openvidu/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: OpenVidu Pro - High Availability

Parameters:
  DomainName:
    Type: String
    Description: Domain name for the OpenVidu High Availability cluster
    AllowedPattern: ^$|^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]$
    ConstraintDescription: The domain name does not have a valid domain name format

  OpenViduCertificateARN:
    Description: 'Amazon certificate arn resource to load into the LoadBalancer'
    Type: String
    AllowedPattern: '.+'
    ConstraintDescription: The Load Balancer domain name must be defined

  OpenViduLicense:
    Description: "Visit https://openvidu.io/account"
    Type: String
    AllowedPattern: ^(?!\s*$).+$
    NoEcho: true
    ConstraintDescription: OpenVidu Pro License is mandatory

  RTCEngine:
    Description: "RTCEngine media engine to use"
    Type: String
    AllowedValues:
      - pion
      - mediasoup
    Default: pion

  MasterNodeInstanceType:
    Description: "Specifies the EC2 instance type for your OpenVidu Master Node"
    Type: String
    Default: c6a.xlarge
    AllowedValues:
      - t3.nano
      - t3.micro
      - t3.small
      - t3.medium
      - t3.large
      - t3.xlarge
      - t3.2xlarge
      - t3a.nano
      - t3a.micro
      - t3a.small
      - t3a.medium
      - t3a.large
      - t3a.xlarge
      - t3a.2xlarge
      - t4g.nano
      - t4g.micro
      - t4g.small
      - t4g.medium
      - t4g.large
      - t4g.xlarge
      - t4g.2xlarge
      - c5.large
      - c5.xlarge
      - c5.2xlarge
      - c5.4xlarge
      - c5.9xlarge
      - c5.12xlarge
      - c5.18xlarge
      - c5.24xlarge
      - c5.metal
      - c5a.large
      - c5a.xlarge
      - c5a.2xlarge
      - c5a.4xlarge
      - c5a.8xlarge
      - c5a.12xlarge
      - c5a.16xlarge
      - c5a.24xlarge
      - c5ad.large
      - c5ad.xlarge
      - c5ad.2xlarge
      - c5ad.4xlarge
      - c5ad.8xlarge
      - c5ad.12xlarge
      - c5ad.16xlarge
      - c5ad.24xlarge
      - c5d.large
      - c5d.xlarge
      - c5d.2xlarge
      - c5d.4xlarge
      - c5d.9xlarge
      - c5d.12xlarge
      - c5d.18xlarge
      - c5d.24xlarge
      - c5d.metal
      - c5n.large
      - c5n.xlarge
      - c5n.2xlarge
      - c5n.4xlarge
      - c5n.9xlarge
      - c5n.18xlarge
      - c5n.metal
      - c6a.large
      - c6a.xlarge
      - c6a.2xlarge
      - c6a.4xlarge
      - c6a.8xlarge
      - c6a.12xlarge
      - c6a.16xlarge
      - c6a.24xlarge
      - c6a.32xlarge
      - c6a.48xlarge
      - c6a.metal
      - c6g.medium
      - c6g.large
      - c6g.xlarge
      - c6g.2xlarge
      - c6g.4xlarge
      - c6g.8xlarge
      - c6g.12xlarge
      - c6g.16xlarge
      - c6g.metal
      - c6gd.medium
      - c6gd.large
      - c6gd.xlarge
      - c6gd.2xlarge
      - c6gd.4xlarge
      - c6gd.8xlarge
      - c6gd.12xlarge
      - c6gd.16xlarge
      - c6gd.metal
      - c6gn.medium
      - c6gn.large
      - c6gn.xlarge
      - c6gn.2xlarge
      - c6gn.4xlarge
      - c6gn.8xlarge
      - c6gn.12xlarge
      - c6gn.16xlarge
      - c6i.large
      - c6i.xlarge
      - c6i.2xlarge
      - c6i.4xlarge
      - c6i.8xlarge
      - c6i.12xlarge
      - c6i.16xlarge
      - c6i.24xlarge
      - c6i.32xlarge
      - c6i.metal
      - c6id.large
      - c6id.xlarge
      - c6id.2xlarge
      - c6id.4xlarge
      - c6id.8xlarge
      - c6id.12xlarge
      - c6id.16xlarge
      - c6id.24xlarge
      - c6id.32xlarge
      - c6id.metal
      - c6in.large
      - c6in.xlarge
      - c6in.2xlarge
      - c6in.4xlarge
      - c6in.8xlarge
      - c6in.12xlarge
      - c6in.16xlarge
      - c6in.24xlarge
      - c6in.32xlarge
      - c6in.metal
      - c7a.medium
      - c7a.large
      - c7a.xlarge
      - c7a.2xlarge
      - c7a.4xlarge
      - c7a.8xlarge
      - c7a.12xlarge
      - c7a.16xlarge
      - c7a.24xlarge
      - c7a.32xlarge
      - c7a.48xlarge
      - c7a.metal-48xl
      - c7g.medium
      - c7g.large
      - c7g.xlarge
      - c7g.2xlarge
      - c7g.4xlarge
      - c7g.8xlarge
      - c7g.12xlarge
      - c7g.16xlarge
      - c7g.metal
      - c7gd.medium
      - c7gd.large
      - c7gd.xlarge
      - c7gd.2xlarge
      - c7gd.4xlarge
      - c7gd.8xlarge
      - c7gd.12xlarge
      - c7gd.16xlarge
      - c7gd.metal
      - c7gn.medium
      - c7gn.large
      - c7gn.xlarge
      - c7gn.2xlarge
      - c7gn.4xlarge
      - c7gn.8xlarge
      - c7gn.12xlarge
      - c7gn.16xlarge
      - c7gn.metal
      - c7i-flex.large
      - c7i-flex.xlarge
      - c7i-flex.2xlarge
      - c7i-flex.4xlarge
      - c7i-flex.8xlarge
      - c7i-flex.12xlarge
      - c7i-flex.16xlarge
      - c7i.large
      - c7i.xlarge
      - c7i.2xlarge
      - c7i.4xlarge
      - c7i.8xlarge
      - c7i.12xlarge
      - c7i.16xlarge
      - c7i.24xlarge
      - c7i.48xlarge
      - c7i.metal-24xl
      - c7i.metal-48xl
      - c8g.medium
      - c8g.large
      - c8g.xlarge
      - c8g.2xlarge
      - c8g.4xlarge
      - c8g.8xlarge
      - c8g.12xlarge
      - c8g.16xlarge
      - c8g.24xlarge
      - c8g.48xlarge
      - c8g.metal-24xl
      - c8g.metal-48xl
      - c8gd.medium
      - c8gd.large
      - c8gd.xlarge
      - c8gd.2xlarge
      - c8gd.4xlarge
      - c8gd.8xlarge
      - c8gd.12xlarge
      - c8gd.16xlarge
      - c8gd.24xlarge
      - c8gd.48xlarge
      - c8gd.metal-24xl
      - c8gd.metal-48xl
      - g4dn.xlarge
      - g4dn.2xlarge
      - g4dn.4xlarge
      - g4dn.8xlarge
      - g4dn.12xlarge
      - g4dn.16xlarge
      - g4dn.metal
      - g5.xlarge
      - g5.2xlarge
      - g5.4xlarge
      - g5.8xlarge
      - g5.12xlarge
      - g5.16xlarge
      - g5.24xlarge
      - g5.48xlarge
      - g5g.xlarge
      - g5g.2xlarge
      - g5g.4xlarge
      - g5g.8xlarge
      - g5g.16xlarge
      - g5g.metal
      - g6.xlarge
      - g6.2xlarge
      - g6.4xlarge
      - g6.8xlarge
      - g6.12xlarge
      - g6.16xlarge
      - g6.24xlarge
      - g6.48xlarge
      - g6e.xlarge
      - g6e.2xlarge
      - g6e.4xlarge
      - g6e.8xlarge
      - g6e.12xlarge
      - g6e.16xlarge
      - g6e.24xlarge
      - g6e.48xlarge
      - g6f.large
      - g6f.xlarge
      - g6f.2xlarge
      - g6f.4xlarge
      - g7e.2xlarge
      - g7e.4xlarge
      - g7e.8xlarge
      - g7e.12xlarge
      - g7e.24xlarge
      - g7e.48xlarge
      - gr6.4xlarge
      - gr6.8xlarge
      - gr6f.4xlarge
      - m6a.large
      - m6a.xlarge
      - m6a.2xlarge
      - m6a.4xlarge
      - m6a.8xlarge
      - m6a.12xlarge
      - m6a.16xlarge
      - m6a.24xlarge
      - m6a.32xlarge
      - m6a.48xlarge
      - m6a.metal
      - m6g.medium
      - m6g.large
      - m6g.xlarge
      - m6g.2xlarge
      - m6g.4xlarge
      - m6g.8xlarge
      - m6g.12xlarge
      - m6g.16xlarge
      - m6g.metal
      - m6gd.medium
      - m6gd.large
      - m6gd.xlarge
      - m6gd.2xlarge
      - m6gd.4xlarge
      - m6gd.8xlarge
      - m6gd.12xlarge
      - m6gd.16xlarge
      - m6gd.metal
      - m6i.large
      - m6i.xlarge
      - m6i.2xlarge
      - m6i.4xlarge
      - m6i.8xlarge
      - m6i.12xlarge
      - m6i.16xlarge
      - m6i.24xlarge
      - m6i.32xlarge
      - m6i.metal
      - m6id.large
      - m6id.xlarge
      - m6id.2xlarge
      - m6id.4xlarge
      - m6id.8xlarge
      - m6id.12xlarge
      - m6id.16xlarge
      - m6id.24xlarge
      - m6id.32xlarge
      - m6id.metal
      - m6idn.large
      - m6idn.xlarge
      - m6idn.2xlarge
      - m6idn.4xlarge
      - m6idn.8xlarge
      - m6idn.12xlarge
      - m6idn.16xlarge
      - m6idn.24xlarge
      - m6idn.32xlarge
      - m6idn.metal
      - m6in.large
      - m6in.xlarge
      - m6in.2xlarge
      - m6in.4xlarge
      - m6in.8xlarge
      - m6in.12xlarge
      - m6in.16xlarge
      - m6in.24xlarge
      - m6in.32xlarge
      - m6in.metal
      - m7a.medium
      - m7a.large
      - m7a.xlarge
      - m7a.2xlarge
      - m7a.4xlarge
      - m7a.8xlarge
      - m7a.12xlarge
      - m7a.16xlarge
      - m7a.24xlarge
      - m7a.32xlarge
      - m7a.48xlarge
      - m7a.metal-48xl
      - m7g.medium
      - m7g.large
      - m7g.xlarge
      - m7g.2xlarge
      - m7g.4xlarge
      - m7g.8xlarge
      - m7g.12xlarge
      - m7g.16xlarge
      - m7g.metal
      - m7gd.medium
      - m7gd.large
      - m7gd.xlarge
      - m7gd.2xlarge
      - m7gd.4xlarge
      - m7gd.8xlarge
      - m7gd.12xlarge
      - m7gd.16xlarge
      - m7gd.metal
      - m7i-flex.large
      - m7i-flex.xlarge
      - m7i-flex.2xlarge
      - m7i-flex.4xlarge
      - m7i-flex.8xlarge
      - m7i-flex.12xlarge
      - m7i-flex.16xlarge
      - m7i.large
      - m7i.xlarge
      - m7i.2xlarge
      - m7i.4xlarge
      - m7i.8xlarge
      - m7i.12xlarge
      - m7i.16xlarge
      - m7i.24xlarge
      - m7i.48xlarge
      - m7i.metal-24xl
      - m7i.metal-48xl
      - m8g.medium
      - m8g.large
      - m8g.xlarge
      - m8g.2xlarge
      - m8g.4xlarge
      - m8g.8xlarge
      - m8g.12xlarge
      - m8g.16xlarge
      - m8g.24xlarge
      - m8g.48xlarge
      - m8g.metal-24xl
      - m8g.metal-48xl
      - m8gd.medium
      - m8gd.large
      - m8gd.xlarge
      - m8gd.2xlarge
      - m8gd.4xlarge
      - m8gd.8xlarge
      - m8gd.12xlarge
      - m8gd.16xlarge
      - m8gd.24xlarge
      - m8gd.48xlarge
      - m8gd.metal-24xl
      - m8gd.metal-48xl
      - p4d.24xlarge
      - p4de.24xlarge
      - p5.4xlarge
      - p5.48xlarge
      - p5e.48xlarge
      - p5en.48xlarge
      - p6-b200.48xlarge
      - p6-b300.48xlarge
      - p6e-gb200.36xlarge
      - r6g.medium
      - r6g.large
      - r6g.xlarge
      - r6g.2xlarge
      - r6g.4xlarge
      - r6g.8xlarge
      - r6g.12xlarge
      - r6g.16xlarge
      - r6g.metal
      - r6gd.medium
      - r6gd.large
      - r6gd.xlarge
      - r6gd.2xlarge
      - r6gd.4xlarge
      - r6gd.8xlarge
      - r6gd.12xlarge
      - r6gd.16xlarge
      - r6gd.metal
      - r7g.medium
      - r7g.large
      - r7g.xlarge
      - r7g.2xlarge
      - r7g.4xlarge
      - r7g.8xlarge
      - r7g.12xlarge
      - r7g.16xlarge
      - r7g.metal
      - r7gd.medium
      - r7gd.large
      - r7gd.xlarge
      - r7gd.2xlarge
      - r7gd.4xlarge
      - r7gd.8xlarge
      - r7gd.12xlarge
      - r7gd.16xlarge
      - r7gd.metal
      - r8g.medium
      - r8g.large
      - r8g.xlarge
      - r8g.2xlarge
      - r8g.4xlarge
      - r8g.8xlarge
      - r8g.12xlarge
      - r8g.16xlarge
      - r8g.24xlarge
      - r8g.48xlarge
      - r8g.metal-24xl
      - r8g.metal-48xl
    ConstraintDescription: "Must be a valid EC2 instance type"

