9930a5b | website

git clone https://git.pyrossh.dev/website

木 Personal website of pyrossh. Built with astrojs, shiki, vite.

9930a5b — pyrossh 2025-11-15T15:01:25+05:30

add alchemy

Generated files not shown: bun.lock

Files changed (2) hide show

alchemy.run.ts +271 -3
package.json +2 -0

alchemy.run.ts CHANGED Viewed

@@ -1,15 +1,283 @@
+/**
+ * Alchemy Infrastructure Configuration for pyrossh.dev
+ *
+ * Converted from Terraform (main.tf) to Alchemy
+ *
+ * This configuration sets up:
+ * - Route53 hosted zone for pyrossh.dev
+ * - S3 buckets for website and git repos
+ * - CloudFront distribution with custom functions
+ * - S3 bucket policies for CloudFront access
+ * - Route53 A record pointing to CloudFront
+ *
+ * Note: ACM Certificate creation is commented out. You'll need to:
+ * 1. Create the certificate manually in ACM (us-east-1 region)
+ * 2. Uncomment and provide the certificate ARN in the ViewerCertificate config
+ */
 import alchemy from "alchemy";
 import AWS from "alchemy/aws/control";
+import { AccountId } from "alchemy/aws";
+const domainName = "pyrossh.dev";
-const app = await alchemy("my-first-app");
+const app = await alchemy("website");
+// Route53 Zone
+const hostedZone = await AWS.Route53.HostedZone("main", {
+  Name: domainName,
+  HostedZoneTags: [
+    { Key: "Environment", Value: "Production" },
+    { Key: "ProvisionedBy", Value: "Alchemy" }
+  ],
+  HostedZoneConfig: {
+    Comment: "ProvisionedBy Alchemy"
+  },
+  adopt: true,
+});
+// S3 Buckets with Public Access Block Configuration
-const reposBucket = await AWS.S3.Bucket("pyrossh-repos2", {
+const websiteBucket = await AWS.S3.Bucket("website-bucket", {
-  BucketName: "pyrossh-repos2",
+  BucketName: "pyrossh-website",
+  PublicAccessBlockConfiguration: {
+    BlockPublicAcls: true,
+    BlockPublicPolicy: true,
+    IgnorePublicAcls: true,
+    RestrictPublicBuckets: true
+  },
   Tags: [
     { Key: "Environment", Value: "Production" },
     { Key: "ProvisionedBy", Value: "Alchemy" }
   ]
 });
+const reposBucket = await AWS.S3.Bucket("repos-bucket", {
+  BucketName: "pyrossh-repos",
+  PublicAccessBlockConfiguration: {
+    BlockPublicAcls: true,
+    BlockPublicPolicy: true,
+    IgnorePublicAcls: true,
+    RestrictPublicBuckets: true
+  },
+  Tags: [
+    { Key: "Environment", Value: "Production" },
+    { Key: "ProvisionedBy", Value: "Alchemy" }
+  ]
+});
+// CloudFront Origin Access Control
+const s3Oac = await AWS.CloudFront.OriginAccessControl("s3-oac", {
+  OriginAccessControlConfig: {
+    Name: "s3-oac",
+    OriginAccessControlOriginType: "s3",
+    SigningBehavior: "always",
+    SigningProtocol: "sigv4"
+  }
+});
+// ACM Certificate (in us-east-1 for CloudFront)
+// Note: AWS Certificate Manager needs to be created separately or use ACMPCA
+// For now, assuming certificate ARN will be provided or created manually
+// You may need to adjust this based on your Alchemy setup
+// CloudFront Functions
+const htmlRedirector = await AWS.CloudFront.Function("html-redirector", {
+  FunctionCode: `function handler(event) {
+  const request = event.request;
+  const uri = request.uri;
+  if (uri.endsWith('/')) {
+      request.uri += 'index.html';
+  } else if (!uri.startsWith('/_astro')) {
+      request.uri += '/index.html';
+  }
+  return request;
+}`,
+  FunctionConfig: {
+    Comment: "HTML redirector function",
+    Runtime: "cloudfront-js-2.0"
+  },
+  Name: "html_redirector"
+});
+const gitRedirector = await AWS.CloudFront.Function("git-redirector", {
+  FunctionCode: `function handler(event) {
+  const request = event.request;
+  const uri = request.uri;
+  request.uri = "/" + request.uri.replace("/repos/", "");
+  return request;
+}`,
+  FunctionConfig: {
+    Comment: "Git redirector function",
+    Runtime: "cloudfront-js-2.0"
+  },
+  Name: "git_redirector"
+});
+// CloudFront Distribution
+const s3Distribution = await AWS.CloudFront.Distribution("s3-distribution", {
+  DistributionConfig: {
+    Origins: [
+      {
+        DomainName: websiteBucket.RegionalDomainName,
+        Id: websiteBucket.RegionalDomainName,
+        OriginAccessControlId: s3Oac.Id,
+        S3OriginConfig: {
+          OriginAccessIdentity: ""
+        }
+      },
+      {
+        DomainName: reposBucket.RegionalDomainName,
+        Id: reposBucket.RegionalDomainName,
+        OriginAccessControlId: s3Oac.Id,
+        S3OriginConfig: {
+          OriginAccessIdentity: ""
+        }
+      }
+    ],
+    Enabled: true,
+    IPV6Enabled: true,
+    Aliases: [domainName],
