jenkins.yml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  Stack for managing Jenkins.
Parameters:
  ParentAlertStack:
    Description: >-
      Name of the parent Stack containing the Alert topic. The Stack
      is queried for the '-TopicArn' export.
    Type: String
    Default: ''
  ParentStorageStack:
    Description: >-
      Name of the parent Stack containing the EFS-Storage. The Stack
      is queried for the '-AvailabilityZone' and '-VolumeId' export.
    Type: String
  JenkinsStorageDevice:
    Description: >-
      Device name of the EBS storage volume used to store the Jenkins
      home directory. Typically this parameter can be unchanged.
    Type: String
    Default: '/dev/xvdj'
  ParentVpcStack:
    Description: >-
      Name of the parent Stack containing the VPC. The Stack is
      queried for the '-VpcId', '-SubnetPublicId', and
      '-AvailabilityZone' export. export.
    Type: String
  KeyName:
    Description: >-
      Name of an existing EC2 KeyPair to enable SSH access to the ECS
      instances.
    Type: AWS::EC2::KeyPair::KeyName
    Default: ECS
  InstanceType:
    Description: WebServer EC2 instance type
    Type: String
    Default: t2.micro
    AllowedValues: [t1.micro, t2.nano, t2.micro, t2.small, t2.medium, t2.large, m1.small,
      m1.medium, m1.large, m1.xlarge, m2.xlarge, m2.2xlarge, m2.4xlarge, m3.medium,
      m3.large, m3.xlarge, m3.2xlarge, m4.large, m4.xlarge, m4.2xlarge, m4.4xlarge,
      m4.10xlarge, c1.medium, c1.xlarge, c3.large, c3.xlarge, c3.2xlarge, c3.4xlarge,
      c3.8xlarge, c4.large, c4.xlarge, c4.2xlarge, c4.4xlarge, c4.8xlarge, g2.2xlarge,
      g2.8xlarge, r3.large, r3.xlarge, r3.2xlarge, r3.4xlarge, r3.8xlarge, i2.xlarge,
      i2.2xlarge, i2.4xlarge, i2.8xlarge, d2.xlarge, d2.2xlarge, d2.4xlarge, d2.8xlarge,
      hi1.4xlarge, hs1.8xlarge, cr1.8xlarge, cc2.8xlarge, cg1.4xlarge]
    ConstraintDescription: must be a valid EC2 instance type.
  EnableEc2Ssh:
    Description: Enable SSH access to the EC instance (true/false).
    Type: String
    AllowedValues: [true, false]
    ConstraintDescription: Please use either true of false.
    Default: false
  LogRetentionInDays:
      Description: The number of days you want to retain log events in the specified log group
      Type: Number
      Default: 14
      AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
  SshLocation:
    Description: The IP address range that can be used to SSH to the EC2 instances
    Type: String
    MinLength: 9
    MaxLength: 18
    Default: 0.0.0.0/0
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x
  HostedZoneName:
    Description: The Route53 HostedZone name for registering the EC2 instance in DNS.
    Type: String
    Default: ''
  DnsName:
    Description: The Route53 DNS name (fully qualified) to create in the HostedZone.
    Type: String
    Default: ''
  LetsEncryptEnable:
    Description: Enable Let's Encrypt on port 80/443, disabling port 8080.
    Type: String
    AllowedValues: [true, false]
    ConstraintDescription: Please use either true of false.
    Default: true
  LetsEncryptMailAddress:
    Description: Mail address for Letsencrypt.
    Type: String
    AllowedPattern: (\S+)@(\S+)\.\S+
    ConstraintDescription: must be a valid mail address.
    Default: nobody@example.com
  TraefikVersion:
    Description: The version of traefik to install.
    Type: String
    Default: v1.6.0
  TraefikSha512:
    Description: The SHA512 sum of traefik, needs to match the version.
    Type: String
    Default: 0abc9de93787ff86879d75963d56f8499433f5ea55c0e10753e80b2b25770e651f1fe17f5f678b1c876dd9b852b2e6415dd5bfdf08dbb6d581eab5542beaa8c6
Conditions:
  HasAlertTopic:
    !Not [!Equals [!Ref ParentAlertStack, '']]
  HasSshAccess:
    !Equals [true, !Ref EnableEc2Ssh]
  HasDnsRegistration:
    !And [!Not [!Equals ['', !Ref HostedZoneName]], !Not [!Equals ['', !Ref DnsName]]]
  HasPort8080:
    !Equals [!Ref LetsEncryptEnable, false]
  HasLetsEncrypt:
    !Equals [!Ref LetsEncryptEnable, true]
Mappings:
  RegionMap:
    'ap-south-1':
      AMI: 'ami-531a4c3c'
    'eu-west-3':
      AMI: 'ami-8ee056f3'
    'eu-west-2':
      AMI: 'ami-403e2524'
    'eu-west-1':
      AMI: 'ami-d834aba1'
    'ap-northeast-2':
      AMI: 'ami-863090e8'
    'ap-northeast-1':
      AMI: 'ami-ceafcba8'
    'sa-east-1':
      AMI: 'ami-84175ae8'
    'ca-central-1':
      AMI: 'ami-a954d1cd'
    'ap-southeast-1':
      AMI: 'ami-68097514'
    'ap-southeast-2':
      AMI: 'ami-942dd1f6'
    'eu-central-1':
      AMI: 'ami-5652ce39'
    'us-east-1':
      AMI: 'ami-97785bed'
    'us-east-2':
      AMI: 'ami-f63b1193'
    'us-west-1':
      AMI: 'ami-824c4ee2'
    'us-west-2':
      AMI: 'ami-f2d3638a'
Resources:
  IPAddress:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      InstanceId: !Ref Ec2Instance

