cdkinfracode/aws_cdk/lib/aws_cdk-stack.ts

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as iam from 'aws-cdk-lib/aws-iam';

export class AwsCdkStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // 1. Look up the existing Default VPC (Free, avoids NAT Gateway charges)
    const vpc = ec2.Vpc.fromLookup(this, 'DefaultVpc', {
      isDefault: true,
    });

    // 2. Create a Security Group for the Mail Server
    const securityGroup = new ec2.SecurityGroup(this, 'MailServerSG', {
      vpc,
      description: 'Security Group for self-hosted mail server',
      allowAllOutbound: true,
    });

    // Allow SSH
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(22), 'Allow SSH access');

    // Mail Protocols (SMTP, SMTPS, Submission)
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(25), 'Allow SMTP');
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(465), 'Allow SMTPS');
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(587), 'Allow SMTP Submission');

    // Mail Protocols (IMAP, IMAPS)
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(143), 'Allow IMAP');
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(993), 'Allow IMAPS');

    // Web Traffic (HTTP, HTTPS for Admin UI & Webmail / SSL certificates)
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(80), 'Allow HTTP');
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), 'Allow HTTPS');

    // WireGuard VPN
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.udp(51820), 'Allow WireGuard VPN');
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(51821), 'Allow WireGuard Web UI');

    // Create IAM Role for EC2 Instance (to allow CloudWatch Agent to write logs & metrics)
    const role = new iam.Role(this, 'MailServerRole', {
      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('CloudWatchAgentServerPolicy'),
      ],
    });

    // 3. Define the EC2 Instance (t3.micro for Free Tier compatibility)
    const instance = new ec2.Instance(this, 'MailServerInstance', {
      vpc,
      vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.fromSsmParameter(
        '/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id'
      ),
      securityGroup,
      role,
      keyName: 'vignesh_tipro',
      detailedMonitoring: true,
      blockDevices: [
        {
          deviceName: '/dev/sda1',
          volume: ec2.BlockDeviceVolume.ebs(60, { // 60GB Root Volume
            volumeType: ec2.EbsDeviceVolumeType.GP3,
          }),
        },
      ],
    });

    // 4. Install Docker, Docker Compose, wg-easy, and CloudWatch Agent via User Data
    instance.addUserData(
      'apt-get update -y',
      'apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release wget',
      'mkdir -m 0755 -p /etc/apt/keyrings',
      'curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg',
      'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null',
      'apt-get update -y',
      'apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin',
      'systemctl enable docker',
      'systemctl start docker',
      // Setup wireguard directory
      'mkdir -p /home/ubuntu/wireguard',
      'cd /home/ubuntu/wireguard',
      // Write the docker-compose.yml file with hardcoded Elastic IP
      'cat <<EOF > docker-compose.yml',
      'services:',
      '  wg-easy:',
      '    image: weejewel/wg-easy',
      '    container_name: wg-easy',
      '    environment:',
      '      - WG_HOST=13.205.93.190',
      '      - PASSWORD=admin123',
      '    volumes:',
      '      - ./config:/etc/wireguard',
      '    ports:',
      '      - "51820:51820/udp"',
      '      - "51821:51821/tcp"',
      '    cap_add:',
      '      - NET_ADMIN',
      '      - SYS_MODULE',
      '    sysctls:',
      '      - net.ipv4.ip_forward=1',
      '      - net.ipv4.conf.all.src_valid_mark=1',
      '    restart: unless-stopped',
      'EOF',
      // Start the container and adjust directory permissions
      'docker compose up -d',
      'chown -R ubuntu:ubuntu /home/ubuntu/wireguard',
      // Install CloudWatch Agent
      'wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb',
      'dpkg -i -E ./amazon-cloudwatch-agent.deb',
      // Write CloudWatch Agent Configuration
      'mkdir -p /opt/aws/amazon-cloudwatch-agent/etc',
      'cat <<EOF > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json',
      '{',
      '  "agent": {',
      '    "metrics_collection_interval": 60,',
      '    "run_as_user": "root"',
      '  },',
      '  "metrics": {',
      '    "metrics_collected": {',
      '      "disk": {',
      '        "measurement": ["used_percent"],',
      '        "metrics_collection_interval": 60,',
      '        "resources": ["/"]',
      '      },',
      '      "mem": {',
      '        "measurement": ["mem_used_percent"],',
      '        "metrics_collection_interval": 60',
      '      }',
      '    }',
      '  },',
      '  "logs": {',
      '    "logs_collected": {',
      '      "files": {',
      '        "collect_list": [',
      '          {',
      '            "file_path": "/var/lib/docker/containers/*/*.log",',
      '            "log_group_name": "WireGuard-Logs",',
      '            "log_stream_name": "{instance_id}",',
      '            "retention_in_days": 7',
      '          }',
      '        ]',
      '      }',
      '    }',
      '  }',
      '}',
      'EOF',
      // Start CloudWatch Agent service with configuration
      '/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json'
    );

    // 5. Associate your pre-created Elastic IP using its Allocation ID
    new ec2.CfnEIPAssociation(this, 'MailServerEIPAssociation', {
      allocationId: 'eipalloc-06bea32c3a787c2b1',
      instanceId: instance.instanceId,
    });

    // Outputs
    new cdk.CfnOutput(this, 'MailServerPublicIP', {
      value: '13.205.93.190',
      description: 'The Elastic IP address of your Mail Server',
    });
  }
}