{ "AWSTemplateFormatVersion": "2010-09-09", "Mappings": { "UserDataMap": { "us-west-2": { "common": "Placeholder" } } }, "Resources": { "LabControlIGW": { "Type": "AWS::EC2::InternetGateway", "Properties": { "Tags": [ { "Key": "owner", "Value": "guanglei.bao@pingcap.com" } ] }, "DependsOn": [ "LabControlVPC" ] }, "LabControlVPC": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": "10.200.0.0/16", "EnableDnsSupport": "true", "EnableDnsHostnames": "true", "Tags": [ { "Key": "owner", "Value": "guanglei.bao@pingcap.com" }, { "Key": "Name", "Value": "Lab Control" } ] } }, "IGWA": { "Type": "AWS::EC2::VPCGatewayAttachment", "Properties": { "InternetGatewayId": { "Ref": "LabControlIGW" }, "VpcId": { "Ref": "LabControlVPC" } } }, "PublicRouteTable": { "Type": "AWS::EC2::RouteTable", "Properties": { "VpcId": { "Ref": "LabControlVPC" }, "Tags": [ { "Key": "owner", "Value": "guanglei.bao@pingcap.com" }, { "Key": "Name", "Value": "Lab Control Public Route" } ] } }, "PublicRoute": { "Type": "AWS::EC2::Route", "Properties": { "DestinationCidrBlock": "0.0.0.0/0", "GatewayId": { "Ref": "LabControlIGW" }, "RouteTableId": { "Ref": "PublicRouteTable" } }, "DependsOn": [ "IGWA" ] }, "SN1": { "Type": "AWS::EC2::Subnet", "Properties": { "VpcId": { "Ref": "LabControlVPC" }, "CidrBlock": "10.200.1.0/24", "AvailabilityZone": "us-west-2a", "PrivateDnsNameOptionsOnLaunch": { "EnableResourceNameDnsAAAARecord": false, "EnableResourceNameDnsARecord": true, "HostnameType": "ip-name" }, "Tags": [ { "Key": "owner", "Value": "guanglei.bao@pingcap.com" }, { "Key": "Name", "Value": { "Fn::Join": [ "-", [ "lab-control-subnet", "1" ] ] } } ] } }, "SRTA1": { "Type": "AWS::EC2::SubnetRouteTableAssociation", "Properties": { "SubnetId": { "Ref": "SN1" }, "RouteTableId": { "Ref": "PublicRouteTable" } } }, "LabControlSG": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Allow nodes communication.", "VpcId": { "Ref": "LabControlVPC" }, "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": 443, "ToPort": 443, "CidrIp": "0.0.0.0/0" }, { "IpProtocol": "icmp", "FromPort": -1, "ToPort": -1, "CidrIp": "0.0.0.0/0" } ], "SecurityGroupEgress": [ { "IpProtocol": "-1", "CidrIp": "0.0.0.0/0" } ], "Tags": [ { "Key": "owner", "Value": "guanglei.bao@pingcap.com" }, { "Key": "Name", "Value": { "Fn::Join": [ "-", [ "lab-control", "sg" ] ] } } ] } }, "IRule": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "IpProtocol": "-1", "SourceSecurityGroupId": { "Fn::GetAtt": [ "LabControlSG", "GroupId" ] }, "GroupId": { "Fn::GetAtt": [ "LabControlSG", "GroupId" ] } } }, "MLT": { "Type": "AWS::EC2::LaunchTemplate", "Properties": { "VersionDescription": "v1", "LaunchTemplateName": { "Fn::Join": [ "-", [ "lab-control", "lt" ] ] }, "LaunchTemplateData": { "IamInstanceProfile": { "Name": "lab-control-service-role" }, "BlockDeviceMappings": [ { "DeviceName": "/dev/xvda", "Ebs": { "DeleteOnTermination": true, "Encrypted": false, "VolumeSize": 500, "VolumeType": "gp2" } } ], "NetworkInterfaces": [ { "DeviceIndex": 0, "AssociatePublicIpAddress": true, "Groups": [ { "Ref": "LabControlSG" } ], "DeleteOnTermination": true } ], "ImageId": "ami-0f94e3bf581aae642", "InstanceType": "c5.xlarge", "KeyName": "pe-ec2-key", "TagSpecifications": [ { "ResourceType": "instance", "Tags": [ { "Key": "owner", "Value": "guanglei.bao@pingcap.com" }, { "Key": "Name", "Value": "lab-control" }, { "Key": "role", "Value": "system" }, { "Key": "student", "Value": "N/A" } ] } ], "UserData": { "Fn::Base64": { "Fn::Join": [ "\n", [ "#!