serverless.yml

service: quantum-mirror-lambda

provider:
  name: aws
  stage: ${opt:stage, 'prod'}
  region: us-east-1
  runtime: nodejs20.x
  logRetentionInDays: 30
  endpointType: regional

custom:
  handlerDir:
    prod: src
    dummy: dummy
  handlerJS:
    prod: src/index
    dummy: dummy/index

resources:
  Resources:
    # Dummy bucket for requests for unsupported paths to go to
    CatchAllBucket:
      Type: AWS::S3::Bucket
      Properties:
        AccessControl: Private

    CFOriginPolicyXAuthorization:
      Type: AWS::CloudFront::OriginRequestPolicy
      Properties:
        OriginRequestPolicyConfig:
          Name: ${self:service}-${self:provider.stage}-XAuthorization
          CookiesConfig:
            CookieBehavior: none
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers:
              - X-Authorization # For the OpenAI bearer token
          QueryStringsConfig:
            QueryStringBehavior: all

    CFImageCachePolicy:
      Type: AWS::CloudFront::CachePolicy
      Properties:
        CachePolicyConfig:
          Name: ${self:service}-${self:provider.stage}-ImageCache
          DefaultTTL: 3600
          MinTTL: 3600
          MaxTTL: 86400
          ParametersInCacheKeyAndForwardedToOrigin:
            EnableAcceptEncodingBrotli: false
            EnableAcceptEncodingGzip: false
            CookiesConfig:
              CookieBehavior: none
            HeadersConfig:
              HeaderBehavior: none
            QueryStringsConfig:
              QueryStringBehavior: all

    CloudFrontDistribution:
      Type: AWS::CloudFront::Distribution
      Properties:
        DistributionConfig:
          DefaultCacheBehavior:
            TargetOriginId: s3-catch-all
            Compress: false
            CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad # CachingDisabled (AWS managed)
            ViewerProtocolPolicy: https-only
          CacheBehaviors:
            # We don't pass any headers to this one (no X-Authorization)
            - PathPattern: 'getImage/*'
              TargetOriginId: get-image-function
              Compress: false
              CachePolicyId:
                Ref: CFImageCachePolicy
              ViewerProtocolPolicy: https-only
              AllowedMethods:
                - GET
                - HEAD
            - PathPattern: 'submitImage'
              TargetOriginId: submit-image-function
              Compress: false
              CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad # CachingDisabled (AWS managed)
              OriginRequestPolicyId:
                Ref: CFOriginPolicyXAuthorization # Pass X-Authorization header to Lambda
              ViewerProtocolPolicy: https-only
              AllowedMethods:
                - HEAD
                - DELETE
                - POST
                - GET
                - OPTIONS
                - PUT
                - PATCH
          Enabled: true
          Origins:
            - Id: s3-catch-all
              DomainName: !GetAtt CatchAllBucket.DomainName
              S3OriginConfig: {}
            - Id: get-image-function
              DomainName: !Select [2, !Split ["/", !GetAtt GetImageLambdaFunctionUrl.FunctionUrl]]
              CustomOriginConfig:
                HTTPSPort: 443
                OriginProtocolPolicy: https-only
                OriginSSLProtocols:
                  - TLSv1.2
                OriginReadTimeout: 30
            - Id: submit-image-function
              DomainName: !Select [ 2, !Split [ "/", !GetAtt SubmitImageLambdaFunctionUrl.FunctionUrl ] ]
              CustomOriginConfig:
                HTTPSPort: 443
                OriginProtocolPolicy: https-only
                OriginSSLProtocols:
                  - TLSv1.2
                OriginReadTimeout: 60
          ViewerCertificate:
            CloudFrontDefaultCertificate: true
  Outputs:
    EndpointForCameraTokenTxt:
      Value:
        Fn::Join:
          - ''
          - - "https://"
            - Fn::GetAtt:
              - CloudFrontDistribution
              - DomainName
            - "/"

functions:
  submitImage:
    handler: ${self:custom.handlerJS.${self:provider.stage}}.submitImage
    memorySize: 128
    timeout: 120
    layers:
      - !Ref ImagemagickLambdaLayer
    # Use function URLs so that we can avoid API Gateway 30 second timeout limit
    url: true

  getImage:
    handler: ${self:custom.handlerJS.${self:provider.stage}}.getImage
    memorySize: 1024
    timeout: 30
    layers:
      - !Ref ImagemagickLambdaLayer
    url: true

package:
  patterns:
    - '!*' # Exclude loose files in root if not included (e.g. config files)
    - '!dummy/**' # Only for dummy stage
    - '!imagemagick/**' # We pack these into a zip instead
    - '!.idea/**'
    - 'package*.json'
    - ${self:custom.handlerDir.${self:provider.stage}}/**

layers:
  # Built using https://github.com/serverlesspub/imagemagick-aws-lambda-2
  #
  # Then: cd imagemagick && zip --symlinks -r ../imagemagick.zip *
  # Since otherwise serverless duplicates symlinks and zip is too big
  imagemagick:
    package:
      artifact: imagemagick.zip
    compatibleArchitectures:
      - x86_64