Deploy to AWS

One EC2 instance runs the gateway in Docker behind Caddy with automatic HTTPS. Data and WhatsApp logins live in PostgreSQL, so the instance is disposable. deploy/aws/deploy.sh does the work. You need the AWS CLI signed in (aws login) and Docker installed locally.

deploy/aws/deploy.sh bootstrap       # once: ECR, IAM role, security group, SSM secrets, Elastic IP, instance
deploy/aws/deploy.sh release         # later: build, push and roll the instance onto the new image
deploy/aws/deploy.sh autostart on    # start the WhatsApp clients
deploy/aws/deploy.sh status | logs [n] | params | destroy

Details

• Region and size. us-east-2 and t3.small by default (2 GB plus 2 GB swap). Override with AWS_REGION and INSTANCE_TYPE. c7i-flex.large has 4 GB for more numbers.
• Secrets are copied from .env to SSM Parameter Store as SecureString and written to the server at start. They are never in the image. ADMIN_API_KEY is not sent. After changing .env, run release, or params and autostart on.
• Address. https://<elastic-ip>.sslip.io until you set your own. Point a DNS A record at the Elastic IP, run aws ssm put-parameter --name /wa-gateway/site_address --value app.example.com --overwrite, then release.
• First boot uses AUTOSTART_CLIENTS=0. Stop any other server using the database, then autostart on. Releases stop the old container first so it can save sessions.
• Access. Port 22 is closed. Use aws ssm start-session --target <instance-id> or deploy/aws/deploy.sh logs.
• Use a separate database for local development, never the production one.