UbuntuLinux-Nextcloud.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Nextcloud ( https://github.com/aws-samples/nextcloud-server ) (uksb-kole4t76z0) (tag:Ubuntu)
Transform: "AWS::LanguageExtensions"

Metadata:
  License:
    Description: >
      Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
      SPDX-License-Identifier: MIT-0

      Permission is hereby granted, free of charge, to any person obtaining a copy of this
      software and associated documentation files (the "Software"), to deal in the Software
      without restriction, including without limitation the rights to use, copy, modify,
      merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
      permit persons to whom the Software is furnished to do so.

      THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
      INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
      PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
      HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
      OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
      SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Nextcloud system requirements: https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html"
      - Label:
          default: EC2 Instance
        Parameters:
          - ec2Name
          - ec2KeyPair
          - osVersion
          - instanceType
          - ec2TerminationProtection
      - Label:
          default: EC2 Network
        Parameters:
          - vpcID
          - subnetID
          - displayPublicIP
          - assignStaticIP
      - Label:
          default: Application Load Balancer (ALB)
        Parameters:
          - enableALB
          - albSubnets
          - albScheme
          - albIpAddressType
      - Label:
          default: ALB HTTPS listener (optional)
        Parameters:
          - albCertificateArn
          - albSecurityPolicy
          - albRedirectHTTPtoHTTPS
          - albHstsHeaderValue
      - Label:
          default: EC2 Remote Administration
        Parameters:
          - ingressIPv4
          - ingressIPv6
          - allowSSHport
          - installDCV
          - installWebmin
      - Label:
          default: Nextcloud
        Parameters:
          - adminUsername
          - phpVersion
          - databaseOption
          - enableR53acmeSupport
      - Label:
          default: S3 Primary Storage
        Parameters:
          - s3StorageClass
          - enableS3BucketLogging
      - Label:
          default: S3 External Storage (optional)
        Parameters:
          - externalS3Bucket
          - externalS3BucketRegion
          - externalS3BucketStorageClass
      - Label:
          default: EBS volume
        Parameters:
          - volumeSize
          - volumeType
      - Label:
          default: AWS Backup
        Parameters:
          - backupResource
          - scheduleExpression
          - scheduleExpressionTimezone
          - deleteAfterDays

    ParameterLabels:
      osVersion:
        default: "OS version and architecture"
      instanceType:
        default: "Instance type (x86_64 or arm64)"
      ec2Name:
        default: "Instance name"
      ec2KeyPair:
        default: "Keypair name"
      ec2TerminationProtection:
        default: "Enable EC2 termination protection to prevent accidental deletion"

      volumeSize:
        default: "Volume size (GiB)"
      volumeType:
        default: "Volume type"

      vpcID:
        default: "VPC with outbound internet connectivity"
      subnetID:
        default: "Subnet in selected VPC with outbound internet connectivity"
      displayPublicIP:
        default: "EC2 in public subnet with public IP assigned?"
      assignStaticIP:
        default: "Elastic IP: assign static public internet IPv4 address"

      enableALB:
        default: "Deploy Application Load Balancer (ALB)"
      albScheme:
        default: "Load balancer scheme (internal or internet facing)"
      albIpAddressType:
        default: "IPv4 only, IPv6 only or dual stack (IPv4-and-IPv6)"
      albSubnets:
        default: "Subnets for ALB. Select at least 2 in EC2 VPC. ** IMPORTANT! Select a subnet even if not deploying ALB **"

      albCertificateArn:
        default: "Certificate ARN"
      albSecurityPolicy:
        default: "HTTPS listener security policy"
      albRedirectHTTPtoHTTPS:
        default: "Redirect HTTP requests to HTTPS"
      albHstsHeaderValue:
        default: "HSTS (HTTP Strict Transport Security) header value. Leave blank not to send"

      ingressIPv4:
        default: "Allowed source prefix (IPv4)"
      ingressIPv6:
        default: "Allowed source prefix (IPv6)"
      allowSSHport:
        default: "Allow SSH from network"
      installDCV:
        default: "Install graphical desktop environment and Amazon DCV server"
      installWebmin:
        default: "Install Webmin web-based system administration tool"

      adminUsername:
        default: "Nextcloud admin username"
      phpVersion:
        default: "PHP version to install"
      enableR53acmeSupport:
        default: "Enable Route 53 ACME protocol DNS-01 challenge support"
      databaseOption:
        default: "Database server to install"

      s3StorageClass:
        default: "Storage class for primary storage"
      enableS3BucketLogging:
        default: "Enable primary storage S3 server access logging"
      externalS3Bucket:
        default: "Existing S3 bucket to mount as external storage. Leave blank for none"
      externalS3BucketRegion:
        default: "Region where external storage S3 bucket is located"
      externalS3BucketStorageClass:
        default: "Storage class for external storage"

      backupResource:
        default: "Resources to backup"
      scheduleExpression:
        default: "CRON expression specifying when AWS Backup initiates a backup job"
      scheduleExpressionTimezone:
        default: "Timezone to set backup schedule"
      deleteAfterDays:
        default: "Number of days after creation that a recovery point (backup) is deleted"

Parameters:
  osVersion:
    Type: String
    Description: https://aws.amazon.com/ec2/graviton/ https://ubuntu.com/aws/pro
    AllowedValues:
      - Ubuntu 24.04 (arm64)
      - Ubuntu Pro 24.04 (arm64)
      - Ubuntu 24.04 (x86_64)
      - Ubuntu Pro 24.04 (x86_64)
    Default: Ubuntu 24.04 (arm64)
  instanceType:
    Type: String
    Description: "https://console.aws.amazon.com/ec2/#InstanceTypes"
    Default: m6g.xlarge

  ec2Name:
    Type: String
    Default: Nextcloud server
  ec2KeyPair:
    Type: AWS::EC2::KeyPair::KeyName
    Description: https://console.aws.amazon.com/ec2/#KeyPairs
    ConstraintDescription: Specify a key pair
    AllowedPattern: ".+"
  ec2TerminationProtection:
    Type: String
    Description: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_ChangingDisableAPITermination.html
    Default: "Yes"
    AllowedValues:
      - "Yes"
      - "No"

  vpcID:
    Type: AWS::EC2::VPC::Id
    Description: "https://console.aws.amazon.com/vpcconsole/home#vpcs:"
    AllowedPattern: .+
    ConstraintDescription: Select a VPC
  subnetID:
    Type: AWS::EC2::Subnet::Id
    Description: "https://console.aws.amazon.com/vpcconsole/home#subnets:"
    AllowedPattern: .+
    ConstraintDescription: Select a Subnet
  assignStaticIP:
    Type: String
    Description: "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html"
    AllowedValues:
      - "Yes"
      - "No"
    Default: "Yes"
  displayPublicIP:
    Type: String
    Description: "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#concepts-public-addresses"
    AllowedValues:
      - "Yes"
      - "No"
    Default: "Yes"

  enableALB:
    Type: String
    Description: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/index.html
    AllowedValues:
      - "Yes"
      - "No"
    Default: "No"
  albScheme:
    Type: String
    Description: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-application-load-balancer.html#configure-load-balancer
    AllowedValues:
      - internet-facing
      - internal
    Default: internet-facing
  albIpAddressType:
    Type: String
    AllowedValues:
      - IPv4
      - IPv4-and-IPv6
      - IPv6
    Default: IPv4
  albSubnets:
    Type: List<AWS::EC2::Subnet::Id>
    Description: "https://console.aws.amazon.com/vpcconsole/home#subnets:"
    ConstraintDescription: Select a subnet
    AllowedPattern: ".+"

  albCertificateArn:
    Type: String
    Description: "https://console.aws.amazon.com/acm/home?#/certificates/list ( aws acm list-certificates )"
    Default: ""
  albSecurityPolicy:
    Type: String
    Description: "https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html"
    AllowedValues:
      - ELBSecurityPolicy-TLS13-1-3-2021-06
      - ELBSecurityPolicy-TLS13-1-3-PQ-2025-09
      - ELBSecurityPolicy-TLS13-1-2-2021-06
      - ELBSecurityPolicy-TLS13-1-2-PQ-2025-09
      - ELBSecurityPolicy-TLS13-1-2-Res-2021-06
      - ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09
      - ELBSecurityPolicy-TLS13-1-2-Ext2-2021-06
      - ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09
      - ELBSecurityPolicy-TLS13-1-2-Ext1-2021-06
      - ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09
      - ELBSecurityPolicy-TLS13-1-1-2021-06
      - ELBSecurityPolicy-TLS13-1-0-2021-06
      - ELBSecurityPolicy-TLS13-1-0-PQ-2025-09
      - ELBSecurityPolicy-TLS-1-2-Ext-2018-06
      - ELBSecurityPolicy-TLS-1-2-2017-01
      - ELBSecurityPolicy-TLS-1-1-2017-01
      - ELBSecurityPolicy-2016-08
      - ELBSecurityPolicy-FS-1-2-Res-2020-10
      - ELBSecurityPolicy-FS-1-2-Res-2019-08
      - ELBSecurityPolicy-FS-1-2-2019-08
      - ELBSecurityPolicy-FS-1-1-2019-08
      - ELBSecurityPolicy-FS-2018-06
      - ELBSecurityPolicy-TLS13-1-3-FIPS-2023-04
      - ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09
      - ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04
      - ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09
      - ELBSecurityPolicy-TLS13-1-2-Res-FIPS-2023-04
      - ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09
      - ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-2023-04
      - ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09
      - ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-2023-04
      - ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09
      - ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-2023-04
      - ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-PQ-2025-09
      - ELBSecurityPolicy-TLS13-1-1-FIPS-2023-04
      - ELBSecurityPolicy-TLS13-1-0-FIPS-2023-04
      - ELBSecurityPolicy-TLS13-1-0-FIPS-PQ-2025-09
    Default: ELBSecurityPolicy-TLS13-1-2-2021-06
  albRedirectHTTPtoHTTPS:
    Type: String
    AllowedValues:
      - "Yes"
      - "No"
    Default: "Yes"
  albHstsHeaderValue:
    Type: String
    Description: "https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html"
    Default: "max-age=31536000; includeSubDomains"

  ingressIPv4:
    Type: String
    Description: e.g. 1.2.3.4/32, get your source IP from https://checkip.amazonaws.com
    AllowedPattern: "^\\d+\\.\\d+\\.\\d+\\.\\d+\\/\\d+$"
    ConstraintDescription: Specify valid IPv4 prefix
    Default: 0.0.0.0/0
  ingressIPv6:
    Type: String
    Description: e.g. 1:2:3:4::/64, get your internet IPv6 address (if any) with tools such as https://ifconfig.co
    AllowedPattern: .+
    ConstraintDescription: Specify valid IPv6 prefix
    Default: ::/0
  allowSSHport:
    Type: String
    Description: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-linux-inst-ssh.html
    AllowedValues:
      - "Yes"
      - "No"
    Default: "No"
  installDCV:
    Type: String
    Description: https://aws.amazon.com/hpc/dcv/
    AllowedValues:
      - "Yes"
      - "No"
    Default: "No"
  installWebmin:
    Type: String
    Description: https://webmin.com/
    AllowedValues:
      - "Yes"
      - "No"
    Default: "No"

  adminUsername:
    Type: String
    AllowedPattern: ".+"
    Default: "admin"
  phpVersion:
    Type: String
    AllowedValues:
      - "php8.3"
      - "php8.4"
      - "php8.5"
    Default: "php8.5"
  databaseOption:
    Type: String
    AllowedValues:
      - "MariaDB"
      - "MySQL"
    Default: "MariaDB"
  enableR53acmeSupport:
    Type: String
    Description: https://letsencrypt.org/docs/challenge-types https://certbot-dns-route53.readthedocs.io/
    AllowedValues:
      - "Yes"
      - "No"
    Default: "Yes"

  s3StorageClass:
    Type: String
    Description: "https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html#sc-compare"
    AllowedValues:
      - GLACIER_IR
      - INTELLIGENT_TIERING
      - ONEZONE_IA
      - STANDARD
      - STANDARD_IA
    Default: INTELLIGENT_TIERING
  enableS3BucketLogging:
    Type: String
    Description: https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html
    AllowedValues:
      - "Yes"
      - "No"
    Default: "No"

