path: root/serverless.yml

service: serverless-oauth2
provider:
  name: aws
  runtime: nodejs10.x
  stage: ${opt:stage, self:custom.defaultStage}
  environment:
    GIT_HOSTNAME: "/pbonaud/oauth/${opt:stage, self:provider.stage}/GIT_HOSTNAME"
    OAUTH_TOKEN_PATH: "/pbonaud/oauth/${opt:stage, self:provider.stage}/OAUTH_TOKEN_PATH"
    OAUTH_AUTHORIZE_PATH: "/pbonaud/oauth/${opt:stage, self:provider.stage}/OAUTH_AUTHORIZE_PATH"
    OAUTH_CLIENT_ID: "/pbonaud/oauth/${opt:stage, self:provider.stage}/OAUTH_CLIENT_ID"
    OAUTH_CLIENT_SECRET:  "/pbonaud/oauth/${opt:stage, self:provider.stage}/OAUTH_CLIENT_SECRET"
    REDIRECT_URL: "/pbonaud/oauth/${opt:stage, self:provider.stage}/REDIRECT_URL"
    OAUTH_SCOPES: "/pbonaud/oauth/${opt:stage, self:provider.stage}/OAUTH_SCOPES"
    TZ: "utc"
  iamRoleStatements:
    - Effect: Allow
      Action:
        - ssm:DescribeParameters
        - ssm:GetParameters
      Resource: "arn:aws:ssm:${opt:region, self:provider.region}:*:parameter/pbonaud/oauth/${opt:stage, self:provider.stage}/*"
    - Effect: Allow
      Action:
        - kms:Decrypt
      Resource: "arn:aws:kms:${opt:region, self:provider.region}:*:key/${self:custom.kms_key.${opt:region, self:provider.region}.${self:provider.stage}}"

custom:
  defaultStage: dev
  kms_key:
    "eu-west-1":
      prod: "4c50d94e-061d-4034-b63f-507eb31b4fe7"
      dev: "foo"

functions:
  auth:
    handler: auth.auth
    memorySize: 128
    timeout: 5
    events:
      - http:
          path: /auth
          method: get
          cors: true
  callback:
    handler: auth.callback
    memorySize: 128
    timeout: 5
    events:
      - http:
          path: /callback
          method: get
          cors: true

plugins:
  - serverless-plugin-optimize
  - serverless-offline

package:
  individually: true