EC2 + Docker Bootstrap Script

Same EC2 box — but instead of typing commands by hand, you hand AWS a bootstrap script (user-data) that installs Docker, Git, Nginx, and Certbot, then launches your app on first boot. This is your first taste of repeatability: spin up an identical server in one click.

The files this template produces. Copy any of them straight into your project.

#!/usr/bin/env bash
set -euo pipefail

# --- Install runtime ---
dnf update -y
dnf install -y docker git nginx
systemctl enable --now docker nginx

# --- Run the app container on an internal port ---
docker run -d --name web \
  -p 127.0.0.1:8080:80 \
  --restart unless-stopped \
  nginx:1.27-alpine

# --- Reverse proxy: Nginx -> container ---
cat >/etc/nginx/conf.d/app.conf <<'NGINX'
server {
  listen 80;
  server_name _;
  location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $remote_addr;
  }
}
NGINX
nginx -t && systemctl reload nginx

echo "Bootstrap complete: $(date -u)" >/var/log/bootstrap-done.log

1. 1

   Write the bootstrap script

   Take the generated user-data.sh. It's idempotent-ish: every fresh instance ends up in the same known state. Read it top to bottom so nothing is magic.

2. 2

   Launch with user-data

   Launch a new t3.micro and paste the script into Advanced details → User data. AWS runs it as root on first boot.

   User-data only runs on the FIRST boot by default — reboots won't re-run it.

3. 3

   Verify it provisioned itself

   SSH in and confirm Docker, the container, and Nginx all came up without you touching them.

   sudo cat /var/log/cloud-init-output.log | tail -n 40

   Shows what the user-data script actually did on boot.

   docker ps && systemctl status nginx --no-pager

4. 4

   Add HTTPS

   Point a domain's A record at the public IP, then run the Certbot helper to get a free, auto-renewing TLS certificate.

   sudo bash enable-tls.sh app.example.com you@example.com

   Issues a cert and rewrites Nginx to redirect HTTP→HTTPS.

Ask the assistant to explain, review, or recommend — authored for this template.

• TLS is now handled

  Info

  Certbot gives you real HTTPS with automatic renewal — a genuine step up from Level 0.

• User-data runs as root

  Medium

  Anything in the script runs with full privileges, so a mistake or secret in it is dangerous.

  Keep secrets out of user-data; later levels inject them via the pipeline.

• Still a one-off server

  Low

  The script is repeatable, but networking, IAM, and the instance itself are still created by hand.

  Level 2 captures all of that in Terraform.

Tear it down when you're done — the fastest way to avoid a surprise bill.

1. 1

   Terminate the EC2 instance.

   Billing
2. 2

   Remove the DNS A record you created for TLS.

3. 3

   Delete the key pair and security group if unused.