A monorepo of Femiwiki's AWS Lambda functions.
# Lint, type-check and test
uv sync
uvx ruff format --check .
uvx ruff check .
uvx ty check .
uv run python -m unittest discover -s sns-discord
uv run python -m unittest discover -s mastodon-discord
uv run python -m unittest discover -s mastodon-boost
uv run python -m unittest discover -s grafana-github
uv run python -m unittest discover -s bounce-handler
# Make into zip file
zip -j lambda.zip sns-discord/lambda_function.py
# Publish
aws lambda update-function-code --function-name DiscordNoti \
--zip-file fileb://lambda.zip --publish --region us-east-1
aws lambda update-function-code --function-name DiscordNoti \
--zip-file fileb://lambda.zip --publish --region ap-northeast-1Relays mentions of the wiki's Mastodon status account from the accounts in
ALLOWED_ACCTS to a Discord channel, as a reply to the alert message a Mastodon
reply answers. It runs every minute from an EventBridge rule in femiwiki/infra
aws/lambda.tf. deploy.yml sets these variables, the two tokens from this
repository's secrets:
MASTODON_INSTANCE: e.g.https://mastodon.socialMASTODON_TOKEN: scopesread:notifications read:statusesALLOWED_ACCTS: comma-separated, e.g.lens0021,someone@example.orgCURSOR_PARAMETER: SSM parameter holding the last notification seenDISCORD_BOT_TOKEN: a bot that can view, read history in, and send to the channel, with the Message Content intentDISCORD_CHANNEL_ID: the channel Grafana posts alerts to
Boosts mentions of the wiki's Mastodon status account from the accounts in
ALLOWED_ACCTS, so their answers to an alert show on the status account.
Private and direct mentions cannot be boosted and are skipped. It runs every
minute from an EventBridge rule in femiwiki/infra aws/lambda.tf. deploy.yml
sets these variables, the token from this repository's MASTODON_BOOST_TOKEN
secret, which femiwiki/infra github/secrets.tf sets from the
LAMBDA_MASTODON_BOOST_TOKEN item in the 1Password infra vault:
MASTODON_INSTANCE: e.g.https://mastodon.socialMASTODON_TOKEN: scopesread:notifications write:statusesALLOWED_ACCTS: comma-separated, e.g.lens0021,someone@example.orgCURSOR_PARAMETER: SSM parameter holding the last notification seen
Keeps one issue in femiwiki/infra per Grafana alert rule labelled
impact=operators. Grafana's webhook contact point calls the function URL from
femiwiki/infra aws/lambda.tf; the first firing opens an issue named after the
rule and its start time in KST, such as Disk almost full (10/3 21:55 KST), and
later notifications become comments while it is open. New issues get the
alert label. An EventBridge rule in aws/access-analyzer.tf also invokes it
for each IAM Access Analyzer finding: an active one opens an issue of its own
that says only that one was found, with its id and a console link, and the issue
closes once the finding is resolved or archived. An EventBridge rule in
aws/sg-alerts.tf invokes it for each security group rule added inbound or
changed in Seoul or Tokyo: one naming 0.0.0.0/0 or ::/0 opens an issue that
says only the region and the CloudTrail event id, and an operator closes it once
checked.
deploy.yml sets:
GITHUB_APP_CLIENT_ID: the alerts GitHub App, installed on femiwiki/infra with Issues read and writeGITHUB_APP_PRIVATE_KEY: that App's private keyGITHUB_MENTION:@femiwiki/pager, mentioned in each new issueGITHUB_REPOSITORY:femiwiki/infraWEBHOOK_TOKEN: the bearer token Grafana sends
Hands SES permanent bounces to MediaWiki's BounceHandler. SES in us-east-1
publishes bounce notifications to an SNS topic that the function subscribes to,
from femiwiki/infra aws/lambda.tf. For mail the wiki sent from a VERP address,
it posts a minimal delivery status report to action=bouncehandler with the
token from SSM in the POST body (femiwiki/docker-mediawiki#215). deploy.yml
sets:
API_URL:https://femiwiki.com/api.phpTOKEN_PARAMETER: the SecureString parameter holding the token
The source code of femiwiki/lambda is primarily distributed under the terms of the GNU Affero General Public License v3.0 or any later version. See COPYRIGHT for details.