ftp-centos7.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建Centos7 ECS实例，配置安全组，安装部署FTP服务，支持自定义ECS或新建ECS资源。
  en: Create a Centos 7 ECS instance, configure security groups, install and deploy
    FTP services, supporting customization of ECS or the creation of new ECS resources.
Conditions:
  CreateEcs:
    Fn::Equals:
      - 创建ECS
      - Ref: EcsCondition
  HasEcs:
    Fn::Equals:
      - 使用已有ECS
      - Ref: EcsCondition
Parameters:
  EcsCondition:
    Type: String
    Label:
      zh-cn: 是否创建ECS
      en: FTP server access username
    AllowedValues:
      - 使用已有ECS
      - 创建ECS
    Default: 使用已有ECS
  EcsInstanceId:
    Type: String
    Default: Null
    Label:
      en: ECS Instance ID
      zh-cn: ECS实例ID
    AssociationProperty: ALIYUN::ECS::Instance::InstanceId
    AssociationPropertyMetadata:
      Visible:
        Condition:
          Fn::Not:
            Fn::Equals:
              - ${EcsCondition}
              - 创建ECS
  FTPUser:
    Label:
      zh-cn: FTP服务访问用户名
      en: FTP server access username
    Type: String
    Default: ftptest
  FTPUserPassword:
    Label:
      zh-cn: FTP服务访问用户密码
      en: FTP server access username
    Type: String
    NoEcho: true
  SystemDiskCategory:
    Default: Null
    AssociationProperty: ALIYUN::ECS::Disk::SystemDiskCategory
    AssociationPropertyMetadata:
      InstanceType: ${InstanceType}
      ZoneId: ${ZoneId}
      Visible:
        Condition:
          Fn::Not:
            Fn::Equals:
              - ${EcsCondition}
              - 使用已有ECS
    Type: String
    Description:
      zh-cn: '<font color=''blue''><b>可选值：</b></font><br>[cloud_efficiency: <font color=''green''>高效云盘</font>]<br>[cloud_ssd: <font color=''green''>SSD云盘</font>]<br>[cloud_essd: <font color=''green''>ESSD云盘</font>]<br>[cloud: <font color=''green''>普通云盘</font>]<br>[ephemeral_ssd: <font color=''green''>本地SSD盘</font>]'
      en: '<font color=''blue''><b>Optional values:</b></font><br>[cloud_efficiency: <font color=''green''>Efficient Cloud Disk</font>]<br>[cloud_ssd: <font color=''green''>SSD Cloud Disk</font>]<br>[cloud_essd: <font color=''green''>ESSD Cloud Disk</font>]<br>[cloud: <font color=''green''>Cloud Disk</font>]<br>[ephemeral_ssd: <font color=''green''>Local SSD Cloud Disk</font>]'
    Label:
      zh-cn: 系统磁盘类型
      en: System Disk Category
  InstancePassword:
    ConstraintDescription:
      zh-cn: 长度8-30，必须包含大写字母、小写字母、数字、特殊符号三种；特殊字符包括：()`~!@#$%^&*_-+=|{}[]:;' <>,.?/
      en: 'Length 8-30, must contain upper case letters, lower case letters, Numbers, special symbols three; special characters include: ()`~!@#$%^&*_-+=|{}[]:;''<>,.?/'
    Description:
      zh-cn: 长度8-30，必须包含大写字母、小写字母、数字、特殊符号三个；<br>特殊字符包括：()`~!@#$%^&*_-+=|{}[]:;'<>,.?/
      en: The 8-30 long login password of instance, consists of the uppercase, lowercase letter and number. <br> special characters include()`~!@#$%^&*_-+=|{}[]:;'<>,.?/
    MinLength: '8'
    Label:
      zh-cn: 实例密码
      en: Instance Password
    AllowedPattern: '[0-9A-Za-z\_\-&:;''<>,=%`~!@#\(\)\$\^\*\+\|\{\}\[\]\.\?\/]+$'
    NoEcho: true
    Default: Null
    MaxLength: '30'
    Type: String
    AssociationPropertyMetadata:
      Visible:
        Condition:
          Fn::Not:
            Fn::Equals:
              - ${EcsCondition}
              - 使用已有ECS
  InstanceType:
    AssociationProperty: ALIYUN::ECS::Instance::InstanceType
    AssociationPropertyMetadata:
      ZoneId: ${ZoneId}
      Visible:
        Condition:
          Fn::Not:
            Fn::Equals:
              - ${EcsCondition}
              - 使用已有ECS
    Type: String
    Default: Null
    Label:
      zh-cn: 实例类型
      en: Instance Type
  ZoneId:
    Default: Null
    AssociationProperty: ALIYUN::ECS::Instance::ZoneId
    Type: String
    Description:
      zh-cn: 可用区ID。<br><b>注： <font color='blue'>选择可用区前请确认该可用区是否支持创建ECS资源的规格</font></b>
      en: Availability Zone ID,<br><b>note： <font color='blue'>Before selecting, please confirm that the Availability Zone supports the specification of creating ECS resources</font></b>
    Label:
      zh-cn: 可用区ID
      en: Available Zone ID
    AssociationPropertyMetadata:
      Visible:
        Condition:
          Fn::Not:
            Fn::Equals:
              - ${EcsCondition}
              - 使用已有ECS
Outputs:
  FTPServerAddress:
    Condition: CreateEcs
    Description: FTP server Connection address.
