AWSTemplateFormatVersion: "2010-09-09"
Description: "Crystalis static screenshot site"

Parameters:
  AppName:
    Type: "String"
  DomainName:
    Type: "String"
  CertificateArn:
    Type: "String"
  HostedZoneName:
    Type: "String"

Resources:
  Bucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Ref "DomainName"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
        BlockPublicPolicy: false
        IgnorePublicAcls: false
        RestrictPublicBuckets: false
    DeletionPolicy: Retain

  CachePolicy:
    Type: "AWS::CloudFront::CachePolicy"
    Properties:
      CachePolicyConfig:
        Comment: !Join [ "", [ "Cache policy for ", !Ref "DomainName", " distribution" ] ]
        DefaultTTL: 300 # five minutes
        MaxTTL: 31536000
        MinTTL: 60
        Name: !Join [ "-", [ !Ref "AppName", "cache-policy" ] ]
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: none
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true
          HeadersConfig:
            HeaderBehavior: none
          QueryStringsConfig:
            QueryStringBehavior: none

  CloudFrontDistribution:
    Type: "AWS::CloudFront::Distribution"
    Properties:
      DistributionConfig:
        Aliases:
          - !Ref "DomainName"
        Comment: !Join [ "", [ "Frontend proxy for ", !Ref "DomainName" ] ]
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          CachePolicyId: !Ref CachePolicy
          Compress: true
          TargetOriginId: !Join [ "-", [ "s3", !Ref "AppName", "bucket" ] ]
          ViewerProtocolPolicy: "redirect-to-https"
        DefaultRootObject: "index.html"
        Enabled: true
        HttpVersion: http2
        IPV6Enabled: true
        Origins:
          - DomainName: !GetAtt Bucket.RegionalDomainName
            Id: !Join [ "-", [ "s3", !Ref "AppName", "bucket" ] ]
            S3OriginConfig:
              OriginAccessIdentity: ""
        ViewerCertificate:
          AcmCertificateArn: !Ref "CertificateArn"
          MinimumProtocolVersion: "TLSv1"
          SslSupportMethod: "sni-only"
      Tags:
        - Key: app
          Value: !Ref "AppName"

  DNSRecords:
    Type: "AWS::Route53::RecordSetGroup"
    Properties:
      Comment: !Join [ "", [ "DNS for ", !Ref "DomainName", " CloudFront proxy" ] ]
      HostedZoneName: !Ref "HostedZoneName"
      RecordSets:
        - Name: !Ref "DomainName"
          Type: "A"
          AliasTarget:
            # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-aliastarget.html#cfn-route53-aliastarget-hostedzoneid
            HostedZoneId: "Z2FDTNDATAQYW2"
            DNSName: !GetAtt CloudFrontDistribution.DomainName
        - Name: !Ref "DomainName"
          Type: "AAAA"
          AliasTarget:
            HostedZoneId: "Z2FDTNDATAQYW2"
            DNSName: !GetAtt CloudFrontDistribution.DomainName