cloudformation.yml

AWSTemplateFormatVersion: 2010-09-09
Description: Mastodon - Full AWS Stack - 0.1.2
Parameters: 
    VPCStackName:
        Description: The VPC that the ECS cluster is deployed to
        Type: AWS::EC2::VPC::Id
        
    PublicSubnetA:
        Description: Choose which public subnets the Application Load Balancer should be deployed to
        Type: AWS::EC2::Subnet::Id
    
    PublicSubnetB:
        Description: Choose which public subnets the Application Load Balancer should be deployed to
        Type: AWS::EC2::Subnet::Id

    RDSPostgreSQLMasterUsername:
      Description: 'PostgreSQL User'
      Type: String
      Default: Masotodon
      
    RDSPostgreSQLMasterPassword:
      Description: 'PostgreSQL Pass'
      Type: String
      NoEcho: true

    UniqueID:
      Description: 'lower case'
      Default: mastodon1
      Type: String

    Domain:
      Description: 'social.example'
      Type: String
      Default: 'social.example'

    DomainEmail:
      Description: 'admin@example.com - used to register certbot/admin account'
      Type: String
      Default: 'admin@social.example'

    R53Zone:
      Description: AWS KeyName
      Type: 'AWS::Route53::HostedZone::Id'

    ReleaseVersion:
      Description: 'v2.5.0rc1'
      Type: String
      Default: 'v2.5.0rc1'

    EC2PrivateIP:
      Description: 'Private IP for the EC2 Primary Instance'
      Type: String
      Default: '10.xxx.xxx.xxx'

    MastodonLocalUserPassword:
      Description: 'mastodon local user password'
      Type: String
      NoEcho: true

    KeyPairName:
      Description: AWS KeyName
      Type: 'AWS::EC2::KeyPair::KeyName'

    ImageId:
      Description: Official Ubuntu 18.04 LTS - Bionic
      Type: String
      Default: ami-09b984525e8ba2206

    SwapSize:
      Description: GB of Swap space
      Type: String
      Default: 5

    MailgunLOGIN:
      Description: 'Mailgun username'
      Type: String
      Default: 'notifications@mail.social.example'
    MailgunPASSWORD:
      Description: 'Mailgun password'
      Type: String
      NoEcho: true

Resources:
# ElastiCache - Redis
  RedisSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      VpcId: !Ref VPCStackName
      GroupDescription: !Sub 'Redis SecurityGroup - ${UniqueID}'
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 6379
          ToPort: 6379
          CidrIp: !Sub '${EC2PrivateIP}/32'

  RedisSubnetGroup:
    Type: 'AWS::ElastiCache::SubnetGroup'
    Properties:
      Description: !Sub 'Redis SubnetGroup - ${UniqueID}'
      SubnetIds:
        - !Ref PublicSubnetA
        - !Ref PublicSubnetB

  RedisParameterGroup:
    Type: 'AWS::ElastiCache::ParameterGroup'
    Properties:
      Description: !Sub 'Redis ParameterGroup - ${UniqueID}'
      CacheParameterGroupFamily: redis4.0

  ElastiCacheRedis:
    Type: 'AWS::ElastiCache::CacheCluster'
    Properties:
      ClusterName: !Sub 'Mastodon-${UniqueID}'
      CacheNodeType: cache.t2.micro
      Engine: redis
      EngineVersion: 4.0.10
      Port: 6379
      NumCacheNodes: '1'
      CacheSubnetGroupName: !Ref RedisSubnetGroup
      VpcSecurityGroupIds:
        - !Ref RedisSecurityGroup
      CacheParameterGroupName: !Ref RedisParameterGroup

# RDS - PostgreSQL
  RDSPostgreSQLSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      VpcId: !Ref VPCStackName
      GroupDescription: !Sub 'PostgreSQL SecurityGroup - ${UniqueID}'
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: !Sub '${EC2PrivateIP}/32'

  RDSPostgreSQLSubnetGroup:
    Type: 'AWS::RDS::DBSubnetGroup'
    Properties:
      DBSubnetGroupDescription: !Sub 'PostgreSQL DBSubnetGroup - ${UniqueID}'
      SubnetIds:
        - !Ref PublicSubnetA
        - !Ref PublicSubnetB