  MediaNodeInstanceType:
    Description: "Specifies the EC2 instance type for your OpenVidu Media Nodes"
    Type: String
    Default: c6a.xlarge
    AllowedValues:
      - t3.nano
      - t3.micro
      - t3.small
      - t3.medium
      - t3.large
      - t3.xlarge
      - t3.2xlarge
      - t3a.nano
      - t3a.micro
      - t3a.small
      - t3a.medium
      - t3a.large
      - t3a.xlarge
      - t3a.2xlarge
      - t4g.nano
      - t4g.micro
      - t4g.small
      - t4g.medium
      - t4g.large
      - t4g.xlarge
      - t4g.2xlarge
      - c5.large
      - c5.xlarge
      - c5.2xlarge
      - c5.4xlarge
      - c5.9xlarge
      - c5.12xlarge
      - c5.18xlarge
      - c5.24xlarge
      - c5.metal
      - c5a.large
      - c5a.xlarge
      - c5a.2xlarge
      - c5a.4xlarge
      - c5a.8xlarge
      - c5a.12xlarge
      - c5a.16xlarge
      - c5a.24xlarge
      - c5ad.large
      - c5ad.xlarge
      - c5ad.2xlarge
      - c5ad.4xlarge
      - c5ad.8xlarge
      - c5ad.12xlarge
      - c5ad.16xlarge
      - c5ad.24xlarge
      - c5d.large
      - c5d.xlarge
      - c5d.2xlarge
      - c5d.4xlarge
      - c5d.9xlarge
      - c5d.12xlarge
      - c5d.18xlarge
      - c5d.24xlarge
      - c5d.metal
      - c5n.large
      - c5n.xlarge
      - c5n.2xlarge
      - c5n.4xlarge
      - c5n.9xlarge
      - c5n.18xlarge
      - c5n.metal
      - c6a.large
      - c6a.xlarge
      - c6a.2xlarge
      - c6a.4xlarge
      - c6a.8xlarge
      - c6a.12xlarge
      - c6a.16xlarge
      - c6a.24xlarge
      - c6a.32xlarge
      - c6a.48xlarge
      - c6a.metal
      - c6g.medium
      - c6g.large
      - c6g.xlarge
      - c6g.2xlarge
      - c6g.4xlarge
      - c6g.8xlarge
      - c6g.12xlarge
      - c6g.16xlarge
      - c6g.metal
      - c6gd.medium
      - c6gd.large
      - c6gd.xlarge
      - c6gd.2xlarge
      - c6gd.4xlarge
      - c6gd.8xlarge
      - c6gd.12xlarge
      - c6gd.16xlarge
      - c6gd.metal
      - c6gn.medium
      - c6gn.large
      - c6gn.xlarge
      - c6gn.2xlarge
      - c6gn.4xlarge
      - c6gn.8xlarge
      - c6gn.12xlarge
      - c6gn.16xlarge
      - c6i.large
      - c6i.xlarge
      - c6i.2xlarge
      - c6i.4xlarge
      - c6i.8xlarge
      - c6i.12xlarge
      - c6i.16xlarge
      - c6i.24xlarge
      - c6i.32xlarge
      - c6i.metal
      - c6id.large
      - c6id.xlarge
      - c6id.2xlarge
      - c6id.4xlarge
      - c6id.8xlarge
      - c6id.12xlarge
      - c6id.16xlarge
      - c6id.24xlarge
      - c6id.32xlarge
      - c6id.metal
      - c6in.large
      - c6in.xlarge
      - c6in.2xlarge
      - c6in.4xlarge
      - c6in.8xlarge
      - c6in.12xlarge
      - c6in.16xlarge
      - c6in.24xlarge
      - c6in.32xlarge
      - c6in.metal
      - c7a.medium
      - c7a.large
      - c7a.xlarge
      - c7a.2xlarge
      - c7a.4xlarge
      - c7a.8xlarge
      - c7a.12xlarge
      - c7a.16xlarge
      - c7a.24xlarge
      - c7a.32xlarge
      - c7a.48xlarge
      - c7a.metal-48xl
      - c7g.medium
      - c7g.large
      - c7g.xlarge
      - c7g.2xlarge
      - c7g.4xlarge
      - c7g.8xlarge
      - c7g.12xlarge
      - c7g.16xlarge
      - c7g.metal
      - c7gd.medium
      - c7gd.large
      - c7gd.xlarge
      - c7gd.2xlarge
      - c7gd.4xlarge
      - c7gd.8xlarge
      - c7gd.12xlarge
      - c7gd.16xlarge
      - c7gd.metal
      - c7gn.medium
      - c7gn.large
      - c7gn.xlarge
      - c7gn.2xlarge
      - c7gn.4xlarge
      - c7gn.8xlarge
      - c7gn.12xlarge
      - c7gn.16xlarge
      - c7gn.metal
      - c7i-flex.large
      - c7i-flex.xlarge
      - c7i-flex.2xlarge
      - c7i-flex.4xlarge
      - c7i-flex.8xlarge
      - c7i-flex.12xlarge
      - c7i-flex.16xlarge
      - c7i.large
      - c7i.xlarge
      - c7i.2xlarge
      - c7i.4xlarge
      - c7i.8xlarge
      - c7i.12xlarge
      - c7i.16xlarge
      - c7i.24xlarge
      - c7i.48xlarge
      - c7i.metal-24xl
      - c7i.metal-48xl
      - c8g.medium
      - c8g.large
      - c8g.xlarge
      - c8g.2xlarge
      - c8g.4xlarge
      - c8g.8xlarge
      - c8g.12xlarge
      - c8g.16xlarge
      - c8g.24xlarge
      - c8g.48xlarge
      - c8g.metal-24xl
      - c8g.metal-48xl
      - c8gd.medium
      - c8gd.large
      - c8gd.xlarge
      - c8gd.2xlarge
      - c8gd.4xlarge
      - c8gd.8xlarge
      - c8gd.12xlarge
      - c8gd.16xlarge
      - c8gd.24xlarge
      - c8gd.48xlarge
      - c8gd.metal-24xl
      - c8gd.metal-48xl
      - g4dn.xlarge
      - g4dn.2xlarge
      - g4dn.4xlarge
      - g4dn.8xlarge
      - g4dn.12xlarge
      - g4dn.16xlarge
      - g4dn.metal
      - g5.xlarge
      - g5.2xlarge
      - g5.4xlarge
      - g5.8xlarge
      - g5.12xlarge
      - g5.16xlarge
      - g5.24xlarge
      - g5.48xlarge
      - g5g.xlarge
      - g5g.2xlarge
      - g5g.4xlarge
      - g5g.8xlarge
      - g5g.16xlarge
      - g5g.metal
      - g6.xlarge
      - g6.2xlarge
      - g6.4xlarge
      - g6.8xlarge
      - g6.12xlarge
      - g6.16xlarge
      - g6.24xlarge
      - g6.48xlarge
      - g6e.xlarge
      - g6e.2xlarge
      - g6e.4xlarge
      - g6e.8xlarge
      - g6e.12xlarge
      - g6e.16xlarge
      - g6e.24xlarge
      - g6e.48xlarge
      - g6f.large
      - g6f.xlarge
      - g6f.2xlarge
      - g6f.4xlarge
      - g7e.2xlarge
      - g7e.4xlarge
      - g7e.8xlarge
      - g7e.12xlarge
      - g7e.24xlarge
      - g7e.48xlarge
      - gr6.4xlarge
      - gr6.8xlarge
      - gr6f.4xlarge
      - m6a.large
      - m6a.xlarge
      - m6a.2xlarge
      - m6a.4xlarge
      - m6a.8xlarge
      - m6a.12xlarge
      - m6a.16xlarge
      - m6a.24xlarge
      - m6a.32xlarge
      - m6a.48xlarge
      - m6a.metal
      - m6g.medium
      - m6g.large
      - m6g.xlarge
      - m6g.2xlarge
      - m6g.4xlarge
      - m6g.8xlarge
      - m6g.12xlarge
      - m6g.16xlarge
      - m6g.metal
      - m6gd.medium
      - m6gd.large
      - m6gd.xlarge
      - m6gd.2xlarge
      - m6gd.4xlarge
      - m6gd.8xlarge
      - m6gd.12xlarge
      - m6gd.16xlarge
      - m6gd.metal
      - m6i.large
      - m6i.xlarge
      - m6i.2xlarge
      - m6i.4xlarge
      - m6i.8xlarge
      - m6i.12xlarge
      - m6i.16xlarge
      - m6i.24xlarge
      - m6i.32xlarge
      - m6i.metal
      - m6id.large
      - m6id.xlarge
      - m6id.2xlarge
      - m6id.4xlarge
      - m6id.8xlarge
      - m6id.12xlarge
      - m6id.16xlarge
      - m6id.24xlarge
      - m6id.32xlarge
      - m6id.metal
      - m6idn.large
      - m6idn.xlarge
      - m6idn.2xlarge
      - m6idn.4xlarge
      - m6idn.8xlarge
      - m6idn.12xlarge
      - m6idn.16xlarge
      - m6idn.24xlarge
      - m6idn.32xlarge
      - m6idn.metal
      - m6in.large
      - m6in.xlarge
      - m6in.2xlarge
      - m6in.4xlarge
      - m6in.8xlarge
      - m6in.12xlarge
      - m6in.16xlarge
      - m6in.24xlarge
      - m6in.32xlarge
      - m6in.metal
      - m7a.medium
      - m7a.large
      - m7a.xlarge
      - m7a.2xlarge
      - m7a.4xlarge
      - m7a.8xlarge
      - m7a.12xlarge
      - m7a.16xlarge
      - m7a.24xlarge
      - m7a.32xlarge
      - m7a.48xlarge
      - m7a.metal-48xl
      - m7g.medium
      - m7g.large
      - m7g.xlarge
      - m7g.2xlarge
      - m7g.4xlarge
      - m7g.8xlarge
      - m7g.12xlarge
      - m7g.16xlarge
      - m7g.metal
      - m7gd.medium
      - m7gd.large
      - m7gd.xlarge
      - m7gd.2xlarge
      - m7gd.4xlarge
      - m7gd.8xlarge
      - m7gd.12xlarge
      - m7gd.16xlarge
      - m7gd.metal
      - m7i-flex.large
      - m7i-flex.xlarge
      - m7i-flex.2xlarge
      - m7i-flex.4xlarge
      - m7i-flex.8xlarge
      - m7i-flex.12xlarge
      - m7i-flex.16xlarge
      - m7i.large
      - m7i.xlarge
      - m7i.2xlarge
      - m7i.4xlarge
      - m7i.8xlarge
      - m7i.12xlarge
      - m7i.16xlarge
      - m7i.24xlarge
      - m7i.48xlarge
      - m7i.metal-24xl
      - m7i.metal-48xl
      - m8g.medium
      - m8g.large
      - m8g.xlarge
      - m8g.2xlarge
      - m8g.4xlarge
      - m8g.8xlarge
      - m8g.12xlarge
      - m8g.16xlarge
      - m8g.24xlarge
      - m8g.48xlarge
      - m8g.metal-24xl
      - m8g.metal-48xl
      - m8gd.medium
      - m8gd.large
      - m8gd.xlarge
      - m8gd.2xlarge
      - m8gd.4xlarge
      - m8gd.8xlarge
      - m8gd.12xlarge
      - m8gd.16xlarge
      - m8gd.24xlarge
      - m8gd.48xlarge
      - m8gd.metal-24xl
      - m8gd.metal-48xl
      - p4d.24xlarge
      - p4de.24xlarge
      - p5.4xlarge
      - p5.48xlarge
      - p5e.48xlarge
      - p5en.48xlarge
      - p6-b200.48xlarge
      - p6-b300.48xlarge
      - p6e-gb200.36xlarge
      - r6g.medium
      - r6g.large
      - r6g.xlarge
      - r6g.2xlarge
      - r6g.4xlarge
      - r6g.8xlarge
      - r6g.12xlarge
      - r6g.16xlarge
      - r6g.metal
      - r6gd.medium
      - r6gd.large
      - r6gd.xlarge
      - r6gd.2xlarge
      - r6gd.4xlarge
      - r6gd.8xlarge
      - r6gd.12xlarge
      - r6gd.16xlarge
      - r6gd.metal
      - r7g.medium
      - r7g.large
      - r7g.xlarge
      - r7g.2xlarge
      - r7g.4xlarge
      - r7g.8xlarge
      - r7g.12xlarge
      - r7g.16xlarge
      - r7g.metal
      - r7gd.medium
      - r7gd.large
      - r7gd.xlarge
      - r7gd.2xlarge
      - r7gd.4xlarge
      - r7gd.8xlarge
      - r7gd.12xlarge
      - r7gd.16xlarge
      - r7gd.metal
      - r8g.medium
      - r8g.large
      - r8g.xlarge
      - r8g.2xlarge
      - r8g.4xlarge
      - r8g.8xlarge
      - r8g.12xlarge
      - r8g.16xlarge
      - r8g.24xlarge
      - r8g.48xlarge
      - r8g.metal-24xl
      - r8g.metal-48xl
    ConstraintDescription: "Must be a valid EC2 instance type"

  InitialMeetAdminPassword:
    Description: 'Initial password for the "admin" user in OpenVidu Meet. If not provided, a random password will be generated.'
    Type: String
    NoEcho: true
    Default: ''
    # Only allow alphanumeric characters
    AllowedPattern: '^[A-Za-z0-9_-]*$'
    ConstraintDescription: 'Must contain only alphanumeric characters (A-Z, a-z, 0-9). Leave empty to generate a random password.'

  InitialMeetApiKey:
    Description: 'Initial API key for OpenVidu Meet. If not provided, no API key will be set and the user can set it later from Meet Console.'
    Type: String
    NoEcho: true
    Default: ''
    # Only allow alphanumeric characters
    AllowedPattern: '^[A-Za-z0-9_-]*$'
    ConstraintDescription: 'Must contain only alphanumeric characters (A-Z, a-z, 0-9). Leave empty to not set an initial API key.'

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
    AllowedPattern: ^.+$
    ConstraintDescription: must be the name of an existing EC2 KeyPair.

  OperatingSystem:
    Description: EC2 Operating System
    Type: String
    Default: "Ubuntu-24"
    AllowedValues: ['Ubuntu-22', 'Ubuntu-24']

  InitialNumberOfMediaNodes:
    Type: Number
    Default: 1
    Description: Number of initial media nodes to deploy

  MinNumberOfMediaNodes:
    Type: Number
    Default: 1
    Description: Minimum number of media nodes to deploy

  MaxNumberOfMediaNodes:
    Type: Number
    Default: 5
    Description: Maximum number of media nodes to deploy

  ScaleTargetCPU:
    Type: Number
    Default: 50
    Description: Target CPU percentage to scale up or down

  S3AppDataBucketName:
    Type: String
    Description: Name of the S3 bucket to store data and recordings. If empty, a bucket will be created

  S3ClusterDataBucketName:
    Type: String
    Description: Name of the S3 bucket to store cluster data. If empty, a bucket will be created

  AdditionalInstallFlags:
    Description: Additional optional flags to pass to the OpenVidu installer (comma-separated, e.g., "--flag1=value, --flag2").
    Type: String
    Default: ""
    AllowedPattern: '^[A-Za-z0-9, =_.\-]*$'  # Allows letters, numbers, comma, space, underscore, dot, equals, and hyphen
    ConstraintDescription: Must be a comma-separated list of flags (for example, --flag=value, --bool-flag).

