Infra: Use ALB for Kaapi Instances

Is your feature request related to a problem?

• Attaching Elastic IPs to kaapi-prod-ui-guardrails and kaapi-staging-ui-guardrails is unnecessary and adds cost.
• EIPs are not needed if services are accessible through an ALB

Describe the solution you'd like

• Do this via ALB instead of Elastic IPs
  • Create Target Groups for kaapi-prod-ui-guardrails and kaapi-staging-ui-guardrails
  • Register respective EC2 instances in each target group

Describe the enhancement you'd like

• Attach Elastic IP (to be done after services are up).
  • kaapi-prod-ui-guardrails
  • kaapi-staging-ui-guardrails
• Create / Update ALB
  • Create ALB (or reuse existing one)
  • Add listener rules:
    • domain → forward to targeted group which we have created.
    • same for others.
• Update DNS in Cloudflare
• SSL Certificate update

Here is the high-level steps:

1. Create a Target Group
This is the group that tells ALB which EC2 to send traffic to.

Go to EC2 Console → Target Groups → Create Target Group

• Target type: Instance
• Protocol: HTTP, Port: whatever your app runs on (e.g. 8000, 3000)
• Health check path: / or /health if your app has one
• Register your EC2 instance as a target

2. Create the ALB

Go to EC2 Console → Load Balancers → Create Load Balancer → Application Load Balancer

• Scheme: Internet-facing
• Listeners: HTTPS 443 (or HTTP 80 to start)
• Subnets: select at least 2 public subnets
• Security group: allow inbound 80 and 443 from anywhere (0.0.0.0/0)
• Forward traffic to the target group

3. Attach SSL Certificate to ALB via Cloudflare

• Set ALB listener to HTTP 80 only
• In Cloudflare, keep SSL mode as Flexible — Cloudflare terminates HTTPS, sends HTTP to ALB

4. Update Cloudflare DNS Record

5. Update EC2 Security Group
Right now EC2 probably allows inbound traffic from anywhere. After ALB is set up, lock it down so only the ALB can reach the EC2:

• Remove the rule: 0.0.0.0/0 → port 8000
• Add rule: ALB security group → port 8000

Comienza revisando las instancias EC2 existentes, los grupos de seguridad, los recursos de ALB y la configuración de DNS de Cloudflare para los servicios de producción y staging de kaapi. Crea o reutiliza grupos de destino y reglas de listener, enruta cada dominio a través del ALB, actualiza la configuración de DNS y SSL, y restringe el acceso de EC2 al grupo de seguridad del ALB. La tarea estará terminada cuando ambos servicios sean accesibles a través de sus dominios sin Elastic IPs y sus comprobaciones de estado sean satisfactorias.