  externalS3Bucket:
    Type: String
    Description: https://console.aws.amazon.com/s3/home ( aws s3 ls )
    Default: ""
  externalS3BucketRegion:
    Type: String
    AllowedValues:
      - af-south-1
      - ap-east-1
      - ap-east-2
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-south-1
      - ap-south-2
      - ap-southeast-1
      - ap-southeast-2
      - ap-southeast-3
      - ap-southeast-4
      - ap-southeast-5
      - ap-southeast-6
      - ap-southeast-7
      - ca-central-1
      - ca-west-1
      - cn-north-1
      - cn-northwest-1
      - eu-central-1
      - eu-central-2
      - eu-north-1
      - eu-south-1
      - eu-south-2
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eusc-de-east-1
      - il-central-1
      - me-central-1
      - me-south-1
      - mx-central-1
      - sa-east-1
      - us-east-1
      - us-east-2
      - us-gov-east-1
      - us-gov-west-1
      - us-west-1
      - us-west-2
    Default: us-east-1
  externalS3BucketStorageClass:
    Type: String
    AllowedValues:
      - GLACIER_IR
      - INTELLIGENT_TIERING
      - ONEZONE_IA
      - STANDARD
      - STANDARD_IA
    Default: INTELLIGENT_TIERING

  volumeSize:
    Type: Number
    Description: https://github.com/nextcloud/server/issues/40539
    MinValue: 10
    MaxValue: 16384
    Default: 70
  volumeType:
    Type: String
    Description: https://aws.amazon.com/ebs/general-purpose/
    AllowedValues:
      - gp3
      - gp2
    Default: gp3

  backupResource:
    Type: String
    AllowedValues:
      - EC2
      - S3
      - ExternalStorage
      - EC2-and-S3
      - All
      - none
    Default: "EC2"
  scheduleExpression:
    Type: String
    Description: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-scheduled-rule-pattern.html
    AllowedPattern: .+
    Default: "cron(0 1 ? * * *)"
  scheduleExpressionTimezone: # https://nodatime.org/TimeZones?version=2024a&format=json
    Type: String
    Description: https://docs.aws.amazon.com/scheduler/latest/UserGuide/schedule-types.html#time-zones
    AllowedValues:
      - Africa/Abidjan
      - Africa/Algiers
      - Africa/Bissau
      - Africa/Cairo
      - Africa/Casablanca
      - Africa/Ceuta
      - Africa/El_Aaiun
      - Africa/Johannesburg
      - Africa/Juba
      - Africa/Khartoum
      - Africa/Lagos
      - Africa/Maputo
      - Africa/Monrovia
      - Africa/Nairobi
      - Africa/Ndjamena
      - Africa/Sao_Tome
      - Africa/Tripoli
      - Africa/Tunis
      - Africa/Windhoek
      - America/Adak
      - America/Anchorage
      - America/Araguaina
      - America/Argentina/Buenos_Aires
      - America/Argentina/Catamarca
      - America/Argentina/Cordoba
      - America/Argentina/Jujuy
      - America/Argentina/La_Rioja
      - America/Argentina/Mendoza
      - America/Argentina/Rio_Gallegos
      - America/Argentina/Salta
      - America/Argentina/San_Juan
      - America/Argentina/San_Luis
      - America/Argentina/Tucuman
      - America/Argentina/Ushuaia
      - America/Asuncion
      - America/Bahia
      - America/Bahia_Banderas
      - America/Barbados
      - America/Belem
      - America/Belize
      - America/Boa_Vista
      - America/Bogota
      - America/Boise
      - America/Cambridge_Bay
      - America/Campo_Grande
      - America/Cancun
      - America/Caracas
      - America/Cayenne
      - America/Chicago
      - America/Chihuahua
      - America/Ciudad_Juarez
      - America/Costa_Rica
      - America/Cuiaba
      - America/Danmarkshavn
      - America/Dawson
      - America/Dawson_Creek
      - America/Denver
      - America/Detroit
      - America/Edmonton
      - America/Eirunepe
      - America/El_Salvador
      - America/Fort_Nelson
      - America/Fortaleza
      - America/Glace_Bay
      - America/Goose_Bay
      - America/Grand_Turk
      - America/Guatemala
      - America/Guayaquil
      - America/Guyana
      - America/Halifax
      - America/Havana
      - America/Hermosillo
      - America/Indiana/Indianapolis
      - America/Indiana/Knox
      - America/Indiana/Marengo
      - America/Indiana/Petersburg
      - America/Indiana/Tell_City
      - America/Indiana/Vevay
      - America/Indiana/Vincennes
      - America/Indiana/Winamac
      - America/Inuvik
      - America/Iqaluit
      - America/Jamaica
      - America/Juneau
      - America/Kentucky/Louisville
      - America/Kentucky/Monticello
      - America/La_Paz
      - America/Lima
      - America/Los_Angeles
      - America/Maceio
      - America/Managua
      - America/Manaus
      - America/Martinique
      - America/Matamoros
      - America/Mazatlan
      - America/Menominee
      - America/Merida
      - America/Metlakatla
      - America/Mexico_City
      - America/Miquelon
      - America/Moncton
      - America/Monterrey
      - America/Montevideo
      - America/New_York
      - America/Nome
      - America/Noronha
      - America/North_Dakota/Beulah
      - America/North_Dakota/Center
      - America/North_Dakota/New_Salem
      - America/Nuuk
      - America/Ojinaga
      - America/Panama
      - America/Paramaribo
      - America/Phoenix
      - America/Port-au-Prince
      - America/Porto_Velho
      - America/Puerto_Rico
      - America/Punta_Arenas
      - America/Rankin_Inlet
      - America/Recife
      - America/Regina
      - America/Resolute
      - America/Rio_Branco
      - America/Santarem
      - America/Santiago
      - America/Santo_Domingo
      - America/Sao_Paulo
      - America/Scoresbysund
      - America/Sitka
      - America/St_Johns
      - America/Swift_Current
      - America/Tegucigalpa
      - America/Thule
      - America/Tijuana
      - America/Toronto
      - America/Vancouver
      - America/Whitehorse
      - America/Winnipeg
      - America/Yakutat
      - Antarctica/Casey
      - Antarctica/Davis
      - Antarctica/Macquarie
      - Antarctica/Mawson
      - Antarctica/Palmer
      - Antarctica/Rothera
      - Antarctica/Troll
      - Antarctica/Vostok
      - Asia/Almaty
      - Asia/Amman
      - Asia/Anadyr
      - Asia/Aqtau
      - Asia/Aqtobe
      - Asia/Ashgabat
      - Asia/Atyrau
      - Asia/Baghdad
      - Asia/Baku
      - Asia/Bangkok
      - Asia/Barnaul
      - Asia/Beirut
      - Asia/Bishkek
      - Asia/Chita
      - Asia/Choibalsan
      - Asia/Colombo
      - Asia/Damascus
      - Asia/Dhaka
      - Asia/Dili
      - Asia/Dubai
      - Asia/Dushanbe
      - Asia/Famagusta
      - Asia/Gaza
      - Asia/Hebron
      - Asia/Ho_Chi_Minh
      - Asia/Hong_Kong
      - Asia/Hovd
      - Asia/Irkutsk
      - Asia/Jakarta
      - Asia/Jayapura
      - Asia/Jerusalem
      - Asia/Kabul
      - Asia/Kamchatka
      - Asia/Karachi
      - Asia/Kathmandu
      - Asia/Khandyga
      - Asia/Kolkata
      - Asia/Krasnoyarsk
      - Asia/Kuching
      - Asia/Macau
      - Asia/Magadan
      - Asia/Makassar
      - Asia/Manila
      - Asia/Nicosia
      - Asia/Novokuznetsk
      - Asia/Novosibirsk
      - Asia/Omsk
      - Asia/Oral
      - Asia/Pontianak
      - Asia/Pyongyang
      - Asia/Qatar
      - Asia/Qostanay
      - Asia/Qyzylorda
      - Asia/Riyadh
      - Asia/Sakhalin
      - Asia/Samarkand
      - Asia/Seoul
      - Asia/Shanghai
      - Asia/Singapore
      - Asia/Srednekolymsk
      - Asia/Taipei
      - Asia/Tashkent
      - Asia/Tbilisi
      - Asia/Tehran
      - Asia/Thimphu
      - Asia/Tokyo
      - Asia/Tomsk
      - Asia/Ulaanbaatar
      - Asia/Urumqi
      - Asia/Ust-Nera
      - Asia/Vladivostok
      - Asia/Yakutsk
      - Asia/Yangon
      - Asia/Yekaterinburg
      - Asia/Yerevan
      - Atlantic/Azores
      - Atlantic/Bermuda
      - Atlantic/Canary
      - Atlantic/Cape_Verde
      - Atlantic/Faroe
      - Atlantic/Madeira
      - Atlantic/South_Georgia
      - Atlantic/Stanley
      - Australia/Adelaide
      - Australia/Brisbane
      - Australia/Broken_Hill
      - Australia/Darwin
      - Australia/Eucla
      - Australia/Hobart
      - Australia/Lindeman
      - Australia/Lord_Howe
      - Australia/Melbourne
      - Australia/Perth
      - Australia/Sydney
      - CET
      - CST6CDT
      - EET
      - EST
      - EST5EDT
      - Etc/GMT
      - Etc/GMT+1
      - Etc/GMT+10
      - Etc/GMT+11
      - Etc/GMT+12
      - Etc/GMT+2
      - Etc/GMT+3
      - Etc/GMT+4
      - Etc/GMT+5
      - Etc/GMT+6
      - Etc/GMT+7
      - Etc/GMT+8
      - Etc/GMT+9
      - Etc/GMT-1
      - Etc/GMT-10
      - Etc/GMT-11
      - Etc/GMT-12
      - Etc/GMT-13
      - Etc/GMT-14
      - Etc/GMT-2
      - Etc/GMT-3
      - Etc/GMT-4
      - Etc/GMT-5
      - Etc/GMT-6
      - Etc/GMT-7
      - Etc/GMT-8
      - Etc/GMT-9
      - Etc/UTC
      - Europe/Andorra
      - Europe/Astrakhan
      - Europe/Athens
      - Europe/Belgrade
      - Europe/Berlin
      - Europe/Brussels
      - Europe/Bucharest
      - Europe/Budapest
      - Europe/Chisinau
      - Europe/Dublin
      - Europe/Gibraltar
      - Europe/Helsinki
      - Europe/Istanbul
      - Europe/Kaliningrad
      - Europe/Kirov
      - Europe/Kyiv
      - Europe/Lisbon
      - Europe/London
      - Europe/Madrid
      - Europe/Malta
      - Europe/Minsk
      - Europe/Moscow
      - Europe/Paris
      - Europe/Prague
      - Europe/Riga
      - Europe/Rome
      - Europe/Samara
      - Europe/Saratov
      - Europe/Simferopol
      - Europe/Sofia
      - Europe/Tallinn
      - Europe/Tirane
      - Europe/Ulyanovsk
      - Europe/Vienna
      - Europe/Vilnius
      - Europe/Volgograd
      - Europe/Warsaw
      - Europe/Zurich
      - HST
      - Indian/Chagos
      - Indian/Maldives
      - Indian/Mauritius
      - MET
      - MST
      - MST7MDT
      - PST8PDT
      - Pacific/Apia
      - Pacific/Auckland
      - Pacific/Bougainville
      - Pacific/Chatham
      - Pacific/Easter
      - Pacific/Efate
      - Pacific/Fakaofo
      - Pacific/Fiji
      - Pacific/Galapagos
      - Pacific/Gambier
      - Pacific/Guadalcanal
      - Pacific/Guam
      - Pacific/Honolulu
      - Pacific/Kanton
      - Pacific/Kiritimati
      - Pacific/Kosrae
      - Pacific/Kwajalein
      - Pacific/Marquesas
      - Pacific/Nauru
      - Pacific/Niue
      - Pacific/Norfolk
      - Pacific/Noumea
      - Pacific/Pago_Pago
      - Pacific/Palau
      - Pacific/Pitcairn
      - Pacific/Port_Moresby
      - Pacific/Rarotonga
      - Pacific/Tahiti
      - Pacific/Tarawa
      - Pacific/Tongatapu
      - WET
    Default: Etc/UTC
  deleteAfterDays:
    Type: Number
    Default: 35

