Infra: Use ALB for Kaapi Instances

Is your feature request related to a problem?

• Attaching Elastic IPs to kaapi-prod-ui-guardrails and kaapi-staging-ui-guardrails is unnecessary and adds cost.
• EIPs are not needed if services are accessible through an ALB

Describe the solution you'd like

• Do this via ALB instead of Elastic IPs
  • Create Target Groups for kaapi-prod-ui-guardrails and kaapi-staging-ui-guardrails
  • Register respective EC2 instances in each target group

Describe the enhancement you'd like

• Attach Elastic IP (to be done after services are up).
  • kaapi-prod-ui-guardrails
  • kaapi-staging-ui-guardrails
• Create / Update ALB
  • Create ALB (or reuse existing one)
  • Add listener rules:
    • domain → forward to targeted group which we have created.
    • same for others.
• Update DNS in Cloudflare
• SSL Certificate update

Here is the high-level steps:

1. Create a Target Group
This is the group that tells ALB which EC2 to send traffic to.

Go to EC2 Console → Target Groups → Create Target Group

• Target type: Instance
• Protocol: HTTP, Port: whatever your app runs on (e.g. 8000, 3000)
• Health check path: / or /health if your app has one
• Register your EC2 instance as a target

2. Create the ALB

Go to EC2 Console → Load Balancers → Create Load Balancer → Application Load Balancer

• Scheme: Internet-facing
• Listeners: HTTPS 443 (or HTTP 80 to start)
• Subnets: select at least 2 public subnets
• Security group: allow inbound 80 and 443 from anywhere (0.0.0.0/0)
• Forward traffic to the target group

3. Attach SSL Certificate to ALB via Cloudflare

• Set ALB listener to HTTP 80 only
• In Cloudflare, keep SSL mode as Flexible — Cloudflare terminates HTTPS, sends HTTP to ALB

4. Update Cloudflare DNS Record

5. Update EC2 Security Group
Right now EC2 probably allows inbound traffic from anywhere. After ALB is set up, lock it down so only the ALB can reach the EC2:

• Remove the rule: 0.0.0.0/0 → port 8000
• Add rule: ALB security group → port 8000

Commencez par examiner les instances EC2 existantes, les groupes de sécurité, les ressources ALB et la configuration DNS de Cloudflare pour les services de production et de staging de kaapi. Créez ou réutilisez des target groups et des listener rules, acheminez chaque domaine via l’ALB, mettez à jour les paramètres DNS et SSL, et restreignez l’accès EC2 au groupe de sécurité de l’ALB. La tâche est terminée lorsque les deux services sont accessibles via leurs domaines sans Elastic IPs et que leurs health checks passent.