    Value:
      Fn::Join:
        - ''
        - - ftp://
          - Fn::GetAtt:
              - VpcEip
              - EipAddress
          - ':21'
  FtpServerAddress:
    Condition: HasEcs
    Description: FTP server Connection address.
    Value:
      Fn::Sub:
        - ftp://${IP}:21
        - IP:
            Fn::Jq:
              - First
              - if .[0].PublicIpAddress != [] then .[0].PublicIpAddress[0] else .[0].EipAddress.IpAddress end
              - Fn::GetAtt:
                  - DS_Instances
                  - Instances
Resources:
  DS_Instances:
    Condition: HasEcs
    Type: DATASOURCE::ECS::Instances
    Properties:
      InstanceIds:
        - Ref: EcsInstanceId
  SecurityGroupIngress_22:
    Condition: HasEcs
    Type: ALIYUN::ECS::SecurityGroupIngress
    Properties:
      SecurityGroupId:
        Fn::Jq:
          - First
          - .[0].SecurityGroupIds[0]
          - Fn::GetAtt:
              - DS_Instances
              - Instances
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 22/22
  SecurityGroupIngress_50000:
    Condition: HasEcs
    Type: ALIYUN::ECS::SecurityGroupIngress
    Properties:
      SecurityGroupId:
        Fn::Jq:
          - First
          - .[0].SecurityGroupIds[0]
          - Fn::GetAtt:
              - DS_Instances
              - Instances
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 50000/50010
  SecurityGroupIngress_21:
    Condition: HasEcs
    Type: ALIYUN::ECS::SecurityGroupIngress
    Properties:
      SecurityGroupId:
        Fn::Jq:
          - First
          - .[0].SecurityGroupIds[0]
          - Fn::GetAtt:
              - DS_Instances
              - Instances
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 21/21
  InstallFtp:
    Condition: HasEcs
    Type: ALIYUN::ECS::RunCommand
    Properties:
      InstanceIds:
        - Ref: EcsInstanceId
      Type: RunShellScript
      Sync: true
      Timeout: 3600
      CommandContent:
        Fn::Sub:
          - |
            #!/bin/bash
            # install ftp
            yum install -y vsftpd
            adduser '${FTPUser}'
            echo '${FTPUserPassword}' | passwd --stdin '${FTPUser}'
            mkdir /var/ftp/test
            touch /var/ftp/test/testfile.txt
            chown -R '${FTPUser}':'${FTPUser}' /var/ftp/test
            touch /etc/vsftpd/chroot_list
            sed -i 's/anonymous_enable=YES/anonymous_enable=NO/' /etc/vsftpd/vsftpd.conf
            sed -i 's/listen=NO/listen=YES/' /etc/vsftpd/vsftpd.conf
            sed -i 's/listen_ipv6=YES/\# listen_ipv6=YES/' /etc/vsftpd/vsftpd.conf
            echo "local_root=/var/ftp/test" >>/etc/vsftpd/vsftpd.conf
            echo "pasv_enable=YES" >>/etc/vsftpd/vsftpd.conf
            echo "allow_writeable_chroot=YES" >>/etc/vsftpd/vsftpd.conf
            echo "pasv_min_port=50000" >>/etc/vsftpd/vsftpd.conf
            echo "pasv_max_port=50010" >>/etc/vsftpd/vsftpd.conf
            echo "pasv_address=${IP}" >>/etc/vsftpd/vsftpd.conf
            sed -i 's/\#anon_upload_enable=YES/anon_upload_enable=YES/' /etc/vsftpd/vsftpd.conf
            sed -i 's/\#chroot_local_user=YES/chroot_local_user=YES/' /etc/vsftpd/vsftpd.conf
            sed -i 's/\#chroot_list_enable=YES/chroot_list_enable=YES/' /etc/vsftpd/vsftpd.conf
            sed -i 's%#chroot_list_file=/etc/vsftpd/chroot_list%chroot_list_file=/etc/vsftpd/chroot_list%' /etc/vsftpd/vsftpd.conf
            chmod o+w /var/ftp/pub/
            systemctl enable vsftpd.service
            systemctl restart vsftpd.service
            ${WaitConditionHandle.CurlCli} -d "{\"status\" : \"SUCCESS\"}"
          - IP:
              Fn::Jq:
                - First
                - if .[0].PublicIpAddress != [] then .[0].PublicIpAddress[0] else .[0].EipAddress.IpAddress end
                - Fn::GetAtt:
                    - DS_Instances
                    - Instances
    DependsOn:
      - SecurityGroupIngress_21