  RDSPostgreSQLInstance:
    Type: 'AWS::RDS::DBInstance'
    DeletionPolicy: Snapshot
    Properties:
      Engine: postgres
      Port: 5432
      PubliclyAccessible: false
      AllocatedStorage: 20
      DBInstanceClass: db.t2.micro
      DBInstanceIdentifier: !Sub 'Mastodon-${UniqueID}'
      DBName: 'mastodon_production'
      MasterUsername: !Ref RDSPostgreSQLMasterUsername
      MasterUserPassword: !Ref RDSPostgreSQLMasterPassword

      DBParameterGroupName: !Ref RDSPostgreSQLParameterGroup
      DBSubnetGroupName: !Ref RDSPostgreSQLSubnetGroup
      VPCSecurityGroups:
        - !Ref RDSPostgreSQLSecurityGroup

  RDSPostgreSQLParameterGroup:
    Type: 'AWS::RDS::DBParameterGroup'
    Properties:
      Description: RDSPostgreSQL
      Family: postgres9.6

# S3 Storage Bucket - User/AccessKeys/Bucket
  MasotodonS3bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Sub '${UniqueID}.files.${Domain}'

  MasotodonS3buckerUser:
    Type: 'AWS::IAM::User'
    Properties:
      Policies:
        - PolicyName: S3
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: 
                  - 's3:ListBucket'
                  - 's3:GetObject*'
                  - 's3:PutObject*'
                  - 's3:DeleteObject*'
                Resource: 
                  - !Sub 'arn:aws:s3:::${MasotodonS3bucket}'
                  - !Sub 'arn:aws:s3:::${MasotodonS3bucket}/*'
      UserName: !Sub 'MasotodonS3buckerUser-${UniqueID}'

  MasotodonS3bucketKey:
    Type: 'AWS::IAM::AccessKey'
    Properties:
      UserName: !Ref MasotodonS3buckerUser

# EC2 Instance
  EC2InstancePrimary:
    Type: 'AWS::EC2::Instance'
    Properties:
      InstanceType: t2.small
      KeyName: !Ref KeyPairName
      ImageId: !Ref ImageId
      IamInstanceProfile: !Ref EC2InstanceProfile
      NetworkInterfaces:
        - DeleteOnTermination: 'true'
          DeviceIndex: 0
          SubnetId: !Ref PublicSubnetA
          AssociatePublicIpAddress: 'true'
          PrivateIpAddresses:
            - Primary: 'true'
              PrivateIpAddress: !Ref 'EC2PrivateIP'
          GroupSet:
            - !Ref EC2SecurityGroup

      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            VolumeSize: 50
            VolumeType: gp2

      UserData:
        Fn::Base64: !Sub |
            #!/bin/bash -ex
            touch /var/tmp/bootstrap.txt
            chmod 777 /var/tmp/bootstrap.txt
            sleep 60  # I've experienced multiple network related issues with the apt-get update below.
            
            echo "stage 0 update" >> /var/tmp/bootstrap.txt
            apt-get update
            echo "$?" >> /var/tmp/bootstrap.txt

            echo "stage 0 awscli" >> /var/tmp/bootstrap.txt
            apt-get --yes install awscli
            echo "$?" >> /var/tmp/bootstrap.txt

            echo "stage 0 lang" >> /var/tmp/bootstrap.txt
            apt-get --yes install language-pack-en
            echo "$?" >> /var/tmp/bootstrap.txt

            echo "stage 0 pip" >> /var/tmp/bootstrap.txt
            apt-get --yes install python-pip
            echo "$?" >> /var/tmp/bootstrap.txt

            echo "stage 0 update pip" >> /var/tmp/bootstrap.txt
            pip install --upgrade pip
            echo "$?" >> /var/tmp/bootstrap.txt

            echo "stage 0 install cfn tools" >> /var/tmp/bootstrap.txt
            sudo pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz
            # sudo required - otherwise crashes 'OSError: [Errno 13] Permission denied: '/usr/local/lib/python2.7/dist-packages/lockfile-0.12.2.dist-info'
            echo "$?" >> /var/tmp/bootstrap.txt
            
            echo "stage 0 signal" >> /var/tmp/bootstrap.txt
            echo "-----" >> /var/tmp/bootstrap.txt
            sudo /usr/local/bin/cfn-init --stack ${AWS::StackName} --resource EC2InstancePrimary --configsets bootstrap --region ${AWS::Region}
            # sudo seems to be required here
            ## SERVER REBOOTS VIA CFN-INIT
            
