@ossy/deployment-tools 1.19.0 → 1.20.1

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## 1.20.1 (2026-05-26)
+
+
+### Bug Fixes
+
+* **deployment-tools:** Update Caddy service setup and Ubuntu AMI version ([6b3f4f7](https://github.com/ossy-se/ossy/commit/6b3f4f755901450be744d4402ec1f314418d101e))
+
+
+
+
+
+# 1.20.0 (2026-05-25)
+
+
+### Features
+
+* **deployment-tools:** Refactor container service management and update documentation ([8e2bc9c](https://github.com/ossy-se/ossy/commit/8e2bc9c186dbc9a16ae6127fad755baffc07d0be))
+
+
+
+
+
 # 1.19.0 (2026-05-25)
 
 

package/README.md

@@ -21,38 +21,139 @@ Caddy uses **on-demand TLS**: before issuing a certificate for any domain, it ca
 
 All services run as Docker containers managed by systemd. Service files are written to the EC2 host by CDK user data at instance creation.
 
-| Service | Unit file | Port | Auto-start | Image |
-|---|---|---|---|---|
-| Caddy | `caddy-route53.service` | 80, 443 | Yes | — |
-| Ossy API | `ossy-api.service` | 3001 | Yes | `ghcr.io/ossy-se/api:latest` |
-| Ossy Platform | `ossy-runtime.service` | 3000 | Yes | `ghcr.io/ossy-se/platform:latest` |
-| website-ossy | `ossy-website-ossy.service` | 3002 | Yes | `ghcr.io/ossy-se/website-ossy:latest` |
-| website-plexus-sanitas | `ossy-website-plexus-sanitas.service` | 3003 | Yes | `ghcr.io/ossy-se/website-plexus-sanitas:latest` |
+| Service | Unit file | Port | Image |
+|---|---|---|---|
+| Caddy | `caddy-route53.service` | 80, 443 | — |
+| Ossy API | `ossy-api.service` | 3001 | `ghcr.io/ossy-se/api:latest` |
+| Ossy Platform | `ossy-runtime.service` | 3000 | `ghcr.io/ossy-se/platform:latest` |
+| _configured via `services`_ | `<name>.service` | _per config_ | _per config_ |
 
-> **TODO (website-ossy, website-plexus-sanitas):** These are temporary services. Once `ossy app publish` is validated for each site, remove their service files and Caddy blocks so traffic flows through the platform runtime instead.
-
-> **TODO:** Pin `@ossy/platform` to a specific version at CDK deploy time (thread through `PlatformConfig`) rather than always pulling `@latest`.
+Additional services are generated automatically from the `services` array in `platforms.json` — see the Configuration section below.
 
