template.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform:
  - AWS::Serverless-2016-10-31

Description: b10cks Nuxt.js Website with Lambda, S3 and CloudFront

Parameters:
  DomainName:
    Type: String
    Description: "The domain name of website"
    Default: "b10cks.com"
  AddWildcardSubdomains:
    Type: String
    Description: "Add wildcard subdomains to website"
    Default: True
  AcmCertificateArn:
    Type: String
    Description: "The certificate ARN for the domain name provided, must be in us-east-1 region"
    Default: ""
  Client:
    Type: String
    Default: "b10cks"

  NuxtPublicFrontendUrl:
    Type: String
    Default: "https://www.b10cks.com"
  NuxtB10cksAccessToken:
    Type: String
    Default: ""
  NuxtB10cksApiUrl:
    Type: String
    Default: "https://api.b10cks.com/api"
  NuxtIlumBaseUrl:
    Type: String
    Default: "https://api.b10cks.com/ilum"
  NuxtPublicUmamiWebsiteId:
    Type: String
    Default: "824064d0-a59f-4db8-99fb-5a4ebc3e61a3"
  NuxtPublicUmamiScriptUrl:
    Type: String
    Default: "https://insights.coderscantina.com/script.js"

Conditions:
  IsDomainProvided: !Not [!Equals [!Ref DomainName, ""]]
  ShouldAddWildcardSubdomains: !Equals [!Ref AddWildcardSubdomains, "True"]
  HasClient: !Not [!Equals [!Ref Client, ""]]

Globals:
  Function:
    Runtime: nodejs24.x
    Architectures:
      - arm64
    Environment:
      Variables:
        AWS_NODEJS_CONNECTION_REUSE_ENABLED: 1
        NODE_OPTIONS: "--max-old-space-size=512"

Resources:
  NuxtFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: !Ref AWS::StackName
      CodeUri: .output/server/
      Handler: index.handler
      MemorySize: 512
      Timeout: 10
      Environment:
        Variables:
          NUXT_B10CKS_ACCESS_TOKEN: !Ref NuxtB10cksAccessToken
          NUXT_B10CKS_API_URL: !Ref NuxtB10cksApiUrl
          NUXT_ILUM_BASE_URL: !Ref NuxtIlumBaseUrl
          NUXT_PUBLIC_FRONTEND_URL: !Ref NuxtPublicFrontendUrl
          NUXT_PUBLIC_UMAMI_WEBSITE_ID: !Ref NuxtPublicUmamiWebsiteId
          NUXT_PUBLIC_UMAMI_SCRIPT_URL: !Ref NuxtPublicUmamiScriptUrl
          NODE_ENV: production
          NITRO_PRESET: aws-lambda
      FunctionUrlConfig:
        AuthType: NONE
      Tags:
        client: !If [HasClient, !Ref Client, !Ref AWS::StackName]

  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${AWS::StackName}'
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: DeleteIncompleteMultipartUploads
            Status: Enabled
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 1
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders: [ ]
            AllowedMethods:
              - "GET"
              - "HEAD"
            AllowedOrigins:
              - "https://www.b10cks.com"
              - "https://b10cks.com"
            ExposedHeaders: [ ]
      Tags:
        - Key: client
          Value: !If [HasClient, !Ref Client, !Ref AWS::StackName]

  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
          - Sid: AllowCloudFrontServicePrincipal
            Effect: Allow
            Principal:
              Service: 'cloudfront.amazonaws.com'
            Action: 's3:GetObject'
            Resource:
              - !Sub 'arn:aws:s3:::${S3Bucket}/*'
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub 'arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}'

  CloudFrontOriginAccessControl:
    Type: 'AWS::CloudFront::OriginAccessControl'
    Properties:
      OriginAccessControlConfig:
        Name: !GetAtt S3Bucket.DomainName
        Description: !Ref AWS::StackName
        OriginAccessControlOriginType: s3
        SigningBehavior: always
        SigningProtocol: 'sigv4'

  NuxtCachePolicy:
    Type: 'AWS::CloudFront::CachePolicy'
    Properties:
      CachePolicyConfig:
        Name: !Sub '${AWS::StackName}-Nuxt'
        Comment: !Sub 'Cache Policy for AWS SAM Project ${AWS::StackName}'
        DefaultTTL: 0
        MaxTTL: 31536000
        MinTTL: 0
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: none
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers:
              - 'Accept-Language'
              - 'CloudFront-Viewer-Country'
          QueryStringsConfig:
            QueryStringBehavior: whitelist
            QueryStrings:
              - b10cks_rv
              - b10cks_vid

  NuxtApiCachePolicy:
    Type: 'AWS::CloudFront::CachePolicy'
    Properties:
      CachePolicyConfig:
        Name: !Sub '${AWS::StackName}-Nuxt-API'
        Comment: !Sub 'Cache Policy for AWS SAM Project ${AWS::StackName} API'
        DefaultTTL: 86400
        MaxTTL: 31536000
        MinTTL: 0
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: none
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers:
              - 'Accept-Language'
              - 'Authorization'
              - 'CloudFront-Viewer-Country'
          QueryStringsConfig:
            QueryStringBehavior: all