  InstanceSecurityGroupPublic:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId:
        Fn::ImportValue:
          !Sub '${ParentVpcStack}-VpcId'
      GroupDescription: Enable access to HTTP port 8080
      Tags:
      - Key: Name
        Value: !Ref AWS::StackId
      - Key: Reach
        Value: public

  InstanceSecurityGroupPublicSsh:
    Type: AWS::EC2::SecurityGroupIngress
    Condition: HasSshAccess
    Properties:
      GroupId: !Ref InstanceSecurityGroupPublic
      IpProtocol: tcp
      FromPort: 22
      ToPort: 22
      CidrIp: !Ref SshLocation

  InstanceSecurityGroupPublic8080:
    Type: AWS::EC2::SecurityGroupIngress
    Condition: HasPort8080
    Properties:
      GroupId: !Ref InstanceSecurityGroupPublic
      IpProtocol: tcp
      FromPort: 8080
      ToPort: 8080
      CidrIp: !Ref SshLocation

  InstanceSecurityGroupPublicLetsEncryptHttp:
    Type: AWS::EC2::SecurityGroupIngress
    Condition: HasLetsEncrypt
    Properties:
      GroupId: !Ref InstanceSecurityGroupPublic
      IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      CidrIp: 0.0.0.0/0

  InstanceSecurityGroupPublicLetsEncryptHttps:
    Type: AWS::EC2::SecurityGroupIngress
    Condition: HasLetsEncrypt
    Properties:
      GroupId: !Ref InstanceSecurityGroupPublic
      IpProtocol: tcp
      FromPort: 443
      ToPort: 443
      CidrIp: 0.0.0.0/0

  InstanceSecurityGroupPrivate:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId:
        Fn::ImportValue:
          !Sub '${ParentVpcStack}-VpcId'
      GroupDescription: Enable all TCP port from instances in this VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 1
        ToPort: 65535
        CidrIp: 10.0.0.0/16
      Tags:
      - Key: Name
        Value: !Ref AWS::StackId
      - Key: Reach
        Value: private

  Ec2Logs:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref LogRetentionInDays

  Ec2Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - 'ec2.amazonaws.com'
          Action:
          - 'sts:AssumeRole'
      Path: '/'
      Policies:
      - PolicyName: logs
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'logs:CreateLogGroup'
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            - 'logs:DescribeLogStreams'
            Resource:
            - 'arn:aws:logs:*:*:*'
      - PolicyName: sts
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'sts:AssumeRole'
            Resource:
            - '*'