 ## Configuration — `platforms.json`
 
-`packages/infrastructure/platforms.json` is the single source of truth for a platform. It contains:
+`packages/infrastructure/platforms.json` is the single source of truth for a platform. Each entry becomes a CDK `Stage` with its own set of stacks.
+
+| Field | Required | Description |
+|---|---|---|
+| `platformName` | Yes | Unique name, used as the CDK stage name and CloudFormation stack prefix |
+| `awsAccountId` | Yes | AWS account ID |
+| `awsKeyPairName` | Yes | EC2 key pair name for SSH access |
+| `awsInstanceClass` | No | EC2 instance class (e.g. `t3`, `t4g`, `m5`). Defaults to `t3` |
+| `awsInstanceSize` | No | EC2 instance size (e.g. `small`, `medium`, `large`). Defaults to `small` |
+| `sesDomains` | No | Domains to configure SES email identity for |
+| `domains` | No | Domains to create Route53 A records for, pointing to the EC2 Elastic IP. Supports wildcards (e.g. `*.ossy.se`). |
+| `services` | No | Per-platform container services (see below) |
+| `dnsRecords` | No | Additional DNS records by root domain (currently supports MX) |
+| `env` | No | Environment variables written to `/etc/environment` on the EC2 host at boot. **Never uploaded to S3.** |
+
+### `services` — container/domain mapping
+
+Services come in two flavours: **HTTP** (routed through Caddy) and **TCP/UDP** (raw socket, bypasses Caddy). Both generate a systemd unit that pulls the image on every restart and forwards `/etc/environment` to the container.
+
+#### HTTP service (default)
+
+Generates a Caddy reverse-proxy block with Route53 TLS. The container must listen on port 3000.
+
+```json
+"services": [
+  {
+    "name": "ossy-website-ossy",
+    "domain": "ossy.se",
+    "image": "ghcr.io/ossy-se/website-ossy:latest"
+  }
+]
+```
+
+| Field | Description |
+|---|---|
+| `name` | Unique service name — Docker container name and systemd unit (`<name>.service`). |
+| `domain` | Hostname routed by Caddy to this container (Route53 TLS via `dns route53`). |
+| `image` | Docker image to pull and run. |
+
+Host ports are auto-assigned starting at `3002`, counting only HTTP services (TCP entries are skipped). Appending new HTTP entries is safe; avoid reordering existing ones.
+
+#### TCP/UDP service
+
+No Caddy block. Ports are mapped directly (`HOST:CONTAINER`) and opened in the EC2 security group. Use this for game servers or any raw socket protocol.
+
+```json
+"services": [
+  {
+    "name": "minecraft",
+    "type": "tcp",
+    "image": "itzg/minecraft-server",
+    "ports": [25565],
+    "protocol": "tcp"
+  }
+]
+```
+
+| Field | Description |
+|---|---|
+| `name` | Unique service name — Docker container name and systemd unit. |
+| `type` | Must be `"tcp"` to enable this mode. |
+| `image` | Docker image to pull and run. |
+| `ports` | Array of port numbers to expose on the host and open in the security group. |
+| `protocol` | `"tcp"` (default), `"udp"`, or `"both"`. |
+
+**Fixed built-in services** (always present, not configurable via `services`):
+- `ossy-api` — the Ossy API (`ghcr.io/ossy-se/api:latest`, port 3001)
+- `ossy-runtime` — the platform runtime serving all CMS-published apps (`ghcr.io/ossy-se/platform:latest`, port 3000, catch-all)
 
-- **AWS config** — account ID, key pair, S3 bucket name, IAM role
-- **`domains`** — list of domains to create Route53 A records for, all pointing to the EC2 host IP
-- **`env`** — environment variables written to `/etc/environment` on the EC2 host at boot time. **These are never uploaded to S3.**
+**Custom domains**: For customer-owned domains (e.g. `woodhill.com`), the customer adds an A record pointing to the Elastic IP at their registrar. No infrastructure change needed — Caddy's on-demand TLS issues the cert automatically once the domain is registered via `ossy app publish`.
 
-To add or change environment variables, update the `env` block in `platforms.json` and redeploy. To add a new domain, add it to `domains` and redeploy.
+**Wildcard subdomains**: Add `*.ossy.se` to `domains` for a Route53 wildcard A record. This covers any `*.ossy.se` subdomain without individual records.
 
-## Bootstrapping a new host
+`MEDIA_REPOSITORY` and `MEDIA_CDN_DOMAIN_NAME` are derived automatically from the provisioned S3 bucket and CloudFront distribution — do not set them in `env`.
 
-CDK provisions the instance, writes all service files, writes `/etc/environment` from `platforms.json`, and starts all services automatically. No manual SSH steps required.
+To add a new platform, add an entry to `platforms.json`. No bucket name or CDN domain is needed; these are auto-generated by CloudFormation.
+
+## CDK Stacks
+
+Each platform is a CDK `Stage` containing five stacks:
+
+| Stack | Description |
+|---|---|
+| `storage-static` | S3 bucket (auto-named), daily backup plan, CloudFront CDN for `/media`. Kept separate from the EC2 stack so storage resources are never touched during instance updates. |
+| `deployment-target` | EC2 instance with Elastic IP. Imports the S3 bucket from `storage-static` via cross-stack reference. |
+| `dns` | Route53 A records for all domains in `platforms.json`, pointing to the Elastic IP. |
+| `ses` | SES email sending identity and DKIM records. |
+
+The Elastic IP ensures the EC2 instance can be replaced (instance type changes, user data updates) without breaking DNS or CloudFormation cross-stack exports.
+
+## Bootstrapping a new platform
 
 ```bash
 cd packages/deployment-tools
-npx cdk deploy ossybot-deployment-target --require-approval never
+npx cdk deploy 'ossybot/**' --profile ossybot --require-approval never
 ```
 
