From b6a631ae7051191d81c3f28a7ca607a7bb25ee70 Mon Sep 17 00:00:00 2001
From: Michael Buntarman <michaelboentarman@gmail.com>
Date: Thu, 29 Oct 2026 19:50:24 +0700
Subject: [PATCH] feat(infra): rebuild the indexer with the API's HTTPS port
 open

---
 .../lib/kwil-indexer/kwil_indexer_instance.go |  9 +++
 .../kwil_indexer_instance_test.go             | 66 +++++++++++++++++++
 2 files changed, 75 insertions(+)
 create mode 100644 deployments/infra/lib/kwil-indexer/kwil_indexer_instance_test.go

diff --git a/deployments/infra/lib/kwil-indexer/kwil_indexer_instance.go b/deployments/infra/lib/kwil-indexer/kwil_indexer_instance.go
index e7388a35f..d91af2cc6 100644
--- a/deployments/infra/lib/kwil-indexer/kwil_indexer_instance.go
+++ b/deployments/infra/lib/kwil-indexer/kwil_indexer_instance.go
@@ -106,6 +106,15 @@ func NewIndexerInstance(scope constructs.Construct, input NewIndexerInstanceInpu
 		jsii.String("Allow ssh."),
 		jsii.Bool(false))
 
+	// https: the v1 API (api.trufscan.io) gets TLS from a Caddy site set up on the
+	// host, not from the fronting, so the API sees each visitor's address. The
+	// Caddyfile shipped in deployments/indexer serves :80 only.
+	instanceSG.AddIngressRule(
+		awsec2.Peer_AnyIpv4(),
+		awsec2.Port_Tcp(jsii.Number(443)),
+		jsii.String("Allow HTTPS to the v1 API."),
+		jsii.Bool(false))
+
 	// Get key-pair pointer.
 	keyPair := awsec2.KeyPair_FromKeyPairName(scope, jsii.String("KeyPair-ind"), jsii.String(config.KeyPairName(scope)))
 
diff --git a/deployments/infra/lib/kwil-indexer/kwil_indexer_instance_test.go b/deployments/infra/lib/kwil-indexer/kwil_indexer_instance_test.go
new file mode 100644
index 000000000..628ac4424
--- /dev/null
+++ b/deployments/infra/lib/kwil-indexer/kwil_indexer_instance_test.go
@@ -0,0 +1,66 @@
+package kwil_indexer_instance_test
+
+import (
+	"testing"
+
+	"github.com/aws/aws-cdk-go/awscdk/v2"
+	"github.com/aws/aws-cdk-go/awscdk/v2/assertions"
+	"github.com/aws/aws-cdk-go/awscdk/v2/awsec2"
+	"github.com/aws/aws-cdk-go/awscdk/v2/awss3"
+	"github.com/aws/jsii-runtime-go"
+	domaincfg "github.com/trufnetwork/node/infra/config/domain"
+	kwil_indexer "github.com/trufnetwork/node/infra/lib/kwil-indexer"
+	"github.com/trufnetwork/node/infra/lib/kwil-network/peer"
+	"github.com/trufnetwork/node/infra/lib/tn"
+	"github.com/trufnetwork/node/infra/lib/utils"
+	testhelpers "github.com/trufnetwork/node/infra/tests/testhelpers"
+)
+
+// The HTTPS rule for the v1 API belongs on the indexer's own security group,
+// next to ssh, whatever the fronting.
+func TestIndexerSecurityGroupAllowsHTTPS(t *testing.T) {
+	app := awscdk.NewApp(nil)
+	stack := awscdk.NewStack(app, jsii.String("TestStack"), &awscdk.StackProps{
+		Env: &awscdk.Environment{
+			Account: jsii.String("123456789012"),
+			Region:  jsii.String("us-east-1"),
+		},
+	})
+
+	vpc := awsec2.NewVpc(stack, jsii.String("Vpc"), &awsec2.VpcProps{NatGateways: jsii.Number(0)})
+	hd := domaincfg.NewHostedDomain(stack, "HostedDomain", &domaincfg.HostedDomainProps{
+		Spec: domaincfg.Spec{
+			Stage:     domaincfg.StageDev,
+			Sub:       "sub",
+			DevPrefix: "test",
+		},
+		EdgeCertificate: false,
+	})
+	tnSG := awsec2.NewSecurityGroup(stack, jsii.String("TnSG"), &awsec2.SecurityGroupProps{Vpc: vpc})
+	bucket := awss3.NewBucket(stack, jsii.String("BinaryBucket"), &awss3.BucketProps{})
+
+	_ = kwil_indexer.NewIndexerInstance(stack, kwil_indexer.NewIndexerInstanceInput{
+		Vpc: vpc,
+		TNInstance: tn.TNInstance{
+			SecurityGroup:  tnSG,
+			PeerConnection: peer.TNPeer{Address: jsii.String("peer0.test.sub")},
+		},
+		IndexerDirAsset:    testhelpers.DummyAsset(stack, "IndexerDir"),
+		IndexerBinaryAsset: utils.S3Object{Bucket: bucket, Key: jsii.String("indexer.zip")},
+		HostedDomain:       hd,
+	})
+
+	template := assertions.Template_FromStack(stack, nil)
+	template.HasResourceProperties(jsii.String("AWS::EC2::SecurityGroup"), map[string]interface{}{
+		"GroupDescription": "Kwil Indexer Security Group.",
+		"SecurityGroupIngress": assertions.Match_ArrayWith(&[]interface{}{
+			map[string]interface{}{
+				"IpProtocol":  "tcp",
+				"FromPort":    443,
+				"ToPort":      443,
+				"CidrIp":      "0.0.0.0/0",
+				"Description": "Allow HTTPS to the v1 API.",
+			},
+		}),
+	})
+}