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: '/'
      Roles:
      - !Ref Ec2Role

  Ec2Instance:
    Type: AWS::EC2::Instance
    CreationPolicy:
      ResourceSignal:
        Timeout: PT5M # Timeout after five minutes
    Metadata:
      AWS::CloudFormation::Init:
        configSets:
          default: !If [ HasLetsEncrypt, [update, awslogs, awshub, prejenkins, installjenkins, startjenkins, supervisor, traefik], [update, awslogs, awshub, prejenkins, installjenkins, startjenkins]]
        update:
          commands:
            01_update:
              command: yum update -y
        awslogs:
          packages:
            yum:
              awslogs: []
          files:
            '/etc/awslogs/awscli.conf':
              content: !Sub |
                [default]
                region = ${AWS::Region}
                [plugins]
                cwlogs = cwlogs
              mode: '000644'
              owner: root
              group: root
            '/etc/awslogs/awslogs.conf':
              content: !Sub |
                [general]
                state_file = /var/lib/awslogs/agent-state
                [/var/log/messages]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/messages
                log_stream_name = {instance_id}/var/log/messages
                log_group_name = ${Ec2Logs}
                [/var/log/secure]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/secure
                log_stream_name = {instance_id}/var/log/secure
                log_group_name = ${Ec2Logs}
                [/var/log/cron]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/cron
                log_stream_name = {instance_id}/var/log/cron
                log_group_name = ${Ec2Logs}
                [/var/log/cloud-init.log]
                datetime_format = %b %d %H:%M:%S
                file = /var/log/cloud-init.log
                log_stream_name = {instance_id}/var/log/cloud-init.log
                log_group_name = ${Ec2Logs}
                [/var/log/cfn-init.log]
                datetime_format = %Y-%m-%d %H:%M:%S
                file = /var/log/cfn-init.log
                log_stream_name = {instance_id}/var/log/cfn-init.log
                log_group_name = ${Ec2Logs}
                [/var/log/cfn-hup.log]
                datetime_format = %Y-%m-%d %H:%M:%S
                file = /var/log/cfn-hup.log
                log_stream_name = {instance_id}/var/log/cfn-hup.log
                log_group_name = ${Ec2Logs}
                [/var/log/cfn-init-cmd.log]
                datetime_format = %Y-%m-%d %H:%M:%S
                file = /var/log/cfn-init-cmd.log
                log_stream_name = {instance_id}/var/log/cfn-init-cmd.log
                log_group_name = ${Ec2Logs}
                [/var/log/cloud-init-output.log]
                file = /var/log/cloud-init-output.log
                log_stream_name = {instance_id}/var/log/cloud-init-output.log
                log_group_name = ${Ec2Logs}
                [/var/log/dmesg]
                file = /var/log/dmesg
                log_stream_name = {instance_id}/var/log/dmesg
                log_group_name = ${Ec2Logs}
                [/var/log/jenkins/jenkins.log]
                datetime_format = %d %b %Y %H:%M:%S
                multi_line_start_pattern = {datetime_format}
                file = /var/log/jenkins/jenkins.log
                log_stream_name = {instance_id}/var/log/jenkins/jenkins.log
                log_group_name = ${Ec2Logs}
              mode: '000644'
              owner: root
              group: root
          services:
            sysvinit:
              awslogs:
                enabled: true
                ensureRunning: true
                packages:
                  yum:
                  - awslogs
                files:
                - '/etc/awslogs/awslogs.conf'
                - '/etc/awslogs/awscli.conf'
        awshub:
          files:
            '/etc/cfn/cfn-hup.conf':
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
                interval=1
              mode: '000400'
              owner: root
              group: root
            '/etc/cfn/hooks.d/cfn-auto-reloader.conf':
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.Ec2Instance.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init --verbose --stack=${AWS::StackName} --region=${AWS::Region} --resource=Ec2Instance
                runas=root
          services:
            sysvinit:
              cfn-hup:
                enabled: true
                ensureRunning: true
                files:
                - '/etc/cfn/cfn-hup.conf'
                - '/etc/cfn/hooks.d/cfn-auto-reloader.conf'
        prejenkins:
          packages:
            yum:
              htop: []
              java-1.8.0-openjdk-devel: []
              git: []
          commands:
            01_rm_jdk7:
              command: yum remove -y java-1.7.0-openjdk
              ignoreErrors: true
            02_get_jenkins_key:
               command: wget -O /etc/yum.repos.d/jenkins.repo https://pkg.jenkins.io/redhat-stable/jenkins.repo
               test: '[ ! -f /etc/yum.repos.d/jenkins.repo ]'
            03_install_jenkins_key:
               command: rpm --import https://pkg.jenkins.io/redhat-stable/jenkins.io.key && touch /etc/have-jenkins-key
               test: '[ ! -f /etc/have-jenkins-key ]'
        installjenkins:
          packages:
            yum:
              jenkins: []
          services:
            sysvinit:
              jenkins:
                enabled: false
                ensureRunning: false
        startjenkins:
          commands:
