AWSTemplateFormatVersion: 2010-09-09

Parameters:
  InstanceType:
    Description: jambonzMini EC2 instance type
    Type: String
    Default: t2.medium
    AllowedValues:
      - t2.small
      - t2.medium
      - t2.large
      - t2.xlarge
      - t3.small
      - t3.medium
      - t3.large
      - t3.xlarge
      - t3a.small
      - t3a.medium
      - t3a.large
      - t3a.xlarge
      - c5.large
      - c5.xlarge
      - c5.2xlarge
      - c5n.large
      - c5n.xlarge
      - c5n.2xlarge
    ConstraintDescription: must be a valid EC2 instance type.
  KeyName:
    Description: Name of an EC2 KeyPair to enable SSH access to the instance.
    Type: 'AWS::EC2::KeyPair::KeyName'
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  AllowedSshCidr:
    Description: Please set CIDR to x.x.x.x/32 to allow one specific IP address ssh access, 0.0.0.0/0 to allow all IP addresses access, or another CIDR range.
    Type: String
    AllowedPattern: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}
    ConstraintDescription: must be a valid network CIDR
  AllowedHttpCidr:
    Description: Please set CIDR to x.x.x.x/32 to allow one specific IP address http(s) access, 0.0.0.0/0 to allow all IP addresses access, or another CIDR range.
    Type: String
    AllowedPattern: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}
    ConstraintDescription: must be a valid network CIDR
  AllowedSipCidr:
    Description: Please set CIDR to x.x.x.x/32 to allow one specific IP address sip access, 0.0.0.0/0 to allow all IP addresses access, or another CIDR range.
    Type: String
    ConstraintDescription: must be a valid network CIDR
    AllowedPattern: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}
  AllowedRtpCidr:
    Description: Please set CIDR to x.x.x.x/32 to allow one specific IP address to send RTP traffic, 0.0.0.0/0 to allow all IP addresses access, or another CIDR range.
    Type: String
    ConstraintDescription: must be a valid network CIDR
    AllowedPattern: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}
  VpcCidr:
    Description: CIDR range for the VPC.
    Type: String
    ConstraintDescription: must be a valid network CIDR
    AllowedPattern: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}
    Default: 10.0.0.0/16
  URLPortal:
    Type: String
    Description: "(Optional) A DNS name that you will point to the jambonz webserver(s)"
    Default: ""

Conditions:
  DontCreateDNS: !Equals
    - !Ref URLPortal
    - ""
  CreateDNS: !Not
    - !Equals 
      - !Ref URLPortal
      - ""

Mappings:
  AWSRegion2AMI:
    us-east-1:
      Ami: ami-0557d258855c8caef
    us-east-2:
      Ami: ami-0da03e2feb6d72e4b
Resources:
  VPC:
    Type: 'AWS::EC2::VPC'
    Properties:
      EnableDnsSupport: true
      EnableDnsHostnames: true
      CidrBlock: !Ref VpcCidr
  PublicSubnet:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref VpcCidr
  jambonzInstance:
    Type: 'AWS::EC2::Instance'
    Properties:
      InstanceType: !Ref InstanceType
      ImageId: !FindInMap [ "AWSRegion2AMI", !Ref AWS::Region,  "Ami"]
      KeyName: !Ref KeyName
      NetworkInterfaces:
        - GroupSet:
            - !Ref jambonzSecurityGroup
            - !Ref sshSecurityGroup
          AssociatePublicIpAddress: true
          DeviceIndex: '0'
          DeleteOnTermination: true
          SubnetId: !Ref PublicSubnet
      UserData:
        Fn::Base64: 
          Fn::Sub:
            - |
              #!/bin/bash -xe

              #install rtpengine kernel module 
              #echo "installing rtpengine kernel module"
              #modprobe xt_RTPENGINE
              #iptables -I INPUT -p udp -j RTPENGINE --id 42

              # get instance metadata
              PRIVATE_IPV4="$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)" 
              PUBLIC_IPV4="$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4)" 
              INSTANCE_ID="$(curl -s http://169.254.169.254/latest/meta-data/instance-id)" 
              AWS_REGION_NAME="$(curl -s http://169.254.169.254/latest/meta-data/placement/region)" 
              
              # change the database password to the instance id
              NEW_DB_PASSWD="$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)" 
              echo "alter user 'admin'@'%' identified by '$NEW_DB_PASSWD'" | mysql -h localhost -u admin -D jambones -pJambonzR0ck$ 
              sudo sed -i -e "s/\(.*\)JAMBONES_MYSQL_PASSWORD.*/\1JAMBONES_MYSQL_PASSWORD: '$NEW_DB_PASSWD',/g" /home/admin/apps/ecosystem.config.js 
              