Conditions:
  useUbuntu2404x86: !Equals [!Ref osVersion, "Ubuntu 24.04 (x86_64)"]
  useUbuntu2404arm64: !Equals [!Ref osVersion, "Ubuntu 24.04 (arm64)"]
  useUbuntuPro2404x86: !Equals [!Ref osVersion, "Ubuntu Pro 24.04 (x86_64)"]

  displayPublicIP: !Equals [!Ref displayPublicIP, "Yes"]
  useElasticIP: !And [!Condition displayPublicIP, !Equals [!Ref assignStaticIP, "Yes"]]
  enableProtection: !Equals [!Ref ec2TerminationProtection, "Yes"]

  hasEIC: !Not [!Equals [!FindInMap [EICprefixMap, !Ref AWS::Region, IpPrefix, DefaultValue: 127.0.0.1/32], 127.0.0.1/32]]
  createSgEIC: !And [!Condition hasEIC, !Condition displayPublicIP]
  createSgSSH: !Equals [!Ref allowSSHport, "Yes"]

  installDCV: !Equals [!Ref installDCV, "Yes"]
  installWebmin: !Equals [!Ref installWebmin, "Yes"]
  hasR53Zone: !Not [!Equals [!Ref enableR53acmeSupport, "Yes"]]

  enableS3BucketLogging: !Equals [!Ref enableS3BucketLogging, "Yes"]
  externalS3Bucket: !Not [!Equals [!Ref externalS3Bucket, ""]]

  backupEC2: !Or [!Equals [!Ref backupResource, "EC2"], !Or [!Equals [!Ref backupResource, "EC2-and-S3"], !Equals [!Ref backupResource, "All"]]]
  backupS3: !Or [!Equals [!Ref backupResource, "S3"], !Or [!Equals [!Ref backupResource, "EC2-and-S3"], !Equals [!Ref backupResource, "All"]]]
  backupExternalStorage: !And [!Condition externalS3Bucket, !Or [!Equals [!Ref backupResource, "ExternalStorage"], !Equals [!Ref backupResource, "All"]]]
  createBackup: !Or [!Condition backupEC2, !Or [!Condition backupS3, !Condition backupExternalStorage]]

  createALB: !Equals [!Ref enableALB, "Yes"]
  albAllowIPv4: !Or [!Equals [!Ref albIpAddressType, "IPv4"], !Equals [!Ref albIpAddressType, "IPv4-and-IPv6"]]
  albAllowIPv6: !Or [!Equals [!Ref albIpAddressType, "IPv6"], !Equals [!Ref albIpAddressType, "IPv4-and-IPv6"]]

  createHttpsListener: !And [!Condition createALB, !Not [!Equals [!Ref albCertificateArn, ""]]]
  createHttpRedirectListener: !And [!Condition createHttpsListener, !Equals [!Ref albRedirectHTTPtoHTTPS, "Yes"]]
  createHttpListener: !And [!Condition createALB, !Not [!Condition createHttpRedirectListener]]
  sendHSTS: !Not [!Equals [!Ref albHstsHeaderValue, ""]]

Mappings:
  # EC2 instance connect: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-prerequisites.html#ec2-instance-connect-setup-security-group
  # curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | jq -r '.prefixes[] | select (.service=="EC2_INSTANCE_CONNECT")'
  # curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | jq -r '.ipv6_prefixes[] | select (.service=="EC2_INSTANCE_CONNECT")'
  EICprefixMap:
    af-south-1:
      IpPrefix: 13.244.121.196/30
      Ipv6Prefix: 2406:da11:700:3b00::/56
    ap-east-1:
      IpPrefix: 43.198.192.104/29
      Ipv6Prefix: 2406:da1e:da1:3c00::/56
    ap-northeast-1:
      IpPrefix: 3.112.23.0/29
      Ipv6Prefix: 2406:da14:1c18:2100::/56
    ap-northeast-2:
      IpPrefix: 13.209.1.56/29
      Ipv6Prefix: 2406:da12:1e1:d900::/56
    ap-northeast-3:
      IpPrefix: 15.168.105.160/29
      Ipv6Prefix: 2406:da16:856:a500::/56
    ap-south-1:
      IpPrefix: 13.233.177.0/29
      Ipv6Prefix: 2406:da1a:74a:4b00::/56
    ap-south-2:
      IpPrefix: 18.60.252.248/29
      Ipv6Prefix: 2406:da1b:d1d:8800::/56
    ap-southeast-1:
      IpPrefix: 3.0.5.32/29
      Ipv6Prefix: 2406:da18:752:6600::/56
    ap-southeast-2:
      IpPrefix: 13.239.158.0/29
      Ipv6Prefix: 2406:da1c:90e:4a00::/56
    ap-southeast-3:
      IpPrefix: 43.218.193.64/29
      Ipv6Prefix: 2406:da19:14b:8c00::/56
    ap-southeast-4:
      IpPrefix: 16.50.248.80/29
      Ipv6Prefix: 2406:da1f:b4f:4600::/56
    ap-southeast-5:
      IpPrefix: 43.216.87.48/29
      Ipv6Prefix: 2406:da10:84f9:9e00::/56
    ap-southeast-6:
      IpPrefix: 3.103.24.208/29
      Ipv6Prefix: 2406:da12:80b3:4800::/56
    ap-southeast-7:
      IpPrefix: 43.209.155.96/29
      Ipv6Prefix: 2406:da14:85c5:5b00::/56
    ca-central-1:
      IpPrefix: 35.183.92.176/29
      Ipv6Prefix: 2600:1f11:ae3:700::/56
    ca-west-1:
      IpPrefix: 40.176.213.168/29
      Ipv6Prefix: 2600:1f1a:4ff6:d500::/56
    cn-north-1:
      IpPrefix: 43.196.20.40/29
      Ipv6Prefix: 2400:7fc0:86fd:e00::/56
    cn-northwest-1:
      IpPrefix: 43.192.155.8/29
      Ipv6Prefix: 2404:c2c0:87aa:4800::/56
    eu-central-1:
      IpPrefix: 3.120.181.40/29
      Ipv6Prefix: 2a05:d014:17a8:8b00::/56
    eu-central-2:
      IpPrefix: 16.63.77.8/29
      Ipv6Prefix: 2a05:d019:1d6:2100::/56
    eu-north-1:
      IpPrefix: 13.48.4.200/30
      Ipv6Prefix: 2a05:d016:494:f00::/56
    eu-south-1:
      IpPrefix: 15.161.135.164/30
      Ipv6Prefix: 2a05:d01a:c03:4a00::/56
    eu-south-2:
      IpPrefix: 18.101.90.48/29
      Ipv6Prefix: 2a05:d011:cbe:f700::/56
    eu-west-1:
      IpPrefix: 18.202.216.48/29
      Ipv6Prefix: 2a05:d018:403:4e00::/56
    eu-west-2:
      IpPrefix: 3.8.37.24/29
      Ipv6Prefix: 2a05:d01c:4ac:3100::/56
    eu-west-3:
      IpPrefix: 35.180.112.80/29
      Ipv6Prefix: 2a05:d012:c9e:d600::/56
    il-central-1:
      IpPrefix: 51.16.183.224/29
      Ipv6Prefix: 2a05:d025:451:7d00::/56
    me-central-1:
      IpPrefix: 3.29.147.40/29
      Ipv6Prefix: 2406:da17:1db:b00::/56
    me-south-1:
      IpPrefix: 16.24.46.56/29
      Ipv6Prefix: 2a05:d01e:27f:ac00::/56
    mx-central-1:
      IpPrefix: 78.12.207.8/29
      Ipv6Prefix: 22600:1f17:4ee0:b800::/56
    sa-east-1:
      IpPrefix: 18.228.70.32/29
      Ipv6Prefix: 2600:1f1e:d1d:e700::/56
    us-east-1:
      IpPrefix: 18.206.107.24/29
      Ipv6Prefix: 2600:1f18:6fe3:8c00::/56
    us-east-2:
      IpPrefix: 3.16.146.0/29
      Ipv6Prefix: 2600:1f16:138f:cf00::/56
    us-gov-east-1:
      IpPrefix: 18.252.4.0/30
      Ipv6Prefix: 2600:1f15:d63:bd00::/56
    us-gov-west-1:
      IpPrefix: 15.200.28.80/30
      Ipv6Prefix: 2600:1f12:fa9:5100::/56
    us-west-1:
      IpPrefix: 13.52.6.112/29
      Ipv6Prefix: 2600:1f1c:12d:e900::/56
    us-west-2:
      IpPrefix: 18.237.140.160/29
      Ipv6Prefix: 2600:1f13:a0d:a700::/56

  albIpTypeMapping:
    IPv4:
      Value: ipv4
    IPv4-and-IPv6:
      Value: dualstack
    IPv6:
      Value: dualstack-without-public-ipv4

Resources:
  instanceIamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: [ec2.amazonaws.com]
            Action: [sts:AssumeRole]
      Path: /
      Policies:
        - PolicyName: Nextcloud-S3PrimaryStoragePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:*
                Resource:
                  - !Sub "arn:${AWS::Partition}:s3:::${s3Bucket}"
                  - !Sub "arn:${AWS::Partition}:s3:::${s3Bucket}/*"
                Condition:
                  IpAddress:
                    aws:SourceIp: [0.0.0.0/0, "::/0"]
        - !If
          - externalS3Bucket
          - PolicyName: Nextcloud-S3ExternalStoragePolicy
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - s3:*
                  Resource:
                    - !Sub "arn:${AWS::Partition}:s3:::${externalS3Bucket}"
                    - !Sub "arn:${AWS::Partition}:s3:::${externalS3Bucket}/*"
                  Condition:
                    IpAddress:
                      aws:SourceIp: [0.0.0.0/0, "::/0"]
          - !Ref AWS::NoValue
        - !If
          - installDCV
          - PolicyName: dcvLicensing
            PolicyDocument: # https://docs.aws.amazon.com/dcv/latest/adminguide/setting-up-license.html
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - s3:GetObject
                  Resource: !Sub arn:*:s3:::dcv-license.${AWS::Region}/*
          - !Ref AWS::NoValue
        - !If
          - hasR53Zone
          - PolicyName: R53acmeAccess
            PolicyDocument: # Certbot dns_route53 : https://certbot-dns-route53.readthedocs.io/en/stable/
              Version: "2012-10-17"
              Statement: # https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/specifying-rrset-conditions.html
                - Effect: Allow
                  Action:
                    - route53:ListHostedZones
                    - route53:GetChange
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - route53:ChangeResourceRecordSets
                  Resource: !Sub arn:${AWS::Partition}:route53:::hostedzone/*
                  Condition:
                    IpAddress:
                      aws:SourceIp: [0.0.0.0/0, "::/0"]
                    ForAllValues:StringEquals:
                      route53:ChangeResourceRecordSetsRecordTypes: [TXT]
                    ForAllValues:StringLike:
                      route53:ChangeResourceRecordSetsNormalizedRecordNames: [_acme-challenge.*]
          - !Ref AWS::NoValue
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/CloudWatchAgentServerPolicy"
      Tags:
        - Key: StackName
          Value: !Ref AWS::StackName
        - Key: StackId
          Value: !Ref AWS::StackId
        - Key: GitHub
          Value: https://github.com/aws-samples/nextcloud-server

  instanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref instanceIamRole

  sgEC2Instance:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow inbound HTTP, HTTPS and any remote admin ports
      VpcId: !Ref vpcID
      SecurityGroupIngress:
        - !If
          - installWebmin
          - Description: Webmin (IPv4)
            IpProtocol: tcp
            FromPort: 10000
            ToPort: 10000
            CidrIp: !Ref ingressIPv4
          - !Ref AWS::NoValue
        - !If
          - installWebmin
          - Description: Webmin (IPv6)
            IpProtocol: tcp
            FromPort: 10000
            ToPort: 10000
            CidrIpv6: !Ref ingressIPv6
          - !Ref AWS::NoValue
        - !If
          - createSgSSH
          - Description: SSH (IPv4)
            IpProtocol: tcp
            FromPort: 22
            ToPort: 22
            CidrIp: !Ref ingressIPv4
          - Description: SSH (IPv4)
            IpProtocol: tcp
            FromPort: 22
            ToPort: 22
            CidrIp: 127.0.0.1/32
        - !If
          - createSgSSH
          - Description: SSH (IPv6)
            IpProtocol: tcp
            FromPort: 22
            ToPort: 22
            CidrIpv6: !Ref ingressIPv6
          - Description: SSH (IPv6)
            IpProtocol: tcp
            FromPort: 22
            ToPort: 22
            CidrIpv6: ::1/128
        - !If
          - installDCV
          - Description: DCV (IPv4)
            IpProtocol: tcp
            FromPort: 8443
            ToPort: 8443
            CidrIp: !Ref ingressIPv4
          - !Ref AWS::NoValue
        - !If
          - installDCV
          - Description: DCV (IPv6)
            IpProtocol: tcp
            FromPort: 8443
            ToPort: 8443
            CidrIpv6: !Ref ingressIPv6
          - !Ref AWS::NoValue
        - !If
          - installDCV
          - Description: DCV QUIC (IPv4)
            IpProtocol: udp
            FromPort: 8443
            ToPort: 8443
            CidrIp: !Ref ingressIPv4
          - !Ref AWS::NoValue
        - !If
          - installDCV
          - Description: DCV QUIC (IPv6)
            IpProtocol: udp
            FromPort: 8443
            ToPort: 8443
            CidrIpv6: !Ref ingressIPv6
          - !Ref AWS::NoValue
        - Description: HTTP (IPv4)
          IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - Description: HTTP (IPv6)
          IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIpv6: ::/0
        - Description: HTTPS (IPv4)
          IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
        - Description: HTTPS (IPv6)
          IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIpv6: ::/0
        - !If
          - createSgEIC
          - Description: SSH (EC2 Instance Connect IPv4)
            IpProtocol: tcp
            FromPort: 22
            ToPort: 22
            CidrIp: !FindInMap [EICprefixMap, !Ref AWS::Region, IpPrefix]
          - !Ref AWS::NoValue
        - !If
          - createSgEIC
          - Description: SSH (EC2 Instance Connect IPv6)
            IpProtocol: tcp
            FromPort: 22
            ToPort: 22
            CidrIpv6: !FindInMap [EICprefixMap, !Ref AWS::Region, Ipv6Prefix]
          - !Ref AWS::NoValue
        - !If
          - createALB
          - Description: Allow ALB inbound
            IpProtocol: "-1"
            SourceSecurityGroupId: !Ref albSecurityGroup
          - !Ref AWS::NoValue
      SecurityGroupEgress:
        - Description: Allow all outbound traffic (IPv4)
          IpProtocol: "-1"
          CidrIp: 0.0.0.0/0
        - Description: Allow all outbound traffic (IPv6)
          IpProtocol: "-1"
          CidrIpv6: ::/0
      Tags:
        - Key: StackName
          Value: !Ref AWS::StackName
        - Key: StackId
          Value: !Ref AWS::StackId
        - Key: Name
          Value: !Sub
            - "${AWS::StackName}-securityGroup-${UID}"
            - UID: !Select [3, !Split ["-", !Select [2, !Split ["/", !Ref AWS::StackId]]]]
        - Key: GitHub
          Value: https://github.com/aws-samples/nextcloud-server

