stack.yml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: CloudFormation template for deploying an EC2 instance for tunshell relays
Parameters:
  InstanceType:
    Description: EC2 instance type
    Type: String
    Default: t3a.nano
  DomainName:
    Description: The apex domain name to create the relay server DNS records for. You must have a Route53 hosted zone for this domain.
    Type: String
  Subdomain:
    Description: The subdomain to create the A record to the relay server for.
    Type: String
    Default: relay
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  SSHLocation:
    Description: The IP address range that can be used to SSH to the EC2 instances
    Type: String
    MinLength: '9'
    MaxLength: '18'
    Default: 0.0.0.0/0
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
  
Mappings:
  # Ubuntu 20.04 LTS AMI's in respective regions
  AWSRegionArch2AMI:
    us-gov-east-1: 
      AMI: ami-9720cce6
    us-gov-west-1: 
      AMI: ami-8899aae9
    us-west-2: 
      AMI: ami-09dd2e08d601bff67
    us-west-1: 
      AMI: ami-075fd582acf0c0128
    us-east-2: 
      AMI: ami-0e84e211558a022c0
    us-east-1: 
      AMI: ami-068663a3c619dd892
    sa-east-1: 
      AMI: ami-001c16a3a4f5d85f1
    me-south-1: 
      AMI: ami-09cbb7fde4a0edad0
    eu-west-3: 
      AMI: ami-0e60c6afa19d896ee
    eu-west-2: 
      AMI: ami-0917237b4e71c5759
    eu-west-1: 
      AMI: ami-0dad359ff462124ca
    eu-north-1: 
      AMI: ami-0d4e2b57f569e9daa
    eu-central-1: 
      AMI: ami-05c26ae4789875080
    ca-central-1: 
      AMI: ami-08a6203f59f9df866
    ap-southeast-2: 
      AMI: ami-0a1a4d97d4af3009b
    ap-southeast-1: 
      AMI: ami-0b8cf0f359b1335e1
    ap-south-1: 
      AMI: ami-0c5b1a88222ac79cb
    ap-northeast-3: 
      AMI: ami-0e319adbbd61f8b6f
    ap-northeast-2: 
      AMI: ami-0de407404c33d1671
    ap-northeast-1: 
      AMI: ami-0c1ac8728ef7f87a4
    ap-east-1: 
      AMI: ami-9ccc8aed
    af-south-1: 
      AMI: ami-033b88f80930a0f7a

Resources:
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      UserData:
        Fn::Base64:
          Fn::Join:
            - ''
            - - |
                #!/bin/bash -xe
                exec > >(tee /var/log/user-data.log|logger -t user-data -s 2>/dev/console) 2>&1
              - "\n"
              - 'RELAY_DOMAIN='
              - Ref:
                  DNSRecord
              - "\n"
              - |
                sudo mkdir /app
                cd /app

                echo "#!/bin/bash" >> env.sh
                echo "export RELAY_DOMAIN=$RELAY_DOMAIN" >> env.sh
                chmod +x env.sh

                curl https://raw.githubusercontent.com/TimeToogo/tunshell/master/aws/setup-ec2.sh > setup-ec2.sh
                sudo chown -R ubuntu:ubuntu /app
                sudo chmod +x setup-ec2.sh
                sudo -u ubuntu bash ./setup-ec2.sh
      InstanceType:
        Ref: InstanceType
      SecurityGroups:
        - Ref: InstanceSecurityGroup
      KeyName:
        Ref: KeyName
      ImageId:
        Fn::FindInMap:
        - AWSRegionArch2AMI
        - Ref: AWS::Region
        - AMI
      CreditSpecification:
        CPUCredits: standard
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            VolumeType: gp2
            VolumeSize: 30
            DeleteOnTermination: true
            Encrypted: true
      Tags:
        - Key: Name
          Value: tunshell-relay-server

  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp:
            Ref: SSHLocation
        - Description: HTTPS access
          IpProtocol: tcp
          FromPort: '443'
          ToPort: '443'
          CidrIp: 0.0.0.0/0
        - Description: HTTP access
          IpProtocol: tcp
          FromPort: '80'
          ToPort: '80'
          CidrIp: 0.0.0.0/0
        - Description: TLS Relay Server open access
          IpProtocol: tcp
          FromPort: '5000'
          ToPort: '5000'
          CidrIp: 0.0.0.0/0

  IPAddress:
    Type: AWS::EC2::EIP

  IPAssoc:
    Type: AWS::EC2::EIPAssociation
    Properties:
      InstanceId:
        Ref: EC2Instance
      EIP:
        Ref: IPAddress

  DNSRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneName:
        Fn::Join:
          - ''
          - - Ref: DomainName
            - '.'
      Name: 
        Fn::Join:
          - '.'
          - 
            - Ref: Subdomain
            - Ref: DomainName
      Type: A
      TTL: 300
      ResourceRecords:
        - Ref: IPAddress

Outputs:
  InstanceId:
    Description: InstanceId of the newly created EC2 instance
    Value:
      Ref: EC2Instance
  InstanceIPAddress:
    Description: IP address of the newly created EC2 instance
    Value:
      Ref: IPAddress