-> Note: EC2 user data only runs on **first boot**. To apply infrastructure changes to an existing instance you must terminate and recreate it, or SSH in and apply the changes manually.
+CDK provisions the instance, writes all service files, writes `/etc/environment` from `platforms.json`, and starts all services automatically. No manual SSH steps are required.
+
+> Note: EC2 user data only runs on **first boot**. To apply infrastructure changes to an existing instance you must terminate and recreate it, or SSH in and apply changes manually.
+
+## Deploying changes
+
+Target a single platform:
+```bash
+npx cdk deploy 'ossybot/**' --profile ossybot
+```
+
+Target all platforms:
+```bash
+npx cdk deploy '**' --profile ossybot
+```
+
+Preview changes without deploying:
+```bash
+npx cdk diff 'ossybot/**' --profile ossybot
+```
+
+List all stacks:
+```bash
+npx cdk list
+```
 
 ## Redeploying after a code change
 
@@ -74,15 +175,20 @@ sudo systemctl restart ossy-website-plexus-sanitas
 
 ## Environment variables
 
-All env vars are defined in the `env` block of `platforms.json` and written to `/etc/environment` at boot. Reference:
+Defined in the `env` block of `platforms.json`, written to `/etc/environment` at boot. The following variables are injected automatically by CDK and should **not** be set manually:
+
+| Variable | Source |
+|---|---|
+| `MEDIA_REPOSITORY` | S3 bucket name from `storage-static` stack |
+| `MEDIA_CDN_DOMAIN_NAME` | CloudFront domain from `storage-static` stack |
+
+All other env vars:
 
 | Variable | Used by | Description |
 |---|---|---|
 | `DB_URL` | API | Atlas MongoDB connection string |
 | `DB_NAME` | API | MongoDB database name |
 | `TOKEN_SECRET` | API | JWT signing secret |
-| `MEDIA_REPOSITORY` | API | S3 bucket name for media uploads |
-| `MEDIA_CDN_DOMAIN_NAME` | API | CloudFront domain for public media |
 | `AWS_ACCESS_KEY_ID` | API | AWS credentials for S3 |
 | `AWS_SECRET_ACCESS_KEY` | API | AWS credentials for S3 |
 | `OSSY_API_KEY` | Platform, websites | API JWT for CMS reads |
@@ -90,22 +196,11 @@ All env vars are defined in the `env` block of `platforms.json` and written to `
 | `OPENAI_API_KEY` | Worker | OpenAI API key |
 | `OPENAI_ORGANIZATION` | Worker | OpenAI organisation ID |
 
-## Infrastructure (CDK)
-
-CDK stacks are defined in `src/infrastructure/`. Run via `cdk deploy` from the `deployment-tools` package.
-
-| Stack | Description |
-|---|---|
-| `trust-ci` | IAM role for CI to deploy infrastructure |
-| `deployment-target` | EC2 host, S3 bucket, CloudFront CDN for media |
-| `dns` | Route53 A records for all domains in `platforms.json` |
-| `ses` | SES email sending |
-
 ## Useful commands
 
 **SSH into instance**
 ```bash
-ssh -i path/to/keys ubuntu@<ip>
+ssh -i path/to/keys ubuntu@<elastic-ip>
 ```
 
 **View service logs**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/deployment-tools",
-  "version": "1.19.0",
+  "version": "1.20.1",
   "description": "Collection of scripts and tools to aid deployment of containers and static files to Amazon Web Services through GitHub Actions",
   "source": "./src/index.js",
   "main": "./src/index.js",
@@ -12,11 +12,7 @@
   },
   "author": "Ossy",
   "license": "ISC",
-  "bin": "./src/index.cli.js",
   "dependencies": {
-    "@actions/core": "^1.10.0",
-    "@aws-sdk/client-sts": "^3.245.0",
-    "arg": "^5.0.2",
     "aws-cdk": "^2.73.0",
     "aws-cdk-lib": "^2.73.0",
     "constructs": "^10.1.304",
@@ -26,5 +22,5 @@
   "devDependencies": {
     "jest": "^27.5.1"
   },
-  "gitHead": "a40e3b439ced37f52db9526f799189e6d0809349"
+  "gitHead": "b063e40ba5b374e04a5911a4fec92ec6b9014409"
 }

