Serverless 应用开发小记

.├── api # api service│   ├── serverless.yml│   └── sns.js # lambda function├── core # core service│   ├── Dockerfile│   ├── Infrastructure│   │   └── tf-fargate│   │       ├── cloudwatch.tf│   │       ├── ecr.tf│   │       ├── ecs.tf│   │       ├── iam.tf│   │       ├── main.tf│   │       ├── output.tf│   │       ├── sns.tf│   │       ├── tasks│   │       │   └── task_definition.json│   │       ├── variables.tf│   │       └── vpc.tf│   ├── Makefile # CLI entry│   ├── requirements.txt│   └── src│       ├── fund.txt│       └── main.py # fargate task└── web # web service    ├── binaryMimeTypes.js    ├── client    │   ├── assets    │   │   └── styles    │   │       └── global.less    │   ├── components    │   │   └── navbar.vue    │   ├── layouts    │   │   └── default.vue    │   ├── pages    │   │   └── index.vue    │   └── plugins    │       └── iview.js    ├── index.js    ├── nuxt.config.js    ├── nuxt.js # lambda function    ├── package-lock.json    ├── package.json    ├── secrets_example.json    ├── serverless.yml    └── yarn.lock

FROM python:3.8-slim-buster
USER rootWORKDIR /tmp
# for sourceRUN rm /bin/sh && ln -s /bin/bash /bin/sh
# for compileRUN  apt-get update \  && apt-get install -y wget \  && apt-get install -y build-essential \  && rm -rf /var/lib/apt/lists/*
# for TA-LibRUN pip install numpy && \  wget http://prdownloads.sourceforge.net/ta-lib/ta-lib-0.4.0-src.tar.gz && \  tar -xvzf ta-lib-0.4.0-src.tar.gz && \  cd ta-lib/ && \  ./configure --prefix=/usr && \  make && \  make installRUN rm -R ta-lib ta-lib-0.4.0-src.tar.gz
# set the working directory in the containerWORKDIR /code# copy the dependencies file to the working directoryCOPY requirements.txt .# install dependenciesRUN pip3 install -r requirements.txt# copy the content of the local src directory to the working directoryCOPY src/ .# command to run on container startCMD [ "python", "./main.py" ]

docker build -t invest-alchemy/core . # 构建docker run -t -i -e TUSHARE_API_TOKEN=xxxx invest-alchemy/core # 本地运行

aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin replace_with_your_ecr_addr.dkr.ecr.us-east-1.amazonaws.com # 登陆ECR
docker build -t invest-alchemy/core . # 本地构建
docker tag invest-alchemy/core:latest replace_with_your_ecr_addr.dkr.ecr.us-east-1.amazonaws.com/invest-alchemy/core:latest # 打Tag
docker push replace_with_your_ecr_addr.dkr.ecr.us-east-1.amazonaws.com/invest-alchemy/core:latest # 推送远程仓库

######################### Role used by the container regulates what AWS services the task has access to, e.g. your application is using a DynamoDB, then the task role must give the task access to Dynamo.resource "aws_iam_role" "ecs_service_role" {  name               = "${var.project}_ecs_service_role_${var.env}"  assume_role_policy = "${data.aws_iam_policy_document.ecs_service_assume_role_policy.json}"}
resource "aws_iam_role_policy" "ecs_service_policy" {  name   = "${var.project}_ecs_service_role_policy_${var.env}"  policy = "${data.aws_iam_policy_document.ecs_service_policy.json}"  role   = "${aws_iam_role.ecs_service_role.id}"}
data "aws_iam_policy_document" "ecs_service_policy" {  statement {    effect = "Allow"    resources = ["*"]    actions = [        "iam:ListPolicies",        "iam:GetPolicyVersion"    ]  }}
data "aws_iam_policy_document" "ecs_service_assume_role_policy" {  statement {    actions = ["sts:AssumeRole"]    principals {      type = "Service"      identifiers = ["ecs-tasks.amazonaws.com"]    }  }}
resource "aws_iam_role_policy_attachment" "ecs_service_role_policy_attachment" {  role       = aws_iam_role.ecs_service_role.name  policy_arn = "arn:aws:iam::aws:policy/AWSLambdaFullAccess" # https://gist.github.com/gene1wood/55b358748be3c314f956}
######################### Role used by the container enables the service to e.g. pull the image from ECR, spin up or deregister tasks etc
resource "aws_iam_role" "ecs_task_execution_role" {  name = "${var.project}_ecs_task_execution_role_${var.env}"   assume_role_policy = <<EOF{ "Version": "2012-10-17", "Statement": [   {     "Action": "sts:AssumeRole",     "Principal": {       "Service": "ecs-tasks.amazonaws.com"     },     "Effect": "Allow",     "Sid": ""   } ]}EOF} resource "aws_iam_role_policy_attachment" "ecs_task_execution_role_policy_attachment" {  role       = aws_iam_role.ecs_task_execution_role.name  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy" # https://gist.github.com/gene1wood/55b358748be3c314f956}
######################### Role used for ECS Events
resource "aws_iam_role" "ecs_events_role" {  name               = "${var.project}_ecs_events_role_${var.env}"  assume_role_policy = "${data.aws_iam_policy_document.ecs_events_assume_role_policy.json}"}
resource "aws_iam_role_policy_attachment" "ecs_events_role_policy" {  policy_arn = "${data.aws_iam_policy.ecs_events_policy.arn}"  role       = "${aws_iam_role.ecs_events_role.id}"}
data "aws_iam_policy" "ecs_events_policy" {  arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceEventsRole" # https://gist.github.com/gene1wood/55b358748be3c314f956}
data "aws_iam_policy_document" "ecs_events_assume_role_policy" {  statement {    actions = ["sts:AssumeRole"]    principals {      type = "Service"      identifiers = ["events.amazonaws.com"]    }  }}