  OpenViduVPC:
    Description: "Dedicated VPC for OpenVidu cluster"
    Type: AWS::EC2::VPC::Id
    AllowedPattern: ^.+$
    ConstraintDescription: You must specify a VPC ID

  OpenViduMasterNodeSubnets:
    Description: "Subnets for OpenVidu Master Node"
    Type: List<AWS::EC2::Subnet::Id>
    AllowedPattern: ^.+$
    ConstraintDescription: You must specify a list of subnet IDs

  OpenViduMediaNodeSubnets:
    Description: "Subnets for OpenVidu Media Nodes"
    Type: List<AWS::EC2::Subnet::Id>
    AllowedPattern: ^.+$
    ConstraintDescription: You must specify a list of subnet IDs

  MasterNodesDiskSize:
    Description: Size of the disk in GB
    Type: Number
    Default: 100
    MinValue: 50
    ConstraintDescription: The disk size must be at least 50 GB

Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
      - Label:
          default: Domain and Load Blancer configuration
        Parameters:
          - DomainName
          - OpenViduCertificateARN
      - Label:
          default: OpenVidu High Availability configuration
        Parameters:
          - OpenViduLicense
          - RTCEngine
      - Label:
          default: OpenVidu Meet configuration
        Parameters:
          - InitialMeetAdminPassword
          - InitialMeetApiKey
      - Label:
          default: EC2 Instance configuration
        Parameters:
          - MasterNodeInstanceType
          - MediaNodeInstanceType
          - KeyName
          - OperatingSystem
      - Label:
          default: Media Nodes Autoscaling Group configuration
        Parameters:
          - InitialNumberOfMediaNodes
          - MinNumberOfMediaNodes
          - MaxNumberOfMediaNodes
          - ScaleTargetCPU
      - Label:
          default: S3 bucket for application data, cluster data and recordings
        Parameters:
          - S3AppDataBucketName
          - S3ClusterDataBucketName
      - Label:
          default: VPC configuration
        Parameters:
          - OpenViduVPC
          - OpenViduMasterNodeSubnets
          - OpenViduMediaNodeSubnets
      - Label:
          default: Volumes configuration
        Parameters:
          - MasterNodesDiskSize
      - Label:
          default: "(Optional) Additional Installer Flags"
        Parameters:
          - AdditionalInstallFlags

Conditions:
  CreateRecordingsBucket: !Equals [!Ref S3AppDataBucketName, ""]
  CreateClusterDataBucket: !Equals [!Ref S3ClusterDataBucketName, ""]
  IsMasterGraviton: !Or
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 't4g']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'c6g']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'c6gd']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'c6gn']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'c7g']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'c7gd']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'c7gn']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'c8g']
    - !Or
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'c8gd']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'm6g']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'm6gd']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'm7g']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'm7gd']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'm8g']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'm8gd']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'r6g']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'r6gd']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'r7g']
    - !Or
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'r7gd']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'r8g']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'g5g']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'p6e-gb200']
  IsMediaGraviton: !Or
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 't4g']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'c6g']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'c6gd']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'c6gn']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'c7g']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'c7gd']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'c7gn']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'c8g']
    - !Or
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'c8gd']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'm6g']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'm6gd']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'm7g']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'm7gd']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'm8g']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'm8gd']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'r6g']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'r6gd']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'r7g']
    - !Or
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'r7gd']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'r8g']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'g5g']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'p6e-gb200']
  IsMasterNodeNvidia: !Or
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'g4dn']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'g5']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'g5g']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'g6']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'g6e']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'g6f']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'gr6']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'gr6f']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'g7e']
    - !Or
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'p4d']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'p4de']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'p5']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'p5e']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'p5en']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'p6-b200']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'p6-b300']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MasterNodeInstanceType ]], 'p6e-gb200']
  IsMediaNodeNvidia: !Or
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'g4dn']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'g5']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'g5g']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'g6']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'g6e']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'g6f']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'gr6']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'gr6f']
    - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'g7e']
    - !Or
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'p4d']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'p4de']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'p5']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'p5e']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'p5en']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'p6-b200']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'p6-b300']
      - !Equals [ !Select [ 0, !Split ['.', !Ref MediaNodeInstanceType ]], 'p6e-gb200']

Mappings:
  ArmImage:
  # aws ssm get-parameters-by-path --path "/aws/service/canonical/ubuntu/" --recursive --query "Parameters[*].Name"  > canonical-ami.txt
    Ubuntu-22:
      ImageId: '{{resolve:ssm:/aws/service/canonical/ubuntu/server/jammy/stable/current/arm64/hvm/ebs-gp2/ami-id}}'
    Ubuntu-24:
      ImageId: '{{resolve:ssm:/aws/service/canonical/ubuntu/server/noble/stable/current/arm64/hvm/ebs-gp3/ami-id}}'
  AmdImage:
    Ubuntu-22:
      ImageId: '{{resolve:ssm:/aws/service/canonical/ubuntu/server/jammy/stable/current/amd64/hvm/ebs-gp2/ami-id}}'
    Ubuntu-24:
      ImageId: '{{resolve:ssm:/aws/service/canonical/ubuntu/server/noble/stable/current/amd64/hvm/ebs-gp3/ami-id}}'

Resources:

  OpenViduSharedInfo:
    Type: AWS::SecretsManager::Secret
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Properties:
      Name: !Sub openvidu-ha-${AWS::Region}-${AWS::StackName}
      Description: Secret for OpenVidu High Availability to store deployment info and seed secret
      # All the values are initialized by one master node and shared with the rest of the nodes
      SecretString: |
        {
          "OPENVIDU_URL": "none",
          "MEET_INITIAL_ADMIN_USER": "none",
          "MEET_INITIAL_ADMIN_PASSWORD": "none",
          "MEET_INITIAL_API_KEY": "none",
          "LIVEKIT_URL": "none",
          "LIVEKIT_API_KEY": "none",
          "LIVEKIT_API_SECRET": "none",
          "DASHBOARD_URL": "none",
          "GRAFANA_URL": "none",
          "MINIO_URL": "none",
          "DOMAIN_NAME": "none",
          "OPENVIDU_PRO_LICENSE": "none",
          "OPENVIDU_RTC_ENGINE": "none",
          "REDIS_PASSWORD": "none",
          "MONGO_ADMIN_USERNAME": "none",
          "MONGO_ADMIN_PASSWORD": "none",
          "MONGO_REPLICA_SET_KEY": "none",
          "MINIO_ACCESS_KEY": "none",
          "MINIO_SECRET_KEY": "none",
          "DASHBOARD_ADMIN_USERNAME": "none",
          "DASHBOARD_ADMIN_PASSWORD": "none",
          "GRAFANA_ADMIN_USERNAME": "none",
          "GRAFANA_ADMIN_PASSWORD": "none",
          "ENABLED_MODULES": "none",
          "OPENVIDU_VERSION": "none",
          "ALL_SECRETS_GENERATED": "false"
        }

  # One SSM parameter per master: atomic per-key writes
  MasterNode1PrivateIpParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /openvidu/${AWS::StackName}/master-node-1-private-ip
      Type: String
      Value: "none"

  MasterNode2PrivateIpParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /openvidu/${AWS::StackName}/master-node-2-private-ip
      Type: String
      Value: "none"

  MasterNode3PrivateIpParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /openvidu/${AWS::StackName}/master-node-3-private-ip
      Type: String
      Value: "none"

  MasterNode4PrivateIpParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /openvidu/${AWS::StackName}/master-node-4-private-ip
      Type: String
      Value: "none"

  S3AppDataBucketResource:
    Type: 'AWS::S3::Bucket'
    Properties:
      ### Unique bucket name using Stack ID
      BucketName: !Join ["-" , [ 'openvidu-appdata', !Select [0, !Split ["-", !Select [2, !Split [/, !Ref AWS::StackId ]]]]]]
      AccessControl: Private
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls : true
        RestrictPublicBuckets: true
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Condition: CreateRecordingsBucket

  S3ClusterDataBucketResource:
    Type: 'AWS::S3::Bucket'
    Properties:
      ### Unique bucket name using Stack ID
      BucketName: !Join ["-" , [ 'openvidu-clusterdata', !Select [0, !Split ["-", !Select [2, !Split [/, !Ref AWS::StackId ]]]]]]
      AccessControl: Private
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls : true
        RestrictPublicBuckets: true
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Condition: CreateClusterDataBucket

  # -------------------------
  # Normalize the master node subnet list to exactly 4 entries, one per OpenVidu Master Node
  # -------------------------
  SubnetProcessorFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub 'SubnetProcessor-${AWS::Region}-${AWS::StackName}'
      Handler: index.lambda_handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        ZipFile: |
          import cfnresponse

          def lambda_handler(event, context):
              try:
                  # Process event data
                  subnets = event['ResourceProperties']['Subnets']

                  # Ensure we have at least four subnets by cycling through the available subnets
                  subnets = (subnets * 4)[:4]  # Repeat the list to have at least 4 elements and then take the first 4

                  # Prepare the response
                  responseData = {
                      'Subnet1': subnets[0],
                      'Subnet2': subnets[1],
                      'Subnet3': subnets[2],
                      'Subnet4': subnets[3],
                  }
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)

              except Exception as e:
                  cfnresponse.send(event, context, cfnresponse.FAILED, {'Message': str(e)})


      Runtime: python3.12
      Timeout: 120

  SubnetProcessor:
    Type: Custom::SubnetProcessor
    Properties:
      ServiceToken: !GetAtt SubnetProcessorFunction.Arn
      Subnets: !Ref OpenViduMasterNodeSubnets

  LambdaLogGroup:
    UpdateReplacePolicy: Retain
    DeletionPolicy: Delete
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/aws/lambda/SubnetProcessor-${AWS::Region}-${AWS::StackName}'
      RetentionInDays: 7

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: LambdaLogsPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/SubnetProcessor-${AWS::Region}-${AWS::StackName}:*'

  OpenViduMasterNodeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: "/"
      Policies:
        - PolicyName: !Sub openvidu-master-policy-${AWS::Region}-${AWS::StackName}
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - autoscaling:SetInstanceHealth
                Resource: '*'
                Condition:
                  StringEquals:
                    'aws:ResourceTag/aws:cloudformation:stack-id': !Ref 'AWS::StackId'
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                  - secretsmanager:UpdateSecret
                Resource: !Ref OpenViduSharedInfo
              - Effect: Allow
                Action:
                  - ssm:GetParameter
                  - ssm:PutParameter
                Resource: !Sub arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/openvidu/${AWS::StackName}/*
              - Fn::If:
                - CreateRecordingsBucket
                - Effect: Allow
                  Action:
                    - s3:DeleteObject
                    - s3:GetObject
                    - s3:PutObject
                  Resource: !Sub ${S3AppDataBucketResource.Arn}/*
                - Effect: Allow
                  Action:
                    - s3:DeleteObject
                    - s3:GetObject
                    - s3:PutObject
                  Resource: !Sub arn:${AWS::Partition}:s3:::${S3AppDataBucketName}/*
              - Fn::If:
                - CreateRecordingsBucket
                - Effect: Allow
                  Action:
                    - s3:ListBucket
                    - s3:GetBucketLocation
                  Resource: !GetAtt S3AppDataBucketResource.Arn
                - Effect: Allow
                  Action:
                    - s3:ListBucket
                    - s3:GetBucketLocation
                  Resource: !Sub arn:${AWS::Partition}:s3:::${S3AppDataBucketName}
              - Fn::If:
                - CreateClusterDataBucket
                - Effect: Allow
                  Action:
                    - s3:DeleteObject
                    - s3:GetObject
                    - s3:PutObject
                  Resource: !Sub ${S3ClusterDataBucketResource.Arn}/*
                - Effect: Allow
                  Action:
                    - s3:DeleteObject
                    - s3:GetObject
                    - s3:PutObject
                  Resource: !Sub arn:${AWS::Partition}:s3:::${S3ClusterDataBucketName}/*
              - Fn::If:
                - CreateClusterDataBucket
                - Effect: Allow
                  Action:
                    - s3:ListBucket
                    - s3:GetBucketLocation
                  Resource: !GetAtt S3ClusterDataBucketResource.Arn
                - Effect: Allow
                  Action:
                    - s3:ListBucket
                    - s3:GetBucketLocation
                  Resource: !Sub arn:${AWS::Partition}:s3:::${S3ClusterDataBucketName}
      RoleName:
        Fn::Join:
          # Generate a not too long and unique role name
          # Getting a unique identifier from the stack id
          - ''
          - - openvidu-master-role-
            - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]

  OpenViduMediaNodeRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
           - !Sub arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: !Sub openvidu-media-policy-${AWS::Region}-${AWS::StackName}
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                Resource: !Ref OpenViduSharedInfo
              - Effect: Allow
                Action:
                  - ssm:GetParameter
                Resource: !Sub arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/openvidu/${AWS::StackName}/*
              - Effect: Allow
                Action:
                  - autoscaling:SetInstanceHealth
                  - autoscaling:CompleteLifecycleAction
                  - autoscaling:RecordLifecycleActionHeartbeat
                Resource: '*'
                Condition:
                  StringEquals:
                    'aws:ResourceTag/aws:cloudformation:stack-name': !Ref 'AWS::StackName'
              - Fn::If:
                - CreateRecordingsBucket
                - Effect: Allow
                  Action:
                    - s3:DeleteObject
                    - s3:GetObject
                    - s3:PutObject
                  Resource: !Sub ${S3AppDataBucketResource.Arn}/*
                - Effect: Allow
                  Action:
                    - s3:DeleteObject
                    - s3:GetObject
                    - s3:PutObject
                  Resource: !Sub arn:${AWS::Partition}:s3:::${S3AppDataBucketName}/*
              - Fn::If:
                - CreateRecordingsBucket
                - Effect: Allow
                  Action:
                    - s3:ListBucket
                    - s3:GetBucketLocation
                  Resource: !GetAtt S3AppDataBucketResource.Arn
                - Effect: Allow
                  Action:
                    - s3:ListBucket
                    - s3:GetBucketLocation
                  Resource: !Sub arn:${AWS::Partition}:s3:::${S3AppDataBucketName}
      RoleName:
        Fn::Join:
          # Generate a not too long and unique role name
          # Getting a unique identifier from the stack id
          - ''
          - - openvidu-media-role-
            - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]

  OpenViduMasterInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub OpenViduMasterInstanceProfile-${AWS::Region}-${AWS::StackName}
      Roles:
        - !Ref OpenViduMasterNodeRole

  OpenViduMediaInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub OpenViduMediaInstanceProfile-${AWS::Region}-${AWS::StackName}
      Roles:
        - !Ref OpenViduMediaNodeRole

  OpenViduMasterLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Metadata:
      Comment: Launch template for OpenVidu Master Node
      AWS::CloudFormation::Init:
        config:
          files:
            '/usr/local/bin/install.sh':
              content: !Sub |
                #!/bin/bash -x
                set -e
                OPENVIDU_VERSION=main
                DOMAIN=
                YQ_VERSION=v4.53.3

                # Install dependencies
                apt-get update && apt-get install -y \
                  curl \
                  unzip \
                  jq \
                  wget
                wget https://github.com/mikefarah/yq/releases/download/${!YQ_VERSION}/yq_linux_$(dpkg --print-architecture).tar.gz -O - |\
                  tar xz && mv yq_linux_$(dpkg --print-architecture) /usr/bin/yq

                AWS_CLI_VERSION=2.35.5
                # Install aws-cli if not already installed
                if ! command -v aws &> /dev/null; then
                  curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m)-${!AWS_CLI_VERSION}.zip" -o "awscliv2.zip"
                  unzip -qq awscliv2.zip
                  ./aws/install
                  rm -rf awscliv2.zip aws
                fi

                # Signal to notify instance is waiting
                SIGNAL_NAME="$1"

                # Exported earlier in this instance's UserData
                MASTER_NODE_NUM="${!MASTER_NODE_NUM}"

                # Token for IMDSv2
                TOKEN="$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")"

                # Get own private IP
                PRIVATE_IP="$(curl -H "X-aws-ec2-metadata-token: $TOKEN" -s http://169.254.169.254/latest/meta-data/local-ipv4)"

                if [[ "$PRIVATE_IP" == "" ]]; then
                  echo "Error: Private IP not found"
                  exit 1
                fi

                aws ssm put-parameter \
                  --region ${AWS::Region} \
                  --name "/openvidu/${AWS::StackName}/master-node-${!MASTER_NODE_NUM}-private-ip" \
                  --value "${!PRIVATE_IP}" \
                  --type String \
                  --overwrite > /dev/null

