cdkinfracode/aws_cdk/lib/aws_cdk-stack.ts

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';

export class AwsCdkStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // 1. Look up the existing Default VPC (Free, avoids NAT Gateway charges)
    const vpc = ec2.Vpc.fromLookup(this, 'DefaultVpc', {
      isDefault: true,
    });

    // 2. Create a Security Group for the Mail Server
    const securityGroup = new ec2.SecurityGroup(this, 'MailServerSG', {
      vpc,
      description: 'Security Group for self-hosted mail server',
      allowAllOutbound: true,
    });

    // Allow SSH
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(22), 'Allow SSH access');

    // Mail Protocols (SMTP, SMTPS, Submission)
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(25), 'Allow SMTP');
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(465), 'Allow SMTPS');
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(587), 'Allow SMTP Submission');

    // Mail Protocols (IMAP, IMAPS)
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(143), 'Allow IMAP');
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(993), 'Allow IMAPS');

    // Web Traffic (HTTP, HTTPS for Admin UI & Webmail / SSL certificates)
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(80), 'Allow HTTP');
    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), 'Allow HTTPS');

    // 3. Define the EC2 Instance (t3.medium recommended for running ClamAV/Rspamd)
    const instance = new ec2.Instance(this, 'MailServerInstance', {
      vpc,
      vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.fromSsmParameter(
        '/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id'
      ),
      securityGroup,
      blockDevices: [
        {
          deviceName: '/dev/sda1',
          volume: ec2.BlockDeviceVolume.ebs(60, { // 60GB Root Volume
            volumeType: ec2.EbsDeviceVolumeType.GP3,
          }),
        },
      ],
    });

    // 4. Install Docker and Docker Compose via User Data
    instance.addUserData(
      'apt-get update -y',
      'apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release',
      'mkdir -m 0755 -p /etc/apt/keyrings',
      'curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg',
      'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null',
      'apt-get update -y',
      'apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin',
      'systemctl enable docker',
      'systemctl start docker'
    );

    // 5. Provision Elastic IP and Associate with EC2
    const eip = new ec2.CfnEIP(this, 'MailServerEIP', {
      domain: 'vpc',
    });

    new ec2.CfnEIPAssociation(this, 'MailServerEIPAssociation', {
      allocationId: eip.attrAllocationId,
      instanceId: instance.instanceId,
    });

    // Outputs
    new cdk.CfnOutput(this, 'MailServerPublicIP', {
      value: eip.ref,
      description: 'The Elastic IP address of your Mail Server',
    });
  }
}