116 lines
4.8 KiB
TypeScript
116 lines
4.8 KiB
TypeScript
import * as cdk from 'aws-cdk-lib';
|
|
import { Construct } from 'constructs';
|
|
import * as ec2 from 'aws-cdk-lib/aws-ec2';
|
|
|
|
export class AwsCdkStack extends cdk.Stack {
|
|
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
|
|
super(scope, id, props);
|
|
|
|
// 1. Look up the existing Default VPC (Free, avoids NAT Gateway charges)
|
|
const vpc = ec2.Vpc.fromLookup(this, 'DefaultVpc', {
|
|
isDefault: true,
|
|
});
|
|
|
|
// 2. Create a Security Group for the Mail Server
|
|
const securityGroup = new ec2.SecurityGroup(this, 'MailServerSG', {
|
|
vpc,
|
|
description: 'Security Group for self-hosted mail server',
|
|
allowAllOutbound: true,
|
|
});
|
|
|
|
// Allow SSH
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(22), 'Allow SSH access');
|
|
|
|
// Mail Protocols (SMTP, SMTPS, Submission)
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(25), 'Allow SMTP');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(465), 'Allow SMTPS');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(587), 'Allow SMTP Submission');
|
|
|
|
// Mail Protocols (IMAP, IMAPS)
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(143), 'Allow IMAP');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(993), 'Allow IMAPS');
|
|
|
|
// Web Traffic (HTTP, HTTPS for Admin UI & Webmail / SSL certificates)
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(80), 'Allow HTTP');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), 'Allow HTTPS');
|
|
|
|
// WireGuard VPN
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.udp(51820), 'Allow WireGuard VPN');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(51821), 'Allow WireGuard Web UI');
|
|
|
|
// 3. Define the EC2 Instance (t3.medium recommended for running ClamAV/Rspamd)
|
|
const instance = new ec2.Instance(this, 'MailServerInstance', {
|
|
vpc,
|
|
vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
|
|
instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.MICRO),
|
|
machineImage: ec2.MachineImage.fromSsmParameter(
|
|
'/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id'
|
|
),
|
|
securityGroup,
|
|
keyName: 'vignesh_tipro',
|
|
blockDevices: [
|
|
{
|
|
deviceName: '/dev/sda1',
|
|
volume: ec2.BlockDeviceVolume.ebs(60, { // 60GB Root Volume
|
|
volumeType: ec2.EbsDeviceVolumeType.GP3,
|
|
}),
|
|
},
|
|
],
|
|
});
|
|
|
|
// 4. Install Docker, Docker Compose, and Run wg-easy
|
|
instance.addUserData(
|
|
'apt-get update -y',
|
|
'apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release',
|
|
'mkdir -m 0755 -p /etc/apt/keyrings',
|
|
'curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg',
|
|
'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null',
|
|
'apt-get update -y',
|
|
'apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin',
|
|
'systemctl enable docker',
|
|
'systemctl start docker',
|
|
// Setup wireguard directory
|
|
'mkdir -p /home/ubuntu/wireguard',
|
|
'cd /home/ubuntu/wireguard',
|
|
// Write the docker-compose.yml file with hardcoded Elastic IP
|
|
'cat <<EOF > docker-compose.yml',
|
|
'services:',
|
|
' wg-easy:',
|
|
' image: weejewel/wg-easy',
|
|
' container_name: wg-easy',
|
|
' environment:',
|
|
' - WG_HOST=YOUR_ELASTIC_IP_HERE', // <--- Replace with your manually created Elastic IP
|
|
' - PASSWORD=admin123',
|
|
' volumes:',
|
|
' - ./config:/etc/wireguard',
|
|
' ports:',
|
|
' - "51820:51820/udp"',
|
|
' - "51821:51821/tcp"',
|
|
' cap_add:',
|
|
' - NET_ADMIN',
|
|
' - SYS_MODULE',
|
|
' sysctls:',
|
|
' - net.ipv4.ip_forward=1',
|
|
' - net.ipv4.conf.all.src_valid_mark=1',
|
|
' restart: unless-stopped',
|
|
'EOF',
|
|
// Start the container and adjust directory permissions
|
|
'docker compose up -d',
|
|
'chown -R ubuntu:ubuntu /home/ubuntu/wireguard'
|
|
);
|
|
|
|
// 5. Associate your pre-created Elastic IP using its Allocation ID
|
|
new ec2.CfnEIPAssociation(this, 'MailServerEIPAssociation', {
|
|
allocationId: 'YOUR_ALLOCATION_ID_HERE', // <--- Replace with your Elastic IP Allocation ID (e.g., eipalloc-xxxx)
|
|
instanceId: instance.instanceId,
|
|
});
|
|
|
|
// Outputs
|
|
new cdk.CfnOutput(this, 'MailServerPublicIP', {
|
|
value: 'YOUR_ELASTIC_IP_HERE', // <--- Replace with your Elastic IP
|
|
description: 'The Elastic IP address of your Mail Server',
|
|
});
|
|
}
|
|
}
|
|
|
|
|