package/src/config/platform-config.js

@@ -5,15 +5,29 @@
  * @property {string[]=} sesDomains - list of domains to configure AWS SES email identity and DKIM records for
  * @property {string[]=} domains - list of domains to create Route53 A records for, pointing to the EC2 host
  * @property {object} dnsRecords - map of dns records by root domain, only supports MX records so that we can add dns records for our email service
+ * @property {Array<HttpServiceConfig|TcpServiceConfig>=} services - per-platform container services; each entry generates a systemd unit. HTTP services also get a Caddy reverse-proxy block. TCP/UDP services get direct port exposure and security group rules instead.
+ *
+ * @typedef {Object} HttpServiceConfig
+ * @property {'http'} [type]    - defaults to 'http' when omitted
+ * @property {string} name      - unique service name (container + systemd unit)
+ * @property {string} domain    - hostname routed by Caddy to this container
+ * @property {string} image     - Docker image (e.g. ghcr.io/ossy-se/website-ossy:latest)
+ *
+ * @typedef {Object} TcpServiceConfig
+ * @property {'tcp'} type       - marks a raw socket service; bypasses Caddy entirely
+ * @property {string} name      - unique service name (container + systemd unit)
+ * @property {string} image     - Docker image (e.g. itzg/minecraft-server)
+ * @property {number[]} ports   - ports to open on the host and in the EC2 security group
+ * @property {'tcp'|'udp'|'both'} [protocol] - defaults to 'tcp'
  * @property {Record<string,string>=} env - environment variables written to /etc/environment on the EC2 host at boot time; never uploaded to S3
  *
  * @property {string} awsAccountId - Aws account id
- * @property {string=} awsRegion - ?
- * @property {string=} awsKeyPairName - ?
- * @property {string} awsRoleToAssume - ?
+ * @property {string=} awsRegion - AWS region, defaults to eu-north-1
+ * @property {string=} awsKeyPairName - EC2 key pair name for SSH access
+ * @property {string=} awsInstanceClass - EC2 instance class (e.g. t3, t4g, m5), defaults to t3
+ * @property {string=} awsInstanceSize - EC2 instance size (e.g. small, medium, large), defaults to small
  *
  * @property {string=} ciDockerNetworkName - ?
- * @property {string} ciGithubActionsRepo - organisation/repoName
  */
 
 const SupportedRegions = {

package/src/infrastructure/cli.js

@@ -1,10 +1,7 @@
 #!/usr/bin/env node
 /* eslint-disable no-new */
 const { App } = require('aws-cdk-lib')
-const { TrustCiStack } = require('./trust-ci-stack')
-const { DeploymentTargetStack } = require('./deployment-target-stack')
-const { DnsStack } = require('./dns-stack')
-const { SesStack } = require('./ses-stack')
+const { PlatformStage } = require('./platform-stage')
 const { PlatformTemplateService } = require('../template')
 const { PlatformConfigService } = require('../config')
 
@@ -15,25 +12,12 @@ PlatformTemplateService
     const app = new App()
 
     configs.forEach(config => {
-
-      const stackProps = {
+      new PlatformStage(app, config.platformName, {
         config,
         env: {
           account: config.awsAccountId,
           region: config.awsRegion
         }
-      }
-
-      new TrustCiStack(app, `${config.platformName}-trust-ci`, stackProps)
-
-      const deploymentTarget = new DeploymentTargetStack(app, `${config.platformName}-deployment-target`, stackProps)
-
-      new DnsStack(app, `${config.platformName}-dns`, {
-        ...stackProps,
-        containerDeploymentTargetPublicIp: deploymentTarget.containerDeploymentTargetPublicIp
       })
-
-      new SesStack(app, `${config.platformName}-ses`, stackProps)
-
     })
   })

package/src/infrastructure/container-deployment-target/caddy.service.js

@@ -1,4 +1,16 @@
-const caddyfile = `
+/**
+ * Builds the full Caddyfile content.
+ * - Global block: on-demand TLS pointing at the API ask endpoint
+ * - API block: explicit Route53 TLS for api.ossy.se
+ * - One block per ContainerService (from platforms.json `services`)
+ * - Catch-all :443 block: on-demand TLS, routes to the platform runtime
+ *
+ * @param {import('./container-service').ContainerService[]} services
+ */
+const buildCaddyfile = (services) => {
+  const serviceBlocks = services.map(s => s.caddyBlock).join('\n')
+
+  return `
 {
   on_demand_tls {
     ask http://localhost:3001/api/v0/apps/ask
@@ -14,32 +26,7 @@ api.ossy.se {
   }
   reverse_proxy localhost:3001
 }
-
-# TODO: remove this block once ossy.se traffic flows through the platform runtime.
-# Once ossy app publish is validated for ossy.se, delete this block and the
-# ossy-website-ossy.service so the catch-all below serves it via the platform.
-ossy.se {
-  tls {
-    dns route53 {
-      max_retries 10
-      profile ci-client
-    }
-  }
-  reverse_proxy localhost:3002
-}
-
-# TODO: remove this block once www.plexus-sanitas.com traffic flows through the platform runtime.
-# Once ossy app publish is validated for plexus-sanitas, delete this block and the
-# ossy-website-plexus-sanitas.service so the catch-all below serves it via the platform.
-www.plexus-sanitas.com {
-  tls {
-    dns route53 {
-      max_retries 10
-      profile ci-client
-    }
-  }
-  reverse_proxy localhost:3003
-}
+${serviceBlocks}
 
