Release: Phase 12 EC2 deploy + Phase 20 HTTPS via Caddy (closes #64) - #80
Merged
Conversation
…logs/Kafka UI
The end-to-end checks mvn verify can't make: Grafana panels light up,
{container="shopsphere-app"} |= "<orderId>" returns every module's line, and
Kafka UI shows topics/offsets. Companion to qa-walkthrough.md (which is
dev-mode); this one runs the full compose profile.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
….cloud.yml) [#58] One-apply terraform/ec2 module: EC2 (AL2023, templated user-data installs Docker, writes compose.cloud.yml, pulls poojithvsc/shopsphere:latest, brings up app+Kafka) + PRIVATE RDS (ingress only from the EC2 SG) + minimal IAM profile. compose.cloud.yml runs app+Kafka against RDS, S3 dormant. ADR-0012 (self-hosted Kafka over MSK; Docker Hub over ECR; RDS posture flip) + lab runbook. terraform validate passes; mvn verify green. Lab-only ACs (apply, RDS-private timeout, QA over EC2, destroy) run in one Whizlabs session — does not close #58 yet. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Caddyfile reverse-proxies :443 -> app:8080 with a self-signed tls-internal cert;
site address via {$CADDY_SITE_ADDRESS:localhost} so the same file serves localhost
locally and the EC2 public IP in the lab. caddy added to docker-compose.yml (full
profile) and compose.cloud.yml (caddy profile). TLS termination PROVEN locally:
https://localhost/actuator/health returns the app JSON through Caddy, /api/v1/products
-> 401. ADR-0020 (self-signed over Let's Encrypt-impossible; Caddy over nginx;
ACM/ALB as own-AWS replacement). Lab-only ACs run with #58 — does not close #64 yet.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…-Postgres fallback [#58] Live Whizlabs run surfaced several constraints; fixes: - use_rds toggle: when false, skip all RDS resources (count=0) and run postgres:16 in a localdb compose profile on the EC2 (sandbox denied RDS, even rds:Describe). The managed-private-RDS path is untouched (use_rds=true, validate-clean). - t2.micro OOM: 2 GiB swapfile in user-data + KAFKA_HEAP_OPTS=-Xmx384m and app JAVA_TOOL_OPTIONS=-Xmx384m (cp-kafka defaults to -Xmx1G, which alone OOM-kills 1 GiB). - create_instance_profile toggle: lab IAM user is denied iam:CreateRole (empty SSM-placeholder role made optional). - associate_public_ip_address=true: sandbox default subnet has MapPublicIpOnLaunch=false. - robust public-IP fetch (checkip.amazonaws.com + IMDS fallback) so Caddy's cert SAN gets the IP (supports #64). - ADR-0012: document use_rds as a genuine two-value seam; RDS-private test deferred. RDS-private negative test stays deferred (no RDS-capable AWS); #58 remains open. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…64] Browsers send no SNI for a bare-IP URL, so Caddy couldn't match the IP-keyed site and served an empty no-SAN fallback cert -> ERR_SSL_PROTOCOL_ERROR. Adding default_sni {$CADDY_SITE_ADDRESS} makes Caddy present the IP cert (IP in SAN) to no-SNI clients. Verified live via openssl (no -servername) and a browser. Note: Windows curl/PowerShell (SChannel) still can't handshake with `tls internal` certs — a client limitation, not a server fault; verify with openssl or a browser. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release PR for the Phase 12 + Phase 20 batch (#58 + #64 — they share one ephemeral EC2). Deployed and QA'd live on AWS on 2026-06-06.
Closes
https://<ip>(self-signed warning expected), health 200 returned through Caddy. Includes thedefault_snifix for bare-IP/no-SNI browsers.Included but #58 stays OPEN
terraform destroy).psql-times-out negative test — was not exercised. The sandbox denies RDS, so Postgres ran as a container behind a newuse_rdstoggle; theuse_rds=trueRDS path isterraform validate-clean but unrun. Per "done means done", Phase 12: EC2 deploy + self-hosted Kafka; RDS becomes private #58 awaits RDS-capable AWS. See the Phase 12: EC2 deploy + self-hosted Kafka; RDS becomes private #58 comment + ADR-0012.Notable changes (born from the live run)
use_rdstoggle + container-Postgreslocaldbprofile (RDS-denied fallback)create_instance_profiletoggle (lab deniesiam:CreateRole)associate_public_ip_address=true; robust public-IP fetch for Caddy's cert SANdefault_sni; lab runbook updated with all eight blockersAlso carries one trailing Phase-18b doc commit (observability QA checklist).
🤖 Generated with Claude Code