[IT-3512] Refactor and cleanup

README.md

@@ -123,6 +123,19 @@ For example, using the `prod` environment:
 ENV=prod cdk synth
 ```
 
+# Certificates
+
+Certificates to set up HTTPS connections should be created manually in AWS certificate manager.
+This is not automated due to AWS requiring manual verification of the domain ownership.
+Once created take the ARN of the certificate and add it to a context in cdk.json.
+
+```json
+  "context": {
+    "dev": {
+      "CERTIFICATE_ARN": "arn:aws:acm:us-east-1:804034162148:certificate/76ed5a71-4aa8-4cc1-9db6-aa7a322ec077"
+    }
+  }
+```
 
 # Secrets
 

app.py

@@ -4,22 +4,31 @@
 from openchallenges.network_stack import NetworkStack
 from openchallenges.ecs_stack import EcsStack
 from openchallenges.service_stack import ServiceStack
-from openchallenges.service_stack import LoadBalancedHttpsServiceStack
+from openchallenges.service_stack import LoadBalancedServiceStack
 from openchallenges.load_balancer_stack import LoadBalancerStack
 from openchallenges.service_props import ServiceProps
 import openchallenges.utils as utils
 
 app = cdk.App()
 
+# get the environment
 environment = utils.get_environment()
+
+# get VARS from cdk.json
 env_vars = app.node.try_get_context(environment)
+dns_namespace = env_vars["DNS_NAMESPACE"]
+dns_sub_domain = env_vars["DNS_SUBDOMAIN"]
+vpc_cidr = env_vars["VPC_CIDR"]
+certificate_arn = env_vars["CERTIFICATE_ARN"]
+
+# get secrets from cdk.json or aws parameter store
 secrets = utils.get_secrets(app)
 
 bucket_stack = BucketStack(app, "openchallenges-buckets")
-network_stack = NetworkStack(app, "openchallenges-network", env_vars["VPC_CIDR"])
-ecs_stack = EcsStack(
-    app, "openchallenges-ecs", network_stack.vpc, env_vars["DNS_NAMESPACE"]
-)
+
+network_stack = NetworkStack(app, "openchallenges-network", vpc_cidr)
+
+ecs_stack = EcsStack(app, "openchallenges-ecs", network_stack.vpc, dns_namespace)
 
 mariadb_props = ServiceProps(
     "openchallenges-mariadb",
@@ -275,9 +284,9 @@
     1024,
     "ghcr.io/sage-bionetworks/openchallenges-app:edge",
     {
-        "API_DOCS_URL": "https://newinfra.openchallenges.io/api-docs",
+        "API_DOCS_URL": f"https://{dns_sub_domain}.{dns_namespace}/api-docs",
         "APP_VERSION": "1.0.0-alpha",
-        "CSR_API_URL": "https://newinfra.openchallenges.io/api/v1",
+        "CSR_API_URL": f"https://{dns_sub_domain}.{dns_namespace}/api/v1",
         "DATA_UPDATED_ON": "2023-09-26",
         "ENVIRONMENT": "production",
         "GOOGLE_TAG_MANAGER_ID": "",
@@ -335,14 +344,15 @@
     },
 )
 
-apex_service_stack = LoadBalancedHttpsServiceStack(
+apex_service_stack = LoadBalancedServiceStack(
     app,
     "openchallenges-apex",
     network_stack.vpc,
     ecs_stack.cluster,
     apex_service_props,
     load_balancer_stack.alb,
     80,
+    certificate_arn,
     "/health",
     health_check_interval=5,
 )

cdk.json

@@ -65,7 +65,9 @@
     "@aws-cdk/aws-eks:nodegroupNameAttribute": true,
     "dev": {
         "VPC_CIDR": "10.255.92.0/24",
-        "DNS_NAMESPACE": "openchallenges.io"
+        "DNS_NAMESPACE": "openchallenges.io",
+        "DNS_SUBDOMAIN": "newinfra",
+        "CERTIFICATE_ARN": "arn:aws:acm:us-east-1:804034162148:certificate/76ed5a71-4aa8-4cc1-9db6-aa7a322ec077"
       },
     "secrets": {
         "MARIADB_PASSWORD": "/openchallenges/MARIADB_PASSWORD",

openchallenges/service_stack.py

@@ -15,8 +15,6 @@
 
 ALB_HTTP_LISTENER_PORT = 80
 ALB_HTTPS_LISTENER_PORT = 443
-# manually created cert
-CERTIFICATE_ARN = "arn:aws:acm:us-east-1:804034162148:certificate/76ed5a71-4aa8-4cc1-9db6-aa7a322ec077"
 
 
 class ServiceStack(cdk.Stack):
@@ -117,54 +115,7 @@ def __init__(
             )
 
 
-class LoadBalancedHttpServiceStack(ServiceStack):
-    """
-    A special stack to create an ECS service fronted by a load balancer. This allows us to split up
-    the ECS services and the load balancer into separate stacks.  It makes maintaining the stacks
-    easier.  Unfortunately, due to the way AWS works, setting up a load balancer and ECS service
-    in different stacks may cause cyclic references.
-    https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ecs/README.html#using-a-load-balancer-from-a-different-stack
-
-    To work around this problem we use the "Split at listener" option from
-    https://github.com/aws-samples/aws-cdk-examples
-    """
-
-    def __init__(
-        self,
-        scope: Construct,
-        construct_id: str,
-        vpc: ec2.Vpc,
-        cluster: ecs.Cluster,
-        props: ServiceProps,
-        load_balancer: elbv2.ApplicationLoadBalancer,
-        listener_port: int,
-        health_check_path: str = "/",
-        health_check_interval: int = 1,  # max is 5
-        **kwargs,
-    ) -> None:
-        super().__init__(scope, construct_id, vpc, cluster, props, **kwargs)
-
-        http_listener = elbv2.ApplicationListener(
-            self,
-            "HttpListener",
-            load_balancer=load_balancer,
-            port=listener_port,
-            open=True,
-            protocol=elbv2.ApplicationProtocol.HTTP,
-        )
-
-        http_listener.add_targets(
-            "HttpTarget",
-            port=props.container_port,
-            protocol=elbv2.ApplicationProtocol.HTTP,
-            targets=[self.service],
-            health_check=elbv2.HealthCheck(
-                path=health_check_path, interval=duration.minutes(health_check_interval)
-            ),
-        )
-
-
-class LoadBalancedHttpsServiceStack(ServiceStack):
+class LoadBalancedServiceStack(ServiceStack):
     """
     A special stack to create an ECS service fronted by a load balancer. This allows us to split up
     the ECS services and the load balancer into separate stacks.  It makes maintaining the stacks
@@ -185,6 +136,7 @@ def __init__(
         props: ServiceProps,
         load_balancer: elbv2.ApplicationLoadBalancer,
         listener_port: int,
+        certificate_arn: str,
         health_check_path: str = "/",
         health_check_interval: int = 1,  # max is 5
         **kwargs,
@@ -195,7 +147,7 @@ def __init__(
         # ACM Certificate for HTTPS
         # -------------------
         self.cert = acm.Certificate.from_certificate_arn(
-            self, "Cert", certificate_arn=CERTIFICATE_ARN
+            self, "Cert", certificate_arn=certificate_arn
         )
 
         # -------------------------------