                SHARED_SECRET=$(aws secretsmanager get-secret-value \
                  --region ${AWS::Region} \
                  --secret-id openvidu-ha-${AWS::Region}-${AWS::StackName} \
                  --query SecretString --output text)
                ALL_SECRETS_GENERATED=$(echo "$SHARED_SECRET" | jq -r '.ALL_SECRETS_GENERATED')

                # If the private IP is the same as the first master node, generate the secrets
                if [[ $MASTER_NODE_NUM -eq 1 ]] && [[ "$ALL_SECRETS_GENERATED" == "false" ]]; then
                  DOMAIN="$(/usr/local/bin/store_secret.sh save DOMAIN_NAME "${DomainName}")"
                  # Publish access URLs early so other nodes can read them during phase 2
                  # (idempotent: after_install rewrites these same byte-identical values later)
                  /usr/local/bin/store_secret.sh save OPENVIDU_URL "https://${!DOMAIN}/"
                  /usr/local/bin/store_secret.sh save LIVEKIT_URL "wss://${!DOMAIN}/"
                  /usr/local/bin/store_secret.sh save DASHBOARD_URL "https://${!DOMAIN}/dashboard/"
                  /usr/local/bin/store_secret.sh save GRAFANA_URL "https://${!DOMAIN}/grafana/"
                  /usr/local/bin/store_secret.sh save MINIO_URL "https://${!DOMAIN}/minio-console/"
                  OPENVIDU_PRO_LICENSE="$(/usr/local/bin/store_secret.sh save OPENVIDU_PRO_LICENSE "${OpenViduLicense}")"
                  OPENVIDU_RTC_ENGINE="$(/usr/local/bin/store_secret.sh save OPENVIDU_RTC_ENGINE "${RTCEngine}")"
                  # Store version so media nodes can use it to install the same version
                  /usr/local/bin/store_secret.sh save OPENVIDU_VERSION "${!OPENVIDU_VERSION}"

                  # Meet initial admin user and password
                  MEET_INITIAL_ADMIN_USER="$(/usr/local/bin/store_secret.sh save MEET_INITIAL_ADMIN_USER "admin")"
                  if [[ "${InitialMeetAdminPassword}" != '' ]]; then
                    MEET_INITIAL_ADMIN_PASSWORD="$(/usr/local/bin/store_secret.sh save MEET_INITIAL_ADMIN_PASSWORD "${InitialMeetAdminPassword}")"
                  else
                    MEET_INITIAL_ADMIN_PASSWORD="$(/usr/local/bin/store_secret.sh generate MEET_INITIAL_ADMIN_PASSWORD)"
                  fi
                  if [[ "${InitialMeetApiKey}" != '' ]]; then
                    MEET_INITIAL_API_KEY="$(/usr/local/bin/store_secret.sh save MEET_INITIAL_API_KEY "${InitialMeetApiKey}")"
                  else
                    MEET_INITIAL_API_KEY="$(/usr/local/bin/store_secret.sh save MEET_INITIAL_API_KEY "")"
                  fi

                  # Store usernames and generate random passwords
                  REDIS_PASSWORD="$(/usr/local/bin/store_secret.sh generate REDIS_PASSWORD)"
                  MONGO_ADMIN_USERNAME="$(/usr/local/bin/store_secret.sh save MONGO_ADMIN_USERNAME "mongoadmin")"
                  MONGO_ADMIN_PASSWORD="$(/usr/local/bin/store_secret.sh generate MONGO_ADMIN_PASSWORD)"
                  MONGO_REPLICA_SET_KEY="$(/usr/local/bin/store_secret.sh generate MONGO_REPLICA_SET_KEY)"
                  MINIO_ACCESS_KEY="$(/usr/local/bin/store_secret.sh save MINIO_ACCESS_KEY "minioadmin")"
                  MINIO_SECRET_KEY="$(/usr/local/bin/store_secret.sh generate MINIO_SECRET_KEY)"
                  DASHBOARD_ADMIN_USERNAME="$(/usr/local/bin/store_secret.sh save DASHBOARD_ADMIN_USERNAME "dashboardadmin")"
                  DASHBOARD_ADMIN_PASSWORD="$(/usr/local/bin/store_secret.sh generate DASHBOARD_ADMIN_PASSWORD)"
                  GRAFANA_ADMIN_USERNAME="$(/usr/local/bin/store_secret.sh save GRAFANA_ADMIN_USERNAME "grafanaadmin")"
                  GRAFANA_ADMIN_PASSWORD="$(/usr/local/bin/store_secret.sh generate GRAFANA_ADMIN_PASSWORD)"
                  LIVEKIT_API_KEY="$(/usr/local/bin/store_secret.sh generate LIVEKIT_API_KEY "API" 12)"
                  LIVEKIT_API_SECRET="$(/usr/local/bin/store_secret.sh generate LIVEKIT_API_SECRET)"
                  ENABLED_MODULES="$(/usr/local/bin/store_secret.sh save ENABLED_MODULES "observability,v2compatibility,openviduMeet")"
                  ALL_SECRETS_GENERATED="$(/usr/local/bin/store_secret.sh save ALL_SECRETS_GENERATED "true")"
                fi

                # Fetch the shared secret again, waiting until master-1 has generated all secrets.
                # Bounded (up to 900s at 5s): a genuinely stuck master-1 still surfaces after the deadline.
                SECRETS_WAIT_ATTEMPTS=0
                SECRETS_WAIT_MAX=180
                while true; do
                  SHARED_SECRET=$(aws secretsmanager get-secret-value \
                    --region ${AWS::Region} \
                    --secret-id openvidu-ha-${AWS::Region}-${AWS::StackName} \
                    --query SecretString --output text || echo 'none')

                  ALL_SECRETS_GENERATED=$(echo "$SHARED_SECRET" | jq -r '.ALL_SECRETS_GENERATED')
                  if [[ "${!ALL_SECRETS_GENERATED}" == "true" ]]; then
                    break
                  fi

                  SECRETS_WAIT_ATTEMPTS=$((SECRETS_WAIT_ATTEMPTS + 1))
                  if [[ $SECRETS_WAIT_ATTEMPTS -ge $SECRETS_WAIT_MAX ]]; then
                    echo "Error: Secrets not generated"
                    exit 1
                  fi
                  sleep 5
                done

                # sending the signal call
                cfn-signal -e $? --stack ${AWS::StackId} --resource "$SIGNAL_NAME" --region ${AWS::Region}

                IP_WAIT_ATTEMPTS=0
                IP_WAIT_MAX=360
                while true; do
                  MASTER_NODE_1_PRIVATE_IP=$(aws ssm get-parameter --region ${AWS::Region} --name "/openvidu/${AWS::StackName}/master-node-1-private-ip" --query Parameter.Value --output text 2>/dev/null || echo 'none')
                  MASTER_NODE_2_PRIVATE_IP=$(aws ssm get-parameter --region ${AWS::Region} --name "/openvidu/${AWS::StackName}/master-node-2-private-ip" --query Parameter.Value --output text 2>/dev/null || echo 'none')
                  MASTER_NODE_3_PRIVATE_IP=$(aws ssm get-parameter --region ${AWS::Region} --name "/openvidu/${AWS::StackName}/master-node-3-private-ip" --query Parameter.Value --output text 2>/dev/null || echo 'none')
                  MASTER_NODE_4_PRIVATE_IP=$(aws ssm get-parameter --region ${AWS::Region} --name "/openvidu/${AWS::StackName}/master-node-4-private-ip" --query Parameter.Value --output text 2>/dev/null || echo 'none')

                  # Check if all master nodes have published their private IPs
                  if [[ "$MASTER_NODE_1_PRIVATE_IP" != "none" ]] && [[ -n "$MASTER_NODE_1_PRIVATE_IP" ]] &&
                      [[ "$MASTER_NODE_2_PRIVATE_IP" != "none" ]] && [[ -n "$MASTER_NODE_2_PRIVATE_IP" ]] &&
                      [[ "$MASTER_NODE_3_PRIVATE_IP" != "none" ]] && [[ -n "$MASTER_NODE_3_PRIVATE_IP" ]] &&
                      [[ "$MASTER_NODE_4_PRIVATE_IP" != "none" ]] && [[ -n "$MASTER_NODE_4_PRIVATE_IP" ]]; then
                    break
                  fi

                  IP_WAIT_ATTEMPTS=$((IP_WAIT_ATTEMPTS + 1))
                  if [[ $IP_WAIT_ATTEMPTS -ge $IP_WAIT_MAX ]]; then
                    echo "Error: timed out after 30 minutes waiting for all master nodes to publish their private IPs to SSM"
                    exit 1
                  fi
                  sleep 5
                done

                # Comma-separated 1-4: must match installer's --master-node-private-ip-list format
                MASTER_NODE_PRIVATE_IP_LIST="$MASTER_NODE_1_PRIVATE_IP,$MASTER_NODE_2_PRIVATE_IP,$MASTER_NODE_3_PRIVATE_IP,$MASTER_NODE_4_PRIVATE_IP"

                # Re-read: other (non-IP) values still come from the shared secret.
                # GetSecretValue is eventually consistent: retry until a read returns the generated values
                SECRET_READ_ATTEMPTS=0
                while true; do
                  SHARED_SECRET=$(aws secretsmanager get-secret-value \
                    --region ${AWS::Region} \
                    --secret-id openvidu-ha-${AWS::Region}-${AWS::StackName} \
                    --query SecretString --output text)
                  if echo "$SHARED_SECRET" | jq -e '(.ALL_SECRETS_GENERATED == "true") and ([.DOMAIN_NAME, .OPENVIDU_VERSION, .REDIS_PASSWORD, .MONGO_ADMIN_PASSWORD, .MONGO_REPLICA_SET_KEY, .MINIO_SECRET_KEY, .DASHBOARD_ADMIN_PASSWORD, .GRAFANA_ADMIN_PASSWORD, .LIVEKIT_API_KEY, .LIVEKIT_API_SECRET] | all(. != "none"))' > /dev/null; then
                    break
                  fi
                  SECRET_READ_ATTEMPTS=$((SECRET_READ_ATTEMPTS + 1))
                  if [[ $SECRET_READ_ATTEMPTS -ge 60 ]]; then
                    echo "Error: shared secret still incomplete after 5 minutes of stale reads"
                    exit 1
                  fi
                  sleep 5
                done

                DOMAIN=$(echo "$SHARED_SECRET" | jq -r '.DOMAIN_NAME')
                OPENVIDU_PRO_LICENSE=$(echo "$SHARED_SECRET" | jq -r '.OPENVIDU_PRO_LICENSE')
                OPENVIDU_RTC_ENGINE=$(echo "$SHARED_SECRET" | jq -r '.OPENVIDU_RTC_ENGINE')
                REDIS_PASSWORD=$(echo "$SHARED_SECRET" | jq -r '.REDIS_PASSWORD')
                MONGO_ADMIN_USERNAME=$(echo "$SHARED_SECRET" | jq -r '.MONGO_ADMIN_USERNAME')
                MONGO_ADMIN_PASSWORD=$(echo "$SHARED_SECRET" | jq -r '.MONGO_ADMIN_PASSWORD')
                MONGO_REPLICA_SET_KEY=$(echo "$SHARED_SECRET" | jq -r '.MONGO_REPLICA_SET_KEY')
                MINIO_ACCESS_KEY=$(echo "$SHARED_SECRET" | jq -r '.MINIO_ACCESS_KEY')
                MINIO_SECRET_KEY=$(echo "$SHARED_SECRET" | jq -r '.MINIO_SECRET_KEY')
                DASHBOARD_ADMIN_USERNAME=$(echo "$SHARED_SECRET" | jq -r '.DASHBOARD_ADMIN_USERNAME')
                DASHBOARD_ADMIN_PASSWORD=$(echo "$SHARED_SECRET" | jq -r '.DASHBOARD_ADMIN_PASSWORD')
                GRAFANA_ADMIN_USERNAME=$(echo "$SHARED_SECRET" | jq -r '.GRAFANA_ADMIN_USERNAME')
                GRAFANA_ADMIN_PASSWORD=$(echo "$SHARED_SECRET" | jq -r '.GRAFANA_ADMIN_PASSWORD')
                MEET_INITIAL_ADMIN_USER=$(echo "$SHARED_SECRET" | jq -r '.MEET_INITIAL_ADMIN_USER')
                MEET_INITIAL_ADMIN_PASSWORD=$(echo "$SHARED_SECRET" | jq -r '.MEET_INITIAL_ADMIN_PASSWORD')
                MEET_INITIAL_API_KEY=""
                if [[ "${InitialMeetApiKey}" != '' ]]; then
                  MEET_INITIAL_API_KEY=$(echo "$SHARED_SECRET" | jq -r '.MEET_INITIAL_API_KEY')
                fi
                LIVEKIT_API_KEY=$(echo "$SHARED_SECRET" | jq -r '.LIVEKIT_API_KEY')
                LIVEKIT_API_SECRET=$(echo "$SHARED_SECRET" | jq -r '.LIVEKIT_API_SECRET')
                ENABLED_MODULES=$(echo "$SHARED_SECRET" | jq -r '.ENABLED_MODULES')

                # Download first: sh <(curl ...) would silently run an empty script on a transient curl failure
                INSTALLER_SCRIPT="/tmp/install_ov_master_node.sh"
                curl -fsSL --retry 8 --retry-all-errors --retry-delay 5 -o "$INSTALLER_SCRIPT" "http://get.openvidu.io/pro/ha/$OPENVIDU_VERSION/install_ov_master_node.sh"
                if [ ! -s "$INSTALLER_SCRIPT" ]; then
                  echo "Downloaded OpenVidu master node installer is empty or missing" >&2
                  exit 1
                fi
                INSTALL_COMMAND="sh $INSTALLER_SCRIPT"

                # Common arguments
                COMMON_ARGS=(
                  "--no-tty"
                  "--install"
                  "--environment=aws"
                  "--deployment-type='ha'"
                  "--node-role='master-node'"
                  "--external-load-balancer"
                  "--master-node-private-ip-list='$MASTER_NODE_PRIVATE_IP_LIST'"
                  "--openvidu-pro-license='$OPENVIDU_PRO_LICENSE'"
                  "--domain-name='$DOMAIN'"
                  "--enabled-modules='$ENABLED_MODULES'"
                  "--rtc-engine=$OPENVIDU_RTC_ENGINE"
                  "--redis-password=$REDIS_PASSWORD"
                  "--mongo-admin-user=$MONGO_ADMIN_USERNAME"
                  "--mongo-admin-password=$MONGO_ADMIN_PASSWORD"
                  "--mongo-replica-set-key=$MONGO_REPLICA_SET_KEY"
                  "--minio-access-key=$MINIO_ACCESS_KEY"
                  "--minio-secret-key=$MINIO_SECRET_KEY"
                  "--dashboard-admin-user=$DASHBOARD_ADMIN_USERNAME"
                  "--dashboard-admin-password=$DASHBOARD_ADMIN_PASSWORD"
                  "--grafana-admin-user=$GRAFANA_ADMIN_USERNAME"
                  "--grafana-admin-password=$GRAFANA_ADMIN_PASSWORD"
                  "--meet-initial-admin-password=$MEET_INITIAL_ADMIN_PASSWORD"
                  "--meet-initial-api-key=$MEET_INITIAL_API_KEY"
                  "--livekit-api-key=$LIVEKIT_API_KEY"
                  "--livekit-api-secret=$LIVEKIT_API_SECRET"
                )

