conductr-cloudformation.yaml

---
AWSTemplateFormatVersion: "2010-09-09"

Description: >
  Create Lightbend Production Suite demo

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Reactive Platform Credentials
        Parameters:
          - LightbendUser
          - LightbendPassword
      - Label:
          default: Network Configuration
        Parameters:
          - VpcCidrBlock
          - SubnetCidrBlocks
      - Label:
          default: Instance Configuration
        Parameters:
          - KeyName

Parameters:
  VpcCidrBlock:
    Type: String
    Default: "10.23.0.0/16"
    Description: The CIDR block for the new VPC.
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: must be a valid VPC CIDR block (see http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html)
  SubnetCidrBlocks:
    Type: CommaDelimitedList
    Default: "10.23.0.0/24, 10.23.1.0/24, 10.23.2.0/24"
    Description: CIDR blocks for the three subnets, separated by commas. These must fall within the VPC CIDR block.
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: The EC2 key pair to use to SSH to your new ConductR instances. Be sure that you have a copy of the private key.
  LightbendUser:
    Type: String
    Description: Your Reactive Platform username from https://www.lightbend.com/product/lightbend-reactive-platform/credentials
  LightbendPassword:
    Type: String
    NoEcho: true
    Description: Your Reactive Platform password from https://www.lightbend.com/product/lightbend-reactive-platform/credentials

Mappings:
  # TODO: add AMIs to more regions
  # See http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/mappings-section-structure.html
  RegionMap:
    us-east-1:
      AMI: ami-ca4ab2dc
    us-west-2:
      AMI: ami-8044ffe0
    eu-west-1:
      AMI: ami-de3f0cb8

Resources:
  # The network: a VPC, three public subnets, and a route to the internet
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidrBlock
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
      Tags:
        - Key: Name
          Value: Lightbend Cluster VPC
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: Lightbend Cluster Internet Gateway
  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  Subnet0:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [ 0, !Ref SubnetCidrBlocks ]
      AvailabilityZone: !Select [ 0, !GetAZs "" ]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub
            - "Lightbend Cluster Subnet ${AZ}"
            - AZ: !Select [ 0, !GetAZs "" ]
  Subnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [ 1, !Ref SubnetCidrBlocks ]
      AvailabilityZone: !Select [ 1, !GetAZs "" ]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub
            - "Lightbend Cluster Subnet ${AZ}"
            - AZ: !Select [ 1, !GetAZs "" ]
  Subnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [ 2, !Ref SubnetCidrBlocks ]
      AvailabilityZone: !Select [ 2, !GetAZs "" ]
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub
            - "Lightbend Cluster Subnet ${AZ}"
            - AZ: !Select [ 2, !GetAZs "" ]
  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: Lightbend Cluster Route Table
  RouteToInternet:
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref RouteTable
      GatewayId: !Ref InternetGateway
      DestinationCidrBlock: 0.0.0.0/0
  RouteTableAssociation0:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref Subnet0
      RouteTableId: !Ref RouteTable
  RouteTableAssociation1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref Subnet1
      RouteTableId: !Ref RouteTable
  RouteTableAssociation2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref Subnet2
      RouteTableId: !Ref RouteTable

  # Security groups:
  #   - allow ingress for HTTP(S) to the load balancer and SSH to the EC2 instances
  #   - allow EC2 instances to connect to each other for internal communication
  #   - allow the load balancer to connect to instances for health checks and routing HTTP
  IngressSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Ingress Security Group to Lightbend Cluster
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: Lightbend Cluster Ingress Security Group
  NodesSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security Group for Lightbend Cluster Nodes
      VpcId: !Ref VPC
      SecurityGroupIngress:
        # SSH
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
        # Health
        - IpProtocol: tcp
          FromPort: 9009
          ToPort: 9009
          SourceSecurityGroupId: !Ref IngressSecurityGroup
        # Visualizer
        - IpProtocol: tcp
          FromPort: 9999
          ToPort: 9999
          SourceSecurityGroupId: !Ref IngressSecurityGroup
      Tags:
        - Key: Name
          Value: Lightbend Cluster Nodes Security Group
  NodesAgentRemotePortRule:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref NodesSecurityGroup
      IpProtocol: tcp
      FromPort: 2552
      ToPort: 2552
      SourceSecurityGroupId: !Ref NodesSecurityGroup
  NodesInternalPortsRule:
    # Akka remoting, control protocol, bundle transfer
    # Status server, service locator
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref NodesSecurityGroup
      IpProtocol: tcp
      FromPort: 9004
      ToPort: 9008
      SourceSecurityGroupId: !Ref NodesSecurityGroup
  NodesBundleEndpointPortsRule:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref NodesSecurityGroup
      IpProtocol: tcp
      FromPort: 10000
      ToPort: 10999
      SourceSecurityGroupId: !Ref NodesSecurityGroup

