Diffbridge
Administration & hosting

Migrating to AWS

Move from OCI to ECS/RDS/S3 without code changes.

Diffbridge was built so that moving clouds is a configuration change, not a rewrite.

Concern OCI (today) AWS (later) Code change
Compute A1 VM + Docker Compose ECS Fargate (Graviton/arm64 or x86), or EC2 + the same Compose file none — same multi-arch image
Database Postgres 16 container RDS / Aurora PostgreSQL none — set DATABASE_URL
Blobs Object Storage via S3-compatible API S3 none — clear S3_ENDPOINT, drop static keys and use the task IAM role
Queue / jobs Postgres (SKIP LOCKED + advisory locks) same, on RDS none — no Redis/SQS dependency
TLS / ingress Caddy ALB + ACM drop Caddy; ALB idle timeout ≥ 120s for SSE
Secrets .env on the VM Secrets Manager → ECS task secrets none — same env var names

There is no OCI-specific SDK anywhere in the app. Object Storage is reached through the AWS S3 SDK pointed at OCI's S3-compatible endpoint, so S3 is the native path.

Steps

  1. Freeze deploys. Set every org's queue policy to FIFO and let the queue drain (/queue shows idle lanes).
  2. Database: pg_dump -Fc from the VM (or use the nightly dump in Object Storage), then pg_restore into RDS. Schema migrations are idempotent and run on boot.
  3. Blobs: copy the bucket.
    aws s3 sync s3://rapidforge-blobs s3://rapidforge-blobs-aws \
  --source-region us-ashburn-1 --endpoint-url https://<ns>.compat.objectstorage.us-ashburn-1.oraclecloud.com
    (Or use rclone with two remotes.) Blob keys are relative, so nothing in the DB changes.
  4. Config: keep ENCRYPTION_KEY and SESSION_SECRET identical (stored org tokens and sessions depend on them). Set:
    DATABASE_URL=postgres://…rds.amazonaws.com:5432/rapidforge
STORAGE_DRIVER=s3
S3_BUCKET=rapidforge-blobs-aws
S3_REGION=us-east-1
S3_ENDPOINT=            # empty = real S3
S3_FORCE_PATH_STYLE=false
S3_ACCESS_KEY_ID=       # empty = IAM role
  5. Compute: two ECS services from the same image — ROLE=api (behind the ALB, health check /healthz) and ROLE=worker (no load balancer, desired count ≥ 1).
  6. Salesforce: update the Connected App callback URL to the new domain (SF_CALLBACK_URL).
  7. Cut over DNS. Unfreeze queue policies.

Sizing guide

  • Small team (≤ 10 orgs): 1 × api (0.5 vCPU / 1 GB) + 1 × worker (1 vCPU / 2 GB), db.t4g.small.
  • Retrieves of large orgs are memory-heavy: give workers 4 GB if you compare orgs with 10k+ components.
Something unclear or missing on this page?
Previous
Security & compliance readiness
Next
Keyboard shortcuts