Infra: Use ALB for Kaapi Instances

Is your feature request related to a problem?

• Attaching Elastic IPs to kaapi-prod-ui-guardrails and kaapi-staging-ui-guardrails is unnecessary and adds cost.
• EIPs are not needed if services are accessible through an ALB

Describe the solution you'd like

• Do this via ALB instead of Elastic IPs
  • Create Target Groups for kaapi-prod-ui-guardrails and kaapi-staging-ui-guardrails
  • Register respective EC2 instances in each target group

Describe the enhancement you'd like

• Attach Elastic IP (to be done after services are up).
  • kaapi-prod-ui-guardrails
  • kaapi-staging-ui-guardrails
• Create / Update ALB
  • Create ALB (or reuse existing one)
  • Add listener rules:
    • domain → forward to targeted group which we have created.
    • same for others.
• Update DNS in Cloudflare
• SSL Certificate update

Here is the high-level steps:

1. Create a Target Group
This is the group that tells ALB which EC2 to send traffic to.

Go to EC2 Console → Target Groups → Create Target Group

• Target type: Instance
• Protocol: HTTP, Port: whatever your app runs on (e.g. 8000, 3000)
• Health check path: / or /health if your app has one
• Register your EC2 instance as a target

2. Create the ALB

Go to EC2 Console → Load Balancers → Create Load Balancer → Application Load Balancer

• Scheme: Internet-facing
• Listeners: HTTPS 443 (or HTTP 80 to start)
• Subnets: select at least 2 public subnets
• Security group: allow inbound 80 and 443 from anywhere (0.0.0.0/0)
• Forward traffic to the target group

3. Attach SSL Certificate to ALB via Cloudflare

• Set ALB listener to HTTP 80 only
• In Cloudflare, keep SSL mode as Flexible — Cloudflare terminates HTTPS, sends HTTP to ALB

4. Update Cloudflare DNS Record

5. Update EC2 Security Group
Right now EC2 probably allows inbound traffic from anywhere. After ALB is set up, lock it down so only the ALB can reach the EC2:

• Remove the rule: 0.0.0.0/0 → port 8000
• Add rule: ALB security group → port 8000

まず、kaapi の本番サービスとステージングサービスについて、既存の EC2 インスタンス、セキュリティグループ、ALB リソース、Cloudflare DNS 設定を確認します。ターゲットグループとリスナールールを作成または再利用し、各ドメインを ALB 経由でルーティングし、DNS と SSL の設定を更新して、EC2 へのアクセスを ALB のセキュリティグループに制限します。両方のサービスが Elastic IPs なしでそれぞれのドメインから到達可能になり、ヘルスチェックに合格すれば完了です。