  s3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - BucketKeyEnabled: true
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: Delete-Incomplete-Multipart-Uploads
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 35
            Status: Enabled
          - Id: Delete-Previous-Versions
            NoncurrentVersionExpiration:
              NoncurrentDays: 2
            Status: Enabled
          - Id: Delete-Expired-Delete-Marker
            ExpiredObjectDeleteMarker: true
            Status: Enabled
      LoggingConfiguration: !If
        - enableS3BucketLogging
        - DestinationBucketName: !Ref logBucket
          LogFilePrefix: !Sub "${AWS::StackName}/"
        - !Ref AWS::NoValue
      Tags:
        - Key: StackName
          Value: !Ref AWS::StackName
        - Key: StackId
          Value: !Ref AWS::StackId
        - Key: GitHub
          Value: https://github.com/aws-samples/nextcloud-server

  s3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref s3Bucket
      PolicyDocument:
        Statement:
          - Effect: Deny
            Action:
              - s3:*
            Condition:
              Bool:
                "aws:SecureTransport": "false"
            Principal: "*"
            Resource: !Sub "${s3Bucket.Arn}/*"

  logBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Condition: enableS3BucketLogging
    Properties:
      Bucket: !Ref logBucket
      PolicyDocument: # https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html
        Statement:
          - Effect: Allow
            Principal:
              Service: logging.s3.amazonaws.com
            Action: s3:PutObject
            Resource: !Sub "${logBucket.Arn}/*"
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId

  logBucket:
    Type: AWS::S3::Bucket
    Condition: enableS3BucketLogging
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - BucketKeyEnabled: true
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: StackName
          Value: !Ref AWS::StackName
        - Key: StackId
          Value: !Ref AWS::StackId
        - Key: GitHub
          Value: https://github.com/aws-samples/nextcloud-server

  ec2Instance:
    Type: AWS::EC2::Instance
    CreationPolicy:
      ResourceSignal:
        Timeout: PT120M
    Metadata:
      Comment: Install Update files
      AWS::CloudFormation::Init:
        configSets:
          setup:
            - 00_setup
          dcv_install:
            - 00_dcv_install
          nextcloud_install:
            - 10_nextcloud_install
        00_setup: # in the following order: packages, groups, users, sources, files, commands, and then services.
          files:
            "/home/ubuntu/update-dcv":
              content: |
                #!/bin/bash
                cd /tmp
                OS_VERSION=$(. /etc/os-release;echo $VERSION_ID | sed -e 's/\.//g')
                sudo rm -f /tmp/nice-dcv-ubuntu$OS_VERSION-$(arch).tgz
                wget https://d1uj6qtbmh3dt5.cloudfront.net/nice-dcv-ubuntu$OS_VERSION-$(arch).tgz
                tar -xvzf nice-dcv-ubuntu$OS_VERSION-$(arch).tgz && cd nice-dcv-*-ubuntu$OS_VERSION-$(arch)
                sudo apt-get install -y ./nice-dcv-server_*.deb
                sudo apt-get install -y ./nice-dcv-web-viewer_*.deb
                sudo apt-get install -y ./nice-xdcv_*.deb
                sudo systemctl daemon-reload
              mode: "000755"
              owner: "ubuntu"
              group: "ubuntu"
            "/home/ubuntu/update-awscli":
              content: |
                #!/bin/bash
                cd /tmp
                sudo rm -f /tmp/awscliv2.zip
                curl https://awscli.amazonaws.com/awscli-exe-linux-$(arch).zip -o awscliv2.zip
                unzip -q -o awscliv2.zip
                /usr/bin/aws --version
                sudo ./aws/install --update -b /usr/bin
                /usr/bin/aws --version
              mode: "000755"
              owner: "ubuntu"
              group: "ubuntu"
            "/etc/systemd/system/dcv-virtual-session.service":
              content: |
                [Unit]
                Description=Create DCV virtual session
                After=default.target network.target

                [Service]
                ExecStart=/opt/dcv-virtual-session.sh

                [Install]
                WantedBy=default.target
              mode: "000644"
              owner: "root"
              group: "root"
            "/opt/dcv-virtual-session.sh":
              content: |
                #!/bin/bash
                dcvUsers=( "ubuntu" )
                while true;
                do
                  for dcvUser in "${dcvUsers[@]}"
                  do
                    if (! /usr/bin/dcv list-sessions | grep -q $dcvUser); then
                      /usr/bin/dcv create-session $dcvUser --owner $dcvUser --storage-root %home% --type virtual
                    fi
                  done
                  date
                  /usr/bin/dcv list-sessions
                  sleep 5
                done
              mode: "000744"
              owner: "root"
              group: "root"
            "/etc/systemd/system/dcv-post-reboot.service":
              content: |
                [Unit]
                Description=Post install tasks
                After=default.target network.target

                [Service]
                ExecStart=/bin/sh -c "/opt/dcv-post-reboot.sh 2>&1 | tee -a /var/log/install-sw.log"

                [Install]
                WantedBy=default.target
              mode: "000644"
              owner: "root"
              group: "root"
            "/opt/dcv-post-reboot.sh":
              content: !Sub |
                #!/bin/bash
                #sysctl -w net.ipv6.conf.all.disable_ipv6=1
                #sysctl -w net.ipv6.conf.default.disable_ipv6=1

                export DEBIAN_FRONTEND=noninteractive

                # Add DCV ports
                if (systemctl status ufw | grep -q Loaded); then
                  ufw allow 8443/tcp
                  ufw allow 8443/udp
                  ufw allow https
                  ufw allow http
                fi

                #
                cd /var/www/html/
                sudo -u www-data php /var/www/html/occ maintenance:repair --include-expensive
                sudo -u www-data php /var/www/html/occ db:add-missing-indices

                apt-get update
                apt-get upgrade -q -y

                # DCV?
                export installDCV="${installDCV}"
                case $installDCV in
                  Yes)
                    systemctl enable --now dcv-virtual-session
                    systemctl enable --now dcvserver
                    ;;
                  No)
                    rm -f /etc/systemd/system/dcv-virtual-session.service
                    rm -f /opt/dcv-virtual-session.sh
                    rm -f /home/ubuntu/update-dcv
                    ;;
                esac

                # IP address cert: https://letsencrypt.org/2026/03/11/shorter-certs-certbot
                if [ "${displayPublicIP}" = "Yes" ]; then
                  # Some Regions create Elastic IP after EC2 instance is created
                  python3 /usr/local/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource ec2Instance --region ${AWS::Region}
                  sleep 45

                  WEB_ROOT="/var/www/html/"

                  IP_ADDR=$(curl -s checkip.amazonaws.com)
                  certbot certonly -n --agree-tos --preferred-profile shortlived --webroot --webroot-path $WEB_ROOT --ip-address $IP_ADDR

                  if [ -d "/etc/letsencrypt/live/$IP_ADDR/" ]; then
                    # Update web server cert
                    rm -f /etc/ssl/certs/ssl-cert-snakeoil.pem
                    rm -f /etc/ssl/private/ssl-cert-snakeoil.key
                    ln -s -f /etc/letsencrypt/live/$IP_ADDR/fullchain.pem /etc/ssl/certs/ssl-cert-snakeoil.pem
                    ln -s -f /etc/letsencrypt/live/$IP_ADDR/privkey.pem /etc/ssl/private/ssl-cert-snakeoil.key
                    # HSTS header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
                    sed -i '2i\        Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"\n' /etc/apache2/sites-enabled/default-ssl.conf
                   
                    systemctl reload apache2

                    # DCV TLS cert: https://docs.aws.amazon.com/dcv/latest/adminguide/manage-cert.html
                    if [ "${installDCV}" = "Yes" ]; then
                      cp -f /etc/letsencrypt/live/$IP_ADDR/fullchain.pem /etc/dcv/dcv.pem
                      cp -f /etc/letsencrypt/live/$IP_ADDR/privkey.pem /etc/dcv/dcv.key
                      chown dcv /etc/dcv/dcv.pem /etc/dcv/dcv.key
                      chmod 600 /etc/dcv/dcv.pem /etc/dcv/dcv.key
                    fi

                    # cert renewal deploy hook
                    mv /opt/renew-cert.sh /etc/letsencrypt/renewal-hooks/deploy/renew-cert.sh
                  fi
                fi
                if [ -f "/opt/renew-cert.sh" ]; then
                  rm /opt/renew-cert.sh
                fi

                python3 /usr/local/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource ec2Instance --region ${AWS::Region}

                rm -f /etc/systemd/system/dcv-post-reboot.service
                rm -f ${!0}
                systemctl daemon-reload
              mode: "000755"
              owner: "root"
              group: "root"
            "/opt/renew-cert.sh":
              content: |
                #!/bin/bash
                CERT_FOLDER=$(curl -s checkip.amazonaws.com)
                if [ -d "/etc/letsencrypt/live/$CERT_FOLDER/" ]; then
                  systemctl daemon-reload
                  if (systemctl status dcvserver | grep -q running); then
                    cp -f /etc/letsencrypt/live/$CERT_FOLDER/fullchain.pem /etc/dcv/dcv.pem
                    cp -f /etc/letsencrypt/live/$CERT_FOLDER/privkey.pem /etc/dcv/dcv.key
                    chown dcv /etc/dcv/dcv.pem /etc/dcv/dcv.key
                    chmod 600 /etc/dcv/dcv.pem /etc/dcv/dcv.key
                  fi
                  if (systemctl status apache2 | grep -q running); then
                    systemctl reload apache2
                  fi
                fi
              mode: "000755"
              owner: "root"
              group: "root"
            "/opt/aws/amazon-cloudwatch-agent/bin/config.json":
              content: |
                {
                    "agent": {
                        "metrics_collection_interval": 300,
                        "run_as_user": "cwagent"
                    },
                    "logs": {
                      "logs_collected": {
                        "files": {
                          "collect_list": [
                            {
                              "file_path": "/var/www/html/data/nextcloud.log",
                              "log_group_class": "STANDARD",
                              "log_group_name": "nextcloud.log",
                              "log_stream_name": "{instance_id}",
                              "retention_in_days": 180
                            }
                          ]
                        }
                      }
                    },
                    "metrics": {
                        "namespace": "CWAgent",
                        "append_dimensions": {
                            "InstanceId": "${aws:InstanceId}"
                        },
                        "metrics_collected": {
                            "mem": {
                                "measurement": [
                                    "used_percent"
                                ]
                            },
                            "disk": {
                                "measurement": [
                                    "used_percent"
                                ],
                                "resources": [
                                    "/"
                                ]
                            }
                        }
                    }
                }
              mode: "000644"
              owner: "root"
              group: "root"
            "/etc/systemd/system/systemd-networkd-wait-online.service.d/override.conf":
              content: |

