Something went wrong. Try again.
Identities for entities did.bot
agent llm did
Something went wrong. Try again.
1234567891011121314151617181920212223242526272829303132333435363738# The single stateful PDS instance, reachable directly from the internet on# 443 -- there is no load balancer in front of it any more. TLS terminates in# the server process itself (see ec2.tf), so there is no separate ALB# security group to hold the public ingress rule; this is that rule, moved.resource "aws_security_group" "instance" { name = "didbot-instance" description = "The single stateful PDS instance, reachable on 443 directly via its Elastic IP" vpc_id = var.vpc_id
ingress { description = "HTTPS from anywhere -- agents and strangers resolving a DID both reach this. Terminated in-process; nothing upstream of the instance sees the plaintext." from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] }
# No port 80. ACME certificate issuance here is DNS-01 (see route53.tf and # iam.tf), which never needs an inbound HTTP-01 challenge listener, and # nothing else in this stack has a reason to speak plaintext HTTP to the # world -- the ALB's old redirect-only listener existed only because an ALB # forces a choice of what happens on 80, which a bare instance does not.
# No inbound SSH rule. Break-glass access is SSM Session Manager, over the # IAM role in iam.tf, which needs no open inbound port and leaves a session # log in CloudTrail. `var.key_name` is still accepted for a key pair as a # true break-glass fallback, but nothing here opens port 22 for it -- add a # scoped ingress rule by hand, from a known address, only for the duration # that fallback is actually needed.
egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] }}