network.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  firerunner runner network: a VPC with public subnets in two or three
  Availability Zones, and the runners' security group (no inbound). Its
  outputs are control.yaml's VpcId, SubnetIds and RunnerSecurityGroupId.
  See deploy/cloudformation/README.md.

Parameters:
  VpcCidr:
    Type: String
    Default: 10.77.0.0/16
    AllowedPattern: '(\d{1,3}\.){3}\d{1,3}/16'
    Description: The VPC's /16. Each subnet gets a /18 quarter of it.
  SubnetCount:
    Type: Number
    AllowedValues: [2, 3]
    Default: 3
    Description: Availability Zones to spread runners over; more zones, more spot capacity.

Conditions:
  ThreeSubnets: !Equals [!Ref SubnetCount, 3]

Resources:
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      # The control VM's private DNS name needs both.
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags: [{ Key: Name, Value: !Ref AWS::StackName }]

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags: [{ Key: Name, Value: !Ref AWS::StackName }]
  GatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties: { VpcId: !Ref Vpc, InternetGatewayId: !Ref InternetGateway }

  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags: [{ Key: Name, Value: !Ref AWS::StackName }]
  DefaultRoute:
    Type: AWS::EC2::Route
    DependsOn: GatewayAttachment
    Properties: { RouteTableId: !Ref RouteTable, DestinationCidrBlock: 0.0.0.0/0, GatewayId: !Ref InternetGateway }

  # Public subnets: runners reach GitHub through the internet gateway, with
  # no NAT gateway to pay for. Nothing reaches in: the security groups allow
  # no inbound from outside the VPC.
  SubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [0, !GetAZs ""]
      CidrBlock: !Select [0, !Cidr [!Ref VpcCidr, 4, 14]]
      MapPublicIpOnLaunch: true
      Tags: [{ Key: Name, Value: !Sub "${AWS::StackName}-a" }]
  SubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [1, !GetAZs ""]
      CidrBlock: !Select [1, !Cidr [!Ref VpcCidr, 4, 14]]
      MapPublicIpOnLaunch: true
      Tags: [{ Key: Name, Value: !Sub "${AWS::StackName}-b" }]
  SubnetC:
    Type: AWS::EC2::Subnet
    Condition: ThreeSubnets
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [2, !GetAZs ""]
      CidrBlock: !Select [2, !Cidr [!Ref VpcCidr, 4, 14]]
      MapPublicIpOnLaunch: true
      Tags: [{ Key: Name, Value: !Sub "${AWS::StackName}-c" }]
  RouteA:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: { SubnetId: !Ref SubnetA, RouteTableId: !Ref RouteTable }
  RouteB:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: { SubnetId: !Ref SubnetB, RouteTableId: !Ref RouteTable }
  RouteC:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Condition: ThreeSubnets
    Properties: { SubnetId: !Ref SubnetC, RouteTableId: !Ref RouteTable }

  RunnerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: firerunner runners; no inbound
      VpcId: !Ref Vpc
      SecurityGroupEgress:
        - { IpProtocol: "-1", CidrIp: 0.0.0.0/0, Description: "GitHub, package registries and the control VM" }
      Tags: [{ Key: Name, Value: !Sub "${AWS::StackName}-runners" }]

Outputs:
  VpcId:
    Value: !Ref Vpc
  SubnetIds:
    Description: Comma-separated, for control.yaml's SubnetIds and the tiers' ec2.subnets.
    Value: !If
      - ThreeSubnets
      - !Join [",", [!Ref SubnetA, !Ref SubnetB, !Ref SubnetC]]
      - !Join [",", [!Ref SubnetA, !Ref SubnetB]]
  RunnerSecurityGroupId:
    Description: For control.yaml's RunnerSecurityGroupId and the tiers' ec2.security_groups.
    Value: !Ref RunnerSecurityGroup