                [Service]
                ExecStart=
                ExecStart=/usr/lib/systemd/systemd-networkd-wait-online --timeout=3

              mode: "000644"
              owner: "root"
              group: "root"
            "/root/install-sw.sh":
              content: !Sub |
                #!/bin/bash
                mkdir -p /tmp/cfn
                cd /tmp/cfn

                # Change password
                PWD=$(cat /var/lib/cloud/data/instance-id)
                USER=ubuntu
                echo "$USER:$PWD" | chpasswd

                # Update OS
                apt-get update -q
                apt-get upgrade -q -y
                apt-get autoremove -q -y
                apt-get install -q -y wget tmux unzip tar curl sed

                # CloudWatch agent: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-commandline-fleet.html#download-CloudWatch-Agent-on-EC2-Instance-commandline-fleet
                if (arch | grep -q x86); then
                  curl -s -L -O https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb
                else
                  curl -s -L -O https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb
                fi
                apt-get install -q -y ./amazon-cloudwatch-agent.deb
                /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c file:/opt/aws/amazon-cloudwatch-agent/bin/config.json -s
                systemctl enable --now amazon-cloudwatch-agent

                # Webmin: https://webmin.com/download/
                export webmin="${installWebmin}"
                case $webmin in
                  Yes)
                    cd /tmp/cfn
                    curl -s -L -O https://raw.githubusercontent.com/webmin/webmin/master/setup-repos.sh
                    echo 'Y' | sh ./setup-repos.sh -f
                    apt-get install -q -y webmin --install-recommends
                    ;;
                esac

                # USB and GPU driver DKMS
                apt-get update -q
                apt-get install -q -y dkms

                # Kernel headers for GPU and USB remotization
                apt-get install -q -y linux-headers-aws
                apt-get install -q -y linux-modules-extra-aws
                apt-get install -q -y usbutils
                # AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
                apt-get remove -q -y awscli
                sudo snap install aws-cli --classic
                if [ -e /snap/bin/aws ]; then
                  rm -f /home/ubuntu/update-awscli
                else
                  /home/ubuntu/update-awscli
                fi
                echo "export AWS_CLI_AUTO_PROMPT=on-partial" >> /home/ubuntu/.bashrc

                # Certbot: https://eff-certbot.readthedocs.io/en/stable/install.html#snap-recommended
                sudo snap install certbot --classic
                ln -s /snap/bin/certbot /usr/bin/certbot
                sudo snap set certbot trust-plugin-with-root=ok
                sudo snap install certbot-dns-route53

                # Ubuntu 24.04: reduce systemd-networkd-wait-online.service 2+ min timeout
                if (lsb_release -r -s | grep -q 24); then
                  sed -i "s/systemd-networkd-wait-online$/& --timeout=3/g" /usr/lib/systemd/system/systemd-networkd-wait-online.service
                else
                  rm -f /etc/systemd/system/systemd-networkd-wait-online.service.d/override.conf
                fi
                systemctl daemon-reload

                rm -f ${!0}
              mode: "000740"
              owner: "root"
              group: "root"
          commands:
            install:
              command: "/root/install-sw.sh >> /var/log/install-sw.log 2>&1"
              ignoreErrors: "true"
        00_dcv_install:
          files:
            "/root/install-dcv.sh":
              content: !Sub |
                #!/bin/bash
                mkdir -p /tmp/cfn
                cd /tmp/cfn

                # Update OS
                apt-get update -q
                apt-get upgrade -q -y

                # DCV prereq: https://docs.aws.amazon.com/dcv/latest/adminguide/setting-up-installing-linux-prereq.html
                apt-get install -q -y ubuntu-desktop-minimal
                apt-get install -q -y gdm3
                apt-get install -q -y amazon-ec2-utils

                # Disable the Wayland protocol: https://docs.aws.amazon.com/dcv/latest/adminguide/setting-up-installing-linux-prereq.html#linux-prereq-wayland
                sed -i '/^\[daemon\]/a WaylandEnable=false' /etc/gdm3/custom.conf

                # resolve "/var/lib/dpkg/info/nice-dcv-server.postinst: 8: dpkg-architecture: not found" when installing dcv-server
                apt-get install -q -y dpkg-dev

                # Microphone redirection: https://docs.aws.amazon.com/dcv/latest/adminguide/setting-up-installing-linux-server.html
                apt-get install -q -y pulseaudio-utils
                apt-get install -q -y gnome-tweaks gnome-shell-extension-ubuntu-dock
                apt-get install -q -y gnome-shell-extension-manager

                # DCV: https://docs.aws.amazon.com/dcv/latest/adminguide/setting-up-installing-linux-server.html
                curl -s -L -O https://d1uj6qtbmh3dt5.cloudfront.net/NICE-GPG-KEY
                gpg --import NICE-GPG-KEY
                OS_VERSION=$(. /etc/os-release;echo $VERSION_ID | sed -e 's/\.//g')
                curl -s -L -O https://d1uj6qtbmh3dt5.cloudfront.net/nice-dcv-ubuntu$OS_VERSION-$(arch).tgz
                tar -xvzf nice-dcv-ubuntu*.tgz && cd nice-dcv-*-$(arch)
                apt-get install -q -y ./nice-dcv-server_*.deb
                apt-get install -q -y ./nice-dcv-web-viewer_*.deb
                usermod -aG video dcv
                apt-get install -q -y ./nice-xdcv_*.deb

                # Printer redirection: https://docs.aws.amazon.com/dcv/latest/adminguide/manage-printer.html
                apt-get install -q -y cups
                GROUP=$(cat /etc/cups/cups-files.conf | grep -oP "SystemGroup\s\K\w+")
                usermod -a -G $GROUP dcv
                systemctl enable cups

                # QUIC: https://docs.aws.amazon.com/dcv/latest/adminguide/enable-quic.html
                cp /etc/dcv/dcv.conf /etc/dcv/dcv.conf."`date +"%Y-%m-%d"`"
                sed -i "s/^#enable-quic-frontend=true/enable-quic-frontend=true/g" /etc/dcv/dcv.conf

                # Higher web client max resolution: https://docs.aws.amazon.com/dcv/latest/adminguide/config-param-ref.html
                sed -i "/^\[display/a web-client-max-head-resolution=(4096, 2160)" /etc/dcv/dcv.conf
                # Console session support
                sed -i "/^\[session-management\/automatic-console-session/a owner=\"ubuntu\"\nstorage-root=\"%home%\"" /etc/dcv/dcv.conf

                # Disable reporting : https://wiki.ubuntu.com/Apport
                sed -i "s/enabled=1/enable=0/g" /etc/default/apport
                apt-get remove -q -y ubuntu-report whoopsie apport
                apt-get autoremove -q -y
                # Disable upgrade prompt: https://help.ubuntu.com/community/Upgrades#Upgrade_policy
                sed -i "s/Prompt=lts/Prompt=never/g" /etc/update-manager/release-upgrades
                chown -R ubuntu:ubuntu /home/ubuntu/.config

                # Ubuntu 24.04: reduce systemd-networkd-wait-online.service 2+ min timeout
                if (lsb_release -r -s | grep -q 24); then
                  sed -i "s/systemd-networkd-wait-online$/& --timeout=3/g" /usr/lib/systemd/system/systemd-networkd-wait-online.service
                fi

                #
                systemctl daemon-reload
                systemctl enable dcv-virtual-session
                systemctl enable dcvserver

                rm -f ${!0}
              mode: "000740"
              owner: "root"
              group: "root"
            "/home/ubuntu/.gnomerc":
              content: |
                export XDG_CURRENT_DESKTOP=ubuntu:GNOME
                export GNOME_SHELL_SESSION_MODE=ubuntu
                export XDG_DATA_DIRS=/usr/share/gnome:/usr/local/share:/usr/share:/var/lib/snapd/desktop
              mode: "000644"
              owner: "ubuntu"
              group: "ubuntu"
            "/etc/skel/.gnomerc":
              content: |
                export XDG_CURRENT_DESKTOP=ubuntu:GNOME
                export GNOME_SHELL_SESSION_MODE=ubuntu
                export XDG_DATA_DIRS=/usr/share/gnome:/usr/local/share:/usr/share:/var/lib/snapd/desktop
              mode: "000644"
              owner: "root"
              group: "root"
            "/home/ubuntu/.config/gnome-initial-setup-done":
              content: |
                yes
              mode: "000664"
              owner: "ubuntu"
              group: "ubuntu"
            "/etc/skel/.config/gnome-initial-setup-done":
              content: |
                yes
              mode: "000644"
              owner: "root"
              group: "root"
          commands:
            install:
              command: "/root/install-dcv.sh > /var/log/install-dcv.log 2>&1"
              ignoreErrors: "true"
        10_nextcloud_install:
          files:
            "/opt/docker/compose.yaml":
              content: |
                services:
                  nextcloud-appapi-harp:
                    container_name: appapi-harp
                    hostname: appapi-harp
                    image: ghcr.io/nextcloud/nextcloud-appapi-harp:release
                    network_mode: "host"
                    restart: always
                    volumes:
                      - /var/run/docker.sock:/var/run/docker.sock
                      - /opt/docker/certs:/certs
                    environment:
                      - HP_SHARED_KEY=hp_shared_key
                      - NC_INSTANCE_URL=http://127.0.0.1
              mode: "000640"
              owner: "ubuntu"
              group: "ubuntu"
            "/etc/systemd/system/docker.service.d/override.conf":
              content: |

                [Service]
                Environment=
                Environment=DOCKER_MIN_API_VERSION=1.41

              mode: "000644"
              owner: "root"
              group: "root"
            "/root/install-nextcloud.sh":
              content: !Sub |
                #!/bin/bash
                mkdir -p /tmp/cfn
                cd /tmp/cfn

                export PHP="${phpVersion}"
                export PHP_VERSION=`echo ${phpVersion} | cut -c 4-7`

                # Resolve imagick no SVG support security warning
                apt-get install -q -y libmagickcore-*-extra

                # https://packages.sury.org/php/README.txt
                apt-get install -q -y ca-certificates apt-transport-https software-properties-common lsb-release
                curl -s -L -O https://packages.sury.org/debsuryorg-archive-keyring.deb
                dpkg -i ./debsuryorg-archive-keyring.deb
                echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list

                # Enable Ondřej Surý PHP repo: https://launchpad.net/~ondrej/+archive/ubuntu/php/                
                #add-apt-repository -y ppa:ondrej/php

                sudo apt-get update

                # PHP and Apache install
                apt-get install -q -y apache2 libapache2-mod-fcgid
                apt-get install -q -y ${phpVersion} ${phpVersion}-{common,fpm,apcu} 
                apt-get install -q -y ${phpVersion}-opcache

                # https://docs.nextcloud.com/server/latest/admin_manual/installation/php_configuration.html
                apt-get install -q -y ${phpVersion}-{xml,xmlrpc,xsl,soap,ldap,zip,bz2,intl,curl,mbstring,bcmath,imagick,gd}
                apt-get install -q -y ${phpVersion}-{memcached,redis,mysql}
                apt-get install -q -y ${phpVersion}-{igbinary,msgpack,zstd,lz4,bz2}
                apt-get install -q -y ${phpVersion}-{smbclient,gmp}
                apt-get install -q -y ${phpVersion}-ldap

                # APCU: https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/caching_configuration.html#id1
                sed -i "^extension/a apc.shm_size=128M" /etc/php/$PHP_VERSION/mods-available/apcu.ini

                # Redis for caching and session state
                apt-get install -q -y redis-server
                systemctl enable --now redis-server
                # Enable unix socket
                sed -i "/unixsocketperm/a unixsocket \/var\/run\/redis\/redis-server.sock\nunixsocketperm 770" /etc/redis/redis.conf
                usermod -a -G redis www-data
                systemctl restart redis-server
                # https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/caching_configuration.html#using-the-redis-session-handler
                sed -i "/^extension/a redis.session.locking_enabled=1\nredis.session.lock_retries=-1\nredis.session.lock_wait_time=10000\n" /etc/php/$PHP_VERSION/mods-available/redis.ini