      Tags:
        - Key: Name
          Value: !Sub "Frontend-${UniqueID}"

    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          bootstrap:
            - "create_files"
            - "run_bootstrap"

        run_bootstrap:
          commands:
            1_bootstrap_userdata:
              command: !Sub |
                #!/bin/bash -ex

                echo "stage 1 update" >> /var/tmp/bootstrap.txt
                apt-get update
                echo "$?" >> /var/tmp/bootstrap.txt

                echo "stage 1 upgrade noninteractive" >> /var/tmp/bootstrap.txt
                DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" upgrade
                echo "$?" >> /var/tmp/bootstrap.txt

                echo "signal trigger" >> /var/tmp/bootstrap.txt
                /usr/local/bin/cfn-signal --success true --region ${AWS::Region} --stack ${AWS::StackName} --resource EC2InstancePrimary
                echo "$?" >> /var/tmp/bootstrap.txt
                #Warning: sudo cfn-signal seems to freeze/break the userdata.

                echo "waiting for stack-create-complete" >> /var/tmp/bootstrap.txt
                aws cloudformation wait stack-create-complete --stack-name ${AWS::StackName} --region ${AWS::Region}
                echo "$?" >> /var/tmp/bootstrap.txt
                echo "CFN Stack completed" >> /var/tmp/bootstrap.txt
                echo "-----" >> /var/tmp/bootstrap.txt

                echo "script1" >> /var/tmp/bootstrap.txt
                bash -ex /var/tmp/stage1.sh  # Mastodon User/Docker/Docker-Compose
                echo "script 1 result $?" >> /var/tmp/bootstrap.txt
                echo "-----" >> /var/tmp/bootstrap.txt

                echo "script2" >> /var/tmp/bootstrap.txt
                sudo -u mastodon bash -ex /var/tmp/stage2.sh  # Mastodon
                echo "script 2 result $?" >> /var/tmp/bootstrap.txt
                echo "-----" >> /var/tmp/bootstrap.txt

                echo "script3" >> /var/tmp/bootstrap.txt
                bash -ex /var/tmp/stage3.sh  # Nginx and Certbot
                echo "script 3 result $?" >> /var/tmp/bootstrap.txt
                echo "-----" >> /var/tmp/bootstrap.txt

                echo "script4" >> /var/tmp/bootstrap.txt
                sudo -u mastodon bash -ex /var/tmp/stage4.sh  # Crontab/Maintenance Jobs
                echo "script 2 result $?" >> /var/tmp/bootstrap.txt
                echo "-----" >> /var/tmp/bootstrap.txt

                echo "Final reboot" >> /var/tmp/bootstrap.txt
                systemctl reboot

        create_files:
          files: 
            /var/tmp/stage1.sh:
              content: !Sub |
                #!/bin/bash -ex

                echo "Create mastodon group" >> /var/tmp/bootstrap.txt
                addgroup -gid 991 mastodon
                echo "$?" >> /var/tmp/bootstrap.txt

                echo "Create mastodon user" >> /var/tmp/bootstrap.txt
                adduser --quiet --disabled-password --gid 991 --uid 991 mastodon --gecos GECOS
                echo "$?" >> /var/tmp/bootstrap.txt

                echo "change mastodon password" >> /var/tmp/bootstrap.txt
                echo "mastodon:${MastodonLocalUserPassword}" | sudo chpasswd
                echo "$?" >> /var/tmp/bootstrap.txt

                echo "Install Docker" >> /var/tmp/bootstrap.txt
                apt --yes install apt-transport-https ca-certificates curl software-properties-common
                curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
                add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable"
                apt update
                apt-cache policy docker-ce
                apt --yes install docker-ce
                echo "$?" >> /var/tmp/bootstrap.txt

                echo "grant mastodon user docker" >> /var/tmp/bootstrap.txt
                usermod -aG docker mastodon
                echo "$?" >> /var/tmp/bootstrap.txt

                echo "install docker-compose" >> /var/tmp/bootstrap.txt
                curl -L https://github.com/docker/compose/releases/download/1.22.0/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose
                chmod +x /usr/local/bin/docker-compose
                echo "$?" >> /var/tmp/bootstrap.txt

                echo "Activate Swap" >> /var/tmp/bootstrap.txt
                fallocate -l ${SwapSize}G /swapfile
                chmod 600 /swapfile
                mkswap /swapfile
                swapon /swapfile
                echo '/swapfile       none    swap    sw      0       0' | tee -a /etc/fstab

              mode: "000755"
              owner: "ubuntu"
              group: "ubuntu"

