hyperdriven.net/src.yml at master · hyperdriven/hyperdriven.net · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
AWSTemplateFormatVersion: "2010-09-09"
Description: hyperdriven.net

Parameters:
  HostedbyXentekReusableDelegationSetID:
    Type: String
    Default: NU451RJ3WP51J
  HyperdrivenNetHostedZoneID:
    Type: String
    Default: Z24RKFNYVAKPOG
  CloudFrontAliasHostedZoneId:
    Type: String
    Default: Z2FDTNDATAQYW2

Resources:
  HyperdrivenNetRecords:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneId: !Ref HyperdrivenNetHostedZoneID
      RecordSets:
        - Name: hyperdriven.net.
          Type: MX
          TTL: 300
          ResourceRecords:
            - '10 aspmx.l.google.com.'
            - '20 alt1.aspmx.l.google.com.'
            - '20 alt2.aspmx.l.google.com.'
            - '30 aspmx2.googlemail.com.'
            - '30 aspmx3.googlemail.com.'
            - '30 aspmx4.googlemail.com.'
            - '30 aspmx5.googlemail.com.'
        - Name: hyperdriven.net.
          Type: TXT
          TTL: '300'
          ResourceRecords:
            - '"v=spf1 include:_spf.google.com ~all"'
        - Name: _dmarc.hyperdriven.net.
          Type: TXT
          TTL: '300'
          ResourceRecords:
            - '"v=DMARC1; p=none; rua=mailto:postmaster@hostedbyxentek.net"'
        - Name: g._domainkey.hyperdriven.net.
          Type: TXT
          TTL: '300'
          ResourceRecords:
            - '"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCW/ujbGBtm6+JcbtiSiCINb2r3hLUVr4I9/K/k/1ygKvJINUDAfsSMcVGqXxmggS6EAWDgaHMnaTyM5GIeLtjJI8ab6/cVMKJ2ozWUDEs3Cxgz8IaXw7QGCj0/BONkyU4i3zpGhXgbGNN6cTIQfnU8GjcCXVaayiFqI1IssHYLywIDAQAB"'
        - Name: _23b959889ed92b9695cff71ae71126b7.hyperdriven.net.
          Type: CNAME
          TTL: '300'
          ResourceRecords:
            - 274932b416430ddbd01022bd5ee3fc6b.vhzmpjdqfx.acm-validations.aws.

  HyperdrivenBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketName: hyperdriven.net
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: false
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  HyperdrivenOAI:
    DependsOn: HyperdrivenBucket
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: "hyperdriven.net"

  HyperdrivenBucketPolicy:
    DependsOn: HyperdrivenOAI
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref HyperdrivenBucket
      PolicyDocument:
        Version: 2012-10-17
        Id: hyperdriven-bucket-policy
        Statement:
          - Principal:
              CanonicalUser: !GetAtt HyperdrivenOAI.S3CanonicalUserId
            Action:
              - s3:GetObject
            Effect: Allow
            Resource: !Join ["",["arn:aws:s3:::", !Ref HyperdrivenBucket,"/*"]]

  HyperdrivenCert:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: hyperdriven.net
      SubjectAlternativeNames:
        - '*.hyperdriven.net'
      Tags:
        - Key: project
          Value: hyperdriven
      ValidationMethod: DNS

  HyperdrivenCDN:
    DependsOn:
      - HyperdrivenCert
      - HyperdrivenBucket
      - HyperdrivenBucketPolicy
      - HyperdrivenOAI
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Aliases:
          - "hyperdriven.net"
          - "www.hyperdriven.net"
        Comment: "hyperdriven.net"
        Enabled: true
        HttpVersion: http2
        IPV6Enabled: true
        Origins:
          - DomainName: !GetAtt HyperdrivenBucket.DomainName
            Id: !GetAtt HyperdrivenBucket.DomainName
            S3OriginConfig:
              OriginAccessIdentity: !Join ["",["origin-access-identity/cloudfront/", !Ref HyperdrivenOAI]]
        PriceClass: PriceClass_100
        ViewerCertificate:
          AcmCertificateArn: !Ref HyperdrivenCert
          SslSupportMethod: sni-only
          MinimumProtocolVersion: TLSv1.1_2016
        CacheBehaviors:
          - PathPattern: "img/*"
            TargetOriginId: !GetAtt HyperdrivenBucket.DomainName
            AllowedMethods:
              - HEAD
              - GET
              - OPTIONS
            CachedMethods:
              - HEAD
              - GET
              - OPTIONS
            Compress: true
            DefaultTTL: 86400
            MinTTL: 0
            MaxTTL: 31536000
            ForwardedValues:
              QueryString: false
              Cookies:
                Forward: none
            SmoothStreaming: false
            ViewerProtocolPolicy: redirect-to-https
          - PathPattern: "js/*"
            TargetOriginId: !GetAtt HyperdrivenBucket.DomainName
            AllowedMethods:
              - HEAD
              - GET
              - OPTIONS
            CachedMethods:
              - HEAD
              - GET
              - OPTIONS
            Compress: true
            DefaultTTL: 86400
            MinTTL: 0
            MaxTTL: 86400
            ForwardedValues:
              QueryString: false
              Cookies:
                Forward: none
            SmoothStreaming: false
            ViewerProtocolPolicy: redirect-to-https
          - PathPattern: "fonts/*"
            TargetOriginId: !GetAtt HyperdrivenBucket.DomainName
            AllowedMethods:
              - HEAD
              - GET
              - OPTIONS
            CachedMethods:
              - HEAD
              - GET
              - OPTIONS
            Compress: true
            DefaultTTL: 86400
            MinTTL: 0
            MaxTTL: 86400
            ForwardedValues:
              QueryString: false
              Cookies:
                Forward: none
            SmoothStreaming: false
            ViewerProtocolPolicy: redirect-to-https
        DefaultCacheBehavior:
          TargetOriginId: !GetAtt HyperdrivenBucket.DomainName
          AllowedMethods:
            - HEAD
            - GET
            - OPTIONS
          CachedMethods:
            - HEAD
            - GET
            - OPTIONS
          Compress: true
          DefaultTTL: 60
          MinTTL: 0
          MaxTTL: 300
          ForwardedValues:
            QueryString: true
            Cookies:
              Forward: none
          SmoothStreaming: false
          ViewerProtocolPolicy: redirect-to-https
        CustomErrorResponses:
          - ResponsePagePath: /index.html
            ErrorCachingMinTTL: 60
            ErrorCode: 403
            ResponseCode: 200
          - ResponsePagePath: /index.html
            ErrorCachingMinTTL: 60
            ErrorCode: 404
            ResponseCode: 200

  HyperdrivenAliasRecords:
    DependsOn: HyperdrivenCDN
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneId: !Ref HyperdrivenNetHostedZoneID
      RecordSets:
        - Name: hyperdriven.net.
          Type: A
          AliasTarget:
            DNSName: !GetAtt HyperdrivenCDN.DomainName
            HostedZoneId: !Ref CloudFrontAliasHostedZoneId
        - Name: www.hyperdriven.net.
          Type: A
          AliasTarget:
            DNSName: !GetAtt HyperdrivenCDN.DomainName
            HostedZoneId: !Ref CloudFrontAliasHostedZoneId