Platforms

AWS ECS

Run the control plane on Amazon ECS with an EBS volume per task and an S3 bucket.

Requirements

An ECS cluster on the EC2 launch type, with instances in at least three availability zones
An S3 bucket and an IAM task role that can read, write, list and delete in it
One EBS volume per control plane instance, mounted on its host

Steps

Store the Rivet token

aws secretsmanager create-secret --name rivet-admin-token \
  --secret-string "$(openssl rand -hex 32)"

Define the task

Run rivetdev/engine:2.3.31 with the command ["--config", "/etc/rivet"], awsvpc networking and these settings. Mount the host’s EBS volume at /var/lib/rivet/log.

RIVET__AUTH__ADMIN_TOKEN=<from the secret>
RIVET__DEPOT__LOG_DIRECTORY=/var/lib/rivet/log
RIVET__OBJECT_STORAGE__PRIMARY__S3__BUCKET=my-rivet-bucket
RIVET__OBJECT_STORAGE__PRIMARY__S3__REGION=us-east-1
RIVET__API_PEER__ADVERTISE_ADDRESS=<task private IP>:6421

Leave out the S3 keys to use the task role. See Storage for other object storage backends. Set stopTimeout to 120 seconds, the most ECS allows. An instance can take up to about ten minutes to shut down, so ECS may stop a task before its shutdown finishes.

Allow port 6421 between tasks

Allow 6421 only from the control plane’s own security group. It is plaintext and unauthenticated. See Ports.

Add a load balancer

Point an Application Load Balancer at port 6420, health-check /health, and raise its idle timeout to 3600 seconds.

Verify

curl https://rivet.example.com/health

{"runtime":"engine","status":"ok","version":"2.3.31",...}