87 lines
3.5 KiB
TypeScript
87 lines
3.5 KiB
TypeScript
import * as cdk from 'aws-cdk-lib';
|
|
import { Construct } from 'constructs';
|
|
import * as ec2 from 'aws-cdk-lib/aws-ec2';
|
|
|
|
export class AwsCdkStack extends cdk.Stack {
|
|
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
|
|
super(scope, id, props);
|
|
|
|
// 1. Look up the existing Default VPC (Free, avoids NAT Gateway charges)
|
|
const vpc = ec2.Vpc.fromLookup(this, 'DefaultVpc', {
|
|
isDefault: true,
|
|
});
|
|
|
|
// 2. Create a Security Group for the Mail Server
|
|
const securityGroup = new ec2.SecurityGroup(this, 'MailServerSG', {
|
|
vpc,
|
|
description: 'Security Group for self-hosted mail server',
|
|
allowAllOutbound: true,
|
|
});
|
|
|
|
// Allow SSH
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(22), 'Allow SSH access');
|
|
|
|
// Mail Protocols (SMTP, SMTPS, Submission)
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(25), 'Allow SMTP');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(465), 'Allow SMTPS');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(587), 'Allow SMTP Submission');
|
|
|
|
// Mail Protocols (IMAP, IMAPS)
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(143), 'Allow IMAP');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(993), 'Allow IMAPS');
|
|
|
|
// Web Traffic (HTTP, HTTPS for Admin UI & Webmail / SSL certificates)
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(80), 'Allow HTTP');
|
|
securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), 'Allow HTTPS');
|
|
|
|
// 3. Define the EC2 Instance (t3.medium recommended for running ClamAV/Rspamd)
|
|
const instance = new ec2.Instance(this, 'MailServerInstance', {
|
|
vpc,
|
|
vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
|
|
instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.MEDIUM),
|
|
machineImage: ec2.MachineImage.lookup({
|
|
name: 'ubuntu/images/hvm-ssd/ubuntu-noble-24.04-amd64-server-*',
|
|
owners: ['099720109477'], // Canonical owner ID
|
|
}),
|
|
securityGroup,
|
|
blockDevices: [
|
|
{
|
|
deviceName: '/dev/sda1',
|
|
volume: ec2.BlockDeviceVolume.ebs(60, { // 60GB Root Volume
|
|
volumeType: ec2.EbsDeviceVolumeType.GP3,
|
|
}),
|
|
},
|
|
],
|
|
});
|
|
|
|
// 4. Install Docker and Docker Compose via User Data
|
|
instance.addUserData(
|
|
'apt-get update -y',
|
|
'apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release',
|
|
'mkdir -m 0755 -p /etc/apt/keyrings',
|
|
'curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg',
|
|
'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null',
|
|
'apt-get update -y',
|
|
'apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin',
|
|
'systemctl enable docker',
|
|
'systemctl start docker'
|
|
);
|
|
|
|
// 5. Provision Elastic IP and Associate with EC2
|
|
const eip = new ec2.CfnEIP(this, 'MailServerEIP', {
|
|
domain: 'vpc',
|
|
});
|
|
|
|
new ec2.CfnEIPAssociation(this, 'MailServerEIPAssociation', {
|
|
eip: eip.ref,
|
|
instanceId: instance.instanceId,
|
|
});
|
|
|
|
// Outputs
|
|
new cdk.CfnOutput(this, 'MailServerPublicIP', {
|
|
value: eip.ref,
|
|
description: 'The Elastic IP address of your Mail Server',
|
|
});
|
|
}
|
|
}
|
|
|