infra.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Autobiography Interview API - Ultra Minimal EC2 Setup'

Parameters:
  ProjectName:
    Type: String
    Default: autobiography-api
    Description: Project name for resource naming
  
  KeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: EC2 Key Pair for SSH access
    Default: autobiography-api-key

Resources:
  # Security Group for EC2
  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for EC2 instance
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0  # SSH access
        - IpProtocol: tcp
          FromPort: 3000
          ToPort: 3000
          CidrIp: 0.0.0.0/0  # API access
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0  # HTTP access
      Tags:
        - Key: Name
          Value: !Sub ${ProjectName}-ec2-sg

  # IAM Role for EC2
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: BedrockAccess
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - bedrock:InvokeModel
                Resource: '*'
        - PolicyName: S3Access
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:DeleteObject
                Resource: !Sub arn:aws:s3:::${S3Bucket}/*
        - PolicyName: ECRAccess
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - ecr:GetAuthorizationToken
                  - ecr:BatchCheckLayerAvailability
                  - ecr:GetDownloadUrlForLayer
                  - ecr:BatchGetImage
                Resource: '*'

  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref EC2Role

  # ECR Repository
  ECRRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: !Sub ${ProjectName}
      ImageScanningConfiguration:
        ScanOnPush: true
      LifecyclePolicy:
        LifecyclePolicyText: |
          {
            "rules": [
              {
                "rulePriority": 1,
                "description": "Keep last 5 images",
                "selection": {
                  "tagStatus": "any",
                  "countType": "imageCountMoreThan",
                  "countNumber": 5
                },
                "action": {
                  "type": "expire"
                }
              }
            ]
          }

  # S3 Bucket for images
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${ProjectName}-images-${AWS::AccountId}
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
        BlockPublicPolicy: false
        IgnorePublicAcls: false
        RestrictPublicBuckets: false
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders: ['*']
            AllowedMethods: [GET, PUT, POST, DELETE]
            AllowedOrigins: ['*']
            MaxAge: 3000

  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
          - Sid: PublicReadGetObject
            Effect: Allow
            Principal: '*'
            Action: s3:GetObject
            Resource: !Sub arn:aws:s3:::${S3Bucket}/*

  # EC2 Instance
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0c2acfcb2ac4d02a0  # Amazon Linux 2023 in ap-northeast-2
      InstanceType: t3.micro  # Free tier eligible
      KeyName: !Ref KeyPairName
      SecurityGroupIds:
        - !Ref EC2SecurityGroup
      IamInstanceProfile: !Ref EC2InstanceProfile
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum update -y
          yum install -y docker git mysql
          
          # Start Docker
          systemctl start docker
          systemctl enable docker
          usermod -a -G docker ec2-user
          
          # Install Docker Compose
          curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
          chmod +x /usr/local/bin/docker-compose
          
          # Install Node.js
          curl -fsSL https://rpm.nodesource.com/setup_18.x | bash -
          yum install -y nodejs
          
          # Install AWS CLI v2
          curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
          unzip awscliv2.zip
          ./aws/install
          
          # Create deployment directory
          mkdir -p /home/ec2-user/app
          chown ec2-user:ec2-user /home/ec2-user/app
          
          # Create environment file
          cat > /home/ec2-user/app/.env << EOF
          NODE_ENV=production
          PORT=3000
          
          # Use SQLite for now (no RDS)
          DB_TYPE=sqlite
          DB_PATH=/home/ec2-user/app/database.sqlite
          
          # AWS
          AWS_REGION=${AWS::Region}
          S3_BUCKET_NAME=${S3Bucket}
          BEDROCK_MODEL_ID=anthropic.claude-3-sonnet-20240229-v1:0
          
          # ECR
          ECR_REPOSITORY_URI=${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${ECRRepository}
          EOF
          
          chown ec2-user:ec2-user /home/ec2-user/app/.env
      Tags:
        - Key: Name
          Value: !Sub ${ProjectName}-instance

Outputs:
  EC2InstanceId:
    Description: EC2 Instance ID
    Value: !Ref EC2Instance
    Export:
      Name: !Sub ${ProjectName}-ultra-ec2-instance-id

  EC2PublicIP:
    Description: EC2 Instance Public IP
    Value: !GetAtt EC2Instance.PublicIp
    Export:
      Name: !Sub ${ProjectName}-ultra-ec2-public-ip

  EC2PublicDNS:
    Description: EC2 Instance Public DNS
    Value: !GetAtt EC2Instance.PublicDnsName
    Export:
      Name: !Sub ${ProjectName}-ultra-ec2-public-dns

  S3BucketName:
    Description: S3 Bucket Name
    Value: !Ref S3Bucket
    Export:
      Name: !Sub ${ProjectName}-ultra-s3-bucket

  ECRRepositoryURI:
    Description: ECR Repository URI
    Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${ECRRepository}
    Export:
      Name: !Sub ${ProjectName}-ultra-ecr-uri

  APIEndpoint:
    Description: API Endpoint URL
    Value: !Sub http://${EC2Instance.PublicIp}:3000
    Export:
      Name: !Sub ${ProjectName}-ultra-api-endpoint