                # Include additional installer flags provided by the user
                if [[ "${AdditionalInstallFlags}" != "" ]]; then
                  IFS=',' read -ra EXTRA_FLAGS <<< "${AdditionalInstallFlags}"
                  for extra_flag in "${!EXTRA_FLAGS[@]}"; do
                    # Trim whitespace around each flag
                    extra_flag="$(echo -e "${!extra_flag}" | sed -e 's/^[ \t]*//' -e 's/[ \t]*$//')"
                    if [[ "$extra_flag" != "" ]]; then
                      COMMON_ARGS+=("$extra_flag")
                    fi
                  done
                fi

                # Construct the final command
                FINAL_COMMAND="$INSTALL_COMMAND $(printf "%s " "${!COMMON_ARGS[@]}")"

                # Install OpenVidu
                exec bash -c "$FINAL_COMMAND"

              mode: '000755'
              owner: root
              group: root
            '/usr/local/bin/config_s3.sh':
              content: !Sub
                - |
                  #!/bin/bash
                  set -e

                  # Install dir and config dir
                  INSTALL_DIR="/opt/openvidu"
                  CLUSTER_CONFIG_DIR="${!INSTALL_DIR}/config/cluster"

                  # Config S3 bucket
                  EXTERNAL_S3_ENDPOINT="https://s3.${AWS::Region}.amazonaws.com"
                  EXTERNAL_S3_REGION="${AWS::Region}"
                  EXTERNAL_S3_PATH_STYLE_ACCESS="false"
                  EXTERNAL_S3_BUCKET_APP_DATA=${S3AppDataBucketResourceName}
                  EXTERNAL_S3_BUCKET_CLUSTER_DATA=${S3ClusterDataBucketResourceName}
                  sed -i "s|EXTERNAL_S3_ENDPOINT=.*|EXTERNAL_S3_ENDPOINT=$EXTERNAL_S3_ENDPOINT|" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                  sed -i "s|EXTERNAL_S3_REGION=.*|EXTERNAL_S3_REGION=$EXTERNAL_S3_REGION|" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                  sed -i "s|EXTERNAL_S3_PATH_STYLE_ACCESS=.*|EXTERNAL_S3_PATH_STYLE_ACCESS=$EXTERNAL_S3_PATH_STYLE_ACCESS|" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                  sed -i "s|EXTERNAL_S3_BUCKET_APP_DATA=.*|EXTERNAL_S3_BUCKET_APP_DATA=$EXTERNAL_S3_BUCKET_APP_DATA|" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                  sed -i "s|EXTERNAL_S3_BUCKET_CLUSTER_DATA=.*|EXTERNAL_S3_BUCKET_CLUSTER_DATA=$EXTERNAL_S3_BUCKET_CLUSTER_DATA|" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                - S3AppDataBucketResourceName: !If
                    - CreateRecordingsBucket
                    - !Ref S3AppDataBucketResource
                    - !Ref S3AppDataBucketName
                  S3ClusterDataBucketResourceName: !If
                    - CreateClusterDataBucket
                    - !Ref S3ClusterDataBucketResource
                    - !Ref S3ClusterDataBucketName
              mode: "000755"
              owner: "root"
              group: "root"
            '/usr/local/bin/after_install.sh':
              content: !Sub |
                #!/bin/bash
                set -e
                # Only master 1 writes the shared secret, to avoid a lost-update race
                if [[ "${!MASTER_NODE_NUM:-}" != "1" ]]; then
                  exit 0
                fi
                # Get current shared secret
                SHARED_SECRET=$(aws secretsmanager get-secret-value \
                  --region ${AWS::Region} \
                  --secret-id openvidu-ha-${AWS::Region}-${AWS::StackName} \
                  --query SecretString --output text)

                # Save access URLs
                DOMAIN=$(echo "$SHARED_SECRET" | jq -r '.DOMAIN_NAME')
                OPENVIDU_URL="https://${!DOMAIN}/"
                LIVEKIT_URL="wss://${!DOMAIN}/"
                DASHBOARD_URL="https://${!DOMAIN}/dashboard/"
                GRAFANA_URL="https://${!DOMAIN}/grafana/"
                MINIO_URL="https://${!DOMAIN}/minio-console/"

                # Update shared secret
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"OPENVIDU_URL": "'"$OPENVIDU_URL"'" }')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"LIVEKIT_URL": "'"$LIVEKIT_URL"'" }')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"DOMAIN_NAME": "'"$DOMAIN"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"DASHBOARD_URL": "'"$DASHBOARD_URL"'" }')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"GRAFANA_URL": "'"$GRAFANA_URL"'" }')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"MINIO_URL": "'"$MINIO_URL"'" }')"

                # Update shared secret
                aws secretsmanager update-secret \
                  --region ${AWS::Region} \
                  --secret-id openvidu-ha-${AWS::Region}-${AWS::StackName} \
                  --secret-string "$SHARED_SECRET"
              mode: "000755"
              owner: "root"
              group: "root"
            '/usr/local/bin/update_config_from_secret.sh':
              content: !Sub |
                #!/bin/bash
                set -e
                # Token for IMDSv2
                TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
                # Get current shared secret
                SHARED_SECRET=$(aws secretsmanager get-secret-value \
                  --region ${AWS::Region} \
                  --secret-id openvidu-ha-${AWS::Region}-${AWS::StackName} \
                  --query SecretString --output text)

                # Installation directory
                INSTALL_DIR="/opt/openvidu"
                CLUSTER_CONFIG_DIR="${!INSTALL_DIR}/config/cluster"
                MASTER_NODE_CONFIG_DIR="${!INSTALL_DIR}/config/node"

                # Replace DOMAIN_NAME
                export DOMAIN=$(echo $SHARED_SECRET | jq -r .DOMAIN_NAME)
                if [[ -n "$DOMAIN" ]]; then
                  sed -i "s/DOMAIN_NAME=.*/DOMAIN_NAME=$DOMAIN/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                else
                  exit 1
                fi

                # Replace rest of the values
                sed -i "s/REDIS_PASSWORD=.*/REDIS_PASSWORD=$(echo $SHARED_SECRET | jq -r .REDIS_PASSWORD)/" "${!MASTER_NODE_CONFIG_DIR}/master_node.env"
                sed -i "s/OPENVIDU_RTC_ENGINE=.*/OPENVIDU_RTC_ENGINE=$(echo $SHARED_SECRET | jq -r .OPENVIDU_RTC_ENGINE)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                sed -i "s/OPENVIDU_PRO_LICENSE=.*/OPENVIDU_PRO_LICENSE=$(echo $SHARED_SECRET | jq -r .OPENVIDU_PRO_LICENSE)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                sed -i "s/MONGO_ADMIN_USERNAME=.*/MONGO_ADMIN_USERNAME=$(echo $SHARED_SECRET | jq -r .MONGO_ADMIN_USERNAME)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                sed -i "s/MONGO_ADMIN_PASSWORD=.*/MONGO_ADMIN_PASSWORD=$(echo $SHARED_SECRET | jq -r .MONGO_ADMIN_PASSWORD)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                sed -i "s/DASHBOARD_ADMIN_USERNAME=.*/DASHBOARD_ADMIN_USERNAME=$(echo $SHARED_SECRET | jq -r .DASHBOARD_ADMIN_USERNAME)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                sed -i "s/DASHBOARD_ADMIN_PASSWORD=.*/DASHBOARD_ADMIN_PASSWORD=$(echo $SHARED_SECRET | jq -r .DASHBOARD_ADMIN_PASSWORD)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                sed -i "s/MINIO_ACCESS_KEY=.*/MINIO_ACCESS_KEY=$(echo $SHARED_SECRET | jq -r .MINIO_ACCESS_KEY)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                sed -i "s/MINIO_SECRET_KEY=.*/MINIO_SECRET_KEY=$(echo $SHARED_SECRET | jq -r .MINIO_SECRET_KEY)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                sed -i "s/GRAFANA_ADMIN_USERNAME=.*/GRAFANA_ADMIN_USERNAME=$(echo $SHARED_SECRET | jq -r .GRAFANA_ADMIN_USERNAME)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                sed -i "s/GRAFANA_ADMIN_PASSWORD=.*/GRAFANA_ADMIN_PASSWORD=$(echo $SHARED_SECRET | jq -r .GRAFANA_ADMIN_PASSWORD)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                sed -i "s/LIVEKIT_API_KEY=.*/LIVEKIT_API_KEY=$(echo $SHARED_SECRET | jq -r .LIVEKIT_API_KEY)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                sed -i "s/LIVEKIT_API_SECRET=.*/LIVEKIT_API_SECRET=$(echo $SHARED_SECRET | jq -r .LIVEKIT_API_SECRET)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"
                sed -i "s/MEET_INITIAL_ADMIN_USER=.*/MEET_INITIAL_ADMIN_USER=$(echo $SHARED_SECRET | jq -r .MEET_INITIAL_ADMIN_USER)/" "${!CLUSTER_CONFIG_DIR}/master_node/meet.env"
                sed -i "s/MEET_INITIAL_ADMIN_PASSWORD=.*/MEET_INITIAL_ADMIN_PASSWORD=$(echo $SHARED_SECRET | jq -r .MEET_INITIAL_ADMIN_PASSWORD)/" "${!CLUSTER_CONFIG_DIR}/master_node/meet.env"
                if [[ "${InitialMeetApiKey}" != '' ]]; then
                  sed -i "s/MEET_INITIAL_API_KEY=.*/MEET_INITIAL_API_KEY=$(echo $SHARED_SECRET | jq -r .MEET_INITIAL_API_KEY)/" "${!CLUSTER_CONFIG_DIR}/master_node/meet.env"
                fi
                sed -i "s/ENABLED_MODULES=.*/ENABLED_MODULES=$(echo $SHARED_SECRET | jq -r .ENABLED_MODULES)/" "${!CLUSTER_CONFIG_DIR}/openvidu.env"

                # Update URLs in secret
                OPENVIDU_URL="https://${!DOMAIN}/"
                LIVEKIT_URL="wss://${!DOMAIN}/"
                DASHBOARD_URL="https://${!DOMAIN}/dashboard/"
                GRAFANA_URL="https://${!DOMAIN}/grafana/"
                MINIO_URL="https://${!DOMAIN}/minio-console/"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"OPENVIDU_URL": "'"$OPENVIDU_URL"'" }')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"LIVEKIT_URL": "'"$LIVEKIT_URL"'" }')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"DOMAIN_NAME": "'"$DOMAIN"'" }')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"DASHBOARD_URL": "'"$DASHBOARD_URL"'" }')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"GRAFANA_URL": "'"$GRAFANA_URL"'" }')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"MINIO_URL": "'"$MINIO_URL"'" }')"
                aws secretsmanager update-secret \
                  --region ${AWS::Region} \
                  --secret-id openvidu-ha-${AWS::Region}-${AWS::StackName} \
                  --secret-string "$SHARED_SECRET"
              mode: "000755"
              owner: "root"
              group: "root"
            '/usr/local/bin/update_secret_from_config.sh':
              content: !Sub |
                #!/bin/bash
                set -e
                # Get current shared secret
                SHARED_SECRET=$(aws secretsmanager get-secret-value \
                  --region ${AWS::Region} \
                  --secret-id openvidu-ha-${AWS::Region}-${AWS::StackName} \
                  --query SecretString --output text)

                # Installation directory
                INSTALL_DIR="/opt/openvidu"
                CLUSTER_CONFIG_DIR="${!INSTALL_DIR}/config/cluster"
                MASTER_NODE_CONFIG_DIR="${!INSTALL_DIR}/config/node"


                # Update shared secret
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"REDIS_PASSWORD": "'"$(/usr/local/bin/get_value_from_config.sh REDIS_PASSWORD "${!MASTER_NODE_CONFIG_DIR}/master_node.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"DOMAIN_NAME": "'"$(/usr/local/bin/get_value_from_config.sh DOMAIN_NAME "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"OPENVIDU_RTC_ENGINE": "'"$(/usr/local/bin/get_value_from_config.sh OPENVIDU_RTC_ENGINE "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"OPENVIDU_PRO_LICENSE": "'"$(/usr/local/bin/get_value_from_config.sh OPENVIDU_PRO_LICENSE "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"MONGO_ADMIN_USERNAME": "'"$(/usr/local/bin/get_value_from_config.sh MONGO_ADMIN_USERNAME "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"MONGO_ADMIN_PASSWORD": "'"$(/usr/local/bin/get_value_from_config.sh MONGO_ADMIN_PASSWORD "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"MINIO_ACCESS_KEY": "'"$(/usr/local/bin/get_value_from_config.sh MINIO_ACCESS_KEY "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"MINIO_SECRET_KEY": "'"$(/usr/local/bin/get_value_from_config.sh MINIO_SECRET_KEY "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"DASHBOARD_ADMIN_USERNAME": "'"$(/usr/local/bin/get_value_from_config.sh DASHBOARD_ADMIN_USERNAME "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"DASHBOARD_ADMIN_PASSWORD": "'"$(/usr/local/bin/get_value_from_config.sh DASHBOARD_ADMIN_PASSWORD "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"GRAFANA_ADMIN_USERNAME": "'"$(/usr/local/bin/get_value_from_config.sh GRAFANA_ADMIN_USERNAME "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"GRAFANA_ADMIN_PASSWORD": "'"$(/usr/local/bin/get_value_from_config.sh GRAFANA_ADMIN_PASSWORD "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"LIVEKIT_API_KEY": "'"$(/usr/local/bin/get_value_from_config.sh LIVEKIT_API_KEY "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"LIVEKIT_API_SECRET": "'"$(/usr/local/bin/get_value_from_config.sh LIVEKIT_API_SECRET "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"MEET_INITIAL_ADMIN_USER": "'"$(/usr/local/bin/get_value_from_config.sh MEET_INITIAL_ADMIN_USER "${!CLUSTER_CONFIG_DIR}/master_node/meet.env")"'"}')"
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"MEET_INITIAL_ADMIN_PASSWORD": "'"$(/usr/local/bin/get_value_from_config.sh MEET_INITIAL_ADMIN_PASSWORD "${!CLUSTER_CONFIG_DIR}/master_node/meet.env")"'"}')"
                if [[ "${InitialMeetApiKey}" != '' ]]; then
                  SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"MEET_INITIAL_API_KEY": "'"$(/usr/local/bin/get_value_from_config.sh MEET_INITIAL_API_KEY "${!CLUSTER_CONFIG_DIR}/master_node/meet.env")"'"}')"
                fi
                SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"ENABLED_MODULES": "'"$(/usr/local/bin/get_value_from_config.sh ENABLED_MODULES "${!CLUSTER_CONFIG_DIR}/openvidu.env")"'"}')"