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      Tags:
        - Key: Name
          Value: !Ref AWS::StackName
        - Key: client
          Value: !If [HasClient, !Ref Client, !Ref AWS::StackName]
      DistributionConfig:
        Comment: !Ref AWS::StackName
        Enabled: true
        PriceClass: PriceClass_100
        HttpVersion: http2and3
        IPV6Enabled: true
        Aliases:
          - !If [IsDomainProvided, !Ref DomainName, !Ref AWS::NoValue]
          - !If [IsDomainProvided, !If [ShouldAddWildcardSubdomains, !Sub '*.${DomainName}', !Ref AWS::NoValue], !Ref AWS::NoValue]
        ViewerCertificate:
          Fn::If:
            - IsDomainProvided
            -
              AcmCertificateArn: !If [IsDomainProvided, !Ref AcmCertificateArn, !Ref AWS::NoValue]
              MinimumProtocolVersion: TLSv1.2_2021
              SslSupportMethod: sni-only
            -
              CloudFrontDefaultCertificate: true
        OriginGroups:
          Quantity: 1
          Items:
            - Id: s3ThenNuxt
              FailoverCriteria:
                StatusCodes:
                  Quantity: 2
                  Items:
                    - 403
                    - 404
              Members:
                Quantity: 2
                Items:
                  - OriginId: s3
                  - OriginId: nuxt
        Origins:
          - Id: nuxt
            DomainName: !Select [ 2, !Split [ "/", !GetAtt NuxtFunctionUrl.FunctionUrl ] ]
            CustomOriginConfig:
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
              OriginSSLProtocols:
                - TLSv1.2
              OriginKeepaliveTimeout: 5
              OriginReadTimeout: 30
          - Id: s3
            DomainName: !GetAtt S3Bucket.RegionalDomainName
            OriginAccessControlId: !Ref CloudFrontOriginAccessControl
            S3OriginConfig:
              OriginAccessIdentity: ''
        DefaultCacheBehavior:
          Compress: true
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
            - OPTIONS
          TargetOriginId: s3ThenNuxt
          ViewerProtocolPolicy: redirect-to-https
          CachePolicyId: !Ref NuxtCachePolicy
          OriginRequestPolicyId: b689b0a8-53d0-40ab-baf2-68738e2966ac # Managed-AllViewerExceptHostHeader
          # Create custom policy to allow storyblok editor
          # ResponseHeadersPolicyId: 67f7725c-6f97-4210-82d7-5512b31e9d03  # Managed-SecurityHeadersPolicy
        CacheBehaviors:
          - PathPattern: /_nuxt/*
            TargetOriginId: s3
            Compress: true
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
            CachedMethods:
              - GET
              - HEAD
              - OPTIONS
            ViewerProtocolPolicy: redirect-to-https
            CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6 # Managed-CachingOptimized
            OriginRequestPolicyId: 88a5eaf4-2fd4-4709-b370-b4c650ea3fcf # Managed-CORS-S3Origin
            ResponseHeadersPolicyId: 67f7725c-6f97-4210-82d7-5512b31e9d03 # Managed-SecurityHeadersPolicy

          - PathPattern: /api/*
            TargetOriginId: nuxt
            Compress: true
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
              - PUT
              - POST
              - PATCH
              - DELETE
            CachedMethods:
              - GET
              - HEAD
              - OPTIONS
            ViewerProtocolPolicy: redirect-to-https
            CachePolicyId: !Ref NuxtApiCachePolicy
            OriginRequestPolicyId: b689b0a8-53d0-40ab-baf2-68738e2966ac # Managed-AllViewerExceptHostHeader
            ResponseHeadersPolicyId: 67f7725c-6f97-4210-82d7-5512b31e9d03 # Managed-SecurityHeadersPolicy
        CustomErrorResponses:
          - ErrorCode: 502
            ResponsePagePath: /error.html
            ResponseCode: 502
            ErrorCachingMinTTL: 10
          - ErrorCode: 503
            ResponsePagePath: /error.html
            ResponseCode: 503
            ErrorCachingMinTTL: 10

Outputs:
  S3Bucket:
    Description: "The S3 bucket that contains static files"
    Value: !Ref S3Bucket
  CloudFrontDistribution:
    Description: "The CloudFront distribution in front of the S3 bucket"
    Value: !Ref CloudFrontDistribution
  WebsiteUrl:
    Description: "The website URL"
    Value: !If [IsDomainProvided, !Sub "https://www.${DomainName}/", !Sub "https://${CloudFrontDistribution.DomainName}/"]
  ApplicationLog:
    Description: "The CloudWatch log group where application log are saved"
    Value: !Sub "/aws/lambda/${NuxtFunction}"