template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: SAM template for Rust binaries

Parameters:
  SslCertificateArn:
    Type: String
    Description: ARN of the ACM certificate for custom domain
  DomainName:
    Type: String
    Description: Domain name for the API Gateway custom domain
    Default: dylanlangston.com
  ToEmail:
    Type: String
    Description: Email address to forward emails to
  FromEmail:
    Type: String
    Description: Email address to use as the sender
  AwsS3BucketName:
    Type: String 
    Description: Name of the S3 bucket
  AwsRegion:
    Type: String
    Description: AWS region
  AwsAccountId:
    Type: String
    Description: AWS account ID
  GeminiAPIKey:
    Type: String
    Description: Google Gemini API Key

Resources:
  SiteBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Ref AwsS3BucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: false
        IgnorePublicAcls: true
        RestrictPublicBuckets: false
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: error.html

  BucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref SiteBucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Sub "arn:aws:s3:::${AwsS3BucketName}/*"

  EmailForwarderRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: EmailForwarderRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: EmailForwarderPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: 
                  - !Sub "arn:aws:logs:${AwsRegion}:${AwsAccountId}:log-group:/aws/lambda/EmailForwarder:*"
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - ses:SendRawEmail
                Resource: 
                  - !Sub "arn:aws:s3:::${AwsS3BucketName}-mail/*"
                  - !Sub "arn:aws:ses:${AwsRegion}:${AwsAccountId}:identity/${FromEmail}"
                  - !Sub "arn:aws:ses:${AwsRegion}:${AwsAccountId}:identity/${ToEmail}"

  EmailForwarderFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: rust.handler
      Runtime: provided.al2023
      CodeUri: rust-lambda/target/email-forward/bootstrap.zip
      Timeout: 30
      MemorySize: 256
      Architectures:
        - arm64
      Environment:
        Variables:
          ToEmail: !Ref ToEmail
          FromEmail: !Ref FromEmail
          AwsS3BucketName: !Sub "${AwsS3BucketName}-mail"
      Role: !GetAtt EmailForwarderRole.Arn
      FunctionName: EmailForwarder

  LambdaPermissionForSES:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt EmailForwarderFunction.Arn
      Principal: ses.amazonaws.com
      SourceAccount: !Sub "${AwsAccountId}"
      SourceArn: !Sub "arn:aws:ses:${AwsRegion}:${AwsAccountId}:receipt-rule-set/${EmailReceiptRuleSet}:receipt-rule/${EmailReceiptRule}"

  EmailReceiptRuleSet:
    Type: AWS::SES::ReceiptRuleSet
    Properties:
      RuleSetName: ForwardEmails

  EmailReceiptRule:
    Type: AWS::SES::ReceiptRule
    Properties:
      RuleSetName: !Ref EmailReceiptRuleSet
      Rule:
        Name: ForwardEmails
        Enabled: true
        ScanEnabled: false
        Recipients:
          - !Ref DomainName
        Actions:
          - S3Action:
              BucketName: !Sub "${AwsS3BucketName}-mail"
          - LambdaAction:
              FunctionArn: !GetAtt EmailForwarderFunction.Arn

  ContactRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: ContactPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: 
                  - !Sub "arn:aws:logs:${AwsRegion}:${AwsAccountId}:log-group:/aws/lambda/ContactMe:*"
              - Effect: Allow
                Action: ses:SendEmail
                Resource: 
                  - !Sub "arn:aws:ses:${AwsRegion}:${AwsAccountId}:identity/${ToEmail}"
                  - !Sub "arn:aws:ses:${AwsRegion}:${AwsAccountId}:identity/${FromEmail}"

  ContactFunction:
    Type: AWS::Serverless::Function 
    Properties:
      CodeUri: rust-lambda/target/contact/bootstrap.zip
      Handler: rust.handler
      Runtime: provided.al2023
      Role: !GetAtt ContactRole.Arn
      FunctionName: ContactMe
      Architectures:
        - arm64
      Environment:
        Variables:
          ToEmail: !Ref ToEmail
          FromEmail: !Ref FromEmail
      Events:
        ContactPOST:
          Type: Api
          Properties:
            Path: /contact
            Method: POST
        ContactOptions:
          Type: Api
          Properties:
            Path: /contact
            Method: OPTIONS

  ChatFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: ChatFunctionPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: 
                  - !Sub "arn:aws:logs:${AwsRegion}:${AwsAccountId}:log-group:/aws/lambda/Chat:*"

  ChatFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: chat.lambda_handler
      Runtime: python3.11
      Role: !GetAtt ChatFunctionRole.Arn
      CodeUri: python-lambda/build/chat.zip
      Timeout: 30
      MemorySize: 128
      FunctionName: Chat
      Architectures:
        - x86_64
      Environment:
        Variables:
          GeminiAPI: !Ref GeminiAPIKey
      Events:
        Post:
          Type: Api
          Properties:
            Path: /chat
            Method: post
        ContactOptions:
          Type: Api
          Properties:
            Path: /chat
            Method: OPTIONS

  ApiGatewayCustomDomain:
    Type: AWS::ApiGateway::DomainName
    Properties:
      DomainName: !Sub "api.${DomainName}"
      CertificateArn: !Ref SslCertificateArn

  ApiGatewayBasePathMapping:
    Type: AWS::ApiGateway::BasePathMapping
    Properties:
      DomainName: !Ref ApiGatewayCustomDomain
      RestApiId: !Ref ServerlessRestApi
      Stage: Prod

Outputs:
  EmailForwarderFunction:
    Description: "Lambda Function ARN"
    Value: !GetAtt EmailForwarderFunction.Arn

  ContactFunction:
    Description: "Lambda Function ARN"
    Value: !GetAtt ContactFunction.Arn

  ChatFunction:
    Description: "Lambda Function ARN"
    Value: !GetAtt ChatFunction.Arn

  ApiUrl:
    Description: "API Gateway URL"
    Value: !Sub "https://api.${DomainName}/"

  S3URL:
    Value: !GetAtt SiteBucket.RegionalDomainName
    Description: URL for website hosted on S3