vignesh/cdkinfracode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: upgrade to T4G instance, optimize storage, and restructure user data for modular setup

Browse source
This commit is contained in:
vickytechkey 2026-08-06 16:21:38 +05:30
parent a8cc81350b
commit b0ba82f7ea
1 changed files with 36 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

58
aws_cdk/lib/aws_cdk-stack.ts
View file

@ -13,7 +13,7 @@ export class AwsCdkStack extends cdk.Stack {
});
// 2. Create a Security Group for the Mail Server
const securityGroup = new ec2.SecurityGroup(this, 'MailServerSG', {
const securityGroup = new ec2.SecurityGroup(this, 'internalsSG', {
vpc,
description: 'Security Group for self-hosted mail server',
allowAllOutbound: true,
@ -40,20 +40,20 @@ export class AwsCdkStack extends cdk.Stack {
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(51821), 'Allow WireGuard Web UI');
// Create IAM Role for EC2 Instance (to allow CloudWatch Agent to write logs & metrics)
const role = new iam.Role(this, 'MailServerRole', {
const role = new iam.Role(this, 'internalsRole', {
assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
managedPolicies: [
iam.ManagedPolicy.fromAwsManagedPolicyName('CloudWatchAgentServerPolicy'),
],
});
// 3. Define the EC2 Instance (t3.micro for Free Tier compatibility)
const instance = new ec2.Instance(this, 'MailServerInstance', {
// 3. Define the EC2 Instance (t4g.medium)
const instance = new ec2.Instance(this, 'internalsInstance', {
vpc,
vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.MICRO),
instanceType: ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.MEDIUM),
machineImage: ec2.MachineImage.fromSsmParameter(
'/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id'
'/aws/service/canonical/ubuntu/server/24.04/stable/current/arm64/hvm/ebs-gp3/ami-id'
),
securityGroup,
role,
@ -62,17 +62,27 @@ export class AwsCdkStack extends cdk.Stack {
blockDevices: [
{
deviceName: '/dev/sda1',
volume: ec2.BlockDeviceVolume.ebs(60, { // 60GB Root Volume
volume: ec2.BlockDeviceVolume.ebs(50, { // 50GB Root Volume
volumeType: ec2.EbsDeviceVolumeType.GP3,
}),
},
],
});
// 4. Install Docker, Docker Compose, wg-easy, and CloudWatch Agent via User Data
// 4. Structured User Data installation
instance.addUserData(
// Ensure folder structures exist
'mkdir -p /home/ubuntu/basic_requirements',
'mkdir -p /home/ubuntu/wireguard',
'mkdir -p /home/ubuntu/email_server',
'mkdir -p /home/ubuntu/build_tools',
// 4.1 Write and run installation for basic requirements (Docker, Python 3, etc.)
'cat <<\'EOF\' > /home/ubuntu/basic_requirements/install.sh',
'#!/bin/bash',
'set -e',
'apt-get update -y',
'apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release wget',
'apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release wget python3 python3-pip python3-venv git',
'mkdir -m 0755 -p /etc/apt/keyrings',
'curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg',
'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null',
@ -80,11 +90,12 @@ export class AwsCdkStack extends cdk.Stack {
'apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin',
'systemctl enable docker',
'systemctl start docker',
// Setup wireguard directory
'mkdir -p /home/ubuntu/wireguard',
'cd /home/ubuntu/wireguard',
// Write the docker-compose.yml file with hardcoded Elastic IP
'cat <<EOF > docker-compose.yml',
'EOF',
'chmod +x /home/ubuntu/basic_requirements/install.sh',
'/home/ubuntu/basic_requirements/install.sh',
// 4.2 Set up Wireguard
'cat <<\'EOF\' > /home/ubuntu/wireguard/docker-compose.yml',
'services:',
' wg-easy:',
' image: weejewel/wg-easy',
@ -105,15 +116,19 @@ export class AwsCdkStack extends cdk.Stack {
' - net.ipv4.conf.all.src_valid_mark=1',
' restart: unless-stopped',
'EOF',
// Start the container and adjust directory permissions
'docker compose up -d',
'cd /home/ubuntu/wireguard && docker compose up -d',
// 4.3 Setup permissions for all user folders
'chown -R ubuntu:ubuntu /home/ubuntu/basic_requirements',
'chown -R ubuntu:ubuntu /home/ubuntu/wireguard',
// Install CloudWatch Agent
'chown -R ubuntu:ubuntu /home/ubuntu/email_server',
'chown -R ubuntu:ubuntu /home/ubuntu/build_tools',
// 4.4 Install CloudWatch Agent
'wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb',
'dpkg -i -E ./amazon-cloudwatch-agent.deb',
// Write CloudWatch Agent Configuration
'mkdir -p /opt/aws/amazon-cloudwatch-agent/etc',
'cat <<EOF > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json',
'cat <<\'EOF\' > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json',
'{',
' "agent": {',
' "metrics_collection_interval": 60,',
@ -148,18 +163,17 @@ export class AwsCdkStack extends cdk.Stack {
' }',
'}',
'EOF',
// Start CloudWatch Agent service with configuration
'/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json'
);
// 5. Associate your pre-created Elastic IP using its Allocation ID
new ec2.CfnEIPAssociation(this, 'MailServerEIPAssociation', {
new ec2.CfnEIPAssociation(this, 'internalsEIPAssociation', {
allocationId: 'eipalloc-06bea32c3a787c2b1',
instanceId: instance.instanceId,
});
// Outputs
new cdk.CfnOutput(this, 'MailServerPublicIP', {
new cdk.CfnOutput(this, 'internalsPublicIP', {
value: '13.205.93.190',
description: 'The Elastic IP address of your Mail Server',
});