Skip to content

v0.2.0

Released: 2026-09-14

Highlights

  • New lightsail-instance target: a persistent AWS Lightsail VM running your binary as a systemd service, for workloads that need a local file (SQLite, sessions) to survive a redeploy — something the LightSail Container Service target can't provide
  • Deploy-time secret resolution (SecretRef) wired through the runtime adapter and into the LightSail target, plus a remote .env/systemd EnvironmentFile= injection path for the new instance target
  • Post-deploy health verification: an HTTP retry probe after a deployment reaches ACTIVE, plus a systemd is-active retry loop for the instance target's non-HTTP workloads

Features

AWS LightSail Instance Target

  • New instance/health_check config schema (InstanceConfig, VMHealthCheck) — exactly one of container or instance is set per deployment
  • Pulumi resource graph: the VM instance, a Pulumi-managed SSH keypair, an SSH-only firewall (opening one additional port only for an HTTP health check), and redeploy-safe binary shipping
  • Redeploys are idempotent: the binary is only re-shipped and the systemd service only reinstalled/restarted when its content, unit, or environment actually changed (tracked via content hashes)
  • Secrets and environment variables injected via a remote .env file referenced by the systemd unit's EnvironmentFile=
  • Two health-check kinds: http (reuses the same retry-probe verification as the container target) and systemd (systemctl is-active, polled over the same SSH session — for outbound-only workloads like Discord bots with no HTTP surface)

Secrets

  • Deploy-time SecretRef resolver supporting ssm: and secretsmanager: sources
  • Resolved secrets injected into the LightSail (container) target's environment
  • deploy.secrets now flows through the runtime adapter end-to-end

Health Verification

  • Post-deploy HTTP retry probe after a deployment reaches ACTIVE, absorbing DNS/TLS settling time before declaring a deployment unhealthy

Configuration

  • Documented ${VAR}/${VAR:-default} environment variable expansion is now implemented in config parsing

Reliability

  • Runtime adapter Detect() resolution is now deterministic
  • Recoverable failures return errors instead of only logging them, and previously-unchecked errors are now handled

Documentation

  • New target page (docs/targets/lightsail-instance.md) covering configuration, deployment, outputs, both health-check kinds, SSH access, and limitations
  • Configuration schema reference, examples, target comparison tables, CLI/API reference, and the AWS setup guide's IAM permissions (including a new least-privilege policy statement for the instance/keypair/firewall actions) all updated for the new target
  • PRD/TRD/PLAN/ROADMAP specs for the Lightsail Instance target initiative

Dependencies

  • github.com/aws/aws-sdk-go-v2 v1.42.0 → v1.47.0
  • github.com/aws/aws-sdk-go-v2/config v1.32.25 → v1.33.4
  • github.com/aws/aws-sdk-go-v2/service/ecr v1.58.4 → v1.65.0
  • github.com/aws/aws-sdk-go-v2/service/iam v1.54.5 → v1.64.0
  • github.com/pulumi/pulumi/sdk/v3 v3.247.0 → v3.262.0
  • Add github.com/aws/aws-sdk-go-v2/service/secretsmanager and github.com/aws/aws-sdk-go-v2/service/ssm (SecretRef resolver)
  • Add github.com/pulumi/pulumi-command/sdk (lightsail-instance target's remote install/SSH steps)
  • Add github.com/grokify/mogo v0.74.9 (post-deploy health verification), replacing a local development pin with the released version