AWSTemplateFormatVersion: "2010-09-09"
Description: "genreviews site"

Resources:
  GenreviewsSiteBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: "genreviews.tmont.com"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
        BlockPublicPolicy: false
        IgnorePublicAcls: false
        RestrictPublicBuckets: false
    DeletionPolicy: Retain

  GenreviewsSiteCachePolicy:
    Type: "AWS::CloudFront::CachePolicy"
    Properties:
      CachePolicyConfig:
        Comment: "Cache policy for genreviews.tmont.com distribution"
        DefaultTTL: 300 # five minutes
        MaxTTL: 31536000
        MinTTL: 60
        Name: "genreviews-cache-policy"
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: none
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true
          HeadersConfig:
            HeaderBehavior: none
          QueryStringsConfig:
            QueryStringBehavior: none

  GenreviewsSiteDistribution:
    Type: "AWS::CloudFront::Distribution"
    Properties:
      DistributionConfig:
        Aliases:
          - genreviews.tmont.com
        Comment: "Frontend proxy for genreviews.tmont.com"
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          CachePolicyId: !Ref GenreviewsSiteCachePolicy
          Compress: true
          TargetOriginId: s3-genreviews-bucket
          ViewerProtocolPolicy: "redirect-to-https"
        DefaultRootObject: "index.html"
        Enabled: true
        HttpVersion: http2
        IPV6Enabled: true
        Origins:
          - DomainName: !GetAtt GenreviewsSiteBucket.RegionalDomainName
            Id: s3-genreviews-bucket
            S3OriginConfig:
              OriginAccessIdentity: ""
        ViewerCertificate:
          AcmCertificateArn: "arn:aws:acm:us-east-1:592283802202:certificate/73845214-de19-46df-9504-d3c9995564b2"
          MinimumProtocolVersion: "TLSv1"
          SslSupportMethod: "sni-only"
      Tags:
        - Key: app
          Value: genreviews

  GenreviewsSiteDNS:
    Type: "AWS::Route53::RecordSetGroup"
    Properties:
      Comment: "DNS for genreviews.tmont.com CloudFront proxy"
      HostedZoneName: "tmont.com."
      RecordSets:
        - Name: genreviews.tmont.com
          Type: "A"
          AliasTarget:
            # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-aliastarget.html#cfn-route53-aliastarget-hostedzoneid
            HostedZoneId: "Z2FDTNDATAQYW2"
            DNSName: !GetAtt GenreviewsSiteDistribution.DomainName
        - Name: genreviews.tmont.com
          Type: "AAAA"
          AliasTarget:
            HostedZoneId: "Z2FDTNDATAQYW2"
            DNSName: !GetAtt GenreviewsSiteDistribution.DomainName