Skip to content
Volāre Documentation

Server Access

Volāre EC2 instances are reached through AWS SSM Session Manager — no SSH keys, no VPN. The /ec2-connect skill is the canonical, guided procedure; this page summarizes it.

Source: .claude/skills/ec2-connect/SKILL.md

Instances

Section titled “Instances”

Instances are discovered by their Name tag, which encodes role-env-index (e.g. api-production-1, ops-runner-staging-1). There is no Role tag.

Role What runs there
api Backend web servers (nginx + php-fpm)
front Frontend instance
ops-runner Maintenance host — Artisan, tinker, queue work, DB backups
  • Region: always us-east-2
  • AWS profile: staging uses the default profile; production uses --profile production

Procedure

Section titled “Procedure”

  1. Confirm environment and role. Production is a write-capable shell — the skill requires explicit confirmation before connecting.

  2. Verify identity so you know which account you’re about to touch:

    Terminal window
    aws <PROFILE> --region us-east-2 sts get-caller-identity

  3. Discover the instance by Name tag prefix (<role>-<env>-*, running only):

    Terminal window
    aws <PROFILE> --region us-east-2 ec2 describe-instances \
      --filters "Name=tag:Name,Values=<role>-<env>-*" "Name=instance-state-name,Values=running" \
      --query 'Reservations[].Instances[].{Id:InstanceId,Name:Tags[?Key==`Name`]|[0].Value}' \
      --output table

  4. Start the session (run in your own terminal — it needs an interactive TTY):

    Terminal window
    aws <PROFILE> --region us-east-2 ssm start-session --target <INSTANCE_ID>

    You land as ssm-user; on ops-runner use sudo su - to reach the container tooling.

Exec into a container (ops-runner)

Section titled “Exec into a container (ops-runner)”

Application containers run on the ops-runner host. To run Artisan, tinker, or maintenance scripts, exec into app-php-fpm-1:

Terminal window
sudo docker exec -it app-php-fpm-1 bash
# or directly
sudo docker exec -it app-php-fpm-1 php artisan tinker

Other containers: app-queue-worker-1, app-scheduler-1, app-web-1, app-nightwatch-1.

Safety

Section titled “Safety”
  • For production, review the verified identity and resolved instance before connecting.
  • Do not run destructive commands (migrations, queue:flush, cache clears against shared resources) casually — you’re on a live host.
  • Only use named AWS profiles; never store or echo credentials.