ForwardedValues:
                # No need for all that with assets
                QueryString: 'false'
                Cookies:
                  Forward: none
              ViewerProtocolPolicy: redirect-to-https
              Compress: true # Serve files with gzip for browsers that support it (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html)
            - PathPattern: 'images/*'
              TargetOriginId: Assets # the static files on S3
              AllowedMethods: [GET, HEAD]
              ForwardedValues:
                # No need for all that with assets
                QueryString: 'false'
                Cookies:
                  Forward: none
              ViewerProtocolPolicy: redirect-to-https
              Compress: true # Serve files with gzip for browsers that support it (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html)
            - PathPattern: 'js/*'
              TargetOriginId: Assets # the static files on S3
              AllowedMethods: [GET, HEAD]
              ForwardedValues:
                # No need for all that with assets
                QueryString: 'false'
                Cookies:
                  Forward: none
              ViewerProtocolPolicy: redirect-to-https
              Compress: true # Serve files with gzip for browsers that support it (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html)
            - PathPattern: 'policies/*'
              TargetOriginId: Assets # the static files on S3
              AllowedMethods: [GET, HEAD]
              ForwardedValues:
                # No need for all that with assets
                QueryString: 'false'
                Cookies:
                  Forward: none
              ViewerProtocolPolicy: redirect-to-https
              Compress: true # Serve files with gzip for browsers that support it (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html)
            - PathPattern: 'resources/*'
              TargetOriginId: Assets # the static files on S3
              AllowedMethods: [GET, HEAD]
              ForwardedValues:
                # No need for all that with assets
                QueryString: 'false'
                Cookies:
                  Forward: none
              ViewerProtocolPolicy: redirect-to-https
              Compress: true # Serve files with gzip for browsers that support it (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html)
            - PathPattern: 'vendor/*'
              TargetOriginId: Assets # the static files on S3
              AllowedMethods: [GET, HEAD]
              ForwardedValues:
                # No need for all that with assets
                QueryString: 'false'
                Cookies:
                  Forward: none
              ViewerProtocolPolicy: redirect-to-https
              Compress: true # Serve files with gzip for browsers that support it (https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html)
          CustomErrorResponses:
            # Do not cache HTTP errors
            - ErrorCode: 500
              ErrorCachingMinTTL: 0
            - ErrorCode: 504
              ErrorCachingMinTTL: 0
          Aliases:
            - ${self:custom.alias}
          ViewerCertificate:
            # ARN of the certificate created in ACM
            AcmCertificateArn: arn:aws:acm:us-east-1:187933545528:certificate/ec7b5304-fd5f-421a-b4da-c9fbf9742508
            # See https://docs.aws.amazon.com/fr_fr/cloudfront/latest/APIReference/API_ViewerCertificate.html
            SslSupportMethod: 'sni-only'
            MinimumProtocolVersion: TLSv1.1_2016
    CloudFormationHeadersPolicy:
      Type: AWS::CloudFront::ResponseHeadersPolicy
      Properties:
        ResponseHeadersPolicyConfig:
          Name: Fantasy-Calendar-Headers-Policy-${self:custom.stage}
          Comment: Response headers policy for fantasy calendar
          CustomHeadersConfig:
            Items:
              - Header: fc-deployment
                Value: ${self:custom.stage}
                Override: true
          SecurityHeadersConfig:
            ContentTypeOptions: # You don't need to specify a value for 'X-Content-Type-Options'.
              # Simply including it in the template sets its value to 'nosniff'.
              Override: false
            ReferrerPolicy:
              ReferrerPolicy: same-origin
              Override: false
            StrictTransportSecurity:
              AccessControlMaxAgeSec: 63072000
              IncludeSubdomains: true
              Preload: true
              Override: false
            XSSProtection:
              ModeBlock: true # You can set ModeBlock to 'true' OR set a value for ReportUri, but not both
              Protection: true
              Override: false
    WebsiteDNSName:
      Type: AWS::Route53::RecordSetGroup
      Properties:
        HostedZoneId: 'Z073956536B27M25YFZT6' # Taken from the AWS Console
        RecordSets:
          - Name: ${self:custom.alias}
            Type: A
            AliasTarget:
              HostedZoneId: Z2FDTNDATAQYW2
              DNSName: !GetAtt [CloudFrontDistribution, DomainName]
              EvaluateTargetHealth: false
  Outputs:
    AssetsOutputKey:
      Value: !Ref Assets