                # Update shared secret
                aws secretsmanager update-secret \
                  --region ${AWS::Region} \
                  --secret-id openvidu-ha-${AWS::Region}-${AWS::StackName} \
                  --secret-string "$SHARED_SECRET"

              mode: "000755"
              owner: "root"
              group: "root"
            '/usr/local/bin/get_value_from_config.sh':
              content: |
                #!/bin/bash
                set -e

                # Function to get the value of a given key from the environment file
                get_value() {
                    local key="$1"
                    local file_path="$2"

                    # Use grep to find the line with the key, ignoring lines starting with #
                    # Use awk to split on '=' and print the second field, which is the value
                    local value=$(grep -E "^\s*$key\s*=" "$file_path" | awk -F= '{print $2}' | sed 's/#.*//; s/^\s*//; s/\s*$//')

                    # If the value is empty, return "none"
                    if [ -z "$value" ]; then
                        echo "none"
                    else
                        echo "$value"
                    fi
                }

                # Check if the correct number of arguments are supplied
                if [ "$#" -ne 2 ]; then
                    echo "Usage: $0 <key> <file_path>"
                    exit 1
                fi

                # Get the key and file path from the arguments
                key="$1"
                file_path="$2"

                # Get and print the value
                get_value "$key" "$file_path"
              mode: "000755"
              owner: "root"
              group: "root"
            '/usr/local/bin/store_secret.sh':
              content: !Sub |
                #!/bin/bash
                set -e
                # Modes: save, generate
                # save mode: save the secret in the secret manager
                # generate mode: generate a random password and save it in the secret manager
                MODE="$1"
                SHARED_SECRET="$(aws secretsmanager get-secret-value \
                  --region ${AWS::Region} \
                  --secret-id ${OpenViduSharedInfo} \
                  --query SecretString --output text)"
                if [[ "$MODE" == "generate" ]]; then
                  SECRET_KEY_NAME="$2"
                  PREFIX="${!3:-}"
                  LENGTH="${!4:-44}"
                  RANDOM_PASSWORD="$(openssl rand -base64 64 | tr -d '+/=\n' | cut -c -${!LENGTH})"
                  RANDOM_PASSWORD="${!PREFIX}${!RANDOM_PASSWORD}"
                  SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"'"$SECRET_KEY_NAME"'": "'"$RANDOM_PASSWORD"'"}')"
                  aws secretsmanager update-secret \
                    --region ${AWS::Region} \
                    --secret-id ${OpenViduSharedInfo} \
                    --secret-string "$SHARED_SECRET" > /dev/null 2>&1
                  echo "$RANDOM_PASSWORD"
                elif [[ "$MODE" == "save" ]]; then
                  SECRET_KEY_NAME="$2"
                  SECRET_VALUE="$3"
                  SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"'"$SECRET_KEY_NAME"'": "'"$SECRET_VALUE"'"}')"
                  aws secretsmanager update-secret \
                    --region ${AWS::Region} \
                    --secret-id ${OpenViduSharedInfo} \
                    --secret-string "$SHARED_SECRET" > /dev/null 2>&1
                  echo "$SECRET_VALUE"
                else
                  exit 1
                fi
              mode: "000755"
              owner: "root"
              group: "root"
            '/usr/local/bin/restart.sh':
              content: |
                #!/bin/bash
                set -e
                # Stop all services
                systemctl stop openvidu

                # Update config from secret
                /usr/local/bin/update_config_from_secret.sh

                # Start all services
                systemctl start openvidu
              mode: "000755"
              owner: "root"
              group: "root"
    Properties:
      LaunchTemplateName: !Sub 'openvidu-ha-master-${AWS::Region}-${AWS::StackName}'
      LaunchTemplateData:
        # Enable IMDSv2
        MetadataOptions:
          HttpEndpoint: enabled
          HttpPutResponseHopLimit: 1
          HttpTokens: required
        IamInstanceProfile:
          Name: !Ref OpenViduMasterInstanceProfile
        ImageId: !If
          - IsMasterGraviton
          - !If
            - IsMasterNodeNvidia
            - '{{resolve:ssm:/aws/service/deeplearning/ami/arm64/base-oss-nvidia-driver-gpu-ubuntu-24.04/latest/ami-id}}'
            - !FindInMap [ArmImage, !Ref OperatingSystem, ImageId]
          - !If
            - IsMasterNodeNvidia
            - '{{resolve:ssm:/aws/service/deeplearning/ami/x86_64/base-oss-nvidia-driver-gpu-ubuntu-24.04/latest/ami-id}}'
            - !FindInMap [AmdImage, !Ref OperatingSystem, ImageId]
        InstanceType: !Ref MasterNodeInstanceType
        KeyName: !Ref KeyName
        SecurityGroupIds:
          - !Ref OpenViduMasterNodeSG
        BlockDeviceMappings:
          - DeviceName: /dev/sda1
            Ebs:
              VolumeSize: !Ref MasterNodesDiskSize
              VolumeType: gp3
              DeleteOnTermination: true

  OpenViduMasterNode1:
    Type: AWS::EC2::Instance
    # Depends on its own SSM parameter so its put-parameter can't race the parameter's creation
    DependsOn: MasterNode1PrivateIpParameter
    Properties:
      LaunchTemplate:
        LaunchTemplateId: !Ref OpenViduMasterLaunchTemplate
        Version: !GetAtt OpenViduMasterLaunchTemplate.LatestVersionNumber
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} - OpenVidu HA - Master Node 1
      SubnetId: !GetAtt SubnetProcessor.Subnet1
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          set -eu -o pipefail

          echo "DPkg::Lock::Timeout \"-1\";" > /etc/apt/apt.conf.d/99timeout

          apt-get update && apt-get install -y \
                python3-pip \
                ec2-instance-connect

          CFN_BOOTSTRAP_VERSION=2.0-39
          # Detect Ubuntu version and install cfn-bootstrap accordingly
          UBUNTU_VERSION=$(lsb_release -rs | cut -d. -f1)
          if [ "$UBUNTU_VERSION" -ge 24 ]; then
            python3 -m pip install --break-system-packages https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
          else
            python3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
          fi

          cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource OpenViduMasterLaunchTemplate

          export MASTER_NODE_NUM=1

          # Install OpenVidu
          /usr/local/bin/install.sh "MasterNodesWaitCondition1" || { echo "[OpenVidu] error installing OpenVidu"; exit 1; }

          # Config S3 bucket
          /usr/local/bin/config_s3.sh || { echo "[OpenVidu] error configuring S3 bucket"; exit 1; }

          # Start OpenVidu
          systemctl start openvidu || { echo "[OpenVidu] error starting OpenVidu"; exit 1; }

          # Local readiness gate: wait up to 300s for Caddy health, restart once if it does not converge
          OPENVIDU_READY=false
          for i in $(seq 1 60); do
            if curl -fsS http://127.0.0.1:7880/health/caddy >/dev/null 2>&1; then
              OPENVIDU_READY=true
              break
            fi
            sleep 5
          done
          if [ "$OPENVIDU_READY" != "true" ]; then
            echo "[OpenVidu] not healthy after 300s, restarting once"
            systemctl restart openvidu || true
            for i in $(seq 1 60); do
              if curl -fsS http://127.0.0.1:7880/health/caddy >/dev/null 2>&1; then
                OPENVIDU_READY=true
                break
              fi
              sleep 5
            done
          fi

          # Update shared secret
          /usr/local/bin/after_install.sh || { echo "[OpenVidu] error updating shared secret"; exit 1; }

          # Launch on reboot
          echo "@reboot /usr/local/bin/restart.sh &> /var/log/openvidu-restart.log" | crontab


  MasterNodesWaitCondition1:
    Type: 'AWS::CloudFormation::WaitCondition'
    CreationPolicy:
      ResourceSignal:
        Timeout: PT20M
        Count: '1'

  OpenViduMasterNode2:
    Type: AWS::EC2::Instance
    DependsOn: MasterNode2PrivateIpParameter
    Properties:
      LaunchTemplate:
        LaunchTemplateId: !Ref OpenViduMasterLaunchTemplate
        Version: !GetAtt OpenViduMasterLaunchTemplate.LatestVersionNumber
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} - OpenVidu HA - Master Node 2
      SubnetId: !GetAtt SubnetProcessor.Subnet2
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          set -eu -o pipefail

          echo "DPkg::Lock::Timeout \"-1\";" > /etc/apt/apt.conf.d/99timeout

          apt-get update && apt-get install -y \
                python3-pip \
                ec2-instance-connect

          CFN_BOOTSTRAP_VERSION=2.0-39
          # Detect Ubuntu version and install cfn-bootstrap accordingly
          UBUNTU_VERSION=$(lsb_release -rs | cut -d. -f1)
          if [ "$UBUNTU_VERSION" -ge 24 ]; then
            python3 -m pip install --break-system-packages https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
          else
            python3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
          fi

          cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource OpenViduMasterLaunchTemplate

          export MASTER_NODE_NUM=2

          # Install OpenVidu
          /usr/local/bin/install.sh "MasterNodesWaitCondition2" || { echo "[OpenVidu] error installing OpenVidu"; exit 1; }

          # Config S3 bucket
          /usr/local/bin/config_s3.sh || { echo "[OpenVidu] error configuring S3 bucket"; exit 1; }

          # Start OpenVidu
          systemctl start openvidu || { echo "[OpenVidu] error starting OpenVidu"; exit 1; }

          # Local readiness gate: wait up to 300s for Caddy health, restart once if it does not converge
          OPENVIDU_READY=false
          for i in $(seq 1 60); do
            if curl -fsS http://127.0.0.1:7880/health/caddy >/dev/null 2>&1; then
              OPENVIDU_READY=true
              break
            fi
            sleep 5
          done
          if [ "$OPENVIDU_READY" != "true" ]; then
            echo "[OpenVidu] not healthy after 300s, restarting once"
            systemctl restart openvidu || true
            for i in $(seq 1 60); do
              if curl -fsS http://127.0.0.1:7880/health/caddy >/dev/null 2>&1; then
                OPENVIDU_READY=true
                break
              fi
              sleep 5
            done
          fi

          # Update shared secret
          /usr/local/bin/after_install.sh || { echo "[OpenVidu] error updating shared secret"; exit 1; }

          # Launch on reboot
          echo "@reboot /usr/local/bin/restart.sh &> /var/log/openvidu-restart.log" | crontab


  MasterNodesWaitCondition2:
    Type: 'AWS::CloudFormation::WaitCondition'
    CreationPolicy:
      ResourceSignal:
        Timeout: PT20M
        Count: '1'

  OpenViduMasterNode3:
    Type: AWS::EC2::Instance
    DependsOn: MasterNode3PrivateIpParameter
    Properties:
      LaunchTemplate:
        LaunchTemplateId: !Ref OpenViduMasterLaunchTemplate
        Version: !GetAtt OpenViduMasterLaunchTemplate.LatestVersionNumber
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} - OpenVidu HA - Master Node 3
      SubnetId: !GetAtt SubnetProcessor.Subnet3
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          set -eu -o pipefail

          echo "DPkg::Lock::Timeout \"-1\";" > /etc/apt/apt.conf.d/99timeout

          apt-get update && apt-get install -y \
                python3-pip \
                ec2-instance-connect

          CFN_BOOTSTRAP_VERSION=2.0-39
          # Detect Ubuntu version and install cfn-bootstrap accordingly
          UBUNTU_VERSION=$(lsb_release -rs | cut -d. -f1)
          if [ "$UBUNTU_VERSION" -ge 24 ]; then
            python3 -m pip install --break-system-packages https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
          else
            python3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
          fi

          cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource OpenViduMasterLaunchTemplate

          export MASTER_NODE_NUM=3

          # Install OpenVidu
          /usr/local/bin/install.sh "MasterNodesWaitCondition3" || { echo "[OpenVidu] error installing OpenVidu"; exit 1; }

          # Config S3 bucket
          /usr/local/bin/config_s3.sh || { echo "[OpenVidu] error configuring S3 bucket"; exit 1; }

          # Start OpenVidu
          systemctl start openvidu || { echo "[OpenVidu] error starting OpenVidu"; exit 1; }

          # Local readiness gate: wait up to 300s for Caddy health, restart once if it does not converge
          OPENVIDU_READY=false
          for i in $(seq 1 60); do
            if curl -fsS http://127.0.0.1:7880/health/caddy >/dev/null 2>&1; then
              OPENVIDU_READY=true
              break
            fi
            sleep 5
          done
          if [ "$OPENVIDU_READY" != "true" ]; then
            echo "[OpenVidu] not healthy after 300s, restarting once"
            systemctl restart openvidu || true
            for i in $(seq 1 60); do
              if curl -fsS http://127.0.0.1:7880/health/caddy >/dev/null 2>&1; then
                OPENVIDU_READY=true
                break
              fi
              sleep 5
            done
          fi

          # Update shared secret
          /usr/local/bin/after_install.sh || { echo "[OpenVidu] error updating shared secret"; exit 1; }

          # Launch on reboot
          echo "@reboot /usr/local/bin/restart.sh &> /var/log/openvidu-restart.log" | crontab


  MasterNodesWaitCondition3:
    Type: 'AWS::CloudFormation::WaitCondition'
    CreationPolicy:
      ResourceSignal:
        Timeout: PT20M
        Count: '1'

  OpenViduMasterNode4:
    Type: AWS::EC2::Instance
    DependsOn: MasterNode4PrivateIpParameter
    Properties:
      LaunchTemplate:
        LaunchTemplateId: !Ref OpenViduMasterLaunchTemplate
        Version: !GetAtt OpenViduMasterLaunchTemplate.LatestVersionNumber
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} - OpenVidu HA - Master Node 4
      SubnetId: !GetAtt SubnetProcessor.Subnet4
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          set -eu -o pipefail

          echo "DPkg::Lock::Timeout \"-1\";" > /etc/apt/apt.conf.d/99timeout

          apt-get update && apt-get install -y \
                python3-pip \
                ec2-instance-connect

          CFN_BOOTSTRAP_VERSION=2.0-39
          # Detect Ubuntu version and install cfn-bootstrap accordingly
          UBUNTU_VERSION=$(lsb_release -rs | cut -d. -f1)
          if [ "$UBUNTU_VERSION" -ge 24 ]; then
            python3 -m pip install --break-system-packages https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
          else
            python3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
          fi

          cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource OpenViduMasterLaunchTemplate

          export MASTER_NODE_NUM=4

          # Install OpenVidu
          /usr/local/bin/install.sh "MasterNodesWaitCondition4" || { echo "[OpenVidu] error installing OpenVidu"; exit 1; }

          # Config S3 bucket
          /usr/local/bin/config_s3.sh || { echo "[OpenVidu] error configuring S3 bucket"; exit 1; }

          # Start OpenVidu
          systemctl start openvidu || { echo "[OpenVidu] error starting OpenVidu"; exit 1; }

          # Local readiness gate: wait up to 300s for Caddy health, restart once if it does not converge
          OPENVIDU_READY=false
          for i in $(seq 1 60); do
            if curl -fsS http://127.0.0.1:7880/health/caddy >/dev/null 2>&1; then
              OPENVIDU_READY=true
              break
            fi
            sleep 5
          done
          if [ "$OPENVIDU_READY" != "true" ]; then
            echo "[OpenVidu] not healthy after 300s, restarting once"
            systemctl restart openvidu || true
            for i in $(seq 1 60); do
              if curl -fsS http://127.0.0.1:7880/health/caddy >/dev/null 2>&1; then
                OPENVIDU_READY=true
                break
              fi
              sleep 5
            done
          fi