  # The ConductR Cluster Instances
  Node0:
    Type: AWS::EC2::Instance
    DependsOn: VPCGatewayAttachment
    Metadata:
      AWS::CloudFormation::Init:
        config:
          commands:
            00_environment:
              command: su ubuntu /home/ubuntu/environment.sh
              cwd: /home/ubuntu
              env:
                LIGHTBEND_USER: !Ref LightbendUser
                LIGHTBEND_PASSWORD: !Ref LightbendPassword
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT10M
    Properties:
      ImageId: !FindInMap [ RegionMap, !Ref "AWS::Region", AMI ]
      KeyName: !Ref KeyName
      InstanceType: "t2.xlarge" # TODO: make configurable?
      AvailabilityZone: !GetAtt Subnet0.AvailabilityZone
      NetworkInterfaces:
        - DeviceIndex: "0"
          AssociatePublicIpAddress: "true"
          GroupSet: [ !Ref NodesSecurityGroup ]
          SubnetId: !Ref Subnet0
      UserData:
        'Fn::Base64': !Sub |
           #!/bin/bash -xe
           /usr/local/bin/cfn-init -v --stack ${AWS::StackName} --resource Node0 --region ${AWS::Region}
           /usr/local/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource Node0 --region ${AWS::Region}
      Tags:
        - Key: Name
          Value: Lightbend Cluster Node 0
        - Key: Role
          Value: Seed Node
  Node1:
    Type: AWS::EC2::Instance
    DependsOn: VPCGatewayAttachment
    Metadata:
      AWS::CloudFormation::Init:
        config:
          commands:
            00_environment:
              command: su ubuntu /home/ubuntu/environment.sh
              cwd: /home/ubuntu
              env:
                LIGHTBEND_USER: !Ref LightbendUser
                LIGHTBEND_PASSWORD: !Ref LightbendPassword
                SEED_NODE: !GetAtt Node0.PrivateIp
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT10M
    Properties:
      ImageId: !FindInMap [ RegionMap, !Ref "AWS::Region", AMI ]
      KeyName: !Ref KeyName
      InstanceType: "t2.xlarge" # TODO: make configurable?
      AvailabilityZone: !GetAtt Subnet1.AvailabilityZone
      NetworkInterfaces:
        - DeviceIndex: "0"
          AssociatePublicIpAddress: "true"
          GroupSet: [ !Ref NodesSecurityGroup ]
          SubnetId: !Ref Subnet1
      UserData:
        'Fn::Base64': !Sub |
           #!/bin/bash -xe
           /usr/local/bin/cfn-init -v --stack ${AWS::StackName} --resource Node1 --region ${AWS::Region}
           /usr/local/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource Node1 --region ${AWS::Region}
      Tags:
        - Key: Name
          Value: Lightbend Cluster Node 1
        - Key: Role
          Value: Node
  Node2:
    Type: AWS::EC2::Instance
    DependsOn:
      - VPCGatewayAttachment
      - Node1 # This ensures the rest of the cluster has started before loading bundles
    Metadata:
      AWS::CloudFormation::Init:
        config:
          commands:
            00_environment:
              command: su ubuntu /home/ubuntu/environment.sh
              cwd: /home/ubuntu
              env:
                LIGHTBEND_USER: !Ref LightbendUser
                LIGHTBEND_PASSWORD: !Ref LightbendPassword
                SEED_NODE: !GetAtt Node0.PrivateIp
            01_update_conductr-cli:
              command: sudo pip3 install --upgrade pip && sudo pip3 install -U conductr-cli
            02_wait:
              command: timeout 1000 bash -c 'until conduct members --host \"$(hostname -i)\"; do sleep 10; done' || echo timed out
            03_bundles:
              command: su ubuntu /home/ubuntu/bundles.sh
              cwd: /home/ubuntu
              env:
                NODE_COUNT: 3
    CreationPolicy:
      ResourceSignal:
        Count: 1
        Timeout: PT10M
    Properties:
      ImageId: !FindInMap [ RegionMap, !Ref "AWS::Region", AMI ]
      KeyName: !Ref KeyName
      InstanceType: "t2.xlarge" # TODO: make configurable?
      AvailabilityZone: !GetAtt Subnet2.AvailabilityZone
      NetworkInterfaces:
        - DeviceIndex: "0"
          AssociatePublicIpAddress: "true"
          GroupSet: [ !Ref NodesSecurityGroup ]
          SubnetId: !Ref Subnet2
      UserData:
        'Fn::Base64': !Sub |
           #!/bin/bash -xe
           /usr/local/bin/cfn-init -v --stack ${AWS::StackName} --resource Node2 --region ${AWS::Region}
           /usr/local/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource Node2 --region ${AWS::Region}
      Tags:
        - Key: Name
          Value: Lightbend Cluster Node 2
        - Key: Role
          Value: Node

  # Load Balancer
  ELB:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      CrossZone: true
      Subnets:
        - !Ref Subnet0
        - !Ref Subnet1
        - !Ref Subnet2
      SecurityGroups:
        - !Ref IngressSecurityGroup
      Listeners:
        - Protocol: HTTP
          LoadBalancerPort: 80
          InstancePort: 9999
      HealthCheck:
        Target: HTTP:9009/status
        Interval: 10
        Timeout: 5
        UnhealthyThreshold: 2
        HealthyThreshold: 3
      Instances:
        - !Ref Node0
        - !Ref Node1
        - !Ref Node2

Outputs:
  VisualizerURL:
    Description: The URL of the load balancer that serves the Visualizer service
    Value: !Sub "http://${ELB.CanonicalHostedZoneName}"