AWSTemplateFormatVersion: '2010-09-09'
Description: A stack for deploying containerized applications onto a cluster of EC2
             hosts using Elastic Container Service. This stack runs containers on
             hosts that are in a public VPC subnet.
Parameters:
  TemplateBucketName:
    Description: S3 bucket containing cloudformation templates
    Type: String
  PrimaryMaxCount:
    Description: The maximum number of EC2 instances in the primary autoscaling group
    Type: Number
  ECSAMI:
    Description: AMI ID
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ecs/optimized-ami/amazon-linux-2/recommended/image_id
  InstanceType:
    Description: EC2 instance type
    Type: String
    Default: m4.xlarge
    AllowedValues: [t2.micro, t2.small, t2.medium, t2.large, m3.medium, m3.large,
      m3.xlarge, m3.2xlarge, m4.large, m4.xlarge, m4.2xlarge, m4.4xlarge, m4.10xlarge,
      c4.large, c4.xlarge, c4.2xlarge, c4.4xlarge, c4.8xlarge, c3.large, c3.xlarge,
      c3.2xlarge, c3.4xlarge, c3.8xlarge, r3.large, r3.xlarge, r3.2xlarge, r3.4xlarge,
      r3.8xlarge, i2.xlarge, i2.2xlarge, i2.4xlarge, i2.8xlarge]
    ConstraintDescription: Please choose a valid instance type.
  InternetGatewayIdProp:
    Type: String
    Default: ""
    Description: Internet Gateway id. If empty Internet Gateway will be created
  VPCIdProp:
    Type: String
    Default: ""
    Description: VPC id. If empty VPC will be created
  SubnetIdProp:
    Type: String
    Default: ""
    Description: Subnet id. If empty Network Stack will be created
  SubnetCIDR:
    Type: String
    Default: 10.0.0.0/24
    Description: Subnet CIDR.
  VPCCIDR:
    Type: String
    Default: 10.0.0.0/16
    Description: VPC CIDR.
  ECSKeyName:
    Type: String
    Default: gerrit-cluster-keys
    Description: EC2 key pair name the cluter's instances
  EnvironmentName:
      Description: An environment name used to build the log stream names
      Type: String
      Default: test
  GerritVolumeId:
    Description: Existing Gerrit volume id
    Type: String
    Default: ""
  GerritVolumeSnapshotId:
    Description: Id of the EBS snapshot for Gerrit volume
    Type: String
    Default: ""
  GerritVolumeAttachMaxRetries:
    Description: Maximum number of retries when attaching Gerrit Volume
    Type: Number
    Default: 5
  GerritVolumeAttachRetryDelay:
    Description: The delay in seconds between Gerrit Volume attach attempts
    Type: Number
    Default: 5
  GerritVolumeSizeInGiB:
    Description: Gerrit volume size in GiB
    Type: Number
    Default: 10
  ReplicaFileSystemID:
    Description: Gerrit replicas shared filesystem id
    Type: String
    Default: ""
  ReplicaFileSystemThroughputMode:
    Description: Gerrit replicas shared filesystem throughput mode
    Type: String
    Default: bursting
    AllowedValues: [bursting, provisioned]
  ReplicaProvisionedThroughputInMibps:
    Description: Gerrit replicas shared filesystem throughput, measured in MiB/s. Valid values are 1-1024.
    Type: Number
    Default: 256

Conditions:
  CreateReplicaEFS: !Equals [!Ref ReplicaFileSystemID, ""]
  NetworkStackNeeded: !Or
    - !Equals [!Ref VPCIdProp, ""]
    - !And
      - !Equals [!Ref InternetGatewayIdProp, ""]
      - !Equals [!Ref SubnetIdProp, ""]

Resources:
  # ECS Resources
  ECSCluster:
    Type: AWS::ECS::Cluster

  EcsHostSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Access to the ECS hosts that run containers
      VpcId: !If [NetworkStackNeeded, !GetAtt ECSTaskNetworkStack.Outputs.VPCRef, !Ref VPCIdProp]
      SecurityGroupIngress:
          # Allow access to NLB from anywhere on the internet
          - CidrIp: 0.0.0.0/0
            IpProtocol: -1

  CloudWatchLogsGroup:
      Type: AWS::Logs::LogGroup
      Properties:
          LogGroupName: !Ref AWS::StackName
          RetentionInDays: 14

  PrimaryASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:
        - !If [NetworkStackNeeded, !GetAtt ECSTaskNetworkStack.Outputs.PublicSubnetOneRef, !Ref SubnetIdProp]
      LaunchConfigurationName: !Ref 'PrimaryLaunchConfiguration'
      MinSize: '1'
      MaxSize: !Ref PrimaryMaxCount
      DesiredCapacity: '1'
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingReplacingUpdate:
        WillReplace: 'true'

  PrimaryLaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: !Ref 'ECSAMI'
      SecurityGroups: [!Ref 'EcsHostSecurityGroup']
      InstanceType: !Ref 'InstanceType'
      IamInstanceProfile: !Ref 'EC2InstanceProfile'
      KeyName: !Ref ECSKeyName
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config
          echo ECS_INSTANCE_ATTRIBUTES={\"target_group\":\"primary\"} >> /etc/ecs/ecs.config
          # Make sure latest version of the helper scripts are installed as per recommendation:
          # https://github.com/awsdocs/aws-cloudformation-user-guide/blob/master/doc_source/cfn-helper-scripts-reference.md#using-the-latest-version
          yum install -y aws-cfn-bootstrap wget aws-cli xfsprogs

          # ATTACH EBS VOLUME
          EC2_INSTANCE_ID=`curl -s http://169.254.169.254/latest/meta-data/instance-id`
          VOLUME_ID=${GerritVolumeStack.Outputs.GerritVolumeRef}
          echo "Volume Id: $VOLUME_ID"

          aws ec2 attach-volume --region ${AWS::Region} --volume-id $VOLUME_ID --instance-id $EC2_INSTANCE_ID --device /dev/xvdg

          for i in $(seq 1 ${GerritVolumeAttachMaxRetries}); do
            echo "Waiting for volume $VOLUME_ID to be attached to the instace $EC2_INSTANCE_ID ($i/${GerritVolumeAttachMaxRetries})"
            volumeStatus=`aws ec2 describe-volumes --region ${AWS::Region} --volume-ids $VOLUME_ID`
            if [[ $volumeStatus =~ "\"State\": \"attached\"" ]]; then
              echo "Volume $VOLUME_ID attached to the instace $EC2_INSTANCE_ID"
              break
            elif [[ "$i" -eq "${GerritVolumeAttachMaxRetries}" ]]; then
              echo "Could not attach the volume $VOLUME_ID to the instace $EC2_INSTANCE_ID after ${GerritVolumeAttachMaxRetries} attempts"
              exit 1
            fi
            sleep ${GerritVolumeAttachRetryDelay}
          done

          if [[ "${GerritVolumeId}" = "" && "${GerritVolumeSnapshotId}" = "" ]]; then
            echo "Create file system for Gerrit volume"
            mkfs -t xfs /dev/xvdg
          fi

          mkdir /gerrit-mount-point
          mount /dev/xvdg /gerrit-mount-point

          if [[ "${GerritVolumeId}" = "" && "${GerritVolumeSnapshotId}" = "" ]]; then
            echo "Create Gerrit directories"
            mkdir -p /gerrit-mount-point/gerrit-logs \
             /gerrit-mount-point/gerrit-cache \
             /gerrit-mount-point/gerrit-data \
             /gerrit-mount-point/gerrit-git \
             /gerrit-mount-point/gerrit-index \
             /gerrit-mount-point/gerrit-db
          fi

          chown 1000:1000 -R /gerrit-mount-point

          # Get the CloudWatch Logs agent
          echo -e "
            {\"logs\":
              {\"logs_collected\":
                {\"files\":
                  {\"collect_list\":
                    [
                      {\"file_path\": \"/gerrit-mount-point/gerrit-logs/replication_log\",
                      \"log_group_name\": \"${AWS::StackName}\",
                      \"log_stream_name\": \"${EnvironmentName}/{instance_id}/primary/replication_log\",
                      \"timezone\": \"UTC\"
                      },
                      {\"file_path\": \"/gerrit-mount-point/gerrit-logs/httpd_log\",
                      \"log_group_name\": \"${AWS::StackName}\",
                      \"log_stream_name\": \"${EnvironmentName}/{instance_id}/primary/httpd_log\",
                      \"timezone\": \"UTC\"
                      },
                      {\"file_path\": \"/gerrit-mount-point/gerrit-logs/sshd_log\",
                      \"log_group_name\": \"${AWS::StackName}\",
                      \"log_stream_name\": \"${EnvironmentName}/{instance_id}/primary/sshd_log\",
                      \"timezone\": \"UTC\"
                      },
                      {\"file_path\": \"/gerrit-mount-point/gerrit-logs/gc_log\",
                      \"log_group_name\": \"${AWS::StackName}\",
                      \"log_stream_name\": \"${EnvironmentName}/{instance_id}/primary/gc_log\",
                      \"timezone\": \"UTC\"
                      },
                      {\"file_path\": \"/gerrit-mount-point/gerrit-logs/audit_log\",
                      \"log_group_name\": \"${AWS::StackName}\",
                      \"log_stream_name\": \"${EnvironmentName}/{instance_id}/primary/audit_log\",
                      \"timezone\": \"UTC\"
                      }
                    ]
                  }
                }
              }
            }" >> /home/ec2-user/gerritlogsaccess.json
          # Install the CloudWatch Logs agent
          wget https://s3.amazonaws.com/amazoncloudwatch-agent/centos/amd64/latest/amazon-cloudwatch-agent.rpm
          rpm -U ./amazon-cloudwatch-agent.rpm
          /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c file:/home/ec2-user/gerritlogsaccess.json -s
          # Signal to CloudFormation aws-cfn-bootstrap has been correctly updated
          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource PrimaryASG --region ${AWS::Region}


  ReplicaASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:
        - !If [NetworkStackNeeded, !GetAtt ECSTaskNetworkStack.Outputs.PublicSubnetOneRef, !Ref SubnetIdProp]
      LaunchConfigurationName: !Ref 'ReplicaLaunchConfiguration'
      MinSize: '1'
      MaxSize: '1'
      DesiredCapacity: '1'
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingReplacingUpdate:
        WillReplace: 'true'

  ReplicaLaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: !Ref 'ECSAMI'
      SecurityGroups: [!Ref 'EcsHostSecurityGroup']
      InstanceType: !Ref 'InstanceType'
      IamInstanceProfile: !Ref 'EC2InstanceProfile'
      KeyName: !Ref ECSKeyName
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config
          echo ECS_INSTANCE_ATTRIBUTES={\"target_group\":\"replica\"} >> /etc/ecs/ecs.config

          # Make sure latest version of the helper scripts are installed as per recommendation:
          # https://github.com/awsdocs/aws-cloudformation-user-guide/blob/master/doc_source/cfn-helper-scripts-reference.md#using-the-latest-version
          yum install -y aws-cfn-bootstrap wget
          # Get the CloudWatch Logs agent
          echo -e "
            {\"logs\":
              {\"logs_collected\":
                {\"files\":
                  {\"collect_list\":
                    [
                      {\"file_path\": \"/var/lib/docker/volumes/gerrit-logs-replica/_data/replication_log\",
                      \"log_group_name\": \"${AWS::StackName}\",
                      \"log_stream_name\": \"${EnvironmentName}/{instance_id}/replica/replication_log\",
                      \"timezone\": \"UTC\"
                      },
                      {\"file_path\": \"/var/lib/docker/volumes/gerrit-logs-replica/_data/httpd_log\",
                      \"log_group_name\": \"${AWS::StackName}\",
                      \"log_stream_name\": \"${EnvironmentName}/{instance_id}/replica/httpd_log\",
                      \"timezone\": \"UTC\"
                      },
                      {\"file_path\": \"/var/lib/docker/volumes/gerrit-logs-replica/_data/sshd_log\",
                      \"log_group_name\": \"${AWS::StackName}\",
                      \"log_stream_name\": \"${EnvironmentName}/{instance_id}/replica/sshd_log\",
                      \"timezone\": \"UTC\"
                      },
                      {\"file_path\": \"/var/lib/docker/volumes/gerrit-logs-replica/_data/gc_log\",
                      \"log_group_name\": \"${AWS::StackName}\",
                      \"log_stream_name\": \"${EnvironmentName}/{instance_id}/replica/gc_log\",
                      \"timezone\": \"UTC\"
                      },
                      {\"file_path\": \"/var/lib/docker/volumes/gerrit-logs-replica/_data/audit_log\",
                      \"log_group_name\": \"${AWS::StackName}\",
                      \"log_stream_name\": \"${EnvironmentName}/{instance_id}/replica/audit_log\",
                      \"timezone\": \"UTC\"
                      }
                    ]
                  }
                }
              }
            }" >> /home/ec2-user/gerritlogsaccess.json
          # Install the CloudWatch Logs agent
          wget https://s3.amazonaws.com/amazoncloudwatch-agent/centos/amd64/latest/amazon-cloudwatch-agent.rpm
          rpm -U ./amazon-cloudwatch-agent.rpm
          /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c file:/home/ec2-user/gerritlogsaccess.json -s
          # Signal to CloudFormation aws-cfn-bootstrap has been correctly updated
          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource ReplicaASG --region ${AWS::Region}