              # get an apiban key
              APIBANKEY=$(curl -X POST -u jambonz:1a074994242182a9e0b67eae93978826 -d "{\"client\": \"$INSTANCE_ID\"}" -s https://apiban.org/sponsor/newkey | jq -r '.ApiKey')
              sudo sed -i -e "s/API-KEY-HERE/$APIBANKEY/g" /usr/local/bin/apiban/config.json
              sudo /usr/local/bin/apiban/apiban-iptables-client FULL
              
              # replace ip addresses in the ecosystem.config.js file
              sudo sed -i -e "s/\(.*\)PRIVATE_IP\(.*\)/\1$PRIVATE_IPV4\2/g" /home/admin/apps/ecosystem.config.js 
              sudo sed -i -e "s/\(.*\)AWS_REGION_NAME\(.*\)/\1$AWS_REGION_NAME\2/g" /home/admin/apps/ecosystem.config.js 
              sudo sed -i -e "s/\(.*\)--JAMBONES_API_BASE_URL--\(.*\)/\1http:\/\/$PUBLIC_IPV4\/v1\2/g" /home/admin/apps/ecosystem.config.js 
              
              # reset the database
              JAMBONES_ADMIN_INITIAL_PASSWORD=$INSTANCE_ID JAMBONES_MYSQL_USER=admin JAMBONES_MYSQL_PASSWORD=$NEW_DB_PASSWD JAMBONES_MYSQL_DATABASE=jambones JAMBONES_MYSQL_HOST=localhost /home/admin/apps/jambonz-api-server/db/reset_admin_password.js
              
              # configure webapp
              if [[ -z "${URLPortal}" ]]; then
                # portals will be accessed by IP address of server
                echo "REACT_APP_API_BASE_URL=http://$PUBLIC_IPV4/api/v1" > /home/admin/apps/jambonz-webapp/.env 
                echo "REACT_APP_MOBILE_BREAKPOINT=767px" >> /home/admin/apps/jambonz-webapp/.env 
                echo "REACT_APP_ENABLE_SUBSPACE=1" >> /home/admin/apps/jambonz-webapp/.env 
                REACT_APP_API_BASE_URL=http://$PUBLIC_IPV4/api/v1 TAG="<script>window.JAMBONZ = { APP_API_BASE_URL: '$REACT_APP_API_BASE_URL'};</script>"
                sed -i -e "\@</head>@i\ $TAG" /home/admin/apps/jambonz-webapp/build/index.html
              else
                # portals will be accessed by DNS name
                echo "REACT_APP_API_BASE_URL=http://${URLPortal}/api/v1" > /home/admin/apps/jambonz-webapp/.env 
                echo "REACT_APP_MOBILE_BREAKPOINT=767px" >> /home/admin/apps/jambonz-webapp/.env 
                echo "REACT_APP_ENABLE_SUBSPACE=1" >> /home/admin/apps/jambonz-webapp/.env 
                REACT_APP_API_BASE_URL=http://${URLPortal}/api/v1 TAG="<script>window.JAMBONZ = { APP_API_BASE_URL: '$REACT_APP_API_BASE_URL'};</script>"
                sed -i -e "\@</head>@i\ $TAG" /home/admin/apps/jambonz-webapp/build/index.html

                # configure nginx for homer and grafana on the monitoring server
                sudo cat << EOF > /etc/nginx/sites-available/default 
                server {
                    listen 80;
                    server_name _;
                    location /api/ {
                        rewrite ^/api/(.*)$ /\$1 break;
                        proxy_pass http://localhost:3002;
                        proxy_set_header Host \$host;
                    }
                    location / {
                        proxy_pass http://localhost:3001;
                        proxy_set_header Host \$host;
                    }
                }
                server {
                  listen 80;
                  server_name grafana.${URLPortal}; 
                  location / {
                    proxy_pass http://localhost:3010; 
                    proxy_http_version 1.1;
                    proxy_set_header Upgrade \$http_upgrade;
                    proxy_set_header Connection 'upgrade';
                    proxy_set_header Host \$host;
                    proxy_cache_bypass \$http_upgrade;
                  }
                }
                server {
                  listen 80;
                  server_name homer.${URLPortal}; 
                  location / {
                    proxy_pass http://localhost:9080; 
                    proxy_http_version 1.1;
                    proxy_set_header Upgrade \$http_upgrade;
                    proxy_set_header Connection 'upgrade';
                    proxy_set_header Host \$host;
                    proxy_cache_bypass \$http_upgrade;
                  }
                }
                server {
                  listen 80;
                  server_name jaeger.${URLPortal}; 
                  location / {
                    proxy_pass http://localhost:16686; 
                    proxy_http_version 1.1;
                    proxy_set_header Upgrade \$http_upgrade;
                    proxy_set_header Connection 'upgrade';
                    proxy_set_header Host \$host;
                    proxy_cache_bypass \$http_upgrade;
                  }
                }
              EOF
              