 :443 {
   tls {
@@ -52,6 +39,7 @@ www.plexus-sanitas.com {
   reverse_proxy localhost:3000
 }
 `
+}
 
 const systemdServiceFile = `
 # caddy-route53.service — Caddy with Route53 DNS plugin for on-demand TLS.
@@ -84,14 +72,19 @@ WantedBy=multi-user.target cloud-init.target
 */
 class CaddyService {
 
-  static install() {
+  /**
+   * @param {import('./container-service').ContainerService[]} services
+   */
+  static install(services = []) {
+    const caddyfile = buildCaddyfile(services)
     return [
       // Write Caddyfile
       'sudo mkdir -p /etc/caddy',
       `sudo tee /etc/caddy/Caddyfile > /dev/null << 'CADDYEOF'\n${caddyfile}\nCADDYEOF`,
       // Write systemd unit
       `sudo tee /etc/systemd/system/caddy-route53.service > /dev/null << 'UNITEOF'\n${systemdServiceFile}\nUNITEOF`,
-      // Install Caddy + xcaddy + Route53 plugin
+      // Create caddy system user (apt install caddy may not run on all Ubuntu versions)
+      'sudo useradd --system --home /var/lib/caddy --shell /usr/sbin/nologin --create-home caddy || true',
       'sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https',
       'sudo curl -1sLf \'https://dl.cloudsmith.io/public/caddy/stable/gpg.key\' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg',
       'sudo curl -1sLf \'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt\' | sudo tee /etc/apt/sources.list.d/caddy-stable.list',

package/src/infrastructure/container-deployment-target/container-deployment-target.js

@@ -11,7 +11,9 @@ const {
   Port,
   UserData,
   KeyPair,
-  BlockDeviceVolume
+  BlockDeviceVolume,
+  CfnEIP,
+  CfnEIPAssociation
 } = require('aws-cdk-lib/aws-ec2')
 const { Role, ServicePrincipal, Policy, PolicyStatement, Effect } = require('aws-cdk-lib/aws-iam')
 const { Source, BucketDeployment } = require('aws-cdk-lib/aws-s3-deployment')
@@ -19,8 +21,7 @@ const { getInstallNodeJs, getInstallNpm, getInstallDocker } = require('./user-da
 const { CaddyService } = require('./caddy.service')
 const { OssyRuntimeService } = require('./ossy-runtime.service')
 const { OssyApiService } = require('./ossy-api.service')
-const { OssyWebsiteOssyService } = require('./ossy-website-ossy.service')
-const { OssyWebsitePlexusSanitasService } = require('./ossy-website-plexus-sanitas.service')
+const { fromConfig: buildContainerServices } = require('./container-service')
 const { AwsProfile } = require('./aws-profile')
 const { SupportedRegions } = require('../../config')
 
@@ -33,7 +34,7 @@ const { SupportedRegions } = require('../../config')
  */
 
 const InstanceImages = {
-  UBUNTU: 'ami-092cce4a19b438926'
+  UBUNTU: 'ami-067bcf851477ebb78' // Ubuntu Server 24.04 LTS (HVM), eu-north-1
 }
 
 /**
@@ -70,8 +71,18 @@ class ContainerDeploymentTarget extends Construct {
       'allow HTTPS traffic from anywhere'
     )
 