  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles: [!Ref 'EC2Role']

  # Role for the EC2 hosts. This allows the ECS agent on the EC2 hosts
  # to communciate with the ECS control plane, as well as download the docker
  # images from ECR to run on your host.
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [ec2.amazonaws.com]
          Action: ['sts:AssumeRole']
      Path: /
      Policies:
      - PolicyName: ecs-service
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
              - 'ecs:CreateCluster'
              - 'ecs:DeregisterContainerInstance'
              - 'ecs:DiscoverPollEndpoint'
              - 'ecs:Poll'
              - 'ecs:RegisterContainerInstance'
              - 'ecs:StartTelemetrySession'
              - 'ecs:Submit*'
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
              - 'ecr:GetAuthorizationToken'
              - 'ecr:BatchGetImage'
              - 'ecr:GetDownloadUrlForLayer'
              - 'ec2:AttachVolume'
              - 'ec2:DescribeVolumes'
            Resource: '*'
  ECSTaskNetworkStack:
    Type: AWS::CloudFormation::Stack
    DeletionPolicy: Retain
    Condition: NetworkStackNeeded
    Properties:
      TemplateURL: !Join [ '', ['https://', !Ref TemplateBucketName, '.s3.amazonaws.com/cf-gerrit-network-stack.yml'] ]
      TimeoutInMinutes: '25'
      Parameters:
        InternetGatewayIdProp: !Ref 'InternetGatewayIdProp'
        VPCIdProp: !Ref 'VPCIdProp'
        VPCCIDR: !Ref 'VPCCIDR'
        SubnetIdProp: !Ref 'SubnetIdProp'
        SubnetCIDR: !Ref 'SubnetCIDR'

  GerritVolumeStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Join [ '', ['https://', !Ref TemplateBucketName, '.s3.amazonaws.com/cf-gerrit-volume.yml'] ]
      TimeoutInMinutes: '25'
      Parameters:
        GerritVolumeId: !Ref 'GerritVolumeId'
        GerritVolumeSnapshotId: !Ref 'GerritVolumeSnapshotId'
        GerritVolumeSizeInGiB: !Ref 'GerritVolumeSizeInGiB'

  ReplicaGitFileSystemPermanentStack:
    Type: AWS::CloudFormation::Stack
    Condition: CreateReplicaEFS
    DeletionPolicy: Retain
    Properties:
      TemplateURL: !Join [ '', ['https://', !Ref TemplateBucketName, '.s3.amazonaws.com/cf-efs-stack.yml'] ]
      TimeoutInMinutes: '25'
      Parameters:
        FileSystemThroughputMode: !Ref ReplicaFileSystemThroughputMode
        ProvisionedThroughputInMibps: !Ref ReplicaProvisionedThroughputInMibps
        PublicSubnet: !If [NetworkStackNeeded, !GetAtt ECSTaskNetworkStack.Outputs.PublicSubnetOneRef, !Ref SubnetIdProp]
        SecurityGroupVPCID: !If [NetworkStackNeeded, !GetAtt ECSTaskNetworkStack.Outputs.VPCRef, !Ref VPCIdProp]
        SecurityGroupCidrIp: !Ref SubnetCIDR
        TagValue: "efs-for-gerrit-replicas"

Outputs:
  ClusterName:
    Description: The name of the ECS cluster
    Value: !Ref 'ECSCluster'
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'ClusterName' ] ]
  VPCId:
    Description: The ID of the VPC that this stack is deployed in
    Value: !If [NetworkStackNeeded, !GetAtt ECSTaskNetworkStack.Outputs.VPCRef, !Ref VPCIdProp]
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'VPCId' ] ]
  PublicSubnetOne:
    Description: Public subnet one
    Value: !If [NetworkStackNeeded, !GetAtt ECSTaskNetworkStack.Outputs.PublicSubnetOneRef, !Ref SubnetIdProp]
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicSubnetOne' ] ]
  ClusterArn:
    Description: The ARN of the ECS cluster
    Value: !GetAtt ECSCluster.Arn
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'ClusterArn' ] ]
  ReplicaFileSystemID:
    Description: The ID of the EFS to be mounted by replicas
    Value: !If [CreateReplicaEFS, !GetAtt ReplicaGitFileSystemPermanentStack.Outputs.FileSystemID, !Ref ReplicaFileSystemID ]
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'ReplicaFileSystemID' ] ]