                # PHP-FPM ini
                cp /etc/php/$PHP_VERSION/fpm/php.ini /etc/php/$PHP_VERSION/fpm/php.ini."`date +"%Y-%m-%d"`"
                # https://www.php.net/manual/en/opcache.configuration.php
              
                sed -i "s/^opcache.enable_cli/;&/" /etc/php/$PHP_VERSION/fpm/php.ini
                sed -i "/^;opcache.enable_cli/a opcache.enable_cli=1" /etc/php/$PHP_VERSION/fpm/php.ini

                sed -i "/;opcache.interned_strings_buffer/a opcache.interned_strings_buffer=16" /etc/php/$PHP_VERSION/fpm/php.ini

                sed -i "s/^output_buffering/;&/" /etc/php/$PHP_VERSION/fpm/php.ini
                sed -i "/^;output_buffering/a output_buffering=Off" /etc/php/$PHP_VERSION/fpm/php.ini

                sed -i 's/memory_limit =.*/memory_limit = 1024M/' /etc/php/$PHP_VERSION/fpm/php.ini

                sed -i 's/upload_max_filesize =.*/upload_max_filesize = 25G/' /etc/php/$PHP_VERSION/fpm/php.ini
                sed -i 's/post_max_size =.*/post_max_size = 25G/' /etc/php/$PHP_VERSION/fpm/php.ini

                # https://docs.nextcloud.com/server/stable/admin_manual/configuration_files/big_file_upload_configuration.html
                sed -i "s/^max_input_time/;&/" /etc/php/$PHP_VERSION/fpm/php.ini
                sed -i "/^;max_input_time/a max_input_time=3600" /etc/php/$PHP_VERSION/fpm/php.ini                

                sed -i "s/^max_execution_time/;&/" /etc/php/$PHP_VERSION/fpm/php.ini
                sed -i "/^;max_execution_time/a max_execution_time=3600" /etc/php/$PHP_VERSION/fpm/php.ini   

                # https://docs.nextcloud.com/server/stable/admin_manual/installation/server_tuning.html#jit
                sed -i "s/^opcache.jit=/;&/" /etc/php/$PHP_VERSION/mods-available/opcache.ini
                sed -i "/^;opcache.jit=/a opcache.jit=1255\nopcache.jit_buffer_size=128M\nopcache.interned_strings_buffer=16\nopcache.max_accelerated_files=10000\nopcache.memory_consumption=128\nopcache.save_comments=1\nopcache.revalidate_freq=1" /etc/php/$PHP_VERSION/mods-available/opcache.ini

                # https://docs.nextcloud.com/server/20/admin_manual/configuration_server/caching_configuration.html?highlight=memcache#id1
                sed -i "/^extension/a apc.enable_cli=1" /etc/php/$PHP_VERSION/mods-available/apcu.ini

                # https://www.php.net/manual/en/class.sessionhandler.php
                sed -i "s/^session.save_handler/;&/" /etc/php/$PHP_VERSION/fpm/php.ini
                sed -i "/^;session.save_handler/a session.save_handler = redis" /etc/php/$PHP_VERSION/fpm/php.ini
                sed -i "s/^session.save_path/;&/" /etc/php/$PHP_VERSION/fpm/php.ini
                sed -i '/^;session.save_path/a session.save_path = "tcp://127.0.0.1:6379"' /etc/php/$PHP_VERSION/fpm/php.ini

                # PHP CLI ini
                cp /etc/php/$PHP_VERSION/cli/php.ini /etc/php/$PHP_VERSION/cli/php.ini."`date +"%Y-%m-%d"`"
                cp /etc/php/$PHP_VERSION/fpm/php.ini /etc/php/$PHP_VERSION/cli/php.ini

                # php-fpm only: https://www.php.net/manual/en/opcache.configuration.php#ini.opcache.file-cache
                mkdir -p /var/www/.opcache
                chown www-data:www-data /var/www/.opcache
                sed -i 's/;opcache.file_cache=.*/opcache.file_cache=\/var\/www\/.opcache/' /etc/php/$PHP_VERSION/fpm/php.ini

                # tune php-fpm for 8 GB RAM: https://docs.nextcloud.com/server/stable/admin_manual/installation/server_tuning.html#tune-php-fpm
                # PHP-FPM Process Calculator at https://spot13.com/pmcalculator/
                sed -i "s/^pm.max_children/;&/" /etc/php/$PHP_VERSION/fpm/pool.d/www.conf
                sed -i "/^;pm.max_children/a pm.max_children = 230" /etc/php/$PHP_VERSION/fpm/pool.d/www.conf
                sed -i "s/^pm.start_servers/;&/" /etc/php/$PHP_VERSION/fpm/pool.d/www.conf
                sed -i "/^;pm.start_servers/a pm.start_servers = 50" /etc/php/$PHP_VERSION/fpm/pool.d/www.conf
                sed -i "s/^pm.min_spare_servers/;&/" /etc/php/$PHP_VERSION/fpm/pool.d/www.conf
                sed -i "/^;pm.min_spare_servers/a pm.min_spare_servers = 50" /etc/php/$PHP_VERSION/fpm/pool.d/www.conf
                sed -i "s/^pm.max_spare_servers/;&/" /etc/php/$PHP_VERSION/fpm/pool.d/www.conf
                sed -i "/^;pm.max_spare_servers/a pm.max_spare_servers = 150" /etc/php/$PHP_VERSION/fpm/pool.d/www.conf

                systemctl enable ${phpVersion}-fpm
                systemctl restart ${phpVersion}-fpm

                # Apache MPM event: https://httpd.apache.org/docs/2.4/mod/event.html
                a2dismod ${phpVersion}
                a2dismod mpm_prefork
                a2enmod mpm_event proxy_fcgi setenvif
                a2enconf ${phpVersion}-fpm

                # Enable HTTP/2, HTTPS and rewrite
                a2enmod headers rewrite http2 ssl mime

                # HTTPS site: for Certbot
                a2ensite default-ssl

                # Enable index.php
                sed -i "s/\bDirectoryIndex\b/& index.php/" /etc/apache2/mods-enabled/dir.conf

                # Redirect HTTP to HTTPS, Allow ACME HTTP-01 challenge over HTTP
                sed -i '/\/VirtualHost/i RewriteEngine on\nRewriteCond %{REQUEST_URI} !\/\\.well\\-known\/?.*\nRewriteRule ^ https:\/\/%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]' /etc/apache2/sites-enabled/000-default.conf 

                # Change permissions and ownership
                usermod -a -G www-data ubuntu
                chown -R ubuntu:www-data /var/www/html
                chmod -R 2775 /var/www/html
                find /var/www/html -type d -exec sudo chmod 2775 {} \;
                find /var/www/html -type f -exec sudo chmod 0664 {} \;

                # Cloudwatch log
                usermod -aG www-data cwagent

                # Nextcloud
                a2enmod headers env dir mime

                # https://docs.nextcloud.com/server/stable/admin_manual/issues/general_troubleshooting.html#service-discovery
                a2enconf nextcloud
                systemctl enable apache2
                systemctl restart apache2

                # HaRP: https://github.com/nextcloud/HaRP
                a2enmod proxy
                a2enmod proxy_http
                a2enmod headers

                # MySQL/MariaDB database
                # https://docs.nextcloud.com/server/stable/admin_manual/configuration_database/linux_database_configuration.html#database-read-committed-transaction-isolation-level
                export DB="${databaseOption}"
                case $DB in
                  MySQL)
                    apt-get install -q -y mysql-server
                    # https://docs.nextcloud.com/server/stable/admin_manual/configuration_database/mysql_4byte_support.html#
                    cp /etc/mysql/mysql.conf.d/mysqld.cnf /etc/mysql/mysql.conf.d/mysqld.cnf."`date +"%Y-%m-%d"`"
                    sed -i "/^\[mysqld\]/a innodb_file_per_table=1\ntransaction_isolation = READ-COMMITTED" /etc/mysql/mysql.conf.d/mysqld.cnf
                    sed -i "/^#innodb_buffer_pool_size/a innodb_buffer_pool_size = 512M" /etc/mysql/mysql.conf.d/mysqld.cnf
                    systemctl enable --now mysql
                    ;;
                  MariaDB)
                    apt-get install -q -y mariadb-server
                    # https://docs.nextcloud.com/server/stable/admin_manual/configuration_database/mysql_4byte_support.html#mariadb-10-3-or-later
                    cp /etc/mysql/mariadb.conf.d/50-server.cnf /etc/mysql/mariadb.conf.d/50-server.cnf."`date +"%Y-%m-%d"`"
                    sed -i "/^\[mysqld\]/a innodb_file_per_table=1\ntransaction_isolation = READ-COMMITTED" /etc/mysql/mariadb.conf.d/50-server.cnf
                    sed -i "/^#innodb_buffer_pool_size/a innodb_buffer_pool_size = 512M" /etc/mysql/mariadb.conf.d/50-server.cnf
                    systemctl enable --now mariadb
                    ;;
                esac

                # Nextcloud files
                cd /tmp
                curl -s -L -O https://nextcloud.com/nextcloud.asc
                gpg --import nextcloud.asc

                # Use IPv4 as IPv6 download can be slow
                curl -4 -s -L -O https://download.nextcloud.com/server/releases/latest.zip
                curl -4 -s -L -O https://download.nextcloud.com/server/releases/latest.zip.asc
                gpg --verify latest.zip.asc

                unzip -q /tmp/latest.zip
                rsync -r /tmp/nextcloud/ /var/www/html/

                # Preconfigured config.php
                cp /root/nextcloud/config.php /var/www/html/config/config.php
                chown -R www-data:www-data /var/www/html/

                # Generate random MySQL/MariaDB password
                apt-get install -q -y pwgen
                DB_USER_PW=$(pwgen -c -n -y -r "\/\'\"\`\&\:" 16)
                echo "Password = $DB_USER_PW" >> /home/ubuntu/nextcloud-credentials

                # Prepare database
                sudo mysql -u root -e "CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY '$DB_USER_PW';
                CREATE DATABASE IF NOT EXISTS nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
                GRANT ALL PRIVILEGES ON nextcloud.* TO 'nextcloud'@'localhost';
                FLUSH PRIVILEGES;"

                # Install Nextcloud: https://docs.nextcloud.com/server/stable/admin_manual/installation/command_line_installation.html
                cd /var/www/html/
                sudo -u www-data php occ maintenance:install \
                 --database='mysql' --database-name='nextcloud' \
                 --database-user='nextcloud' --database-pass="$DB_USER_PW" \
                 --admin-user='${adminUsername}' --admin-pass=$(cat /var/lib/cloud/data/instance-id)

                # nextcloud.occ
                echo "alias nextcloud.occ='sudo -u www-data php /var/www/html/occ'" >> ~/.bashrc
                echo "alias nextcloud.occ='sudo -u www-data php /var/www/html/occ'" >> /home/ubuntu/.bashrc
                echo "alias occ='sudo -u www-data php /var/www/html/occ'" >> ~/.bashrc
                echo "alias occ='sudo -u www-data php /var/www/html/occ'" >> /home/ubuntu/.bashrc

                # Allow ALL as trusted_domains: https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/config_sample_php_parameters.html#trusted-domains
                sudo -u www-data php occ config:system:set "trusted_domains" 1 --value=*

                # phpinfo troubleshooting: https://docs.nextcloud.com/server/stable/admin_manual/issues/general_troubleshooting.html
                sudo -u www-data php occ config:app:set --value=yes serverinfo phpinfo

                # Disable default apps
                sudo -u www-data php occ app:disable dashboard
                sudo -u www-data php occ app:disable photos
                sudo -u www-data php occ app:disable firstrunwizard
                sudo -u www-data php occ app:disable weather_status

                # Enable apps
                sudo -u www-data php occ app:enable files_external
                sudo -u www-data php occ app:install user_saml
                sudo -u www-data php occ app:disable user_saml

                # Mount S3 as external storage?
                export S3Bucket="${externalS3Bucket}"
                if [ -n "$S3Bucket" ]; then
                  sudo -u www-data php /var/www/html/occ files_external:create \
                    "AmazonS3-${externalS3Bucket}"  "amazons3" "null::null" \
                    -c region=${externalS3BucketRegion} -c bucket="${externalS3Bucket}" -c storageClass="${externalS3BucketStorageClass}"
                fi
                # Enable sharing for S3 external storage
                sudo -u www-data php /var/www/html/occ files_external:option 1 enable_sharing true

                # May fix large file transfer failure for S3 external storage. Best option is to use larger instance size
                # https://github.com/nextcloud/server/issues/24390 https://help.nextcloud.com/t/s3-random-storage-problem-on-large-files/72897/4
                # sed -i "s/524288000;/104857600;/g" /var/www/html/lib/private/Files/ObjectStore/S3ConnectionTrait.php

                # sendmail
                apt-get install -q -y sendmail

                # jq: for parsing /var/www/html/data/nextcloud.log
                apt-get install -q -y jq

                # https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/background_jobs_configuration.html#cron-jobs
                crontab -u www-data /root/nextcloud/crontab-www-data