            /var/tmp/stage2.sh:
              content: !Sub 
                - |
                  #!/bin/bash -ex

                  cd /home/mastodon
                  echo "git clone" >> /var/tmp/bootstrap.txt
                  git clone https://github.com/tootsuite/mastodon.git live
                  echo "$?" >> /var/tmp/bootstrap.txt
                  cd /home/mastodon/live
                  echo "git checkout" >> /var/tmp/bootstrap.txt
                  git checkout ${ReleaseVersion}
                  echo "$?" >> /var/tmp/bootstrap.txt

                  echo "copy AWS docker-compose.yml" >> /var/tmp/bootstrap.txt
                  rm -f docker-compose.yml
                  cp /var/tmp/docker-compose.yml /home/mastodon/live/docker-compose.yml

                  echo "create .env.production" >> /var/tmp/bootstrap.txt
                  cat >> /home/mastodon/live/.env.production << EOF
                  LOCAL_DOMAIN=${Domain}
                  SINGLE_USER_MODE=false
                  SECRET_KEY_BASE=fc6379db2af899b3c980c83fc725f06996e9c5994b8adf34ec3c346731b6964c7b850209e0edfbc594d26a95108b6fe344bd0c9d2deeee127b51184d75a90cce
                  OTP_SECRET=0ee36c5efb11cda1113ee59a3506003d4660fd1eeedc858391731baf9c6435dac572e0ec15474be64deeadd84df6f61c8b54070610f34f772c2e16e050587435
                  VAPID_PRIVATE_KEY=z2es43uf_5z1z1ZiJRK1bMAeWS02UO871NGAuhBpTSU=
                  VAPID_PUBLIC_KEY=BI_XIXxCKG1E_shNXhs_G5ehCYqml8alsUWkpTSUjNL8nDqZGcd-bUMfCKU70x5sUJxXqp7PtIGWkA6yQ6xNP00=
                  DB_HOST=${DB_ENDPOINT}
                  DB_PORT=${DB_PORT}
                  DB_NAME=mastodon_production
                  DB_USER=${RDSPostgreSQLMasterUsername}
                  DB_PASS=${RDSPostgreSQLMasterPassword}
                  REDIS_HOST=${REDIS_ENDPOINT}
                  REDIS_PORT=${REDIS_PORT}
                  REDIS_PASSWORD=
                  S3_ENABLED=true
                  S3_PROTOCOL=https
                  S3_BUCKET=${UniqueID}.files.${Domain}
                  S3_REGION=${AWS::Region}
                  S3_HOSTNAME=s3-${AWS::Region}.amazonaws.com
                  AWS_ACCESS_KEY_ID=${S3_ACCESSKEY}
                  AWS_SECRET_ACCESS_KEY=${S3_SECRETKEY}
                  SMTP_SERVER=smtp.mailgun.org
                  SMTP_PORT=587
                  SMTP_LOGIN=${MailgunLOGIN}
                  SMTP_PASSWORD=${MailgunPASSWORD}
                  SMTP_AUTH_METHOD=plain
                  SMTP_OPENSSL_VERIFY_MODE=none
                  SMTP_FROM_ADDRESS=${Domain} <${MailgunLOGIN}>
                  EOF

                  cd /home/mastodon/live  # Just incase

                  echo "docker-compose build" >> /var/tmp/bootstrap.txt
                  docker-compose build 
                  echo "$?" >> /var/tmp/bootstrap.txt

                  echo "db:setup" >> /var/tmp/bootstrap.txt
                  docker-compose run --rm web bundle exec rails db:setup -e SAFETY_ASSURED=1 -e RAILS_ENV=production 
                  # Create DB tables (Destructive: Deletes existing tables)
                  echo "$?" >> /var/tmp/bootstrap.txt

                  echo "assets:precompile" >> /var/tmp/bootstrap.txt
                  docker-compose run --rm web bundle exec rails assets:precompile  
                  # Compile assetts (Notice: docker will complete this step using the build step)
                  echo "$?" >> /var/tmp/bootstrap.txt

                  echo "docker-compose up -d" >> /var/tmp/bootstrap.txt
                  docker-compose up -d
                  echo "$?" >> /var/tmp/bootstrap.txt

