serverless.yml

service: internal-spoke

frameworkVersion: ">=1.0.0 <2.0.0"

custom:
  stage: ${opt:stage, 'dev'}
  region: ${opt:region, 'us-east-1'}
  baseUrl:
    dev: https://${self:custom.customDomain.domainName}
    prod: https://spoke.elizabethwarren.com
  debugApollo:
    dev: 1
    prod: 0
  reservedConcurrency:
    dev: 100
    prod: 1000
  # uncomment suppressPhoneValidation, dropMessageRatio
  # and skipTwilioAndAutoreply and equivalent env vars below
  # suppressPhoneValidation:
    # dev: 1
  # dropMessageRatio:
    # dev: 0.9
  # skipTwilioAndAutoReply:
    # dev: 1
  deploy:
    # Users can define these parameters in SSM (they will be looked up at deploy time)
    # or in the deploy environment or inline
    bucket_name: ${ssm:${BUCKET NAME~true}
    bucket_arn: ${ssm:${BUCKET ARN~true}
  vpcConfig:
    subnetIds:
      # Users can define these parameters in SSM (they will be looked up at deploy time)
      # or in the deploy environment or inline
      - "${ssm:${SUBNET ID}~true}"
      ...
    securityGroupIds:
      # Users can define this parameter in SSM (it will be looked up at deploy time)
      # or in the deploy environment or inline
      - "${ssm:${SECURITY GROUP ID}~true}"
  associateWaf:
      # OPTIONAL. A WAF is not strictly required, but it is generally useful to have
      # one to handle IP-level rate limiting
    name: WAF NAME
  customDomain:
    domainName: "A DOMAIN NAME"
    stage: ${self:custom.stage}
    certificateName: "*.A DOMAIN NAME"
    createRoute53Record: true
    securityPolicy: tls_1_2
  custom:
    prune:
      automatic: true
      number: 5

provider:
  name: aws
  runtime: nodejs12.x
  deploymentBucket:
    name: ${self:custom.deploy.bucket_name}
    blockPublicAccess: true
  iamRoleStatements:
    - Effect: Allow
      Action: lambda:InvokeFunction
      Resource: "arn:aws:lambda:${self:custom.region}:#{AWS::AccountId}:function:internal-spoke-${self:custom.stage}-worker"
    - Effect: Allow
      Action:
        - "events:PutEvents"
        - "cloudwatch:PutMetricData"
      Resource: "*"
    - Effect: Allow
      Action:
        - "ses:CreateTemplate"
        - "ses:SendEmail"
        - "ses:SendTemplatedEmail"
        - "ses:UpdateTemplate"
      Resource: "*"
    - Effect: Allow
      Action:
        - "s3:*"
      Resource:
        # Users can define this parameter in SSM (it will be looked up at deploy time)
        # or in the deploy environment or inline
        - "${ssm:${PRIVATE BUCKET ARN}~true}"
        - "${ssm:${PRIVATE BUCKET ARN}~true}/*"
    - Effect: Allow
      Action:
        - codedeploy:*
      Resource:
        - "*"
  environment:
    STAGE: ${self:custom.stage}
    NODE_ENV: production
    STATIC_BASE_URL: /assets/
    SUPPRESS_SELF_INVITE: 1
    PHONE_NUMBER_COUNTRY: US
    SUPPRESS_SEED_CALLS: 1
    KNEX_MIGRATION_DIR: ./build/server/migrations
    PASSPORT_STRATEGY: slack
    AWS_ACCESS_AVAILABLE: 1
    DST_REFERENCE_TIMEZONE: America/New_York
    DEFAULT_SERVICE: twilio
    DB_PORT: 5432
    DB_TYPE: pg
    EMAIL_ENABLED: true
    SES_REGION: us-east-1
    CACHE_PREFIX: spoke-
    CONTACTS_PER_PHONE_NUMBER: 200
    JOB_EXECUTOR: LAMBDA
    ASSETS_DIR: ./build/client/assets
    ASSETS_MAP_FILE: assets.json
    OPTOUTS_SHARE_ALL_ORGS: 1
    MAX_CONTACTS: 75000
    SLOW_REQUEST_LOG_THRESHOLD: 500
    CLOUDWATCH_METRICS_ENABLED: 1
    DEBUG_APOLLO: ${self:custom.debugApollo.${self:custom.stage}}
    TWILIO_STATUS_CALLBACK_URL: ${self:custom.baseUrl.${self:custom.stage}}/twilio-message-report
    JOB_LAMBDA_WORKER_FUNCTION_NAME: internal-spoke-${self:custom.stage}-worker
    BASE_URL: ${self:custom.baseUrl.${self:custom.stage}}
    ASSET_DOMAIN: https://ew-spoke-public.elizabethwarren.codes/${self:custom.stage}