            01_prepare_ebs:
              command: !Sub 'mkfs -t ext4 ${JenkinsStorageDevice}'
              test: !Sub 'if file -s ${JenkinsStorageDevice} | grep -q ": data"; then exit 0; else exit 1; fi'
            02_mount_ebs:
              command: !Sub 'mount ${JenkinsStorageDevice} /var/lib/jenkins'
              test: 'if mountpoint -q /var/lib/jenkins; then exit 1; else exit 0; fi'
            03_fstab:
              command: !Sub 'echo ${JenkinsStorageDevice} /var/lib/jenkins ext4 defaults,nofail 0 2 >> /etc/fstab'
              test: 'if grep ${JenkinsStorageDevice} /etc/fstab; then exit 1; else exit 0; fi'
            04_permissions:
              command: chown jenkins:jenkins /var/lib/jenkins
          services:
            sysvinit:
              jenkins:
                enabled: true
                ensureRunning: true
        supervisor:
          packages:
            python:
             supervisor: []
          files:
            '/etc/init.d/supervisord':
              content: |
                #!/bin/bash
                #
                # supervisord   Startup script for the Supervisor process control system
                #
                # chkconfig: 2345 95 05
                ### BEGIN INIT INFO
                # Provides: supervisord
                # Required-Start: $all
                # Required-Stop: $all
                # Short-Description: start and stop Supervisor process control system
                # Description: Supervisor is a client/server system that allows
                #   its users to monitor and control a number of processes on
                #   UNIX-like operating systems.
                ### END INIT INFO
                # Source function library
                . /etc/rc.d/init.d/functions
                # Source system settings
                if [ -f /etc/sysconfig/supervisord ]; then
                    . /etc/sysconfig/supervisord
                fi
                # Path to the supervisorctl script, server binary,
                # and short-form for messages.
                supervisorctl=/usr/local/bin/supervisorctl
                supervisord=${SUPERVISORD-/usr/local/bin/supervisord}
                prog=supervisord
                pidfile=${PIDFILE-/var/run/supervisord.pid}
                lockfile=${LOCKFILE-/var/lock/subsys/supervisord}
                STOP_TIMEOUT=${STOP_TIMEOUT-60}
                OPTIONS="${OPTIONS--c /etc/supervisord.conf}"
                RETVAL=0
                start() {
                    echo -n $"Starting $prog: "
                    daemon --pidfile=${pidfile} $supervisord $OPTIONS
                    RETVAL=$?
                    echo
                    if [ $RETVAL -eq 0 ]; then
                        touch ${lockfile}
                        $supervisorctl $OPTIONS status
                    fi
                    return $RETVAL
                }
                stop() {
                    echo -n $"Stopping $prog: "
                    killproc -p ${pidfile} -d ${STOP_TIMEOUT} $supervisord
                    RETVAL=$?
                    echo
                    [ $RETVAL -eq 0 ] && rm -rf ${lockfile} ${pidfile}
                }
                reload() {
                    echo -n $"Reloading $prog: "
                    LSB=1 killproc -p $pidfile $supervisord -HUP
                    RETVAL=$?
                    echo
                    if [ $RETVAL -eq 7 ]; then
                        failure $"$prog reload"
                    else
                        $supervisorctl $OPTIONS status
                    fi
                }
                restart() {
                    stop
                    start
                }
                case "$1" in
                    start)
                        start
                        ;;
                    stop)
                        stop
                        ;;
                    status)
                        status -p ${pidfile} $supervisord
                        RETVAL=$?
                        [ $RETVAL -eq 0 ] && $supervisorctl $OPTIONS status
                        ;;
                    restart)
                        restart
                        ;;
                    condrestart|try-restart)
                        if status -p ${pidfile} $supervisord >&/dev/null; then
                          stop
                          start
                        fi
                        ;;
                    force-reload|reload)
                        reload
                        ;;
                    *)
                        echo $"Usage: $prog {start|stop|restart|condrestart|try-restart|force-reload|reload}"
                        RETVAL=2
                esac
                exit $RETVAL
              mode: '000755'
              owner: root
              group: root
            '/etc/supervisord.conf':
              content: |
                ; /etc/supervisord.conf (created initially by echo_supervisord_conf)
                [unix_http_server]
                file=/var/run/supervisor.sock
                [supervisord]
                user=root
                logfile=/var/log/supervisord.log
                logfile_maxbytes=50MB
                logfile_backups=10
                loglevel=info
                pidfile=/var/run/supervisord.pid
                nodaemon=false
                minfds=1024
                minprocs=200
                [rpcinterface:supervisor]
                supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
                [supervisorctl]