                - { REDIS_ENDPOINT: !GetAtt ElastiCacheRedis.RedisEndpoint.Address, REDIS_PORT: !GetAtt ElastiCacheRedis.RedisEndpoint.Port, DB_ENDPOINT: !GetAtt RDSPostgreSQLInstance.Endpoint.Address, DB_PORT: !GetAtt RDSPostgreSQLInstance.Endpoint.Port, S3_ACCESSKEY: !Ref MasotodonS3bucketKey, S3_SECRETKEY: !GetAtt MasotodonS3bucketKey.SecretAccessKey }
              
              mode: "000755"
              owner: "ubuntu"
              group: "ubuntu"

            /var/tmp/stage3.sh:
              content: !Sub |
                #!/bin/bash -ex
                
                echo "chown /live/public" >> /var/tmp/bootstrap.txt
                sudo chown -R 991:991 /home/mastodon/live/public  # Better to run this as root
                echo "$?" >> /var/tmp/bootstrap.txt

                echo "Install nginx" >> /var/tmp/bootstrap.txt
                apt-get --yes install nginx
                echo "$?" >> /var/tmp/bootstrap.txt

                echo "Configure nginx for mastodon" >> /var/tmp/bootstrap.txt
                systemctl stop nginx.service
                systemctl enable nginx.service
                rm /etc/nginx/sites-available/default
                rm /etc/nginx/sites-enabled/default
                cp /var/tmp/mastodon.nginx /etc/nginx/sites-available/mastodon
                ln -s /etc/nginx/sites-available/mastodon /etc/nginx/sites-enabled/mastodon

                echo "install certbot" >> /var/tmp/bootstrap.txt
                apt-get update
                add-apt-repository ppa:certbot/certbot -y
                apt-get update
                apt-get --yes install python-certbot-nginx
                echo "$?" >> /var/tmp/bootstrap.txt

                echo "Certbot certonly standalone - Request new TLS Cert" >> /var/tmp/bootstrap.txt
                systemctl stop nginx.service
                certbot certonly --standalone -d ${Domain} --agree-tos -m ${DomainEmail} --non-interactive
                echo "$?" >> /var/tmp/bootstrap.txt

              mode: "000755"
              owner: "ubuntu"
              group: "ubuntu"

            /var/tmp/stage4.sh:
              content: !Sub |
                #!/bin/bash -ex

                echo "Certbot crontab - Renew TLS Certs" >> /bar/tmp/bootstrap.txt
                cat >> /etc/cron.daily/letsencrypt-renew << EOF
                #!/usr/bin/env bash
                certbot renew
                systemctl reload nginx
                EOF
                chmod +x /etc/cron.daily/letsencrypt-renew
                systemctl restart cron

              mode: "000755"
              owner: "ubuntu"
              group: "ubuntu"

            /var/tmp/mastodon.nginx:
              content: !Sub |
                map $http_upgrade $connection_upgrade {
                  default upgrade;
                  ''      close;
                }

                proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=1g;

                server {
                  listen 80;
                  listen [::]:80;
                  server_name ${Domain};
                  root /home/mastodon/live/public;
                  location /.well-known/acme-challenge/ { allow all; }
                  location / { return 301 https://$host$request_uri; }
                }

                server {
                  listen 443 ssl http2;
                  listen [::]:443 ssl http2;
                  server_name ${Domain};

                  ssl_protocols TLSv1.2;
                  ssl_ciphers HIGH:!MEDIUM:!LOW:!aNULL:!NULL:!SHA;
                  ssl_prefer_server_ciphers on;
                  ssl_session_cache shared:SSL:10m;

                  ssl_certificate     /etc/letsencrypt/live/${Domain}/fullchain.pem;
                  ssl_certificate_key /etc/letsencrypt/live/${Domain}/privkey.pem;

                  keepalive_timeout    70;
                  sendfile             on;
                  client_max_body_size 80m;

                  root /home/mastodon/live/public;

                  gzip on;
                  gzip_disable "msie6";
                  gzip_vary on;
                  gzip_proxied any;
                  gzip_comp_level 6;
                  gzip_buffers 16 8k;
                  gzip_http_version 1.1;
                  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

                  add_header Strict-Transport-Security "max-age=31536000";

