From a personal service to a deployable demo: release integrity, Terraform and AWS

Language: English | 简体中文

I turned French Learning Hub into a deployable demonstration system by separating the personal workbench from a curated, read-only runtime. The work covered server-enforced access boundaries, precomputed model artifacts, Linux release packaging, browser acceptance, Terraform infrastructure and verified installation on EC2.

My engineering contribution: defining the demo’s runtime and data boundaries, connecting source provenance to release identity, and taking the deployment through an SSM-managed AWS environment with upgrade and rollback procedures.

发布日期：2026-10-20

Separate the demo from personal data and paid calls

The full FLH service stores personal learning records and offers write operations. A portfolio demo needs a different contract: synthetic data, a small set of inspectable workflows and a bounded runtime.

The demo therefore has its own mode. A boundary wraps the entire server and allows only GET and HEAD on a small route list. Other paths and write methods are rejected before service handlers run. SQLite opens as an immutable artifact, and live providers are disabled.

Semantic and hybrid presets use precomputed E5 document and query vectors. The public-demo runtime searches an in-process artifact index; the personal semantic service uses Qdrant. Free-text keyword search remains available, while semantic/hybrid inputs are selected presets. A visitor cannot trigger a new embedding request.

Treat the artifact as part of the release

The package combines the Go binary, built React frontend, synthetic database, vectors, metadata and validation tools. Linux amd64 and arm64 builds carry source and artifact identity with SHA-256 manifests.

Startup validates the migration ledger and a versioned domain fingerprint. The fingerprint includes facts that affect visible knowledge, such as admission and extraction selection. A mismatch refuses startup rather than quietly serving data with incompatible semantics.

This work also exposed a static-file symlink escape. The fix confined file opening to the web root using Go’s os.Root, and the existing acceptance harness was rerun against the correction. That connected an actual failure reproduction to the release boundary.

Build checks around the user’s path

The public-demo CI exercises HTTP routes and browser workflows, includes a controlled failure probe and verifies cleanup. Release preparation also tested startup ownership, readiness, occupied ports and temporary-directory cleanup. Those checks make the package easier to operate than a binary that merely starts on one development machine.

Deploy with a small, understandable operating model

The AWS environment uses Terraform, a single EC2 instance, private S3 release storage, scoped IAM examples and Session Manager. Administration does not require an inbound SSH port. The application listens on loopback.

The release installer downloads a named package, verifies checksums and artifact identity, switches the active release, then checks readiness and the live identity. If post-install validation fails, the previous release provides a rollback path.

The project records an operator-run deployment and upgrade of a verified-source arm64 release. The service was active and ready, its identity matched, and the demo was opened through an SSM port forward. Closing that tunnel only closes access; it does not stop EC2.

A clear next deployment stage

I also prepared an opt-in public HTTPS path using an Elastic IP, nginx, DNS preflight and certificate-renewal checks. Terraform changes are gated, and the host tool refuses conflicting listeners or unsuitable DNS. The recorded deployment establishes EC2 plus private SSM access; public HTTPS cutover is still pending.

This is the distinction I want a release process to preserve: building a feature, packaging it, deploying it and exposing it publicly are separate milestones with separate checks.

Implementation used AI coding agents under my direction and review. Cloud deployment results in the linked report are operator-reported; this article does not claim a fresh cloud audit.

Server boundary · Release tooling · AWS deployment · HTTPS tooling · CI