    # Users can define these parameters in SSM (they will be looked up at deploy time)
    # or in the deploy environment or inline. Secrets like this are best maintained
    # in something like SSM, but careful use of environment variables works here too!
    SESSION_SECRET: ${ssm:${SESSION SECRET PARAMETER NAME}~true}
    AWS_S3_BUCKET_NAME: ${ssm:${PRIVATE BUCKET NAME}~true}
    AUTH0_CLIENT_ID: ${ssm:${AUTH0 CLIENT ID}~true}
    AUTH0_CLIENT_SECRET: ${ssm:${AUTHO CLIENT_SECRET}~true}
    AUTH0_DOMAIN: ${ssm:${AUTH0 DOMAIN}/DOMAIN}
    DB_HOST: ${ssm:${POSTGRES HOST}~true}
    DB_NAME: ${ssm:${POSTGRES DB NAME}~true}
    DB_USER: ${ssm:${POSTGRES USER}~true}
    DB_PASSWORD: ${ssm:${POSTGRES PASSWORD}~true}
    EMAIL_FROM: ${ssm:${EMAIL FROM}~true}
    EMAIL_REPLY_TO: ${ssm:${EMAIL REPLY TO}~true}
    REDIS_URL: redis://${ssm:${REDIS ENDPOINT}~true}:6379/3
    TWILIO_ACCOUNT_SID: ${ssm:${TWILIO ACCOUNT SID}~true}
    TWILIO_AUTH_TOKEN: ${ssm:${TWILIO AUTH TOKEN}~true}
    TWILIO_MESSAGE_SERVICE_SID: ${ssm:${TWILIO MESSAGE SERVICE SID}~true}
    TWILIO_VOICE_URL: ${ssm:${TWILIO VOICE URL}~true}
    SLACK_CLIENT_ID: ${ssm:${SLACK CLIENT ID}~true}
    SLACK_CLIENT_SECRET: ${ssm:${SLACK CLIENT SECRET}~true}
    SLACK_TEAM_ID: ${ssm:${SLACK TEAM ID}~true}
    EMBEDDED_SHIFTER_URL: ${ssm:${EMBEDDED SHIFTER URL}~true}
    SENTRY_DSN: ${ssm:${SENTRY DSN}~true}

    # SUPPRESS_PHONE_VALIDATION: 1
    # SKIP_TWILIO_AND_AUTOREPLY: ${self:custom.skipTwilioAndAutoReply.${self:custom.stage}}
    # DROP_MESSAGE_RATIO: ${self:custom.dropMessageRatio.${self:custom.stage}}

functions:
  api:
    handler: lambda.handler
    vpc: ${self:custom.vpcConfig}
    events:
      - http: ANY /
      - http: ANY {proxy+}
    reservedConcurrency: ${self:custom.reservedConcurrency.${self:custom.stage}}
    deploymentSettings:
      type: Linear10PercentEvery1Minute
      alias: Live
      preTrafficHook: preflight
      postTrafficHook: postflight
    dependsOn:
      - PreflightLambdaFunction
      - PostflightLambdaFunction
  worker:
    handler: build/server/server/lambda/worker.handler
    vpc: ${self:custom.vpcConfig}
    timeout: 600
#  twilio-webhook:
#    handler: build/server/server/lambda/twilio-webhook.handler
#    vpc: ${self:custom.vpcConfig}
#    events:
#      - sqs:
#          arn: ${ssm:${self:custom.stage}/spoke/sqs/TWILIO_WEBHOOK_QUEUE_ARN~true}
#          batchSize: 1 # TODO: this is for testing, raise it in production
  # send-reminders:
  #   handler: build/server/server/lambda/send-reminders.handler
  #   vpc: ${self:custom.vpcConfig}
  #   timeout: 900
  #   events:
  #     - schedule: cron(0 1,17 * * ? *)
  preflight:
    handler: build/server/server/lambda/codedeploy.preflight
    vpc: ${self:custom.vpcConfig}
    timeout: 600
  postflight:
    handler: build/server/server/lambda/codedeploy.postflight
    vpc: ${self:custom.vpcConfig}
    timeout: 600

plugins:
  - serverless-domain-manager
  - serverless-associate-waf
  - serverless-api-compression
  - serverless-prune-plugin
  - serverless-jetpack
  - serverless-plugin-canary-deployments
  - serverless-plugin-git-variables

package:
  excludeDevDependencies: true
  package:
  exclude:
    - "*"
    - "webpack/**"
    - ".github/**"
    - "dev-tools/**"
    - "docs/**"
    - "__test__/**"
    - "__mocks__/**"
    - "**/node_modules/aws-sdk/**" # included on Lambda.
    - "!package.json"
    - "!lambda.js"
    - "!knexfile.js"
    - "build/client/assets/*.js"
    - "build/client/assets/*.js.map"