          # Update shared secret
          /usr/local/bin/after_install.sh || { echo "[OpenVidu] error updating shared secret"; exit 1; }

          # Launch on reboot
          echo "@reboot /usr/local/bin/restart.sh &> /var/log/openvidu-restart.log" | crontab

  MasterNodesWaitCondition4:
    Type: 'AWS::CloudFormation::WaitCondition'
    CreationPolicy:
      ResourceSignal:
        Timeout: PT20M
        Count: '1'

  OpenViduMediaNodeLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Metadata:
      Comment: Launch template for OpenVidu Media Node
      AWS::CloudFormation::Init:
        config:
          files:
            '/usr/local/bin/install.sh':
              content: !Sub |
                #!/bin/bash
                set -e
                YQ_VERSION=v4.53.3

                # Install dependencies
                apt-get update && apt-get install -y \
                  curl \
                  unzip \
                  jq \
                  wget
                wget https://github.com/mikefarah/yq/releases/download/${!YQ_VERSION}/yq_linux_$(dpkg --print-architecture).tar.gz -O - |\
                  tar xz && mv yq_linux_$(dpkg --print-architecture) /usr/bin/yq

                AWS_CLI_VERSION=2.35.5
                # Install aws-cli if not already installed
                if ! command -v aws &> /dev/null; then
                  curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m)-${!AWS_CLI_VERSION}.zip" -o "awscliv2.zip"
                  unzip -qq awscliv2.zip
                  ./aws/install
                  rm -rf awscliv2.zip aws
                fi

                # Token for IMDSv2
                TOKEN="$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")"

                # Get own private IP
                PRIVATE_IP="$(curl -H "X-aws-ec2-metadata-token: $TOKEN" -s http://169.254.169.254/latest/meta-data/local-ipv4)"

                SHARED_SECRET="$(aws secretsmanager get-secret-value \
                  --region ${AWS::Region} \
                  --secret-id openvidu-ha-${AWS::Region}-${AWS::StackName} \
                  --query SecretString --output text || echo 'none')"
                if [[ "$SHARED_SECRET" == "none" ]]; then
                  echo "Error: Shared secret not found"
                  exit 1
                fi

                SECRETS_WAIT_ATTEMPTS=0
                SECRETS_WAIT_MAX=360
                while true; do
                  # Validate content, not just the flag: stale eventually-consistent reads can return pre-generation values
                  if echo "$SHARED_SECRET" | jq -e '(.ALL_SECRETS_GENERATED == "true") and (.OPENVIDU_VERSION != "none") and (.REDIS_PASSWORD != "none")' > /dev/null; then
                    break
                  fi
                  SECRETS_WAIT_ATTEMPTS=$((SECRETS_WAIT_ATTEMPTS + 1))
                  if [[ $SECRETS_WAIT_ATTEMPTS -ge $SECRETS_WAIT_MAX ]]; then
                    echo "Error: timed out after 30 minutes waiting for shared secrets to be generated"
                    exit 1
                  fi
                  sleep 5
                  SHARED_SECRET="$(aws secretsmanager get-secret-value \
                    --region ${AWS::Region} \
                    --secret-id openvidu-ha-${AWS::Region}-${AWS::StackName} \
                    --query SecretString --output text || echo 'none')"
                done

                # Get OpenVidu Media Nodes version to deploy
                OPENVIDU_VERSION=$(echo "$SHARED_SECRET" | jq -r '.OPENVIDU_VERSION')
                if [[ "$OPENVIDU_VERSION" == "none" ]]; then
                  echo "OpenVidu version not found"
                  exit 1
                fi

                IP_WAIT_ATTEMPTS=0
                IP_WAIT_MAX=360
                while true; do
                  MASTER_NODE_1_PRIVATE_IP=$(aws ssm get-parameter --region ${AWS::Region} --name "/openvidu/${AWS::StackName}/master-node-1-private-ip" --query Parameter.Value --output text 2>/dev/null || echo 'none')
                  MASTER_NODE_2_PRIVATE_IP=$(aws ssm get-parameter --region ${AWS::Region} --name "/openvidu/${AWS::StackName}/master-node-2-private-ip" --query Parameter.Value --output text 2>/dev/null || echo 'none')
                  MASTER_NODE_3_PRIVATE_IP=$(aws ssm get-parameter --region ${AWS::Region} --name "/openvidu/${AWS::StackName}/master-node-3-private-ip" --query Parameter.Value --output text 2>/dev/null || echo 'none')
                  MASTER_NODE_4_PRIVATE_IP=$(aws ssm get-parameter --region ${AWS::Region} --name "/openvidu/${AWS::StackName}/master-node-4-private-ip" --query Parameter.Value --output text 2>/dev/null || echo 'none')

                  if [[ "$MASTER_NODE_1_PRIVATE_IP" != "none" ]] && [[ -n "$MASTER_NODE_1_PRIVATE_IP" ]] &&
                      [[ "$MASTER_NODE_2_PRIVATE_IP" != "none" ]] && [[ -n "$MASTER_NODE_2_PRIVATE_IP" ]] &&
                      [[ "$MASTER_NODE_3_PRIVATE_IP" != "none" ]] && [[ -n "$MASTER_NODE_3_PRIVATE_IP" ]] &&
                      [[ "$MASTER_NODE_4_PRIVATE_IP" != "none" ]] && [[ -n "$MASTER_NODE_4_PRIVATE_IP" ]]; then
                    break
                  fi

                  IP_WAIT_ATTEMPTS=$((IP_WAIT_ATTEMPTS + 1))
                  if [[ $IP_WAIT_ATTEMPTS -ge $IP_WAIT_MAX ]]; then
                    echo "Error: timed out after 30 minutes waiting for all master nodes to publish their private IPs to SSM"
                    exit 1
                  fi
                  sleep 5
                done
                MASTER_NODE_PRIVATE_IP_LIST="$MASTER_NODE_1_PRIVATE_IP,$MASTER_NODE_2_PRIVATE_IP,$MASTER_NODE_3_PRIVATE_IP,$MASTER_NODE_4_PRIVATE_IP"
                REDIS_PASSWORD=$(echo "$SHARED_SECRET" | jq -r '.REDIS_PASSWORD')

                # Download first: sh <(curl ...) would silently run an empty script on a transient curl failure
                INSTALLER_SCRIPT="/tmp/install_ov_media_node.sh"
                curl -fsSL --retry 8 --retry-all-errors --retry-delay 5 -o "$INSTALLER_SCRIPT" "http://get.openvidu.io/pro/ha/$OPENVIDU_VERSION/install_ov_media_node.sh"
                if [ ! -s "$INSTALLER_SCRIPT" ]; then
                  echo "Downloaded OpenVidu media node installer is empty or missing" >&2
                  exit 1
                fi
                INSTALL_COMMAND="sh $INSTALLER_SCRIPT"

                # Common arguments
                COMMON_ARGS=(
                  "--no-tty"
                  "--install"
                  "--environment=aws"
                  "--deployment-type='ha'"
                  "--node-role='media-node'"
                  "--master-node-private-ip-list=$MASTER_NODE_PRIVATE_IP_LIST"
                  "--private-ip=$PRIVATE_IP"
                  "--redis-password=$REDIS_PASSWORD"
                )

                # Construct the final command with all arguments
                FINAL_COMMAND="$INSTALL_COMMAND $(printf "%s " "${!COMMON_ARGS[@]}")"

                # Install OpenVidu
                exec bash -c "$FINAL_COMMAND"
              mode: '000755'
              owner: root
              group: root
            '/usr/local/bin/set_as_unhealthy.sh':
              content: !Sub |
                #!/bin/bash
                set -e
                # Token for IMDSv2
                TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")

                # Get own instance ID
                INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id)

                # Set instance as unhealthy
                aws autoscaling set-instance-health \
                  --region ${AWS::Region} \
                  --instance-id "$INSTANCE_ID" \
                  --health-status Unhealthy
              mode: "000755"
              owner: "root"
              group: "root"
            '/usr/local/bin/stop_media_node.sh':
              content: !Sub |
                #!/bin/bash
                set -e
                # Token for IMDSv2
                TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")

                # Get own instance ID
                INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/instance-id)
                ASG_NAME=openvidu-ha-media-asg-${AWS::Region}-${AWS::StackName}

                # Execute if docker is installed
                if [ -x "$(command -v docker)" ]; then
                  echo "Stopping media node services and waiting for termination..."
                  docker container kill --signal=SIGQUIT openvidu || true
                  docker container kill --signal=SIGQUIT ingress || true
                  docker container kill --signal=SIGQUIT egress || true
                  for agent_container in $(docker ps --filter "label=openvidu-agent=true" --format '{{.Names}}'); do
                    docker container kill --signal=SIGQUIT "$agent_container"
                  done
                  TIME_PASSED=0
                  HEARTBEAT_MAX=1800
                  # Wait for running containers to not be openvidu, ingress, egress or an openvidu agent
                  while [ $(docker ps --filter "label=openvidu-agent=true" -q | wc -l) -gt 0 ] || \
                        [ $(docker inspect -f '{{.State.Running}}' openvidu 2>/dev/null) == "true" ] || \
                        [ $(docker inspect -f '{{.State.Running}}' ingress 2>/dev/null) == "true" ] || \
                        [ $(docker inspect -f '{{.State.Running}}' egress 2>/dev/null) == "true" ]; do
                    echo "Waiting for containers to stop..."
                    sleep 5
                    TIME_PASSED=$((TIME_PASSED+5))
                    if [ $TIME_PASSED -ge $HEARTBEAT_MAX ]; then
                      echo "Increase lifecycle hook timeout to continue waiting for termination"
                      # Increase lifecycle hook timeout
                      aws autoscaling record-lifecycle-action-heartbeat \
                        --region ${AWS::Region} \
                        --lifecycle-hook-name StopMediaNodeLifecycleHook-${AWS::Region}-${AWS::StackName} \
                        --auto-scaling-group-name "$ASG_NAME" \
                        --instance-id "$INSTANCE_ID"
                      TIME_PASSED=0
                    fi
                  done
                fi

                aws autoscaling complete-lifecycle-action \
                  --region ${AWS::Region} \
                  --lifecycle-hook-name StopMediaNodeLifecycleHook-${AWS::Region}-${AWS::StackName} \
                  --auto-scaling-group-name "$ASG_NAME" \
                  --lifecycle-action-result CONTINUE \
                  --instance-id "$INSTANCE_ID"
              mode: "000755"
              owner: "root"
              group: "root"
    Properties:
      LaunchTemplateName: !Sub 'openvidu-ha-media-${AWS::Region}-${AWS::StackName}'
      LaunchTemplateData:
        # Enable IMDSv2 by default
        MetadataOptions:
          HttpEndpoint: enabled
          HttpPutResponseHopLimit: 1
          HttpTokens: required
        IamInstanceProfile:
          Arn: !GetAtt OpenViduMediaInstanceProfile.Arn
        SecurityGroupIds:
          - !GetAtt OpenViduMediaNodeSG.GroupId
        ImageId: !If
          - IsMediaGraviton
          - !If
            - IsMediaNodeNvidia
            - '{{resolve:ssm:/aws/service/deeplearning/ami/arm64/base-oss-nvidia-driver-gpu-ubuntu-24.04/latest/ami-id}}'
            - !FindInMap [ArmImage, !Ref OperatingSystem, ImageId]
          - !If
            - IsMediaNodeNvidia
            - '{{resolve:ssm:/aws/service/deeplearning/ami/x86_64/base-oss-nvidia-driver-gpu-ubuntu-24.04/latest/ami-id}}'
            - !FindInMap [AmdImage, !Ref OperatingSystem, ImageId]
        KeyName: !Ref KeyName
        InstanceType: !Ref MediaNodeInstanceType
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash
            set -eu -o pipefail

            echo "DPkg::Lock::Timeout \"-1\";" > /etc/apt/apt.conf.d/99timeout

            apt-get update && apt-get install -y \
                python3-pip \
                ec2-instance-connect

            CFN_BOOTSTRAP_VERSION=2.0-39
            # Detect Ubuntu version and install cfn-bootstrap accordingly
            UBUNTU_VERSION=$(lsb_release -rs | cut -d. -f1)
            if [ "$UBUNTU_VERSION" -ge 24 ]; then
              python3 -m pip install --break-system-packages https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
            else
              python3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
            fi

            cfn-init --region ${AWS::Region} --stack ${AWS::StackName} --resource OpenViduMediaNodeLaunchTemplate

            export HOME="/root"

            # Install OpenVidu
            /usr/local/bin/install.sh || { echo "[OpenVidu] error installing OpenVidu"; /usr/local/bin/set_as_unhealthy.sh; exit 1; }

            MASTER_IP_1=$(aws ssm get-parameter --region ${AWS::Region} --name "/openvidu/${AWS::StackName}/master-node-1-private-ip" --query Parameter.Value --output text 2>/dev/null || echo 'none')
            MASTER_IP_2=$(aws ssm get-parameter --region ${AWS::Region} --name "/openvidu/${AWS::StackName}/master-node-2-private-ip" --query Parameter.Value --output text 2>/dev/null || echo 'none')
            MASTER_IP_3=$(aws ssm get-parameter --region ${AWS::Region} --name "/openvidu/${AWS::StackName}/master-node-3-private-ip" --query Parameter.Value --output text 2>/dev/null || echo 'none')
            MASTER_IP_4=$(aws ssm get-parameter --region ${AWS::Region} --name "/openvidu/${AWS::StackName}/master-node-4-private-ip" --query Parameter.Value --output text 2>/dev/null || echo 'none')
            MASTER_HEALTHY=false
            for i in $(seq 1 360); do
              for MASTER_IP in "$MASTER_IP_1" "$MASTER_IP_2" "$MASTER_IP_3" "$MASTER_IP_4"; do
                if [ "$MASTER_IP" != "none" ] && [ -n "$MASTER_IP" ] && curl -sf "http://$MASTER_IP:7880/health/caddy" >/dev/null 2>&1; then
                  MASTER_HEALTHY=true
                  break
                fi
              done
              if [ "$MASTER_HEALTHY" = "true" ]; then
                break
              fi
              sleep 5
            done
            if [ "$MASTER_HEALTHY" != "true" ]; then
              echo "[OpenVidu] no master node became healthy after 30 minutes"
              /usr/local/bin/set_as_unhealthy.sh
              exit 1
            fi

            # Start OpenVidu
            systemctl start openvidu || { echo "[OpenVidu] error starting OpenVidu"; /usr/local/bin/set_as_unhealthy.sh; exit 1; }

            # Wait for the app
            # /usr/local/bin/check_app_ready.sh
        BlockDeviceMappings:
          - DeviceName: /dev/sda1
            Ebs:
              VolumeType: gp3
              DeleteOnTermination: true
              VolumeSize: !If [IsMediaNodeNvidia, 100, 50]

