Infra: Use ALB for Kaapi Instances

Is your feature request related to a problem?

• Attaching Elastic IPs to kaapi-prod-ui-guardrails and kaapi-staging-ui-guardrails is unnecessary and adds cost.
• EIPs are not needed if services are accessible through an ALB

Describe the solution you'd like

• Do this via ALB instead of Elastic IPs
  • Create Target Groups for kaapi-prod-ui-guardrails and kaapi-staging-ui-guardrails
  • Register respective EC2 instances in each target group

Describe the enhancement you'd like

• Attach Elastic IP (to be done after services are up).
  • kaapi-prod-ui-guardrails
  • kaapi-staging-ui-guardrails
• Create / Update ALB
  • Create ALB (or reuse existing one)
  • Add listener rules:
    • domain → forward to targeted group which we have created.
    • same for others.
• Update DNS in Cloudflare
• SSL Certificate update

Here is the high-level steps:

1. Create a Target Group
This is the group that tells ALB which EC2 to send traffic to.

Go to EC2 Console → Target Groups → Create Target Group

• Target type: Instance
• Protocol: HTTP, Port: whatever your app runs on (e.g. 8000, 3000)
• Health check path: / or /health if your app has one
• Register your EC2 instance as a target

2. Create the ALB

Go to EC2 Console → Load Balancers → Create Load Balancer → Application Load Balancer

• Scheme: Internet-facing
• Listeners: HTTPS 443 (or HTTP 80 to start)
• Subnets: select at least 2 public subnets
• Security group: allow inbound 80 and 443 from anywhere (0.0.0.0/0)
• Forward traffic to the target group

3. Attach SSL Certificate to ALB via Cloudflare

• Set ALB listener to HTTP 80 only
• In Cloudflare, keep SSL mode as Flexible — Cloudflare terminates HTTPS, sends HTTP to ALB

4. Update Cloudflare DNS Record

5. Update EC2 Security Group
Right now EC2 probably allows inbound traffic from anywhere. After ALB is set up, lock it down so only the ALB can reach the EC2:

• Remove the rule: 0.0.0.0/0 → port 8000
• Add rule: ALB security group → port 8000

Bắt đầu bằng cách xem xét các EC2 instance hiện có, security group, tài nguyên ALB và cấu hình Cloudflare DNS cho các dịch vụ production và staging của kaapi. Tạo hoặc sử dụng lại target group và listener rule, định tuyến từng domain qua ALB, cập nhật các thiết lập DNS và SSL, đồng thời hạn chế quyền truy cập EC2 vào security group của ALB. Hoàn tất khi cả hai dịch vụ đều có thể truy cập thông qua domain của chúng mà không cần Elastic IPs và các health check đều đạt.