                serverurl=unix:///var/run/supervisor.sock
                [include]
                files = /etc/supervisord.conf.d/*.conf
              mode: '000644'
              owner: root
              group: root
          commands:
            01_create_config_dir:
              command: mkdir /etc/supervisord.conf.d
              test: '[ ! -d /etc/supervisord.conf.d ]'
          services:
            sysvinit:
              supervisord:
                enabled: true
                ensureRunning: true
                files:
                  - /etc/supervisord.conf
                packages:
                  python:
                    - supervisor
        traefik:
          files:
            '/usr/local/sbin/install-traefik':
              content: !Sub |
                #!/bin/bash -xe
                wget -O /tmp/traefik "https://github.com/containous/traefik/releases/download/${TraefikVersion}/traefik_linux-amd64"
                if [ "${TraefikSha512}" != "$(cd /tmp && sha512sum traefik | awk '{print($1)}')" ]; then
                    echo "Traefik sha512 value doesn't match! Exiting."
                    exit 1
                fi
                install -o root -g root /tmp/traefik /usr/local/bin/traefik
                setcap 'cap_net_bind_service=+ep' /usr/local/bin/traefik
              mode: '000700'
              owner: root
              group: root
            '/etc/traefik/traefik.toml':
              content: !Sub |
                logLevel = "INFO"
                defaultEntryPoints = ["http", "https"]
                [entryPoints]
                  [entryPoints.http]
                    address = ":80"
                    compress = false
                    [entryPoints.http.redirect]
                      entryPoint = "https"
                  [entryPoints.https]
                    address = ":443"
                    [entryPoints.https.tls]
                [acme]
                email = "${LetsEncryptMailAddress}"
                storage = "/var/lib/traefik/acme.json"
                entryPoint = "https"
                onHostRule = true
                [[acme.domains]]
                main = "${DnsName}"
                [acme.httpChallenge]
                entryPoint = "http"
                [file]
                filename = "/etc/traefik/servers.toml"
                watch = false
              mode: '000644'
              owner: root
              group: root
            '/etc/traefik/servers.toml':
              content: !Sub |
                loglevel = "ERROR"
                [backends]
                  [backends.jenkins]
                    [backends.jenkins.servers.server0]
                      url = "http://127.0.0.1:8080"
                      weight = 1
                    [backends.jenkins.loadBalancer]
                      method = "wrr"
                [frontends]
                  [frontends.jenkins]
                    entryPoints = ["http", "https"]
                    backend = "jenkins"
                    passHostHeader = true
                  [frontends.jenkins.routes.domain]
                    rule = "Host:${DnsName}"
              mode: '000644'
              owner: root
              group: root
            '/etc/supervisord.conf.d/traefik.conf':
              content: |
                [program:traefik]
                command=/usr/local/bin/traefik
                user=traefik
                directory=/var/lib/traefik
          commands:
            01_install_traefik:
              command: /usr/local/sbin/install-traefik
              test: '[ ! -f /usr/local/bin/traefik ]'
            02_groupadd:
              command: groupadd -g 4000 traefik
              test: 'if grep -q traefik: /etc/group; then exit 1; else exit 0; fi'
            03_useradd:
              command: adduser -u 4000 -g 4000 -s /sbin/nologin -d /var/lib/traefik traefik
              test: 'if grep -q traefik: /etc/passwd; then exit 1; else exit 0; fi'
            04_refresh_supervisord:
              command: /usr/local/bin/supervisorctl update
    Properties:
      AvailabilityZone:
        Fn::ImportValue:
          !Sub '${ParentVpcStack}-AvailabilityZone'
      ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', AMI]
      InstanceType: !Ref InstanceType
      IamInstanceProfile: !Ref InstanceProfile
      KeyName: !Ref KeyName
      Volumes:
      - Device: !Ref JenkinsStorageDevice
        VolumeId:
          Fn::ImportValue:
            !Sub '${ParentStorageStack}-VolumeId'
      NetworkInterfaces:
      - AssociatePublicIpAddress: true
        DeviceIndex: '0'
        GroupSet:
        - !Ref InstanceSecurityGroupPublic
        SubnetId:
          Fn::ImportValue:
            !Sub '${ParentVpcStack}-SubnetPublicId'
      Tags:
      - Key: Name
        Value: jenkins
      UserData:
        # NOTE Don't run the shell with -e since then cfn-signal maybe never reached.
        Fn::Base64: !Sub |
          #!/bin/bash -x
          # Prepare the instance using AWS::CloudFormation::Init.
          # See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-init.html
          # NOTE look at /var/log/cfn-init.log to analyze problems.
          yum install -y aws-cfn-bootstrap
          /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} \
              --resource Ec2Instance --configsets default --region ${AWS::Region}
          # Signal the status from cfn-init:
          # NOTE the last commands status is used to indicate the result of the provisioning.
          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource Ec2Instance \
              --region ${AWS::Region}

