agents.oventlabs.com en 45 minutosagents.oventlabs.com in 45 minutes

🧩 ContextoContext

Ya teníamos un solo ALB ("truck") con múltiples sitios en producción (TenK, LogiRed, ClinicFlow). La misión: montar agents.oventlabs.com encima del mismo ALB, con HTTPS, sin romper nada y cerrando el puerto directo al server.

We already had a single ALB ("truck") serving multiple production sites (TenK, LogiRed, ClinicFlow). The mission: bring up agents.oventlabs.com behind the same ALB with HTTPS, without breaking anything, and closing the direct-to-server port.

🏗️ Arquitectura finalFinal architecture

Client
  -> https://agents.oventlabs.com
      -> ALB :443 (SNI selects agents cert)
          -> Rule priority 400 (host=agents.oventlabs.com)
              -> TargetGroup ovents-landing-3001
                  -> EC2 i-xxxx:3001
                      -> Docker container (Next.js standalone)

🐳 Paso 1 — Docker en EC2 (puerto 3001)Step 1 — Docker on EC2 (port 3001)

Primero aseguras que tu app responda localmente. Si el ALB falla, el 80% de las veces es porque el target no responde en el puerto o health check.

First, ensure your app responds locally. If the ALB fails, 80% of the time the target isn't responding on the port or the health check.

# Verifica el container
docker ps | grep ovents-landing

# Verifica HTTP local
curl -I http://localhost:3001/

📜 Paso 2 — Certificado en ACM (DNS validation)Step 2 — ACM certificate (DNS validation)

Pides un cert para agents.oventlabs.com y ACM te da un CNAME. Ese CNAME va en Hostinger.

Request a cert for agents.oventlabs.com and ACM gives you a CNAME. That CNAME goes into Hostinger.

aws acm request-certificate \
  --domain-name agents.oventlabs.com \
  --validation-method DNS \
  --region us-east-2

aws acm describe-certificate --certificate-arn <CERT_ARN>

🧠 Paso 3 — ALB: regla por host + SNIStep 3 — ALB: host rule + SNI

Aquí está la magia: no creas un ALB nuevo. Le agregas:

• Un Target Group nuevo (HTTP:3001)
• Una regla host-header (priority 400)
• Un certificado adicional al listener 443 (SNI)

This is the magic: you don't create a new ALB. You add:

• A new Target Group (HTTP:3001)
• A host-header rule (priority 400)
• An extra certificate on the 443 listener (SNI)

# 1) Target group
aws elbv2 create-target-group \
  --name ovents-landing-3001 \
  --protocol HTTP --port 3001 \
  --vpc-id <VPC_ID> \
  --target-type instance

aws elbv2 register-targets \
  --target-group-arn <TG_ARN> \
  --targets Id=<INSTANCE_ID>,Port=3001

# 2) Adjuntar cert al listener 443
aws elbv2 add-listener-certificates \
  --listener-arn <LISTENER_ARN> \
  --certificates CertificateArn=<CERT_ARN>

# 3) Regla de enrutamiento
aws elbv2 create-rule \
  --listener-arn <LISTENER_ARN> \
  --priority 400 \
  --conditions Field=host-header,Values=agents.oventlabs.com \
  --actions Type=forward,TargetGroupArn=<TG_ARN>

🛡️ Paso 4 — Hardening: cerrar 3001 al públicoStep 4 — Hardening: close 3001 to the public

Este es el punto que separa “funciona” de “está bien hecho”. Si el ALB ya funciona, no necesitas EC2:3001 abierto a internet.

This is what separates “it works” from “it’s properly done”. If the ALB works, you don't need EC2:3001 exposed to the internet.

# Revoke public access
aws ec2 revoke-security-group-ingress \
  --group-id <EC2_SG> \
  --protocol tcp --port 3001 --cidr 0.0.0.0/0

# Allow from ALB SG (recommended)
aws ec2 authorize-security-group-ingress \
  --group-id <EC2_SG> \
  --protocol tcp --port 3001 \
  --source-group <ALB_SG>

🧯 Rollback (plan de reversa)Rollback plan

Por si la cagas o algo raro pasa, esto regresa a “estado inicial” sin tumbar producción:

• Eliminar la regla priority 400 (host agents.oventlabs.com)
• Opcional: remover el cert de agents del listener 443
• Dejar DNS como estaba

If something goes sideways, this returns you to the baseline without taking prod down:

• Delete the priority 400 rule (host agents.oventlabs.com)
• Optional: remove the agents cert from the 443 listener
• Restore DNS

# Delete the rule
aws elbv2 delete-rule --rule-arn <RULE_ARN>

# Optional: remove certificate
aws elbv2 remove-listener-certificates \
  --listener-arn <LISTENER_ARN> \
  --certificates CertificateArn=<CERT_ARN>

💬 OpiniónOpinion

Esto es lo que la gente subestima: no es “poner un dominio”. Es DNS + TLS + routing + security + observar el sistema cuando falla. La diferencia entre pro y “me funcionó” es que el pro tiene rollback y cierra puertos.

This is what people underestimate: it's not just “adding a domain”. It's DNS + TLS + routing + security + observing the system under failure. The difference between “it worked” and “pro” is having rollback and closing ports.