+    // Build container services from config — opens additional security group ports for TCP/UDP services
+    const containerServices = buildContainerServices(props.config.services)
+
+    containerServices.forEach(service => {
+      service.securityGroupPorts.forEach(({ port, protocol }) => {
+        const portRule = protocol === 'udp' ? Port.udp(port) : Port.tcp(port)
+        securityGroup.addIngressRule(Peer.anyIpv4(), portRule, `${service.name} ${protocol.toUpperCase()} ${port}`)
+      })
+    })
+
     const platformConfigDeployment = new BucketDeployment(this, 'PlatformConfigDeployment', {
-      sources: [Source.jsonData('platform-config.json', { ...props.config, awsRoleToAssume: undefined, env: undefined })],
+      sources: [Source.jsonData('platform-config.json', { ...props.config, env: undefined })],
       destinationBucket: props.bucket,
       // Default prune:true would delete every other object (e.g. media/*) on each infra deploy.
       prune: false
@@ -125,11 +136,10 @@ class ContainerDeploymentTarget extends Construct {
       `sudo tee /etc/environment << 'ENVEOF'\n${envLines.join('\n')}\nENVEOF`,
       // Create shared Docker network for inter-container communication
       'docker network create ossy-network || true',
-      ...CaddyService.install(),
+      ...CaddyService.install(containerServices.filter(s => s.caddyBlock !== null)),
       ...OssyRuntimeService.install(),
       ...OssyApiService.install(),
-      ...OssyWebsiteOssyService.install(),
-      ...OssyWebsitePlexusSanitasService.install()
+      ...containerServices.flatMap(s => s.install())
     )
 
     userData.addS3DownloadCommand({
@@ -146,21 +156,42 @@ class ContainerDeploymentTarget extends Construct {
       ...OssyRuntimeService.start(),
       ...OssyApiService.enable(),
       ...OssyApiService.start(),
-      ...OssyWebsiteOssyService.enable(),
-      ...OssyWebsiteOssyService.start(),
-      ...OssyWebsitePlexusSanitasService.enable(),
-      ...OssyWebsitePlexusSanitasService.start()
+      ...containerServices.flatMap(s => [...s.enable(), ...s.start()])
     )
 
+    const instanceClassMap = {
+      t2: InstanceClass.T2,
+      t3: InstanceClass.T3,
+      t3a: InstanceClass.T3A,
+      t4g: InstanceClass.T4G,
+      m5: InstanceClass.M5,
+      m6i: InstanceClass.M6I,
+      c5: InstanceClass.C5,
+      c6i: InstanceClass.C6I,
+    }
+
+    const instanceSizeMap = {
+      nano: InstanceSize.NANO,
+      micro: InstanceSize.MICRO,
+      small: InstanceSize.SMALL,
+      medium: InstanceSize.MEDIUM,
+      large: InstanceSize.LARGE,
+      xlarge: InstanceSize.XLARGE,
+      '2xlarge': InstanceSize.XLARGE2,
+    }
+
+    const instanceClass = instanceClassMap[props.config.awsInstanceClass ?? 't3']
+    const instanceSize = instanceSizeMap[props.config.awsInstanceSize ?? 'small']
+
+    if (!instanceClass) throw new Error(`[ContainerDeploymentTarget] Unknown awsInstanceClass: ${props.config.awsInstanceClass}`)
+    if (!instanceSize) throw new Error(`[ContainerDeploymentTarget] Unknown awsInstanceSize: ${props.config.awsInstanceSize}`)
+
     const ec2Instance = new Instance(this, 'Ec2Instance', {
       vpc,
       securityGroup,
       userData,
       role,
-      instanceType: InstanceType.of(
-        InstanceClass.T3,
-        InstanceSize.SMALL
-      ),
+      instanceType: InstanceType.of(instanceClass, instanceSize),
       machineImage: new GenericLinuxImage({
         [SupportedRegions.North]: InstanceImages.UBUNTU
       }),
@@ -175,7 +206,15 @@ class ContainerDeploymentTarget extends Construct {
 
     props.bucket.grantRead(ec2Instance, '*')
 
-    this.instancePublicIp = ec2Instance.instancePublicIp
+    // Elastic IP gives the instance a stable public IP that survives instance replacements,
+    // preventing CloudFormation cross-stack export conflicts when the EC2 instance is updated.
+    const eip = new CfnEIP(this, 'ElasticIp', { domain: 'vpc' })
+    new CfnEIPAssociation(this, 'EipAssociation', {
+      instanceId: ec2Instance.instanceId,
+      allocationId: eip.attrAllocationId
+    })
+
+    this.instancePublicIp = eip.attrPublicIp
 
   }
 }