      - SecurityGroupIngress_22
  EcsSecurityGroup:
    Condition: CreateEcs
    Type: ALIYUN::ECS::SecurityGroup
    Properties:
      SecurityGroupIngress:
        - Priority: 1
          PortRange: 22/22
          NicType: internet
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
        - Priority: 1
          PortRange: 21/21
          NicType: internet
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
        - Priority: 1
          PortRange: 50000/50010
          NicType: internet
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
      VpcId:
        Ref: EcsVpc
  WaitConditionHandle:
    Type: ALIYUN::ROS::WaitConditionHandle
  EcsVSwitch:
    Type: ALIYUN::ECS::VSwitch
    Condition: CreateEcs
    Properties:
      VpcId:
        Ref: EcsVpc
      CidrBlock: 192.168.1.0/24
      ZoneId:
        Ref: ZoneId
  WaitCondition:
    Type: ALIYUN::ROS::WaitCondition
    Properties:
      Count: 1
      Handle:
        Ref: WaitConditionHandle
      Timeout: 1800
    DependsOn: EcsInstance
  VpcEip:
    Condition: CreateEcs
    Type: ALIYUN::VPC::EIP
    Properties:
      Bandwidth: 5
  EipAssociation:
    Condition: CreateEcs
    DependsOn:
      - VpcEip
    Type: ALIYUN::VPC::EIPAssociation
    Properties:
      InstanceId:
        Fn::GetAtt:
          - EcsInstance
          - InstanceId
      AllocationId:
        Ref: VpcEip
  EcsInstance:
    Condition: CreateEcs
    Type: ALIYUN::ECS::Instance
    Properties:
      UserData:
        Fn::Sub: |
          #!/bin/bash
          # install ftp
          yum install -y vsftpd
          adduser '${FTPUser}'
          echo '${FTPUserPassword}' | passwd --stdin '${FTPUser}'
          mkdir /var/ftp/test
          touch /var/ftp/test/testfile.txt
          chown -R '${FTPUser}':'${FTPUser}' /var/ftp/test
          touch /etc/vsftpd/chroot_list
          sed -i 's/anonymous_enable=YES/anonymous_enable=NO/' /etc/vsftpd/vsftpd.conf
          sed -i 's/listen=NO/listen=YES/' /etc/vsftpd/vsftpd.conf
          sed -i 's/listen_ipv6=YES/\# listen_ipv6=YES/' /etc/vsftpd/vsftpd.conf
          echo "local_root=/var/ftp/test" >>/etc/vsftpd/vsftpd.conf
          echo "pasv_enable=YES" >>/etc/vsftpd/vsftpd.conf
          echo "allow_writeable_chroot=YES" >>/etc/vsftpd/vsftpd.conf
          echo "pasv_min_port=50000" >>/etc/vsftpd/vsftpd.conf
          echo "pasv_max_port=50010" >>/etc/vsftpd/vsftpd.conf
          echo "pasv_address=${VpcEip.EipAddress}" >>/etc/vsftpd/vsftpd.conf
          sed -i 's/\#anon_upload_enable=YES/anon_upload_enable=YES/' /etc/vsftpd/vsftpd.conf
          sed -i 's/\#chroot_local_user=YES/chroot_local_user=YES/' /etc/vsftpd/vsftpd.conf
          sed -i 's/\#chroot_list_enable=YES/chroot_list_enable=YES/' /etc/vsftpd/vsftpd.conf
          sed -i 's%#chroot_list_file=/etc/vsftpd/chroot_list%chroot_list_file=/etc/vsftpd/chroot_list%' /etc/vsftpd/vsftpd.conf
          chmod o+w /var/ftp/pub/
          systemctl enable vsftpd.service
          systemctl restart vsftpd.service
          ${WaitConditionHandle.CurlCli} -d "{\"status\" : \"SUCCESS\"}"
      SystemDiskCategory:
        Ref: SystemDiskCategory
      VpcId:
        Fn::GetAtt:
          - EcsVpc
          - VpcId
      AllocatePublicIP: false
      SecurityGroupId:
        Ref: EcsSecurityGroup
      ImageId: centos_7
      VSwitchId:
        Ref: EcsVSwitch
      Password:
        Ref: InstancePassword
      InstanceType:
        Ref: InstanceType
  EcsVpc:
    Condition: CreateEcs
    Type: ALIYUN::ECS::VPC
    Properties:
      CidrBlock: 192.168.0.0/16
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
      - Parameters:
          - EcsCondition
          - EcsInstanceId
          - ZoneId
          - InstanceType
          - SystemDiskCategory
          - InstancePassword
          - FTPUser
          - FTPUserPassword
        Label:
          default: ECS
    TemplateTags:
      - acs:document-help:ecs:手动搭建FTP站点（CentOS 7）