A new infra/sidecar/ stack runs tangled-collaborator-sidecar on one Lightsail instance in us-east-1. It holds the $5 bundle with IPv4, a static IP, and an A record for tangled-collaborator-sidecar.did.bot written directly in the did.bot zone. Automatic snapshots are on by default, and the instance is prevent_destroy, because its disk holds the sidecar's OAuth client key.
The firewall opens 443 to the world. Port 22 is open to Lightsail's browser console range and to any deploy_cidrs, and every login uses short-lived credentials from get-instance-access-details, so no key is stored. The launch script only creates the sidecar user, the data directory and the systemd unit. The binary arrives through the sidecar repo's deploy script. docs/sidecar.md has the first apply and the first deploy.
The infra split into its own repository follows this, once the sidecar works end to end.
🤖 Generated with Claude Code