Repository navigation
Armonia · Private EC2 deployment and Bedrock instance-role credentials #1887
Description
Important
Problem — The hub runs from machine-specific scripts with hard-coded home paths, open service auth, and no frontdoor unit; the Bedrock provider does not load from a bare EC2 instance role. The first team deployment cannot be stood up on AWS reproducibly.
Approach — Let the Bedrock provider use the default credential chain, including instance metadata, when explicitly enabled, and package a parameterized private deployment: environment file, dedicated system user, frontdoor and engine services, TLS, team-deployment auth, persistent storage, and backups.
Scope — in: Bedrock instance-role support, deployment configuration file, service units for frontdoor and engines, TLS termination, refusal of open auth, storage layout and database-consistent backups, a runbook. out: public exposure, clustering, self-hosted inference.
Assumptions — Access is over a private network or VPN; the host has an instance role with model invocation permissions.
Acceptance Criteria
- With the opt-in enabled and only an instance role available, the Bedrock provider loads and completes a model call.
- Without the opt-in, provider behavior is unchanged.
- A fresh host configured from the deployment file starts the frontdoor and engines as a dedicated user with no home-directory assumptions.
- The deployment refuses to start with open service auth.
- A backup taken while serving restores to a consistent session store.
- Restarting the host preserves sessions, memberships, campaigns, and work requests.
Testing Decisions
Extend the provider loading tests with a credential-chain case; add a deployment smoke test on a clean host image.
Key Decisions
- Instance-role support is opt-in, so laptops never probe instance metadata.
- One coordination host and one engine process to start; more engine processes only behind the existing sticky routing.
Constraints & Invariants
- No credentials in the deployment file; secrets come from the host's secret store.
Prior Art
- The hub server wrapper, the frontdoor, the per-shard service template, the fleet installer, the upstream engine container image.
Activity
[-]Team engine · Private EC2 deployment and Bedrock instance-role credentials[/-][+]Armonia · Private EC2 deployment and Bedrock instance-role credentials[/+]