Infra: Use ALB for Kaapi Instances

Is your feature request related to a problem?

• Attaching Elastic IPs to kaapi-prod-ui-guardrails and kaapi-staging-ui-guardrails is unnecessary and adds cost.
• EIPs are not needed if services are accessible through an ALB

Describe the solution you'd like

• Do this via ALB instead of Elastic IPs
  • Create Target Groups for kaapi-prod-ui-guardrails and kaapi-staging-ui-guardrails
  • Register respective EC2 instances in each target group

Describe the enhancement you'd like

• Attach Elastic IP (to be done after services are up).
  • kaapi-prod-ui-guardrails
  • kaapi-staging-ui-guardrails
• Create / Update ALB
  • Create ALB (or reuse existing one)
  • Add listener rules:
    • domain → forward to targeted group which we have created.
    • same for others.
• Update DNS in Cloudflare
• SSL Certificate update

Here is the high-level steps:

1. Create a Target Group
This is the group that tells ALB which EC2 to send traffic to.

Go to EC2 Console → Target Groups → Create Target Group

• Target type: Instance
• Protocol: HTTP, Port: whatever your app runs on (e.g. 8000, 3000)
• Health check path: / or /health if your app has one
• Register your EC2 instance as a target

2. Create the ALB

Go to EC2 Console → Load Balancers → Create Load Balancer → Application Load Balancer

• Scheme: Internet-facing
• Listeners: HTTPS 443 (or HTTP 80 to start)
• Subnets: select at least 2 public subnets
• Security group: allow inbound 80 and 443 from anywhere (0.0.0.0/0)
• Forward traffic to the target group

3. Attach SSL Certificate to ALB via Cloudflare

• Set ALB listener to HTTP 80 only
• In Cloudflare, keep SSL mode as Flexible — Cloudflare terminates HTTPS, sends HTTP to ALB

4. Update Cloudflare DNS Record

5. Update EC2 Security Group
Right now EC2 probably allows inbound traffic from anywhere. After ALB is set up, lock it down so only the ALB can reach the EC2:

• Remove the rule: 0.0.0.0/0 → port 8000
• Add rule: ALB security group → port 8000

Inizia esaminando le istanze EC2 esistenti, i gruppi di sicurezza, le risorse ALB e la configurazione DNS di Cloudflare per i servizi di produzione e staging di kaapi. Crea o riutilizza i gruppi target e le regole del listener, instrada ogni dominio attraverso l’ALB, aggiorna le impostazioni DNS e SSL e limita l’accesso EC2 al gruppo di sicurezza dell’ALB. Il lavoro è completato quando entrambi i servizi sono raggiungibili tramite i rispettivi domini senza Elastic IPs e i relativi health check hanno esito positivo.