The README described the deployed architecture and resources but never
documented that the repo itself is a CDK v2 app, leaving cdk.json and
the bin/lib layout unexplained for anyone opening the codebase.
Add a "CDK app" section mapping cdk.json, bin/app.ts, the stack file,
cdk.context.json, and the TypeScript config to their roles, so the
infrastructure-as-code component is discoverable from the README.
Swap the cdk.json app runner from ts-node to tsx and pin tsx 4.23.0
to match sh-mcp. Bump typescript to ~7.0.2; ts-node 10.x is
incompatible with the TS7 compiler API.
The public rustdesk.seahaven.com name resolves to the EIP, which the
security group blocks on the admin port (21114). Add an internal-only
rustdesk-admin.int.seahaven.com record pointed at the instance private IP
so the console is reachable over the VPN without using the raw IP.
The requireImdsv2 aspect names its launch template "<id>LaunchTemplate"
by default, which collided with an existing account-global
InstanceLaunchTemplate and failed the first deploy. Enabling
@aws-cdk/aws-ec2:uniqueImdsv2TemplateName makes the name hash-unique.
Scaffold the CDK stack for a self-hosted RustDesk Server Pro relay so
remote support no longer depends on the public RustDesk rendezvous/relay
infrastructure.
Single ARM64 EC2 (SSM-managed, no SSH) runs hbbs+hbbr in Docker. The
server key pair and DB live on a standalone RETAINed EBS volume so they
survive instance replacement (clients keep trusting the same key). Relay
ports are public; the Pro admin console (21114) is restricted to the
office VPN + VPC. IMDSv2 is enforced and the data dir is locked to root.
EIP + rustdesk.seahaven.com give clients a stable address.