                # ExApps: https://docs.nextcloud.com/server/stable/admin_manual/exapps_management/AppAPIAndExternalApps.html
                # Add Docker's official GPG key
                apt-get install -q -y ca-certificates curl
                install -m 0755 -d /etc/apt/keyrings
                curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
                chmod a+r /etc/apt/keyrings/docker.asc
                # Add the repository to Apt sources
                echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
                  tee /etc/apt/sources.list.d/docker.list > /dev/null
                apt-get update -q
                apt-get install -q -y docker-ce
                systemctl enable docker
                usermod -aG docker ubuntu

                if (lsb_release -r -s | grep -q 22); then
                  update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-12 12
                  update-alternatives --config gcc
                fi

                # GPU driver for G/P instance : https://repost.aws/articles/ARWGxLArMBQ4y1MKoSHTq3gQ/
                apt-get install -q -y pciutils
                apt-get install -q -y amazon-ec2-utils
                if ( lspci | grep -q NVIDIA ); then
                  cd /tmp

                  # Disable Nouveau: https://docs.nvidia.com/ai-enterprise/deployment-guide-vmware/0.1.0/nouveau.html#ubuntu
                  if (! cat /etc/modprobe.d/blacklist.conf | grep -q nouveau); then
                    echo "blacklist vga16fb" >> /etc/modprobe.d/blacklist.conf
                    echo "blacklist nouveau" >> /etc/modprobe.d/blacklist.conf
                    echo "blacklist rivafb" >> /etc/modprobe.d/blacklist.conf
                    echo "blacklist nvidiafb" >> /etc/modprobe.d/blacklist.conf
                    echo "blacklist rivatv" >> /etc/modprobe.d/blacklist.conf
                  fi
                  sed -i 's/^GRUB_CMDLINE_LINUX_DEFAULT="/GRUB_CMDLINE_LINUX_DEFAULT="rdblacklist=nouveau /g' /etc/default/grub
                  update-grub

                  DISTRO=$(. /etc/os-release;echo $ID$VERSION_ID | sed -e 's/\.//g')
                  if (arch | grep -q x86); then
                    ARCH=x86_64
                  else
                    ARCH=sbsa
                  fi
                  cd /tmp
                  curl -L -O https://developer.download.nvidia.com/compute/cuda/repos/$DISTRO/$ARCH/cuda-keyring_1.1-1_all.deb
                  apt-get install -q -y ./cuda-keyring_1.1-1_all.deb
                  apt-get update
                  
                  if ( ec2-metadata -t | grep -q 6f\. ); then
                    # NVIDIA GRID: https://repost.aws/articles/ARBXrCH5wuStKWCXfIDdG4Ig/
                    apt-get install -q -y dkms linux-headers-aws linux-modules-extra-aws unzip gcc make libglvnd-dev pkg-config

                    if (lsb_release -r -s | grep -q 22); then
                      if (cat /proc/version | grep -q gcc-12); then
                        update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-12 12
                        update-alternatives --config gcc
                      fi
                    fi

                    aws s3 cp --recursive s3://ec2-linux-nvidia-drivers/latest/ . --no-sign-request
                    chmod +x NVIDIA-Linux-x86_64*.run

                    KERNEL_VERSION=$(ls -a /lib/modules | sort -V -r | head -n 1)                    
                    if (! uname -r | grep -q $KERNEL_VERSION ); then
                      ./NVIDIA-Linux-x86_64*.run -s --kernel-source-path=/lib/modules/$KERNEL_VERSION/build --kernel-name=$KERNEL_VERSION --skip-module-load
                      dkms autoinstall
                    else 
                      ./NVIDIA-Linux-x86_64*.run -s
                    fi
                  else
                    VERSION=$(apt-cache search "nvidia-driver" | grep "^nvidia-driver-.*-server-open" | cut -d"-" -f3 | sort -r | head -1)
                    apt-get install -q -y linux-modules-nvidia-$VERSION-server-open-aws nvidia-headless-no-dkms-$VERSION-server-open nvidia-driver-$VERSION-server-open nvidia-utils-$VERSION-server
                    apt-get install -q -y nvidia-settings

                    if ( ec2-metadata -t | grep -q " p[0-9]" ); then
                      apt-get install -q -y nvidia-fabricmanager-$VERSION libnvidia-nscq-$VERSION
                      apt-get install -q -y nvidia-imex-$VERSION
                      if ( ec2-metadata -t | grep -q " p[6-9]" ); then
                        apt-get install -q -y nvlsm
                        apt-get install -q -y infiniband-diags
                        echo "ib_umad" | tee -a /etc/modules-load.d/modules.conf
                        modprobe ib_umad
                      fi
                      systemctl enable --now nvidia-fabricmanager
                    fi
                  fi

                  # For ExApps: https://docs.nextcloud.com/server/stable/developer_manual/exapp_development/faq/GpuSupport.html
                  apt-get install -q -y nvidia-container-toolkit
                  nvidia-ctk runtime configure --runtime=docker
                  systemctl restart docker

                  # Unattended
                  apt-get install -q -y unattended-upgrades
                  sed -i '/\/\/Unattended-Upgrade::Automatic-Reboot "false";/a Unattended-Upgrade::Automatic-Reboot "true";' /etc/apt/apt.conf.d/50unattended-upgrades
                fi

                # HaRP: https://docs.nextcloud.com/server/stable/admin_manual/exapps_management/AppAPIAndExternalApps.html#harp
                # https://docs.nextcloud.com/server/stable/admin_manual/exapps_management/DeployConfigurations.html#nextcloud-and-docker-on-the-same-host-with-nextcloud-bare-metal
                apt-get install -q -y pwgen
                HP_SHARED_KEY=$(pwgen -c -n -y -r "\/\'\"\`\&\:" 16)
                echo "HARP Proxy Password = $HP_SHARED_KEY" >> /home/ubuntu/nextcloud-credentials

                sed -i "s/hp_shared_key/$HP_SHARED_KEY/g" /opt/docker/compose.yaml
                cd /opt/docker

                # only works for IPv4, otherwise docker compose will fail to pull images
                sysctl -w net.ipv6.conf.all.disable_ipv6=1
                sysctl -w net.ipv6.conf.default.disable_ipv6=1
                docker compose up -d --quiet-pull

                # Apache Reverse Proxy
                sed -i '/<\/VirtualHost>/d' /etc/apache2/sites-enabled/default-ssl.conf
                cat /root/exapps.conf >> /etc/apache2/sites-enabled/default-ssl.conf
                echo "</VirtualHost>" >> /etc/apache2/sites-enabled/default-ssl.conf

                sed -i '/<\/VirtualHost>/d' /etc/apache2/sites-enabled/000-default.conf
                cat /root/exapps.conf >> /etc/apache2/sites-enabled/000-default.conf
                echo "</VirtualHost>" >> /etc/apache2/sites-enabled/000-default.conf

                systemctl restart apache2

                # Register Deploy Daemon
                if ( ec2-metadata -t | grep -q "\ [g|p]" ); then
                  COMPUTE_DEVICE=cuda
                else
                  COMPUTE_DEVICE=cpu
                fi

                sudo -u www-data php /var/www/html/occ  app_api:daemon:register harp_proxy_host "Harp Proxy (Host)" \
                  "docker-install" "http" "127.0.0.1:8780" "http://127.0.0.1" \
                  --harp --harp_frp_address "127.0.0.1:8782" --harp_shared_key \
                  "$HP_SHARED_KEY" --set-default --compute_device=$COMPUTE_DEVICE

                rm -f ${!0}
              mode: "000740"
              owner: "root"
              group: "root"
            "/etc/apache2/conf-available/nextcloud.conf": # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#apache-configuration-label
              content: |
                <Directory /var/www/>
                  Require all granted
                  AllowOverride All
                  Options FollowSymLinks MultiViews

                  <IfModule mod_dav.c>
                    Dav off
                  </IfModule>
                </Directory>
              mode: "000644"
              owner: "root"
              group: "root"
            "/root/exapps.conf": # https://github.com/nextcloud/HaRP/issues/44
              content: |
                <Location /exapps/>
                  ProxyPreserveHost On
                  ProxyPass http://127.0.0.1:8780/exapps/ nocanon
                  ProxyPassReverse http://127.0.0.1:8780/exapps/
                  RequestHeader set X-Real-IP %{REMOTE_ADDR}s
                  RequestHeader set X-Forwarded-For %{REMOTE_ADDR}s
                  RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
                </Location>
              mode: "000644"
              owner: "root"
              group: "root"
            "/root/nextcloud/config.php":
              # https://docs.nextcloud.com/server/stable/admin_manual/configuration_files/files_locking_transactional.html
              # https://docs.nextcloud.com/server/stable/admin_manual/configuration_files/primary_storage.html
              # https://docs.nextcloud.com/server/stable/admin_manual/configuration_files/default_files_configuration.html
              # https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/config_sample_php_parameters.html
              # https://docs.nextcloud.com/server/stable/admin_manual/configuration_files/default_files_configuration.html
              content: !Sub
                - |
                  <?php

                  $CONFIG = array(
                    'trusted_domains' =>
                    array (
                      0 => 'localhost',
                      1 => '*',
                    ),
                    'trusted_proxies' =>
                    array (
                      0 => '10.0.0.0/8',
                      1 => '172.16.0.0/12',
                      2 => '192.168.0.0/16',
                    ),
                    'default_phone_region' => 'SG',
                    'maintenance_window_start' => 1,
                    'memcache.local' => '\OC\Memcache\APCu',
                    'memcache.distributed' => '\OC\Memcache\Redis',
                    'memcache.locking' => '\OC\Memcache\Redis',
                    'redis' => [
                         'host' => '/var/run/redis/redis-server.sock',
                         'port' => 0,
                         'timeout' => 0.0,
                    ],
                    'mysql.utf8mb4' => true,
                    'htaccess.RewriteBase' => '/',
                    'defaultapp' => 'files',
                    'skeletondirectory' => '', # set to '/var/www/html/core/skeleton' to include skeleton files               
                    'objectstore' => array(
                      'class' => 'OC\\Files\\ObjectStore\\S3',
                      'arguments' => array(
                        'bucket' => '${bucketName}',
                        'region' => '${AWS::Region}',
                        'hostname' => 's3.${AWS::Region}.amazonaws.com',
                        'storageClass' => '${s3StorageClass}',
                        'uploadPartSize' => '524288000',
                        'verify_bucket_exists' => true,
                        'use_ssl' => true
                      ),
                    ),
                  );
                - bucketName: !Ref s3Bucket
              mode: "000640"
              owner: "root"
              group: "root"
            "/root/nextcloud/crontab-www-data":
              content: |
                */5  *  *  *  * php -f /var/www/html/cron.php
              mode: "000640"
              owner: "root"
              group: "root"
            "/home/ubuntu/nextcloud-credentials":
              content: !Sub |
                Database User: nextcloud

              mode: "000400"
              owner: "ubuntu"
              group: "ubuntu"
          commands:
            install:
              command: "/root/install-nextcloud.sh > /var/log/install-nextcloud.log 2>&1"
              ignoreErrors: "true"
    Properties:
      ImageId: # https://ubuntu.com/server/docs/cloud-images/amazon-ec2 https://ubuntu.com/blog/ubuntu-pro-is-now-part-of-the-aws-ec2-console
        !If [
          useUbuntu2404x86,
          "{{resolve:ssm:/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id}}",
          !If [
            useUbuntu2404arm64,
            "{{resolve:ssm:/aws/service/canonical/ubuntu/server/24.04/stable/current/arm64/hvm/ebs-gp3/ami-id}}",
            !If [
              useUbuntuPro2404x86,
              "{{resolve:ssm:/aws/service/canonical/ubuntu/pro-server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id}}",
              "{{resolve:ssm:/aws/service/canonical/ubuntu/pro-server/24.04/stable/current/arm64/hvm/ebs-gp3/ami-id}}"
            ]
          ]
        ]
      InstanceType: !Ref instanceType
      IamInstanceProfile: !Ref instanceProfile
      KeyName: !Ref ec2KeyPair
      SubnetId: !Ref subnetID
      Monitoring: false
      DisableApiTermination: !If [enableProtection, true, false]
      EbsOptimized: true
      SecurityGroupIds:
        - !Ref sgEC2Instance
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            VolumeType: !Ref volumeType
            VolumeSize: !Ref volumeSize
            DeleteOnTermination: true
            Encrypted: true
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          mkdir -p /tmp/cfn
          cd /tmp/cfn

          # disable IPv6 during setup
          #sysctl -w net.ipv6.conf.all.disable_ipv6=1
          #sysctl -w net.ipv6.conf.default.disable_ipv6=1

          export DEBIAN_FRONTEND=noninteractive

          systemctl stop apt-daily.timer apt-daily-upgrade.timer
          apt-get clean all
          apt-get update -q
          sleep 15
          apt-get install -q -y procps
          pkill apt
          pkill dpkg
          apt-get install -q -y wget tmux unzip tar curl sed