  OpenViduMediaNodeASG:
    DependsOn:
      - OpenViduMediaInstanceProfile
      - OpenViduMasterInstanceProfile
      - StopMediaNodeCloudWatchEventRule
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      AutoScalingGroupName: !Sub openvidu-ha-media-asg-${AWS::Region}-${AWS::StackName}
      LaunchTemplate:
        LaunchTemplateId: !Ref OpenViduMediaNodeLaunchTemplate
        Version: !GetAtt OpenViduMediaNodeLaunchTemplate.DefaultVersionNumber
      TargetGroupARNs:
        - !Ref OpenViduMediaNodeRTMPTG
      MinSize: !Ref MinNumberOfMediaNodes
      MaxSize: !Ref MaxNumberOfMediaNodes
      DesiredCapacity: !Ref InitialNumberOfMediaNodes
      VPCZoneIdentifier: !Ref OpenViduMediaNodeSubnets
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} - OpenVidu HA - Media Node
          PropagateAtLaunch: true

  StopMediaNodeLifecycleHook:
    Type: 'AWS::AutoScaling::LifecycleHook'
    Properties:
      LifecycleHookName: !Sub StopMediaNodeLifecycleHook-${AWS::Region}-${AWS::StackName}
      AutoScalingGroupName: !Ref OpenViduMediaNodeASG
      LifecycleTransition: 'autoscaling:EC2_INSTANCE_TERMINATING'
      DefaultResult: 'CONTINUE'
      HeartbeatTimeout: 3600

  StopMediaNodeDocumentRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ssm.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
        - PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
                - ssm:DescribeInstanceInformation
                - ssm:ListCommands
                - ssm:ListCommandInvocations
              Resource: "*"
            - Effect: Allow
              Action:
                - ssm:SendCommand
              Resource: !Sub arn:${AWS::Partition}:ssm:${AWS::Region}::document/AWS-RunShellScript
            - Action:
                - ssm:SendCommand
              Resource: !Sub arn:${AWS::Partition}:ec2:*:*:instance/*
              Condition:
                StringEquals:
                  'aws:ResourceTag/aws:cloudformation:stack-name': !Ref 'AWS::StackName'
              Effect: Allow
          PolicyName: SSM-Automation-Policy

  StopMediaNodeAutomationDocument:
    Type: AWS::SSM::Document
    Properties:
      Name:
        Fn::Join:
          # Generate a not too long and unique document name
          # Getting a unique identifier from the stack id
          - ''
          - - 'StopMediaNodeAutomationDocument-'
            - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]
      DocumentType: Automation
      Content:
        schemaVersion: '0.3'
        assumeRole: "{{automationAssumeRole}}"
        description: This document stops the OpenVidu services in a Media Node and
          terminates the instance. It stop the OpenVidu services without interrupting
          the running sessions, ingress and egress running in the Media Node.
          Also it sends a CONTINUE signal to the Auto Scaling Group to continue the
          instance termination when the services are stopped.
        parameters:
          InstanceId:
            type: String
          automationAssumeRole:
            type: String
            default: !GetAtt StopMediaNodeDocumentRole.Arn
            description: "(Required) The ARN of the role that allows Automation to
              perform the actions."
        mainSteps:
          - name: RunCommand
            action: aws:runCommand
            inputs:
              DocumentName: AWS-RunShellScript
              InstanceIds:
                - "{{ InstanceId }}"
              Parameters:
                # 24 hours as a timeout to wait for the instance to stop all services
                executionTimeout: "60"
                commands:
                  - nohup /usr/local/bin/stop_media_node.sh > /var/log/stop_media_node.log 2>&1 &


  StopMediaNodeCloudWatchEventRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - events.amazonaws.com
          Action:
            - sts:AssumeRole
      Policies:
      - PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - ssm:StartAutomationExecution
              Resource:
                - !Sub arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:automation-execution/*
                - !Sub arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:document/${StopMediaNodeAutomationDocument}
        PolicyName: !Sub StopMediaNodeCloudWatchEventPolicy-${AWS::Region}-${AWS::StackName}
      - PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
              - iam:PassRole
            Resource: !GetAtt StopMediaNodeDocumentRole.Arn
        PolicyName: Pass-Role-SSM-Automation-Policy

  StopMediaNodeCloudWatchEventRule:
    Type: AWS::Events::Rule
    Properties:
      Description: Rule to trigger the StopMediaNodeAutomationDocument when an instance is terminated
      EventPattern:
        source:
          - aws.autoscaling
        detail-type:
          - EC2 Instance-terminate Lifecycle Action
        detail:
          AutoScalingGroupName:
            - !Sub openvidu-ha-media-asg-${AWS::Region}-${AWS::StackName}
      Name:
        Fn::Join:
          # Generate a not too long and unique rule name
          # Getting a unique identifier from the stack id
          - ''
          - - StopMediaNodeCloudWatchEventRule-
            - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]
      Targets:
        - Arn: !Sub arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:automation-definition/${StopMediaNodeAutomationDocument}:$DEFAULT
          RoleArn: !GetAtt StopMediaNodeCloudWatchEventRole.Arn
          Id:
            Fn::Join:
              # Generate a not too long and unique target id
              # Getting a unique identifier from the stack id
              - ''
              - - StopMediaNodeCloudWatchEventRule-
                - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]
          InputTransformer:
            InputPathsMap:
              instanceid: "$.detail.EC2InstanceId"
            InputTemplate: |
              {
                "InstanceId": [ <instanceid> ]
              }

  OpenViduMediaNodeASGScalingPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AutoScalingGroupName: !Ref OpenViduMediaNodeASG
      PolicyType: TargetTrackingScaling
      EstimatedInstanceWarmup: 120
      TargetTrackingConfiguration:
        PredefinedMetricSpecification:
          PredefinedMetricType: ASGAverageCPUUtilization
        TargetValue: !Ref ScaleTargetCPU

  OpenViduMasterNodeSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for OpenVidu Master Node
      GroupName: !Sub openvidu-ha-master-sg-${AWS::Region}-${AWS::StackName}
      VpcId: !Ref OpenViduVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIpv6: ::/0

  OpenViduLoadBalancerToMasterHTTPIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      SourceSecurityGroupId: !Ref OpenViduLoadBalancerSG

  OpenViduLoadBalancerToMasterIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 7880
      ToPort: 7880
      SourceSecurityGroupId: !Ref OpenViduLoadBalancerSG

  OpenViduMasterToMasterRedisIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 7000
      ToPort: 7001
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMediaNodeToMasterNodeClusterPortIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 7880
      ToPort: 7880
      SourceSecurityGroupId: !Ref OpenViduMediaNodeSG

  OpenViduMediaNodeToMasterRedisIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 7000
      ToPort: 7001
      SourceSecurityGroupId: !Ref OpenViduMediaNodeSG

  OpenViduMasterToMasterMinioIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 9100
      ToPort: 9100
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMasterToMasterMinioConsoleSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 9101
      ToPort: 9101
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMediaNodeToMasterMinioIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 9100
      ToPort: 9100
      SourceSecurityGroupId: !Ref OpenViduMediaNodeSG

  OpenViduMasterToMasterMongoIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 20000
      ToPort: 20000
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMediaNodeToMasterMongoIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 20000
      ToPort: 20000
      SourceSecurityGroupId: !Ref OpenViduMediaNodeSG

  OpenViduMasterToMasterMimirGrpcIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 9095
      ToPort: 9095
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMasterToMasterMimirGossipIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 7946
      ToPort: 7946
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMediaNodeToMasterHTTPMimirSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 9009
      ToPort: 9009
      SourceSecurityGroupId: !Ref OpenViduMediaNodeSG

  OpenViduMasterToMasterLokiGrpcIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 9096
      ToPort: 9096
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMasterToMasterLokiGossipIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 7947
      ToPort: 7947
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMasterToMasterDashboardsIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 5000
      ToPort: 5000
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMasterToMasterGrafanaIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 3000
      ToPort: 3000
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMediaNodeToMasterHTTPLokiSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 3100
      ToPort: 3100
      SourceSecurityGroupId: !Ref OpenViduMediaNodeSG

  OpenViduMasterToMasterV2CompatibilityIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 4443
      ToPort: 4443
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMediaNodeToMasterV2CompatibilityWebhookIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !GetAtt OpenViduMasterNodeSG.GroupId
      IpProtocol: tcp
      FromPort: 4443
      ToPort: 4443
      SourceSecurityGroupId: !GetAtt OpenViduMediaNodeSG.GroupId

  OpenViduMasterToMasterMeetIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 9080
      ToPort: 9080
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMasterToMasterCustomAppIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 6080
      ToPort: 6080
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMediaNodeToMasterMeetWebhookIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !GetAtt OpenViduMasterNodeSG.GroupId
      IpProtocol: tcp
      FromPort: 9080
      ToPort: 9080
      SourceSecurityGroupId: !GetAtt OpenViduMediaNodeSG.GroupId

  OpenViduMediaNodeToMasterCustomAppIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !GetAtt OpenViduMasterNodeSG.GroupId
      IpProtocol: tcp
      FromPort: 6080
      ToPort: 6080
      SourceSecurityGroupId: !GetAtt OpenViduMediaNodeSG.GroupId

  OpenViduMediaNodeSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for OpenVidu Media Node
      GroupName: !Sub openvidu-ha-media-sg-${AWS::Region}-${AWS::StackName}
      VpcId: !Ref OpenViduVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIpv6: ::/0
        - IpProtocol: udp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: 443
          ToPort: 443
          CidrIpv6: ::/0
        - IpProtocol: tcp
          FromPort: 7881
          ToPort: 7881
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 7881
          ToPort: 7881
          CidrIpv6: ::/0
        - IpProtocol: udp
          FromPort: 7885
          ToPort: 7885
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: 7885
          ToPort: 7885
          CidrIpv6: ::/0
        - IpProtocol: udp
          FromPort: 50000
          ToPort: 60000
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: 50000
          ToPort: 60000
          CidrIpv6: ::/0
        - IpProtocol: tcp
          FromPort: 50000
          ToPort: 60000
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 50000
          ToPort: 60000
          CidrIpv6: ::/0

  OpenViduLoadBalancerToMediaNodeRTMPIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMediaNodeSG
      IpProtocol: tcp
      FromPort: 1945
      ToPort: 1945
      SourceSecurityGroupId: !Ref OpenViduLoadBalancerSG

  OpenViduLoadBalancerToMediaNodeIngressHealthCheckSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMediaNodeSG
      IpProtocol: tcp
      FromPort: 9092
      ToPort: 9092
      SourceSecurityGroupId: !Ref OpenViduLoadBalancerSG

  OpenViduMasterToMediaNodeServerIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMediaNodeSG
      IpProtocol: tcp
      FromPort: 7880
      ToPort: 7880
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduMasterToMediaNodeClientIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMediaNodeSG
      IpProtocol: tcp
      FromPort: 8080
      ToPort: 8080
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduTurnTLSMasterNodeToMediaNodeIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMediaNodeSG
      IpProtocol: tcp
      FromPort: 5349
      ToPort: 5349
      SourceSecurityGroupId: !Ref OpenViduMasterNodeSG

  OpenViduTurnTLSLoadBalancerToMediaNodeIngressSG:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref OpenViduMasterNodeSG
      IpProtocol: tcp
      FromPort: 443
      ToPort: 443
      SourceSecurityGroupId: !Ref OpenViduLoadBalancerSG

  OpenViduLoadBalancerSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for the Load Balancer
      GroupName: !Sub openvidu-ha-lb-sg-${AWS::Region}-${AWS::StackName}
      VpcId: !Ref OpenViduVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIpv6: ::/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIpv6: ::/0
        - IpProtocol: tcp
          FromPort: 1935
          ToPort: 1935
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 1935
          ToPort: 1935
          CidrIpv6: ::/0

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name:
        Fn::Join:
          # Generate a not too long and unique load balancer name
          # Getting a unique identifier from the stack id
          - ''
          - - OpenViduHA-
            - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]
      Subnets: !Ref OpenViduMasterNodeSubnets
      SecurityGroups:
        - !Ref OpenViduLoadBalancerSG
      Type: network
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} - OpenVidu HA - Load Balancer

  OpenViduMasterNodeWithTurnTLSHTTPListener:
    Type: 'AWS::ElasticLoadBalancingV2::Listener'
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref OpenViduMasterNodeHTTPTG
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: TCP

  OpenViduMasterNodeWithTurnTLSListener:
    Type: 'AWS::ElasticLoadBalancingV2::Listener'
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref OpenViduMasterNodeWithTurnTLSTG
      LoadBalancerArn: !Ref LoadBalancer
      Port: 443
      Protocol: TLS
      Certificates:
        - CertificateArn: !Ref OpenViduCertificateARN

  OpenViduRTMPMediaNodeListener:
    Type: 'AWS::ElasticLoadBalancingV2::Listener'
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref OpenViduMediaNodeRTMPTG
      LoadBalancerArn: !Ref LoadBalancer
      Port: 1935
      Protocol: TLS
      Certificates:
        - CertificateArn: !Ref OpenViduCertificateARN

  OpenViduMasterNodeHTTPTG:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name:
        Fn::Join:
          # Generate a not too long and unique target id
          # Getting a unique identifier from the stack id
          - ''
          - - OVHTTP-
            - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]
      TargetType: instance
      Targets:
        - Id: !Ref OpenViduMasterNode1
        - Id: !Ref OpenViduMasterNode2
        - Id: !Ref OpenViduMasterNode3
        - Id: !Ref OpenViduMasterNode4
      VpcId: !Ref OpenViduVPC
      Port: 80
      Protocol: TCP
      Matcher:
        HttpCode: '200'
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /health/caddy
      HealthCheckProtocol: HTTP
      HealthCheckPort: '7880'
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 3
      UnhealthyThresholdCount: 4
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 60
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} - OpenVidu HA - Master HTTP Target Group

  OpenViduMasterNodeWithTurnTLSTG:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name:
        Fn::Join:
          # Generate a not too long and unique target id
          # Getting a unique identifier from the stack id
          - ''
          - - OVTurnTLSMaster-
            - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]
      TargetType: instance
      Targets:
        - Id: !Ref OpenViduMasterNode1
        - Id: !Ref OpenViduMasterNode2
        - Id: !Ref OpenViduMasterNode3
        - Id: !Ref OpenViduMasterNode4
      VpcId: !Ref OpenViduVPC
      Port: 443
      Protocol: TCP
      Matcher:
        HttpCode: '200'
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /health/caddy
      HealthCheckProtocol: HTTP
      HealthCheckPort: '7880'
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 3
      UnhealthyThresholdCount: 4
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 60
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} - OpenVidu HA - TURN TLS Master Target Group

  OpenViduMediaNodeRTMPTG:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name:
        Fn::Join:
          # Generate a not too long and unique target id
          # Getting a unique identifier from the stack id
          - ''
          - - OVRTMP-
            - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]
      VpcId: !Ref OpenViduVPC
      Port: 1945
      Protocol: TCP
      Matcher:
        HttpCode: '200'
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /
      HealthCheckProtocol: HTTP
      # Ingress health check port
      HealthCheckPort: '9092'
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 3
      UnhealthyThresholdCount: 4
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 60
      Tags:
        - Key: Name
          Value: !Sub ${AWS::StackName} - OpenVidu HA - RTMP Target Group

Outputs:
  ServicesAndCredentials:
    Description: Services and credentials
    Value: !Sub https://${AWS::Region}.console.aws.amazon.com/secretsmanager/home?region=${AWS::Region}#!/secret?name=openvidu-ha-${AWS::Region}-${AWS::StackName}