                  location / {
                    try_files $uri @proxy;
                  }

                  location ~ ^/(emoji|packs|system/accounts/avatars|system/media_attachments/files) {
                    add_header Cache-Control "public, max-age=31536000, immutable";
                    add_header Strict-Transport-Security "max-age=31536000";
                    try_files $uri @proxy;
                  }

                  location /sw.js {
                    add_header Cache-Control "public, max-age=0";
                    add_header Strict-Transport-Security "max-age=31536000";
                    try_files $uri @proxy;
                  }

                  location @proxy {
                    proxy_set_header Host $host;
                    proxy_set_header X-Real-IP $remote_addr;
                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                    proxy_set_header X-Forwarded-Proto https;
                    proxy_set_header Proxy "";
                    proxy_pass_header Server;

                    proxy_pass http://127.0.0.1:3000;
                    proxy_buffering on;
                    proxy_redirect off;
                    proxy_http_version 1.1;
                    proxy_set_header Upgrade $http_upgrade;
                    proxy_set_header Connection $connection_upgrade;

                    proxy_cache CACHE;
                    proxy_cache_valid 200 7d;
                    proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
                    add_header X-Cached $upstream_cache_status;
                    add_header Strict-Transport-Security "max-age=31536000";

                    tcp_nodelay on;
                  }

                  location /api/v1/streaming {
                    proxy_set_header Host $host;
                    proxy_set_header X-Real-IP $remote_addr;
                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                    proxy_set_header X-Forwarded-Proto https;
                    proxy_set_header Proxy "";

                    proxy_pass http://127.0.0.1:4000;
                    proxy_buffering off;
                    proxy_redirect off;
                    proxy_http_version 1.1;
                    proxy_set_header Upgrade $http_upgrade;
                    proxy_set_header Connection $connection_upgrade;

                    tcp_nodelay on;
                  }

                  error_page 500 501 502 503 504 /500.html;
                }
              mode: "000755"
              owner: "ubuntu"
              group: "ubuntu"

            /var/tmp/docker-compose.yml:
              content: !Sub |
                  version: '3'
                  services:
                    web:
                      build: .
                      image: tootsuite/mastodon:${ReleaseVersion}
                      restart: always
                      env_file: .env.production
                      command: bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000 -b '0.0.0.0'"
                      networks:
                        - external_network
                        - internal_network
                      ports:
                        - "127.0.0.1:3000:3000"
                      volumes:
                        - ./public/system:/mastodon/public/system

                    streaming:
                      build: .
                      image: tootsuite/mastodon:${ReleaseVersion}
                      restart: always
                      env_file: .env.production
                      command: yarn start
                      networks:
                        - external_network
                        - internal_network
                      ports:
                        - "127.0.0.1:4000:4000"

                    sidekiq:
                      build: .
                      image: tootsuite/mastodon:${ReleaseVersion}
                      restart: always
                      env_file: .env.production
                      command: bundle exec sidekiq -q default -q mailers -q pull -q push
                      networks:
                        - external_network
                        - internal_network
                      volumes:
                        - ./public/system:/mastodon/public/system
                  networks:
                    external_network:
                    internal_network:
                      internal: true
              mode: "000755"
              owner: "ubuntu"
              group: "ubuntu"

    CreationPolicy:
      ResourceSignal:
        Timeout: PT2H

  EC2InstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Path: /
      Roles:
        - !Ref EC2Role

  EC2Role:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName: Oracle-ec2
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 's3:ListBucket'
                  - 's3:GetObject*'
                  - 's3:PutObject*'
                  - 's3:DeleteObject*'
                Resource: 
                  - !Sub 'arn:aws:s3:::${MasotodonS3bucket}'
                  - !Sub 'arn:aws:s3:::${MasotodonS3bucket}/*'
              - Effect: Allow
                Action: 'cloudformation:DescribeStacks'
                Resource: "*"

  EC2SecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      VpcId: !Ref VPCStackName
      GroupDescription: !Sub 'EC2 SecurityGroup - ${UniqueID}'
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 22
        ToPort: 22
        CidrIp: 0.0.0.0/0

  EC2InstancePrimaryDNS:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref R53Zone
      Comment: Primary Instance.
      Name: !Sub ${Domain}
      Type: A
      TTL: '60'
      ResourceRecords:
      - !GetAtt EC2InstancePrimary.PublicIp
    DependsOn: EC2InstancePrimary