VmApp.lw

export
  type VMApp
  type VMAppSecurityGroups
  new

import Fugue.AWS.AutoScaling as AutoScaling
import Fugue.AWS.EC2 as EC2
import Fugue.AWS.ELB as ELB
import Fugue.AWS.IAM as IAM
import Fugue.AWS.RDS as RDS
import Fugue.AWS.DynamoDB as DynamoDB
import Fugue.AWS as AWS
import Fugue.Core.Vars as Vars

type VMApp:
  | VMApp
    elb: ELB.LoadBalancer
    asg: AutoScaling.AutoScalingGroup
    sgs: VMAppSecurityGroups
    rds: Optional<RDS.DBInstance>
    ddb: Optional<DynamoDB.Table>

type VMAppSecurityGroups:
  elbSg: EC2.SecurityGroup
  asgSg: EC2.SecurityGroup
  rdsSg: Optional<EC2.SecurityGroup>
  clientSg: EC2.SecurityGroup

fun amiForRegion(region: AWS.Region) -> String:
  case region of
    | AWS.Us-east-1 -> "ami-a60c23b0"
    | AWS.Us-west-1 -> "ami-96f1dcf6"
    | AWS.Us-west-2 -> "ami-7646530f"
    | AWS.Eu-west-1 -> "ami-af455dc9"
    | _ -> AWS.Region.toString(region) ++ " is not supported."

fun makeVMAppSgs {
      name: String,
      vpc: EC2.Vpc,
      withRDS: Bool,
      extraTags: List<AWS.Tag>
    } -> VMAppSecurityGroups:
  let elbSg: EC2.SecurityGroup.new {
    description: name ++ "-elb-sg",
    ipPermissions: [
      EC2.IpPermission.http(EC2.IpPermission.Target.all),
      EC2.IpPermission.https(EC2.IpPermission.Target.all),
    ],
    tags: List.concat([AWS.tag("Name", name ++ "-elb-sg")], extraTags),
    vpc: vpc,
  }
  let asgSg: EC2.SecurityGroup.new {
    description: name ++ "-asg-sg",
    ipPermissions: [
      EC2.IpPermission.http(EC2.IpPermission.Target.securityGroups([elbSg])),
      EC2.IpPermission.https(EC2.IpPermission.Target.securityGroups([elbSg])),
      EC2.IpPermission.ssh(EC2.IpPermission.Target.securityGroups([clientSg]))
    ],
    tags: List.concat([AWS.tag("Name", name ++ "-asg-sg")], extraTags),
    vpc: vpc,
  }
  let rdsSg:
    if withRDS then
      Optional(EC2.SecurityGroup.new {
        description: name ++ "-rds-sg",
        ipPermissions: [
          EC2.IpPermission.mysql(EC2.IpPermission.Target.securityGroups([asgSg])),
          EC2.IpPermission.mysql(EC2.IpPermission.Target.securityGroups([clientSg]))
        ],
        tags: List.concat([AWS.tag("Name", name ++ "-rds-sg")], extraTags),
        vpc: vpc,
      })
    else
      None
  let clientSg: EC2.SecurityGroup.new {
    description: name ++ "-client-sg",
    ipPermissions: [],
    tags: List.concat([AWS.tag("Name", name ++ "-client-sg")], extraTags),
    vpc: vpc,
  }
  {
    elbSg: elbSg,
    asgSg: asgSg,
    rdsSg: rdsSg,
    clientSg: clientSg,
  }

fun ec2Policy(name: String, region: String) -> IAM.Policy:
  IAM.Policy.new {
    policyName: name ++ "-ec2-policy",
    policyDocument:
      Template.render {
        data: {name: name, region: region},
        template:
          '{
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Action": ["ec2:*"],
                "Resource": "*"
              }
            ]
          }'
      },
  }