+    DefaultRootObject: "index.html",
+    CustomErrorResponses: [400, 403, 404, 405, 414, 416, 500, 501, 502, 503, 504].map(code => ({
+      ErrorCode: code,
+      ResponseCode: code,
+      ResponsePagePath: code < 500 ? "/404.html" : "/500.html"
+    })),
+    CacheBehaviors: [
+      {
+        PathPattern: "/repos/*.git/*",
+        AllowedMethods: ["GET", "HEAD"],
+        CachedMethods: ["GET", "HEAD"],
+        TargetOriginId: reposBucket.RegionalDomainName,
+        ForwardedValues: {
+          QueryString: false,
+          Cookies: {
+            Forward: "none"
+          }
+        },
+        MinTTL: 0,
+        DefaultTTL: 86400,
+        MaxTTL: 31536000,
+        Compress: true,
+        ViewerProtocolPolicy: "redirect-to-https",
+        FunctionAssociations: [{
+          EventType: "viewer-request",
+          FunctionARN: gitRedirector.FunctionARN
+        }]
+      },
+      {
+        PathPattern: "/*",
+        AllowedMethods: ["GET", "HEAD"],
+        CachedMethods: ["GET", "HEAD"],
+        TargetOriginId: websiteBucket.RegionalDomainName,
+        ForwardedValues: {
+          QueryString: true,
+          Cookies: {
+            Forward: "none"
+          }
+        },
+        ViewerProtocolPolicy: "redirect-to-https",
+        MinTTL: 0,
+        DefaultTTL: 3600,
+        MaxTTL: 86400,
+        FunctionAssociations: [{
+          EventType: "viewer-request",
+          FunctionARN: htmlRedirector.FunctionARN
+        }]
+      }
+    ],
+    DefaultCacheBehavior: {
+      AllowedMethods: ["GET", "HEAD"],
+      CachedMethods: ["GET", "HEAD"],
+      TargetOriginId: websiteBucket.RegionalDomainName,
+      ForwardedValues: {
+        QueryString: true,
+        Cookies: {
+          Forward: "none"
+        }
+      },
+      ViewerProtocolPolicy: "redirect-to-https",
+      MinTTL: 0,
+      DefaultTTL: 3600,
+      MaxTTL: 86400,
+      FunctionAssociations: [{
+        EventType: "viewer-request",
+        FunctionARN: htmlRedirector.FunctionARN
+      }]
+    },
+    PriceClass: "PriceClass_All",
+    Restrictions: {
+      GeoRestriction: {
+        RestrictionType: "none"
+      }
+    },
+    ViewerCertificate: {
+      CloudFrontDefaultCertificate: false,
+      // AcmCertificateArn: domainSslCertificate.CertificateArn,
+      // Uncomment above and create certificate separately or provide ARN
+      SslSupportMethod: "sni-only"
+    },
+    Comment: "Pyrossh Website Distribution"
+  }
+});
+// S3 Bucket Policies
+const websiteBucketPolicy = await AWS.S3.BucketPolicy("website-bucket-policy", {
+  Bucket: websiteBucket.BucketName || "pyrossh-website",
+  PolicyDocument: {
+    Version: "2012-10-17",
+    Statement: [{
+      Principal: {
+        Service: "cloudfront.amazonaws.com"
+      },
+      Action: "s3:GetObject",
+      Resource: [
+        websiteBucket.Arn,
+        `${websiteBucket.Arn}/*`
+      ],
+      Effect: "Allow",
+      Condition: {
+        StringEquals: {
+          "AWS:SourceArn": `arn:aws:cloudfront::${await AccountId()}:distribution/${s3Distribution.Id}`
+        }
+      }
+    }]
+  }
+});
+const reposBucketPolicy = await AWS.S3.BucketPolicy("repos-bucket-policy", {
+  Bucket: reposBucket.BucketName || "pyrossh-repos",
+  PolicyDocument: {
+    Version: "2012-10-17",
+    Statement: [{
+      Principal: {
+        Service: "cloudfront.amazonaws.com"
+      },
+      Action: "s3:GetObject",
+      Resource: [
+        reposBucket.Arn,
+        `${reposBucket.Arn}/*`
+      ],
+      Effect: "Allow",
+      Condition: {
+        StringEquals: {
+          "AWS:SourceArn": `arn:aws:cloudfront::${await AccountId()}:distribution/${s3Distribution.Id}`
+        }
+      }
+    }]
+  }
+});
+// Route53 A Record
+const aRecordDomain = await AWS.Route53.RecordSet("a-record-domain", {
+  HostedZoneId: hostedZone.Id,
+  Name: domainName,
+  Type: "A",
+  AliasTarget: {
+    DNSName: s3Distribution.DomainName,
+    HostedZoneId: s3Distribution.DomainName, // CloudFront hosted zone ID
+    EvaluateTargetHealth: false
+  }
+});
 await app.finalize();

package.json CHANGED Viewed

@@ -23,12 +23,14 @@
     "astro-color-scheme": "^1.1.5",
     "astro-expressive-code": "^0.41.3",
     "astro-icon": "^1.1.5",
     "expressive-code-color-chips": "^0.1.2",
     "pretty-bytes": "^7.1.0",
     "simple-git": "^3.27.0",
     "timeago.js": "^4.0.2"
   },
   "devDependencies": {
+    "client-s3": "aws-sdk/client-s3",
     "@iconify-json/mdi": "^1.2.3",
     "@iconify-json/material-symbols": "^1.2.39",
     "@playwright/test": "^1.52.0",