/bin/bash", "echo LANG=en_US.utf-8 > /etc/environment", "echo LC_ALL=en_US.utf-8 >> /etc/environment", "mkdir ~ec2-user/stage/ 2>/dev/null", "cd ~ec2-user/stage/", "yum -y update", "yum -y install git awscli httpd mod_ssl", "TOKEN=`curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\"`", "REGION_CODE=`curl -H \"X-aws-ec2-metadata-token: $TOKEN\" -v http://169.254.169.254/latest/meta-data/placement/region`", "INSTANCE_ID=`curl -H \"X-aws-ec2-metadata-token: $TOKEN\" -v http://169.254.169.254/latest/meta-data/instance-id`", "echo export REGION_CODE=${REGION_CODE} > ~ec2-user/cloud-env.sh", "echo export INSTANCE_ID=${INSTANCE_ID} >> ~ec2-user/cloud-env.sh", "alias cp='cp'", "su - ec2-user -c \"pip3 install boto3\"", "chown -R ec2-user:ec2-user ~ec2-user/*", "chmod +x ~ec2-user/*.sh", "aws ec2 associate-address --instance-id ${INSTANCE_ID} --public-ip 52.42.18.8 --allow-reassociation --region ${REGION_CODE}", "amazon-linux-extras install -y php8.0", "usermod -a -G apache ec2-user", "chown -R ec2-user:apache /var/www", "chmod 2775 /var/www && find /var/www -type d -exec chmod 2775 {} \\;", "find /var/www -type f -exec chmod 0664 {} \\;", "aws s3 cp s3://pe-lab-control/config/pingcap.net.cert /etc/pki/tls/certs/", "aws s3 cp s3://pe-lab-control/config/pingcap.net_chain.cert /etc/pki/tls/certs/", "aws s3 cp s3://pe-lab-control/config/ca.cert /etc/pki/tls/certs/", "chmod 644 /etc/pki/tls/certs/*.cert", "aws s3 cp s3://pe-lab-control/config/pingcap.net.key /etc/pki/tls/private/", "chmod 600 /etc/pki/tls/private/pingcap.net.key", "aws s3 cp s3://pe-lab-control/config/ssl.conf /etc/httpd/conf.d/", "aws s3 cp s3://pe-lab-control/config/httpd.conf /etc/httpd/conf/", "chmod 644 /etc/httpd/conf.d/ssl.conf", "chmod 644 /etc/httpd/conf/httpd.conf", "su - ec2-user -c \"aws s3 sync s3://pe-lab-control/ui/ /var/www/html/\"", "rm -f google-api-php-client--PHP8.0.zip", "wget https://pingcap-edu.s3.us-west-2.amazonaws.com/google-api-php-client--PHP8.0.zip", "unzip -u google-api-php-client--PHP8.0.zip -d /var/www/html/google-api-php-client", "rm -f google-api-php-client--PHP8.0.zip", "mkdir /var/www/wallet/ 2>/dev/null", "aws s3 cp s3://pe-lab-control/config/client_auth_config_lab-control.pingcap.net.json /var/www/wallet/", "chown -R ec2-user:apache /var/www/wallet/", "rm -f /etc/httpd/conf.d/userdir.conf", "rm -f /etc/httpd/conf.d/autoindex.conf", "systemctl restart httpd", "systemctl enable httpd", "aws s3 sync s3://pe-lab-control/lab_control_scripts/ /usr/share/httpd/lab_control_scripts/", "chown -R apache /usr/share/httpd/lab_control_scripts/", "chmod -R 550 /usr/share/httpd/lab_control_scripts/", "chown apache /usr/share/httpd", "cp /etc/passwd /etc/passwd.bak", "sed -i '' -e \"s/Apache:\\/usr\\/share\\/httpd:\\/sbin\\/nologin/Apache:\\/usr\\/share\\/httpd:\\/bin\\/bash/g\" /etc/passwd 2>/dev/null", "su - apache -c \"pip3 install boto3\"", "mkdir /usr/share/httpd/.ssh/ 2>/dev/null", "aws s3 sync s3://pe-lab-control/config/keys /usr/share/httpd/.ssh/", "chown -R apache /usr/share/httpd/.ssh/", "chmod 400 /usr/share/httpd/.ssh/*/*.pem", "mkdir /usr/share/httpd/logs/ 2>/dev/null", "chown apache:apache /usr/share/httpd/logs/", "chown root:root /var/www/html/.htaccess", "chmod 644 /var/www/html/.htaccess", "chown root:root /var/www/html/lab-controller/.htaccess", "chmod 644 /var/www/html/lab-controller/.htaccess", "su - apache -c \"curl --proto '=https' --tlsv1.2 -sSf https://tiup-mirrors.pingcap.com/install.sh | sh\"", "su - apache -c \"tiup install cloud\"", "su - apache -c \"tiup cloud:v1.0.0-beta.1\"", "aws s3 cp s3://pe-lab-control/config/config.toml /usr/share/httpd/.ticloud/", "chown apache:apache /usr/share/httpd/.ticloud/config.toml", "chmod 600 /usr/share/httpd/.ticloud/config.toml", "su - apache -c \"pip3 install requests\"", "su - apache -c \"pip3 install mysql-connector\"" ] ] } } } } }, "MG": { "Type": "AWS::AutoScaling::AutoScalingGroup", "Properties": { "AutoScalingGroupName": { "Fn::Join": [ "-", [ "Lab-Control", "asg" ] ] }, "LaunchTemplate": { "LaunchTemplateId": { "Ref": "MLT" }, "Version": { "Fn::GetAtt": [ "MLT", "LatestVersionNumber" ] } }, "MaxSize": "1", "MinSize": "1", "DesiredCapacity": "1", "VPCZoneIdentifier": [ { "Ref": "SN1" } ], "Tags": [ { "Key": "owner", "Value": "guanglei.bao@pingcap.com", "PropagateAtLaunch": "true" } ] }, "DependsOn": [ "IGWA" ] } } }