user_data.sh

#!/bin/bash
set -euo pipefail

# Log everything
exec > >(tee /var/log/user-data.log) 2>&1

echo "=== Starting Umami setup ==="

# Configure 2GB swap file for better memory handling on t4g.nano
echo "=== Configuring swap ==="
# Disable existing swap if any
swapoff -a 2>/dev/null || true
# Remove old swap file if exists
rm -f /swapfile
# Create 2GB swap file
dd if=/dev/zero of=/swapfile bs=1M count=2048
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
# Add to fstab for persistence
grep -q '/swapfile' /etc/fstab || echo '/swapfile swap swap defaults 0 0' >> /etc/fstab

# Install AWS CLI, SSM agent, and dependencies
dnf install -y docker aws-cli amazon-ssm-agent
systemctl enable amazon-ssm-agent
systemctl start amazon-ssm-agent

# Get instance metadata (IMDSv2)
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
INSTANCE_ID=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id)

echo "Instance ID: $INSTANCE_ID"

# Associate Elastic IP
echo "=== Associating Elastic IP ==="
aws ec2 associate-address \
  --instance-id "$INSTANCE_ID" \
  --allocation-id "${eip_allocation_id}" \
  --region "${aws_region}"

# Attach and mount EBS data volume
echo "=== Attaching EBS volume ==="
aws ec2 attach-volume \
  --volume-id "${ebs_volume_id}" \
  --instance-id "$INSTANCE_ID" \
  --device /dev/xvdf \
  --region "${aws_region}"

# Wait for volume to attach
echo "Waiting for volume to attach..."
while [ ! -e /dev/xvdf ] && [ ! -e /dev/nvme1n1 ]; do
  sleep 1
done
sleep 5

# Determine the actual device name (could be xvdf or nvme1n1)
if [ -e /dev/nvme1n1 ]; then
  DATA_DEVICE=/dev/nvme1n1
else
  DATA_DEVICE=/dev/xvdf
fi

echo "Data device: $DATA_DEVICE"

# Check if volume needs formatting (new volume)
if ! blkid "$DATA_DEVICE" | grep -q ext4; then
  echo "Formatting new volume..."
  mkfs.ext4 "$DATA_DEVICE"
fi

# Create mount point and mount
mkdir -p /data
mount "$DATA_DEVICE" /data

# Add to fstab for persistence
echo "$DATA_DEVICE /data ext4 defaults,nofail 0 2" >> /etc/fstab

# Create data directories
mkdir -p /data/postgres
mkdir -p /data/caddy

# Start Docker
systemctl enable docker
systemctl start docker

# Install Docker Compose
curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose

# Create umami directory
mkdir -p /opt/umami
cd /opt/umami

# Create docker-compose.yml
cat > docker-compose.yml << 'COMPOSE_EOF'
services:
  umami:
    image: ghcr.io/umami-software/umami:postgresql-latest
    ports:
      - "127.0.0.1:3000:3000"
    environment:
      DATABASE_URL: postgresql://umami:umami@db:5432/umami
      DATABASE_TYPE: postgresql
      APP_SECRET: ${app_secret}
      TRACKER_SCRIPT_NAME: ${tracker_script_name}
      DISABLE_TELEMETRY: 1
    depends_on:
      db:
        condition: service_healthy
    restart: always

  db:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: umami
      POSTGRES_USER: umami
      POSTGRES_PASSWORD: umami
    volumes:
      - /data/postgres:/var/lib/postgresql/data
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U umami"]
      interval: 5s
      timeout: 5s
      retries: 5

  caddy:
    image: caddy:2-alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - /data/caddy:/data
      - caddy_config:/config
    depends_on:
      - umami
    restart: always

volumes:
  caddy_config:
COMPOSE_EOF

# Create Caddyfile with Let's Encrypt
cat > Caddyfile << 'CADDY_EOF'
${domain} {
    tls ${letsencrypt_email}
    reverse_proxy umami:3000
}
CADDY_EOF

# Start services
/usr/local/bin/docker-compose up -d

# Install and configure CloudWatch Agent
echo "=== Installing CloudWatch Agent ==="
dnf install -y amazon-cloudwatch-agent

# Create CloudWatch Agent configuration
cat > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json << 'CW_EOF'
{
  "agent": {
    "metrics_collection_interval": 60,
    "run_as_user": "root"
  },
  "metrics": {
    "namespace": "CWAgent",
    "append_dimensions": {
      "InstanceId": "umami"
    },
    "metrics_collected": {
      "cpu": {
        "measurement": [
          "cpu_usage_active"
        ],
        "metrics_collection_interval": 60,
        "totalcpu": true,
        "append_dimensions": {
          "cpu": "cpu-total"
        }
      },
      "mem": {
        "measurement": [
          "mem_used_percent"
        ],
        "metrics_collection_interval": 60
      },
      "disk": {
        "measurement": [
          "disk_used_percent"
        ],
        "metrics_collection_interval": 60,
        "resources": [
          "/",
          "/data"
        ]
      }
    }
  }
}
CW_EOF

# Start CloudWatch Agent
systemctl enable amazon-cloudwatch-agent
/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -s -c file:/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json

# Create a script to monitor Docker containers and send metrics
cat > /opt/umami/docker-monitor.sh << 'MONITOR_EOF'
#!/bin/bash
TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
REGION=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region)
RUNNING=$(docker ps -q | wc -l)
aws cloudwatch put-metric-data \
  --namespace CWAgent \
  --metric-name docker_containers_running \
  --dimensions InstanceId=umami \
  --value "$RUNNING" \
  --region "$REGION"
MONITOR_EOF
chmod +x /opt/umami/docker-monitor.sh

# Add cron job for Docker monitoring every 5 minutes
echo "*/5 * * * * root /opt/umami/docker-monitor.sh" > /etc/cron.d/docker-monitor

echo "=== Umami setup complete ==="
echo "Access Umami at https://${domain}"
echo "Default login: admin / umami"
echo "IMPORTANT: Change the default password immediately!"