AWSTemplateFormatVersion: '2010-09-09'
Description: A stack for deploying containerized applications onto a cluster of EC2
             hosts using Elastic Container Service. This stack runs containers on
             hosts that are in a public VPC subnet.
Parameters:
  TemplateBucketName:
    Description: S3 bucket containing cloudformation templates
    Type: String
  ECSAMI:
    Description: AMI ID
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ecs/optimized-ami/amazon-linux-2/recommended/image_id
  InstanceType:
    Description: EC2 instance type
    Type: String
    Default: m4.2xlarge
    AllowedValues: [t2.micro, t2.small, t2.medium, t2.large, m3.medium, m3.large,
      m3.xlarge, m3.2xlarge, m4.large, m4.xlarge, m4.2xlarge, m4.4xlarge, m4.10xlarge,
      c4.large, c4.xlarge, c4.2xlarge, c4.4xlarge, c4.8xlarge, c3.large, c3.xlarge,
      c3.2xlarge, c3.4xlarge, c3.8xlarge, r3.large, r3.xlarge, r3.2xlarge, r3.4xlarge,
      r3.8xlarge, i2.xlarge, i2.2xlarge, i2.4xlarge, i2.8xlarge]
    ConstraintDescription: Please choose a valid instance type.
  InternetGatewayIdProp:
    Type: String
    Default: ""
    Description: Internet Gateway id. If empty Internet Gateway will be created
  VPCIdProp:
    Type: String
    Default: ""
    Description: VPC id. If empty VPC will be created
  SubnetIdProp:
    Type: String
    Default: ""
    Description: Subnet id. If empty Network Stack will be created
  SubnetCIDR:
    Type: String
    Default: 10.0.0.0/24
    Description: Subnet CIDR.
  VPCCIDR:
    Type: String
    Default: 10.0.0.0/16
    Description: VPC CIDR.
  ECSKeyName:
    Type: String
    Default: gerrit-cluster-keys
    Description: EC2 key pair name the cluter's instances
  EnvironmentName:
      Description: An environment name used to build the log stream names
      Type: String
      Default: test
  FileSystemThroughputMode:
    Description:  Gerrit shared filesystem throughput mode
    Type: String
    Default: bursting
    AllowedValues: [bursting, provisioned]
  ProvisionedThroughputInMibps:
    Description:  The fs throughput, measured in MiB/s. Valid values are 1-1024.
    Type: Number
    Default: 256
  HAProxyMaxCount:
    Description: The maximum number of EC2 instances in the haproxy autoscaling group
    Type: Number
    Default: 2
  HAProxyDesiredCount:
    Description: The desired number of haproxy instances
    ConstraintDescription: number of haproxy must be at least 2
    Type: Number
    MinValue: 2
    Default: 2
  MasterMaxCount:
    Description: The maximum number of EC2 instances in the master autoscaling group
    ConstraintDescription: number of haproxy must be at least 2
    Type: Number
    Default: 2
    MinValue: 2

Conditions:
  isProvisionedThroughput: !Equals [!Ref FileSystemThroughputMode, "provisioned"]

Resources:
  # ECS Resources
  ECSCluster:
    Type: AWS::ECS::Cluster

  EcsHostSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Access to the ECS hosts that run containers
      VpcId: !GetAtt ECSTaskNetworkStack.Outputs.VPCRef
      SecurityGroupIngress:
          # Allow access to NLB from anywhere on the internet
          - CidrIp: 0.0.0.0/0
            IpProtocol: -1

  CloudWatchLogsGroup:
      Type: AWS::Logs::LogGroup
      Properties:
          LogGroupName: !Ref AWS::StackName
          RetentionInDays: 14

  ReplicaECSAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:
        - !GetAtt ECSTaskNetworkStack.Outputs.PublicSubnetOneRef
      LaunchConfigurationName: !Ref 'ReplicaLaunchConfiguration'
      MinSize: '1'
      MaxSize: '1'
      DesiredCapacity: '1'
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingReplacingUpdate:
        WillReplace: 'true'

  ReplicaLaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: !Ref 'ECSAMI'
      SecurityGroups: [!Ref 'EcsHostSecurityGroup']
      InstanceType: !Ref 'InstanceType'
      IamInstanceProfile: !Ref 'EC2InstanceProfile'
      KeyName: !Ref ECSKeyName
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config
          echo ECS_INSTANCE_ATTRIBUTES={\"target_group\":\"replica\"} >> /etc/ecs/ecs.config

          # Make sure latest version of the helper scripts are installed as per recommendation:
          # https://github.com/awsdocs/aws-cloudformation-user-guide/blob/master/doc_source/cfn-helper-scripts-reference.md#using-the-latest-version
          yum install -y aws-cfn-bootstrap wget

          # Install the CloudWatch Logs agent
          wget https://s3.amazonaws.com/amazoncloudwatch-agent/centos/amd64/latest/amazon-cloudwatch-agent.rpm
          rpm -U ./amazon-cloudwatch-agent.rpm
          /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s

          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource ReplicaECSAutoScalingGroup --region ${AWS::Region}

  HAProxyECSAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:
        - !GetAtt ECSTaskNetworkStack.Outputs.PublicSubnetOneRef
      LaunchConfigurationName: !Ref 'HAProxyLaunchConfiguration'
      MinSize: '2'
      MaxSize: !Ref HAProxyMaxCount
      DesiredCapacity: !Ref HAProxyDesiredCount
    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M
    UpdatePolicy:
      AutoScalingReplacingUpdate:
        WillReplace: 'true'

  HAProxyLaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: !Ref 'ECSAMI'
      SecurityGroups: [!Ref 'EcsHostSecurityGroup']
      InstanceType: !Ref 'InstanceType'
      IamInstanceProfile: !Ref 'EC2InstanceProfile'
      KeyName: !Ref ECSKeyName
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config
          echo ECS_INSTANCE_ATTRIBUTES={\"target_group\":\"haproxy\"} >> /etc/ecs/ecs.config

          # Make sure latest version of the helper scripts are installed as per recommendation:
          # https://github.com/awsdocs/aws-cloudformation-user-guide/blob/master/doc_source/cfn-helper-scripts-reference.md#using-the-latest-version
          yum install -y aws-cfn-bootstrap wget

          # Install the CloudWatch Logs agent
          wget https://s3.amazonaws.com/amazoncloudwatch-agent/centos/amd64/latest/amazon-cloudwatch-agent.rpm
          rpm -U ./amazon-cloudwatch-agent.rpm
          /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s

          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource HAProxyECSAutoScalingGroup --region ${AWS::Region}

  Master1ASG:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Join [ '', ['https://', !Ref TemplateBucketName, '.s3.amazonaws.com/cf-master-asg.yml'] ]
      TimeoutInMinutes: '25'
      Parameters:
        GerritInstanceNumber: 1
        EC2AMI: !Ref ECSAMI
        InstanceType: !Ref InstanceType
        ECSKeyName: !Ref ECSKeyName
        EnvironmentName: !Ref EnvironmentName
        ECSCluster: !Ref ECSCluster
        EC2SecurityGroup: !Ref EcsHostSecurityGroup
        EC2InstanceProfile: !Ref EC2InstanceProfile
        FileSystem: !Ref FileSystem
        SubnetId: !GetAtt ECSTaskNetworkStack.Outputs.PublicSubnetOneRef
        LogGroupName: !Ref AWS::StackName
        MasterMaxCount: !Ref MasterMaxCount

  Master2ASG:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Join [ '', ['https://', !Ref TemplateBucketName, '.s3.amazonaws.com/cf-master-asg.yml'] ]
      TimeoutInMinutes: '25'
      Parameters:
        GerritInstanceNumber: 2
        EC2AMI: !Ref ECSAMI
        InstanceType: !Ref InstanceType
        ECSKeyName: !Ref ECSKeyName
        EnvironmentName: !Ref EnvironmentName
        ECSCluster: !Ref ECSCluster
        EC2SecurityGroup: !Ref EcsHostSecurityGroup
        EC2InstanceProfile: !Ref EC2InstanceProfile
        FileSystem: !Ref FileSystem
        SubnetId: !GetAtt ECSTaskNetworkStack.Outputs.PublicSubnetOneRef
        LogGroupName: !Ref AWS::StackName
        MasterMaxCount: !Ref MasterMaxCount

  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles: [!Ref 'EC2Role']

  # Role for the EC2 hosts. This allows the ECS agent on the EC2 hosts
  # to communciate with the ECS control plane, as well as download the docker
  # images from ECR to run on your host.
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [ec2.amazonaws.com]
          Action: ['sts:AssumeRole']
      Path: /
      Policies:
      - PolicyName: ecs-service
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
              - 'ecs:CreateCluster'
              - 'ecs:DeregisterContainerInstance'
              - 'ecs:DiscoverPollEndpoint'
              - 'ecs:Poll'
              - 'ecs:RegisterContainerInstance'
              - 'ecs:StartTelemetrySession'
              - 'ecs:Submit*'
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
              - 'ecr:GetAuthorizationToken'
              - 'ecr:BatchGetImage'
              - 'ecr:GetDownloadUrlForLayer'
            Resource: '*'
  FileSystem:
    Type: AWS::EFS::FileSystem
    Properties:
      ThroughputMode: !Ref FileSystemThroughputMode
      ProvisionedThroughputInMibps: !If [isProvisionedThroughput, !Ref ProvisionedThroughputInMibps, !Ref "AWS::NoValue"]
      FileSystemTags:
        - Key: Name
          Value: "multi-master-git-repo"
  GitMountTarget:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref FileSystem
      SubnetId: !GetAtt ECSTaskNetworkStack.Outputs.PublicSubnetOneRef
      SecurityGroups:
        - !Ref MountTargetSecurityGroup
  MountTargetSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !GetAtt ECSTaskNetworkStack.Outputs.VPCRef
      GroupDescription: "Security group for mount target"
      SecurityGroupIngress:
        - IpProtocol: TCP
          FromPort: 2049
          ToPort: 2049
          CidrIp: !GetAtt ECSTaskNetworkStack.Outputs.PublicOneCIDR
  ECSTaskNetworkStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Join [ '', ['https://', !Ref TemplateBucketName, '.s3.amazonaws.com/cf-gerrit-network-stack.yml'] ]
      TimeoutInMinutes: '25'
      Parameters:
        InternetGatewayIdProp: !Ref 'InternetGatewayIdProp'
        VPCIdProp: !Ref 'VPCIdProp'
        VPCCIDR: !Ref 'VPCCIDR'
        SubnetIdProp: !Ref 'SubnetIdProp'
        SubnetCIDR: !Ref 'SubnetCIDR'

Outputs:
  ClusterName:
    Description: The name of the ECS cluster
    Value: !Ref 'ECSCluster'
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'ClusterName' ] ]
  VPCId:
    Description: The ID of the VPC that this stack is deployed in
    Value: !GetAtt ECSTaskNetworkStack.Outputs.VPCRef
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'VPCId' ] ]
  PublicSubnetOne:
    Description: Public subnet one
    Value: !GetAtt ECSTaskNetworkStack.Outputs.PublicSubnetOneRef
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'PublicSubnetOne' ] ]