          # CfN scripts: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-helper-scripts-reference.html
          apt-get install -q -y python3 python3-pip python3-setuptools python3-docutils python3-daemon
          curl -s -L -O https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz
          tar -xf aws-cfn-bootstrap-py3-latest.tar.gz
          cd aws-cfn-bootstrap-2.0
          python3 setup.py build > /var/log/install-cfn-helper.log 2>&1
          python3 setup.py install >> /var/log/install-cfn-helper.log 2>&1
          cd /tmp/cfn
          export CFN_INIT="python3 /usr/local/bin/cfn-init"

          $CFN_INIT -v --stack ${AWS::StackName} --resource ec2Instance --region ${AWS::Region} -c setup

          # Install desktop environment and DCV?
          if [ "${installDCV}" = "Yes" ]; then
            $CFN_INIT -v --stack ${AWS::StackName} --resource ec2Instance --region ${AWS::Region} -c dcv_install
          fi

          # Nextcloud
          $CFN_INIT -v --stack ${AWS::StackName} --resource ec2Instance --region ${AWS::Region} -c nextcloud_install

          #
          systemctl set-default multi-user.target
          systemctl daemon-reload
          systemctl enable dcv-post-reboot

          # enable back IPv6
          #sysctl -w net.ipv6.conf.all.disable_ipv6=0
          #sysctl -w net.ipv6.conf.default.disable_ipv6=0

          sleep 1 && reboot
      Tags:
        - Key: Name
          Value: !Ref ec2Name
        - Key: StackName
          Value: !Ref AWS::StackName
        - Key: StackId
          Value: !Ref AWS::StackId
        - Key: GitHub
          Value: https://github.com/aws-samples/nextcloud-server

  elasticIP:
    Condition: useElasticIP
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      NetworkBorderGroup: !Ref AWS::Region
      InstanceId: !Ref ec2Instance
      Tags:
        - Key: StackName
          Value: !Ref AWS::StackName
        - Key: StackId
          Value: !Ref AWS::StackId
        - Key: Name
          Value: !Sub
            - "${AWS::StackName}-elasticIP-${UID}"
            - UID: !Select [3, !Split ["-", !Select [2, !Split ["/", !Ref AWS::StackId]]]]
        - Key: GitHub
          Value: https://github.com/aws-samples/nextcloud-server

  alb:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Condition: createALB
    Properties:
      IpAddressType: !FindInMap [albIpTypeMapping, !Ref albIpAddressType, Value]
      Scheme: !Ref albScheme
      SecurityGroups:
        - !Ref albSecurityGroup
      Subnets: !Ref albSubnets
      Tags:
        - Key: StackName
          Value: !Ref AWS::StackName
        - Key: StackId
          Value: !Ref AWS::StackId
        - Key: GitHub
          Value: https://github.com/aws-samples/nextcloud-server

  albHttpListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Condition: createHttpListener
    Properties:
      LoadBalancerArn: !Ref alb
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref albTargetGroup
      Port: 80
      Protocol: HTTP

  albHttpRedirectListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Condition: createHttpRedirectListener
    Properties:
      LoadBalancerArn: !Ref alb
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Type: "redirect"
          RedirectConfig:
            Protocol: "HTTPS"
            Port: 443
            Host: "#{host}"
            Path: "/#{path}"
            Query: "#{query}"
            StatusCode: "HTTP_301"

  albHttpsListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Condition: createHttpsListener
    Properties:
      LoadBalancerArn: !Ref alb
      Port: 443
      Protocol: HTTPS
      Certificates:
        - CertificateArn: !Ref albCertificateArn
      SslPolicy: !Ref albSecurityPolicy
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref albTargetGroup
      ListenerAttributes:
        - !If
          - sendHSTS
          - Key: routing.http.response.server.enabled
            Value: true
          - !Ref AWS::NoValue
        - !If
          - sendHSTS
          - Key: routing.http.response.strict_transport_security.header_value
            Value: !Ref albHstsHeaderValue
          - !Ref AWS::NoValue

  albTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Condition: createALB
    Properties:
      HealthCheckEnabled: true
      HealthyThresholdCount: 2
      Matcher:
        HttpCode: "200-302"
      IpAddressType: ipv4
      Port: 443
      Protocol: HTTPS
      ProtocolVersion: HTTP1
      TargetGroupAttributes:
        - Key: stickiness.enabled
          Value: true
        - Key: stickiness.type
          Value: app_cookie
        - Key: stickiness.app_cookie.cookie_name
          Value: Nextcloud
      Tags:
        - Key: StackName
          Value: !Ref AWS::StackName
        - Key: StackId
          Value: !Ref AWS::StackId
        - Key: GitHub
          Value: https://github.com/aws-samples/nextcloud-server
      TargetType: instance
      Targets:
        - Id: !Ref ec2Instance
          Port: 443
      VpcId: !Ref vpcID

  albSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Condition: createALB
    Properties:
      GroupDescription: ALB allow HTTP and HTTPS
      VpcId: !Ref vpcID
      SecurityGroupIngress:
        - !If
          - albAllowIPv4
          - Description: HTTP (IPv4)
            IpProtocol: tcp
            FromPort: 80
            ToPort: 80
            CidrIp: 0.0.0.0/0
          - !Ref AWS::NoValue
        - !If
          - albAllowIPv4
          - Description: HTTPS (IPv4)
            IpProtocol: tcp
            FromPort: 443
            ToPort: 443
            CidrIp: 0.0.0.0/0
          - !Ref AWS::NoValue
        - !If
          - albAllowIPv6
          - Description: HTTP (IPv6)
            IpProtocol: tcp
            FromPort: 80
            ToPort: 80
            CidrIpv6: ::/0
          - !Ref AWS::NoValue
        - !If
          - albAllowIPv6
          - Description: HTTPS (IPv6)
            IpProtocol: tcp
            FromPort: 443
            ToPort: 443
            CidrIpv6: ::/0
          - !Ref AWS::NoValue
      SecurityGroupEgress:
        - !If
          - albAllowIPv4
          - Description: Allow all outbound traffic (IPv4)
            IpProtocol: "-1"
            CidrIp: 0.0.0.0/0
          - !Ref AWS::NoValue
        - !If
          - albAllowIPv6
          - Description: Allow all outbound traffic (IPv6)
            IpProtocol: "-1"
            CidrIpv6: ::/0
          - !Ref AWS::NoValue
      Tags:
        - Key: StackName
          Value: !Ref AWS::StackName
        - Key: StackId
          Value: !Ref AWS::StackId
        - Key: Name
          Value: !Sub
            - "${AWS::StackName}-albSecurityGroup-${UID}"
            - UID: !Select [3, !Split ["-", !Select [2, !Split ["/", !Ref AWS::StackId]]]]
        - Key: GitHub
          Value: https://github.com/aws-samples/nextcloud-server

  backupPlan:
    Type: AWS::Backup::BackupPlan
    Condition: createBackup
    Properties:
      BackupPlan:
        BackupPlanName: !Sub
          - "${AWS::StackName}-backupPlan-${UID}"
          - UID: !Select [3, !Split ["-", !Select [2, !Split ["/", !Ref AWS::StackId]]]]
        BackupPlanRule:
          - RuleName: !Sub
              - "${AWS::StackName}-backupRule-${UID}"
              - UID: !Select [3, !Split ["-", !Select [2, !Split ["/", !Ref AWS::StackId]]]]
            TargetBackupVault: !Ref backupVault
            ScheduleExpression: !Ref scheduleExpression
            ScheduleExpressionTimezone: !Ref scheduleExpressionTimezone
            Lifecycle:
              DeleteAfterDays: !Ref deleteAfterDays
      BackupPlanTags: {"StackName": !Ref AWS::StackName, "StackId": !Ref AWS::StackId, "GitHub": "https://github.com/aws-samples/nextcloud-server"}

  backupVault:
    Type: AWS::Backup::BackupVault
    Condition: createBackup
    UpdateReplacePolicy: Delete
    Properties:
      BackupVaultName: !Sub
        - "${AWS::StackName}-backupVault-${UID}"
        - UID: !Select [3, !Split ["-", !Select [2, !Split ["/", !Ref AWS::StackId]]]]
      BackupVaultTags: {"StackName": !Ref AWS::StackName, "StackId": !Ref AWS::StackId, "GitHub": "https://github.com/aws-samples/nextcloud-server"}

  backupSelection:
    Type: AWS::Backup::BackupSelection
    Condition: createBackup
    Properties:
      BackupPlanId: !Ref backupPlan
      BackupSelection:
        IamRoleArn: !GetAtt backupRestoreRole.Arn
        Resources:
          - !If
            - backupS3
            - !GetAtt s3Bucket.Arn
            - !Ref AWS::NoValue
          - !If
            - backupEC2
            - !Sub "arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/${ec2Instance}"
            - !Ref AWS::NoValue
          - !If
            - backupExternalStorage
            - !Sub "arn:${AWS::Partition}:s3:::${externalS3Bucket}"
            - !Ref AWS::NoValue
        SelectionName: !Sub
          - "${AWS::StackName}-backupSelection-${UID}"
          - UID: !Select [3, !Split ["-", !Select [2, !Split ["/", !Ref AWS::StackId]]]]

  backupRestoreRole:
    Type: AWS::IAM::Role
    Condition: createBackup
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: backup.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: restore-EC2-instance-profile
          PolicyDocument: # https://docs.aws.amazon.com/aws-backup/latest/devguide/restoring-ec2.html
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - iam:PassRole
                Resource: !GetAtt instanceIamRole.Arn
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/AWSBackupServiceRolePolicyForS3Backup"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/AWSBackupServiceRolePolicyForS3Restore"
      Tags:
        - Key: StackName
          Value: !Ref AWS::StackName
        - Key: StackId
          Value: !Ref AWS::StackId
        - Key: GitHub
          Value: https://github.com/aws-samples/nextcloud-server

Outputs:
  EC2console:
    Description: EC2 console
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/ec2/home?region=${AWS::Region}#Instances:search=${ec2Instance}"

  EC2instanceConnect:
    Condition: createSgEIC
    Description: EC2 Instance Connect
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/ec2-instance-connect/ssh?connType=standard&instanceId=${ec2Instance}&osUser=ubuntu&sshPort=22#/"

  EC2serialConsole:
    Description: EC2 Serial Console
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/ec2-instance-connect/ssh?connType=serial&instanceId=${ec2Instance}&serialPort=0#/"

  EC2iamRole:
    Description: EC2 IAM role
    Value: !Sub
      - "https://console.aws.amazon.com/iam/home#/roles/details/${role}"
      - role: !Select [1, !Split ["/", !GetAtt instanceIamRole.Arn]]

  EC2instanceID:
    Description: EC2 Instance ID
    Value: !Ref ec2Instance

  SSMsessionManager:
    Description: SSM Session Manager (" sudo passwd ubuntu " to change Ubuntu login user password)
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/systems-manager/session-manager/${ec2Instance}"

  DCVUrl:
    Condition: installDCV
    Description: DCV URL (login as ubuntu)
    Value: !Sub
      - "https://${IpAddress}:8443/?username=ubuntu     ( dcv://ubuntu:@${IpAddress}:8443 )"
      - IpAddress: !If [displayPublicIP, !GetAtt ec2Instance.PublicIp, !GetAtt ec2Instance.PrivateIp]

  WebUrl:
    Description: Website
    Value: !If [displayPublicIP, !Sub "https://${ec2Instance.PublicIp}", !Sub "https://${ec2Instance.PrivateIp}"]

  WebminUrl:
    Condition: installWebmin
    Description: Webmin URL (login as ubuntu)
    Value: !If [displayPublicIP, !Sub "https://${ec2Instance.PublicIp}:10000", !Sub "https://${ec2Instance.PrivateIp}:10000"]

  NextcloudSetPasswordCmd:
    Description: Set Nextcloud admin login password command
    Value: !Sub "sudo -u www-data php /var/www/html/occ user:resetpassword ${adminUsername}"

  NextcloudAdminUsername:
    Description: Nextcloud admin username
    Value: !Ref adminUsername

  NextcloudLog:
    Description: Cloudwatch log for nextcloud.log
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/cloudwatch/home?region=${AWS::Region}#logsV2:log-groups/log-group/nextcloud.log/log-events/${ec2Instance}"

  AlbConsole:
    Condition: createALB
    Description: ALB Console
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/ec2/home?region=${AWS::Region}#LoadBalancers:search=${alb}"

  AlbDnsName:
    Condition: createALB
    Description: ALB URL
    Value: !GetAtt alb.DNSName