fun ddbPolicy(name: String, region: String) -> IAM.Policy:
  IAM.Policy.new {
    policyName: name ++ "-ddb-policy",
    policyDocument:
      Template.render {
        data: {name: name, region: region},
        template: 
          '{
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Action": ["dynamodb:*"],
                "Resource": "arn:aws:dynamodb:{{region}}:*:table/{{name}}-table"
              }
            ]
          }'
      },
  }

fun rdsPolicy(name: String, region: String) -> IAM.Policy:
  IAM.Policy.new {
    policyName: name ++ "-rds-policy",
    policyDocument:
      Template.render {
        data: {name: name, region: region},
        template:
          '{
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Action": ["rds-db:connect*"],
                "Resource": "arn:aws:rds:{{region}}:*:db:{{name}}-dbInstance"
              }
            ]
          }'
      },
  }

fun makeVMAppIamProfile {
      name: String,
      region: String,
      withDDB: Bool,
      withRDS: Bool,
    } -> IAM.InstanceProfile:
  let webAppPolicies: [ 
    policy for (policy, enable) in [
      (ec2Policy(name,region), True),
      (ddbPolicy(name,region), withDDB),
      (rdsPolicy(name,region), withRDS)
    ] if enable
  ]
  let webAppRole: 
    IAM.Role.new {
      roleName: name ++ "-role",
      rolePolicies: webAppPolicies,
      assumeRolePolicyDocument: IAM.Policy.AssumeRole.ec2,
    }
  IAM.InstanceProfile.new {
    instanceProfileName: name ++ "-profile",
    roles: [webAppRole],
  }

fun new {
      name: String,
      subnets: List<EC2.Subnet>,
      vpc: Optional<EC2.Vpc>,
      region: Optional<AWS.Region>,
      keyName: Optional<String>,
      image: Optional<String>,
      userData: Optional<String>,
      instanceType: Optional<EC2.InstanceType>,
      managementSgs: Optional<List<EC2.SecurityGroup>>,
      withRDS: Optional<Bool>,
      dbEngine: Optional<RDS.Engine>,
      dbInstanceClass: Optional<RDS.DBInstanceClass>,
      dbStorageType: Optional<EC2.VolumeType>,
      dbAllocatedStorage: Optional<Int>,
      dbMultiAZ: Optional<Bool>,
      dbName: Optional<String>,
      dbMasterUsername: Optional<String>,
      dbMasterUserPassword: Optional<Vars.Password>,
      withDDB: Optional<Bool>,
      ddbProvisionedReadThroughput: Optional<Int>,
      ddbProvisionedWriteThroughput: Optional<Int>,
      dbAllocatedStorage: Optional<Int>,
      tags: Optional<List<AWS.Tag>>
    } -> VMApp:
  let _vpc: Optional.unpack(List.index(subnets,0).(EC2.Subnet).vpc, vpc)
  let _region: Optional.unpack(_vpc.(EC2.Vpc).region, region)
  let _keyName:              Optional.unpack(name, keyName)
  let _image:                Optional.unpack(amiForRegion(_region), image)
  let _userData:             Optional.unpack(" ", userData)
  let _instanceType:         Optional.unpack(EC2.T2_micro, instanceType)
  let _withRDS:              Optional.unpack(False, withRDS)
  let _dbEngine:             Optional.unpack(RDS.MySQL, dbEngine)
  let _dbInstanceClass:      Optional.unpack(RDS.DB_T2_MICRO, dbInstanceClass)
  let _dbStorageType:        Optional.unpack(EC2.Standard, dbStorageType)
  let _dbAllocatedStorage:   Optional.unpack(10, dbAllocatedStorage)
  let _dbMultiAZ:            Optional.unpack(False, dbMultiAZ)
  let _dbName:               Optional.unpack(name, dbName)
  let _dbMasterUsername:     Optional.unpack("root", dbMasterUsername)
  let _dbMasterUserPassword: Optional.unpack(Vars.VarsKey({key: "/rds/password"}), dbMasterUserPassword)
  let _managementSgs:        Optional.unpack([], managementSgs)
  let _withDDB:              Optional.unpack(False, withDDB)
  let _ddbProvisionedReadThroughput:  Optional.unpack(10, ddbProvisionedReadThroughput)
  let _ddbProvisionedWriteThroughput: Optional.unpack(10, ddbProvisionedWriteThroughput)
  let _extraTags:            Optional.unpack([], tags)