  CpuAlarm:
    Condition: HasAlertTopic
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: CPU too high alarm
      AlarmActions:
      - Fn::ImportValue: !Sub '${ParentAlertStack}-TopicArn'
      MetricName: CPUUtilization
      Namespace: AWS/EC2
      Statistic: Average
      Period: 60
      EvaluationPeriods: 3
      Threshold: 90
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
      - Name: InstanceId
        Value:
          Ref: Ec2Instance

  DnsRecord:
    Type: AWS::Route53::RecordSet
    Condition: HasDnsRegistration
    Properties:
      HostedZoneName: !Sub '${HostedZoneName}.'
      Name: !Sub '${DnsName}.'
      Type: A
      TTL: 900
      ResourceRecords:
      - !Ref IPAddress

Outputs:
  InstanceId:
    Description: Instance Id of newly created instance.
    Value: !Ref Ec2Instance
  AvailabilityZone:
    Description: The Availability Zone of the instance.
    Value: !GetAtt Ec2Instance.AvailabilityZone
  PrivateDnsName:
    Description: The private DNS name of the instance.
    Value: !GetAtt Ec2Instance.PrivateDnsName
  PublicDnsName:
    Description: The public DNS name of the instance.
    Value: !GetAtt Ec2Instance.PublicDnsName
  PrivateIp:
    Description: Private IP of the instance.
    Value: !GetAtt Ec2Instance.PrivateIp
  PublicIp:
    Description: Public IP of the instance.
    Value: !Ref IPAddress
  PublicUrl:
    Description: Public URL of the instance.
    Value: !If [HasLetsEncrypt, !Sub 'https://${DnsName}/', !Sub 'http://${DnsName}:8080/']