variable "TUSHARE_API_TOKEN" {  description = "Tushare API Token from .env"  type        = string}

data "template_file" "task" {  template = "${file("./Infrastructure/tf-fargate/tasks/task_definition.json")}"
  vars = {    project             = "${var.project}"    aws_region          = "${var.aws_region}"    ecr_image_uri       = "${var.ecr_image_uri}"    TUSHARE_API_TOKEN = "${var.TUSHARE_API_TOKEN}" # 注入变量  }}

"environment": [{"name": "TUSHARE_API_TOKEN", "value": "${TUSHARE_API_TOKEN}"}]

################ Config ########################S3_BUCKET ?= invest-alchemyAWS_REGION ?= us-east-1ENV ?= devECR := 745121664662.dkr.ecr.us-east-1.amazonaws.com/invest-alchemy-core-ecr-dev # ECR Repository Example: 123456789012.dkr.ecr.eu-west-1.amazonaws.com/{project_name}-ecr-{env}################################################
################ Artifacts Bucket ##############artifacts:	@echo "Creation of artifacts bucket"	@aws s3 mb s3://$(S3_BUCKET)	@aws s3api put-bucket-encryption --bucket $(S3_BUCKET) \		--server-side-encryption-configuration \		'{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'	@aws s3api put-bucket-versioning --bucket $(S3_BUCKET) --versioning-configuration Status=Enabled################################################

build-docker:	@echo "run aws ecr get-login --region $(AWS_REGION) first"	@docker build -t $(PROJECT) .	@docker tag $(PROJECT) $(ECR)	@docker push $(ECR)
################ Terraform #####################
init:	@. .env	@terraform init \		-backend-config="bucket=$(S3_BUCKET)" \		-backend-config="key=$(PROJECT)/terraform.tfstate" \		./Infrastructure/tf-fargate/
validate:	@terraform validate ./Infrastructure/tf-fargate/
plan:	@terraform plan \		-var="env=$(ENV)" \		-var="project=$(PROJECT)" \		-var="description=$(DESCRIPTION)" \		-var="aws_region=$(AWS_REGION)" \		-var="artifacts_bucket=$(S3_BUCKET)" \		./Infrastructure/tf-fargate/
apply:	@terraform apply \		-var="env=$(ENV)" \		-var="project=$(PROJECT)" \		-var="description=$(DESCRIPTION)" \		-compact-warnings ./Infrastructure/tf-fargate/
destroy:	@read -p "Are you sure that you want to destroy: '$(PROJECT)-$(ENV)-$(AWS_REGION)'? [yes/N]: " sure && [ $${sure:-N} = 'yes' ]	@terraform destroy ./Infrastructure/tf-fargate/

service: apiapp: invest-alchemyorg: madawei2699
provider:  name: aws  role: arn:aws:iam::745121664662:role/invest-alchemy-lambda  runtime: nodejs12.x  stage: dev  region: us-east-1
functions:  subscribe_sns:    handler: sns.subscribe_sns    memorySize: 128    description: Subscribe sns topic.    environment:      snsTopicArn: arn:aws:sns:us-east-1:745121664662:trade-signal-topic    events:      - http:           path: subscribe          method: post          cors: true          integration: LAMBDA

service: webapp: invest-alchemyorg: madawei2699
provider:  name: aws  runtime: nodejs12.x  stage: ${self:custom.secrets.NODE_ENV}  region: us-east-1  environment:     NODE_ENV: ${self:custom.secrets.NODE_ENV}
functions:  nuxt:    handler: index.nuxt    memorySize: 256    events:      - http:          path: /          method: any          cors: true      - http:          path: /{proxy+}           method: any          cors: true
plugins:  - serverless-apigw-binary  - serverless-domain-manager  - serverless-offline
custom:  secrets: ${file(secrets.json)}  apigwBinary:    types:      - '*/*'  customDomain:    domainName: ${self:custom.secrets.DOMAIN}    basePath: ''    stage: ${self:custom.secrets.NODE_ENV}    createRoute53Record: true