  let sgs: makeVMAppSgs {
    name: name,
    vpc: _vpc,
    withRDS: _withRDS,
    extraTags: _extraTags,
  }

  let profile: makeVMAppIamProfile {
    name: name,
    region: AWS.Region.toString(_region),
    withDDB: _withDDB,
    withRDS: _withRDS,
  }

  let elb:  ELB.LoadBalancer.new {
    loadBalancerName: name ++ "-elb",
    listeners: [
      ELB.Listener.new {
        protocol: ELB.TCP,
        loadBalancerPort: 80,
        instancePort: 80,
        instanceProtocol: ELB.TCP,
      },
      ELB.Listener.new {
        protocol: ELB.TCP,
        loadBalancerPort: 443,
        instancePort: 443,
        instanceProtocol: ELB.TCP,
      }
    ],
    healthCheck: ELB.HealthCheck.tcp {
      port: 80,
      interval: 5,
      timeout: 2,
      unhealthyThreshold: 2,
      healthyThreshold: 2,
    },
    subnets: subnets,
    securityGroups: [sgs.elbSg],
    tags: List.concat([AWS.tag("Name", name)], _extraTags),
  }
  let lc: AutoScaling.LaunchConfiguration.new {
    image: _image,
    securityGroups: List.concat([sgs.asgSg], _managementSgs),
    keyName: _keyName,
    instanceType: _instanceType,
    associatePublicIpAddress: True,
    iamInstanceProfile: profile,
    userData: _userData, 
  }
  let asg: AutoScaling.AutoScalingGroup.new {
    subnets: subnets,
    loadBalancers: [elb],
    minSize: 1,
    maxSize: 2,
    defaultCooldown: 300,
    healthCheckType: AutoScaling.Ec2,
    launchConfiguration: lc,
    tags: List.concat([AWS.tag("Name", name)], _extraTags),
    terminationPolicies: [AutoScaling.ClosestToNextInstanceHour],
    enabledMetrics: [
      AutoScaling.GroupInServiceInstances,
      AutoScaling.GroupTotalInstances,
    ]
  }

  let rds:
    if _withRDS then
      let subnetGroup: RDS.DBSubnetGroup.new {
        name: name,
        description: name ++ "-subnet-group",
        subnets: subnets,
        tags: List.concat([AWS.tag("Name", name)], _extraTags),
      }
      let securityGroups: case sgs.rdsSg of
        | None        -> []
        | Optional sg -> [sg]
      Optional(RDS.DBInstance.new {
        dbName: _dbName,
        dbInstanceIdentifier: name ++ "-dbInstance",
        dbInstanceClass: _dbInstanceClass,
        engine: _dbEngine,
        masterUsername: _dbMasterUsername,
        allocatedStorage: _dbAllocatedStorage,
        securityGroups: securityGroups,
        availabilityZone: None,
        dbSubnetGroup: subnetGroup,
        multiAZ: _dbMultiAZ,
        publiclyAccessible: True,
        storageType: _dbStorageType,
        masterUserPassword: _dbMasterUserPassword,
        tags: List.concat([AWS.tag("Name", name)], _extraTags),
      })
    else
      None

  let ddb:
    if _withDDB then
      Optional(DynamoDB.Table.new {
        name: name ++ "-table",
        attributes: {"PropertyName": DynamoDB.S},
        schema: {"PropertyName": DynamoDB.HASH},
        provisionedThroughput: {
          read: _ddbProvisionedReadThroughput,
          write: _ddbProvisionedWriteThroughput ,
        },
        region: _region,
      })
    else
      None

  VMApp {
    sgs: sgs,
    elb: elb,
    asg: asg,
    rds: rds,
    ddb: ddb,
  }