serverless.yml

service: folk-webapp

custom:
  stage: ${opt:stage, self:provider.stage}
  service: ${self:custom.stage}-${self:service}
  bucketName: ${self:custom.service}-static-web
  env:
    API_URL: ${ssm:/${self:custom.stage}/folk-webapp/DATAPLATTFORM_API_URL}
    OAUTH_URL: ${ssm:/${self:custom.stage}/folk-webapp/DATAPLATTFORM_AUTH_URL}
    STORAGE_URL: ${ssm:/${self:custom.stage}/folk-webapp/DATAPLATTFORM_RAW_STORAGE_URL}
    CLIENT_ID: ${ssm:/${self:custom.stage}/folk-webapp/CLIENT_ID}
    PRIVACY_POLICY_KEY: ${ssm:/${self:custom.stage}/folk-webapp/PRIVACY_POLICY_KEY}
    stage: ${opt:stage, self:provider.stage}
  allowedMethods:
    - GET
    - HEAD
    - OPTIONS
    - PUT
    - PATCH
    - POST
    - DELETE
  stageDomains:
    dev: dev.folk.knowit.no
    prod: folk.knowit.no
  domain: ${self:custom.stageDomains.${self:custom.stage}}
  serverlessPluginTypescript:
    tsConfigFileLocation: "./apps/server/tsconfig.json"

provider:
  name: aws
  stage: dev
  region: eu-central-1
  runtime: nodejs18.x
  stackName: ${self:custom.service}
  timeout: 25
  httpApi:
    name: ${self:custom.service}-api
    payload: "2.0"

package:
  excludeDevDependencies: false
  include:
    - apps/server/**
    - packages/**/*
  # exclude:
  #   - "*/**"
  individually: true

functions:
  proxyLambda:
    handler: apps/server/lambda.handler
    name: ${self:custom.service}-express-proxy
    environment: ${self:custom.env}
    role: LambdaRole
    events:
      - httpApi: "*"

plugins:
  - serverless-plugin-typescript
  - serverless-plugin-monorepo

resources:
  Resources:
    LambdaRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: ${self:custom.service}-proxy-lambda-role
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        ManagedPolicyArns:
          - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
        Policies:
          - PolicyName: ${self:custom.stage}-ParameterStore-${self:service}
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - ssm:GetParameter
                    - ssm:GetParameters
                  Resource:
                    - "Fn::Join":
                        - ":"
                        - - "arn:aws:ssm"
                          - Ref: "AWS::Region"
                          - Ref: "AWS::AccountId"
                          - "parameter/${self:custom.stage}/${self:service}/*"
                - Effect: Allow
                  Action:
                    - ssm:GetParameter
                    - ssm:GetParameters
                  Resource:
                    - "Fn::Join":
                        - ":"
                        - - "arn:aws:ssm"
                          - Ref: "AWS::Region"
                          - Ref: "AWS::AccountId"
                          - "parameter/${self:custom.stage}/${self:service}/*"

    FolkStaticS3Bucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:custom.bucketName}
        AccessControl: PublicRead
        WebsiteConfiguration:
          IndexDocument: index.html
          ErrorDocument: index.html

    FolkStaticS3BucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket:
          Ref: FolkStaticS3Bucket
        PolicyDocument:
          Statement:
            - Sid: PublicReadGetObject
              Effect: Allow
              Principal: "*"
              Action:
                - s3:GetObject
              Resource: arn:aws:s3:::${self:custom.bucketName}/*

    FolkDistribution:
      Type: AWS::CloudFront::Distribution
      Properties:
        DistributionConfig:
          Enabled: true
          Aliases:
            - ${self:custom.domain}
          Origins:
            - DomainName: ${self:custom.bucketName}.s3-website.${self:provider.region}.amazonaws.com
              Id: ${self:custom.service}-default-origin
              CustomOriginConfig:
                HTTPPort: 80
                OriginProtocolPolicy: http-only
            - DomainName:
                Fn::Join:
                  - ""
                  - - !Ref "HttpApi"
                    - ".execute-api."
                    - !Ref "AWS::Region"
                    - "."
                    - !Ref "AWS::URLSuffix"
              Id: ${self:custom.service}-api-origin
              CustomOriginConfig:
                HTTPSPort: 443
                OriginProtocolPolicy: https-only
                OriginSSLProtocols:
                  - TLSv1.2
          CacheBehaviors:
            - TargetOriginId: ${self:custom.service}-api-origin
              ForwardedValues:
                Cookies:
                  Forward: all
                QueryString: true
                Headers:
                  - Accept
                  - Content-Type
                  - Authorization
                  - Origin
                  - Referer
              PathPattern: /auth*
              ViewerProtocolPolicy: redirect-to-https
              AllowedMethods: ${self:custom.allowedMethods}
            - TargetOriginId: ${self:custom.service}-api-origin
              ForwardedValues:
                QueryString: true
                Headers:
                  - Accept
                  - Content-Type
                  - Authorization
              PathPattern: /api*
              ViewerProtocolPolicy: redirect-to-https
              AllowedMethods: ${self:custom.allowedMethods}
          DefaultRootObject: index.html
          CustomErrorResponses:
            - ErrorCode: 404
              ResponseCode: 200
              ResponsePagePath: /index.html
          DefaultCacheBehavior:
            TargetOriginId: ${self:custom.service}-default-origin
            ForwardedValues:
              QueryString: false
            ViewerProtocolPolicy: redirect-to-https
          PriceClass: PriceClass_100
          ViewerCertificate:
            AcmCertificateArn:
              Fn::Join:
                - ":"
                - - "arn:aws:acm:us-east-1"
                  - !Ref "AWS::AccountId"
                  - ${ssm:/${self:custom.stage}/folk-webapp/CERTIFICATE_NAME}
            MinimumProtocolVersion: TLSv1.2_2019
            SslSupportMethod: sni-only

  Outputs:
    FolkStaticBucketOutput:
      Value:
        "Ref": FolkStaticS3Bucket
    FolkDistributionOutput:
      Value:
        "Fn::GetAtt": [FolkDistribution, DomainName]