From a706fd4f7d00ce6e24e8d9644378c59db8fceee3 Mon Sep 17 00:00:00 2001
From: Michael Buntarman <michaelboentarman@gmail.com>
Date: Thu, 29 Oct 2026 20:29:11 +0700
Subject: [PATCH] feat(infra): rebuild the indexer with the testnet port open

---
 .../lib/kwil-indexer/kwil_indexer_instance.go |  8 +++++
 .../kwil_indexer_instance_test.go             | 34 +++++++++++--------
 2 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/deployments/infra/lib/kwil-indexer/kwil_indexer_instance.go b/deployments/infra/lib/kwil-indexer/kwil_indexer_instance.go
index d91af2cc..545999cc 100644
--- a/deployments/infra/lib/kwil-indexer/kwil_indexer_instance.go
+++ b/deployments/infra/lib/kwil-indexer/kwil_indexer_instance.go
@@ -115,6 +115,14 @@ func NewIndexerInstance(scope constructs.Construct, input NewIndexerInstanceInpu
 		jsii.String("Allow HTTPS to the v1 API."),
 		jsii.Bool(false))
 
+	// testnet indexer: a second indexer, set up on the host for testnet, serves
+	// its API on 8080 directly.
+	instanceSG.AddIngressRule(
+		awsec2.Peer_AnyIpv4(),
+		awsec2.Port_Tcp(jsii.Number(8080)),
+		jsii.String("Allow the testnet indexer API."),
+		jsii.Bool(false))
+
 	// Get key-pair pointer.
 	keyPair := awsec2.KeyPair_FromKeyPairName(scope, jsii.String("KeyPair-ind"), jsii.String(config.KeyPairName(scope)))
 
diff --git a/deployments/infra/lib/kwil-indexer/kwil_indexer_instance_test.go b/deployments/infra/lib/kwil-indexer/kwil_indexer_instance_test.go
index 628ac442..00d4017e 100644
--- a/deployments/infra/lib/kwil-indexer/kwil_indexer_instance_test.go
+++ b/deployments/infra/lib/kwil-indexer/kwil_indexer_instance_test.go
@@ -16,9 +16,10 @@ import (
 	testhelpers "github.com/trufnetwork/node/infra/tests/testhelpers"
 )
 
-// The HTTPS rule for the v1 API belongs on the indexer's own security group,
+// The ports of the services set up on the indexer host (HTTPS for the v1 API,
+// 8080 for the testnet indexer) belong on the indexer's own security group,
 // next to ssh, whatever the fronting.
-func TestIndexerSecurityGroupAllowsHTTPS(t *testing.T) {
+func TestIndexerSecurityGroupAllowsPublicPorts(t *testing.T) {
 	app := awscdk.NewApp(nil)
 	stack := awscdk.NewStack(app, jsii.String("TestStack"), &awscdk.StackProps{
 		Env: &awscdk.Environment{
@@ -51,16 +52,21 @@ func TestIndexerSecurityGroupAllowsHTTPS(t *testing.T) {
 	})
 
 	template := assertions.Template_FromStack(stack, nil)
-	template.HasResourceProperties(jsii.String("AWS::EC2::SecurityGroup"), map[string]interface{}{
-		"GroupDescription": "Kwil Indexer Security Group.",
-		"SecurityGroupIngress": assertions.Match_ArrayWith(&[]interface{}{
-			map[string]interface{}{
-				"IpProtocol":  "tcp",
-				"FromPort":    443,
-				"ToPort":      443,
-				"CidrIp":      "0.0.0.0/0",
-				"Description": "Allow HTTPS to the v1 API.",
-			},
-		}),
-	})
+	for port, description := range map[int]string{
+		443:  "Allow HTTPS to the v1 API.",
+		8080: "Allow the testnet indexer API.",
+	} {
+		template.HasResourceProperties(jsii.String("AWS::EC2::SecurityGroup"), map[string]interface{}{
+			"GroupDescription": "Kwil Indexer Security Group.",
+			"SecurityGroupIngress": assertions.Match_ArrayWith(&[]interface{}{
+				map[string]interface{}{
+					"IpProtocol":  "tcp",
+					"FromPort":    port,
+					"ToPort":      port,
+					"CidrIp":      "0.0.0.0/0",
+					"Description": description,
+				},
+			}),
+		})
+	}
 }