centOS-ecs-oss.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建CentOS ECS实例并配置OSS反向代理，支持新建或使用现有实例与OSS Bucket。
  en: Create a CentOS ECS instance and configure OSS reverse proxy, supporting the
    creation of new or utilization of existing instances along with OSS Buckets.
Parameters:
  CommonName:
    Type: String
    Default: oss-server-sign
  BucketName:
    AssociationPropertyMetadata:
      Length: 6
      Prefix: test-bucketname-
      CharacterClasses:
        - Class: lowercase
          min: 1
    Description:
      zh-cn: Bucket 名称在 OSS 范围内必须全局唯一。长度为3~63个字符。必须以小写英文字母或数字开头和结尾，可包含小写英文字母、数字和短划线（-）。
      en: Bucket names must be globally unique within the scope of OSS. The length is 3~63 characters. Must start and end with a lowercase English letter or number, and can contain lowercase English letters, numbers, and dashes (-).
    Label:
      zh-cn: 新建存储空间名称
      en: NewBucketName
    AllowedPattern: ^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$
    AssociationProperty: AutoCompleteInput
    Type: String
  ZoneId:
    Type: String
    AssociationProperty: ALIYUN::ECS::Instance::ZoneId
    AssociationPropertyMetadata:
      AutoSelectFirst: true
    Label:
      en: Availability Zone
      zh-cn: 可用区
  InstanceType:
    Type: String
    AssociationProperty: ALIYUN::ECS::Instance::InstanceType
    AssociationPropertyMetadata:
      InstanceChargeType: PostPaid
      SystemDiskCategory: cloud_essd
      ZoneId: ${ZoneId}
    Label:
      en: Instance Type
      zh-cn: 实例规格
  Password:
    NoEcho: true
    Type: String
    Description:
      en: Server login password, Length 8-30, must contain three(Capital letters, lowercase letters, numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special symbol in)
      zh-cn: 服务器登录密码，长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）
    Label:
      en: ECS Instance Password
      zh-cn: ECS实例密码
    ConstraintDescription:
      en: Length 8-30, must contain three(Capital letters, lowercase letters, numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special symbol in)
      zh-cn: 长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）
    AssociationProperty: ALIYUN::ECS::Instance::Password
Resources:
  InstanceRole:
    Type: ALIYUN::RAM::Role
    DependsOn: OssBucket
    Properties:
      RoleName: 
        Fn::Replace:
          - "_": "."
          - Fn::Join:
            - "_"
            - - "OSSRole"
              - Ref: ALIYUN::StackName
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service:
                - ecs.aliyuncs.com
        Version: '1'
      Policies:
      - PolicyName:
          Ref: ALIYUN::StackName
        PolicyDocument:
          Version: '1'
          Statement:
          - Action:
            - oss:GetObject
            Resource:
            - Fn::Sub:
              - acs:oss:*:*:${BucketName}/*
              - BucketName:
                  - Ref: BucketName
            Effect: Allow
  VPC:
    Type: ALIYUN::ECS::VPC
    Properties:
      VpcName: myvpc
      CidrBlock: 192.168.0.0/16
  VSwitch:
    Type: ALIYUN::ECS::VSwitch
    Properties:
      VpcId:
        Ref: VPC
      ZoneId:
        Ref: ZoneId
      CidrBlock: 192.168.0.0/24
  SecurityGroup:
    Type: ALIYUN::ECS::SecurityGroup
    Properties:
      VpcId:
        Ref: VPC
      SecurityGroupName: mysg
      SecurityGroupType: normal
      SecurityGroupIngress:
        - SourceCidrIp: 0.0.0.0/0
          PortRange: 80/80
          IpProtocol: tcp
  EcsInstance: 
    Type: ALIYUN::ECS::Instance
    DependsOn: 
      - OssBucket
      - InstanceRole
    Properties:
      VpcId: 
        Ref: VPC
      VSwitchId:
        Ref: VSwitch
      HostName: WebServer
      ImageId: centos_7 
      IoOptimized: optimized
      AllocatePublicIP: true
      RamRoleName:
        Fn::GetAtt:
        - InstanceRole
        - RoleName
      InstanceChargeType: PostPaid
      SpotStrategy: NoSpot  
      InstanceType:
        Ref: InstanceType
      Password: 
        Ref: Password
      SecurityGroupId:
        Ref: SecurityGroup
      SystemDiskCategory: cloud_essd
      SystemDiskDiskName: SystemDisk
      SystemDiskSize: 40     
  OssBucket:
    Type: ALIYUN::OSS::Bucket
    Properties:
      BucketName: 
        Ref: BucketName
      AccessControl: private
      CORSConfiguration:
        CORSRule:
        - AllowedHeader:
          - '*'
          AllowedMethod:
          - GET
          AllowedOrigin:
          - '*'
  InstanceRunCommand:
    Type: ALIYUN::ECS::RunCommand
    Properties:
      InstanceIds:
        - Ref: EcsInstance
      Type: RunShellScript
      CommandContent: 
        Fn::Sub:
          - |
            #!/bin/bash
            sudo yum install -y nginx
            export OSS_PUBLIC_DOMAIN=${OSS_DOMAIN}
            sudo sed -i "46 a \ \tlocation / {\n \ \t\ \tproxy_pass http://${OSS_DOMAIN};\n \ \t} " /etc/nginx/nginx.conf
            cd /usr/sbin
            sudo ./nginx
          - OSS_DOMAIN: 
              Fn::GetAtt:
                - OssBucket
                - InternalDomainName
      Timeout: 3600
Outputs:
  BucketPublicDomainName:
    Value:
      Fn::GetAtt:
        - OssBucket
        - DomainName
  BucketInternalDomainName:
    Value:
      Fn::GetAtt:
        - OssBucket
        - InternalDomainName
  Console.Bucket:
    Label:
      zh-cn: Bucket
      en: Bucket
    Description:
      zh-cn: 文件上传到的bucket控制台页面。可访问该链接上传测试文件。
      en: Bucket console page, which you can upload test files.
    Value: 
      Fn::Sub:
        - https://oss.console.aliyun.com/bucket/oss-${Region}/${BucketName}
        - Region:
            Ref: ALIYUN::Region
          BucketName:
            Ref: BucketName
  Console.Url:
    Label:
      zh-cn: EcsIP
      en: EcsIP
    Description:
      zh-cn: ECS公网地址，可使用此地址+文件访问路径访问bucket资源。
      en: Public address of ECS, which you can access bucket resources via file access path.
    Value:
      Fn::Sub:
        - http://${IP}
        - IP:
            Fn::GetAtt:
              - EcsInstance
              - PublicIp
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
      - Parameters:
        - BucketName
        Label:
          default: 'OSSBucket'
      - Parameters:
        - ZoneId
        - InstanceType
        - Password
        Label:
          default: 'ECS'
    TemplateTags:
      - acs:document-help:ecs:基于CentOS的ECS实例实现OSS反向代理