                sudo systemctl restart nginx
              fi
              sudo -u admin bash -c "pm2 restart /home/admin/apps/ecosystem.config.js" 
              sudo -u admin bash -c "pm2 save"
              sudo env PATH=$PATH:/usr/bin /usr/lib/node_modules/pm2/bin/pm2 startup systemd -u admin --hp /home/admin
              
              # restart heplify-server
              sudo systemctl restart heplify-server
            - URLPortal: !Ref URLPortal

  jambonzSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      VpcId: !Ref VPC
      GroupDescription: 'Allow sip, rtp, http and ssh access'
      SecurityGroupIngress:
        - Description: sip
          IpProtocol: udp
          FromPort: 5060
          ToPort: 5060
          CidrIp: !Ref AllowedSipCidr
        - Description: rtp
          IpProtocol: udp
          FromPort: 40000
          ToPort: 60000
          CidrIp: !Ref AllowedRtpCidr
        - Description: http
          IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref AllowedHttpCidr
        - Description: https
          IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: !Ref AllowedHttpCidr
        - Description: homer
          IpProtocol: tcp
          FromPort: 9080
          ToPort: 9080
          CidrIp: !Ref AllowedHttpCidr
        - Description: jaeger
          IpProtocol: tcp
          FromPort: 16686
          ToPort: 16686
          CidrIp: !Ref AllowedHttpCidr
        - Description: grafana
          IpProtocol: tcp
          FromPort: 3000
          ToPort: 3000
          CidrIp: !Ref AllowedHttpCidr
        - Description: smpp
          IpProtocol: tcp
          FromPort: 3020
          ToPort: 3020
          CidrIp: !Ref VpcCidr
      SecurityGroupEgress:
        - IpProtocol: -1
          FromPort: 0
          ToPort: 0
          CidrIp: 0.0.0.0/0
    DependsOn:
      - PublicRoute
  sshSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      VpcId: !Ref VPC
      GroupDescription: 'Allow sip, rtp, http and ssh access'
      SecurityGroupIngress:
        - Description: ssh
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref AllowedSshCidr
    DependsOn:
      - PublicRoute
  InternetGateway:
    Type: 'AWS::EC2::InternetGateway'
    Properties: {}
  PublicRouteTable:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref VPC
  PublicRoute:
    Type: 'AWS::EC2::Route'
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      RouteTableId: !Ref PublicRouteTable
      GatewayId: !Ref InternetGateway
    DependsOn:
      - VPCGatewayAttachment
  VPCGatewayAttachment:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
  PublicSubnetRouteTableAssociation:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet
  EIP:
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc
  EIPAssociation:
    Type: 'AWS::EC2::EIPAssociation'
    Properties:
      InstanceId: !Ref jambonzInstance
      AllocationId: !GetAtt EIP.AllocationId

Outputs:
  PortalHttpURL:
    Value: !Join 
      - ''
      - - 'http://'
        - !GetAtt 
          - jambonzInstance
          - PublicIp
    Description: URL for the jambonz portal
    Condition: DontCreateDNS
  PortalURL:
    Value: !Join 
      - ''
      - - 'http://'
        - !Ref URLPortal
    Description: URL for the jambonz portal
    Condition: CreateDNS
  GrafanaURL:
    Value: !Join 
      - ''
      - - 'http://grafana.'
        - !Ref URLPortal
    Description: URL for the grafana portal
    Condition: CreateDNS
  JaegerURL:
    Value: !Join 
      - ''
      - - 'http://jaeger.'
        - !Ref URLPortal
    Description: URL for the jaeger portal
    Condition: CreateDNS
  HomerURL:
    Value: !Join 
      - ''
      - - 'http://homer.'
        - !Ref URLPortal
    Description: URL for the homer portal
    Condition: CreateDNS
  ServerIP:
    Value: !GetAtt 
      - jambonzInstance
      - PublicIp
    Description: Server IP address - create a DNS record for this domain as well as subdomains grafana, homer, and jaeger
    Condition: CreateDNS
  User:
    Value: admin
    Description: Login username for the jambonz portal
  Password:
    Value: !Ref jambonzInstance
    Description: Initial password for jambonz portal.  You will be forced to change it once you log in for the first time.