Since it was my first project, I’ll never forget the feeling of getting to play the game I'd worked on. Being able to adjust the speed, point count, music, animations, colors, then hit ‘build’ and fire it up on my phone? So cool!

We had a blast, but eventually steered towards different fields. In my case - backend & cloud.

Now, after a couple of years, that game project still stands alone in my game portfolio (built games one, not the played games one, that one is a different story C:).

Do I want to build a game? I do.

Do I have the time to learn the game dev, C++, C# or something else? Eh, probably not.

But do I need to learn it with all AI tools that are out there? Nope.

Want to skip reading and check out the game right away? Here it is:

https://breakout.kaumnen.com/ (might take a bit to load WASM things at first)

So which game will it be? Breakout

• Simple - check

• Familiar - check

• Replayable - check

• Power-ups - check

• Fun - check

Can I vibe code it? Spoiler alert: absolutely! But how?

Amazon Q Developer CLI and a Plan

I wanted to check out Amazon Q Developer for some time now, CLI part to be precise. It’s an AI-powered assistant that can generate code, commands, tests, explain something, fix problems, etc. I’ve seen a lot of people recommending it. The full feature set can be found here.

Now I got a project and some free time - let’s finally check it out!

Installing instructions, setup, how does it function - all of that can be found in the docs. There is a free tier too!

Now that I’ve set it up, let’s create a plan.

1. What are we building? A Breakout game

2. With what programming language? Python 3.13

3. What libraries to use? Pygame

There are a few more requirements:

1. I want it to run on web, so let’s use pygbag for WebAssembly

2. I want to use uv package manager. If you didn’t check out uv - I can’t recommend it enough, it’s awesome. It really is.

With that, let’s prompt Q chat to create an overview.md file which will contain all the project requirements, what to build, how to build it and so on:

create a detailed overview.md file for building a web based breakout retro game using python 3.13, uv package manager, pygame with pygbag for web assembly

Not the best of prompts, but lets see what will come out of it:

1. Core tech

   1. 

2. Project Structure

   1. 

3. Game States

   1. 

4. Game Features, Visual Design, Performance Considerations, Dev Workflow in phases, Deployment Options and more

This document (you can find a full version here) will help with model guidance and keep it from steering off course. I didn’t expect it to create a project overview this detailed. Great stuff.

This is an important feature as you want to stay in control. Will it rm -rf / your system on its own? Only if you allow it.

But for our overview.md file - it’s fine.

Tip: When you are using AI assistants/agents, you should have an overview.md, tasks.md, acceptance.md and other files so you can include or reference them during the chat to keep the LLM’s focus on the point.

Subscribe now

Implementation

I can start the implementation now. The prompt:

i already have uv installed, start with the project structure and  dependencies install

And the result:

What I find cool here is that I see:

• Model’s reasoning

• The tool it is trying to use

• The tool input

• The purpose of the tool’s input

It is very detailed.

Different tools will have a different preview. For example, this is what the fs_write tool in action looks like:

It went on to setup the structure and the dependencies. After that, again, a detailed overview:

I went on to finish those next steps one by one, with little to no changes.

After it created a few files - it’s finally ready! I type in y and:

Not a big deal, is it? Happens all the time. The cool thing is that Q Developer CLI has awareness of command outputs, so it can act on the problems without you going back and forth with the model.

After a few changes, the game boots up!

It works, but I noticed a few problems:

• Using arrow or A/D keys doesn’t override the mouse control, so the paddle is moving left and right only within the bounds of the mouse-controlled area

• Bricks in higher rows don’t have more health than those in lower ones

• Collision does not change the ball’s direction of movement

I’ve sent a few prompts to fix these issues, Q Developer CLI did its thing and fixed the issues. Take a look at the sped up video:

Great! Now that the core logic is in place, next up - power-ups!

Tip: don’t prompt it to do multiple things at once. Send precise prompts. If any issues need fixing - write out a few examples to help model understand the issue better. Ideally - point to the file(s) that should be modified. Q is smart enough to find and read them on its own!

I kept sending precise and focused prompts. Testing the game, noting the issues and prompting again. After a few of those - it’s ready!

The power-ups really bumped the fun up a notch! Check it out:

Do note that I did not write a single line of the code or config. Not even a command. Everything you see has been generated so to speak.

The WebAssembly

I think we’re ready to see how it can run in the browser. Sending a new prompt:

lets implement the web part

I intentionally sent a vague prompt to see if it’d remember the pygbag requirement from the overview.md file, and check it out:

It did remember! Then proceeded to:

• do a test run

• setup a config file for the pygbag

• check and refactor existing files to align them with the pygbag requirements

Tried again and.. bingo!

Tip: If you notice, during the chat, that the model is lost, trying some weird things, circling back after the new prompt - just start a new chat to clear the context. Why? The bad responses the model generated stay in the context and will negatively impact the output quality.

Conclusion

Looking back at that old Google Drive folder and my high school game project, it's incredible to see how far technology has come. Building this Breakout game with Amazon Q Developer CLI felt like a huge leap forward.

As for the Amazon Q Developer CLI - it’s great. The interface in which it operates (the CLI) provides so many possibilities, from help with commands (e.g. those scary-looking ffmpeg commands) to full code generation. I plan to test it more, might even stop hitting the Up arrow key 50 times instead of just typing out a command. Or even better - q chat “help”.

There are LLMs. RAG is well-known. MCP servers seem pretty interesting. So I got an idea - can I create an AI-powered assistant that can help me quickly query the docs and see what’s up? Yes!

Also, while I’m at that - it’s a good opportunity to test Amazon Nova LLMs (Micro, Lite and Pro).

This article walks through the creation of lumen, a proof-of-concept app I built to help with AWS-related questions, by combining Retrieval Augmented Generation (RAG), AWS Model Context Protocol (MCP) servers, and the capabilities of Amazon's Nova Large Language Models (LLMs).

Architecture Overview

We covered the why part. Let’s now focus on the what and how parts.

Here is a quick diagram of lumen:

It has what the vast majority of RAG systems have these days:

1. Knowledge Base - Qdrant Vector DB

2. Retriever - LangChain’s tool in Python BE

3. Integration Layer - LangChain/LangGraph

4. Generator - Amazon Nova LLMs

There is one more thing I added - AWS MCP Servers:

• Core MCP Server

• AWS Documentation MCP Server

Retrieval Augmented Generation (RAG)

lumen ingests the PDF files. PDF is one of the few file formats that proves to be a challenge to parse and chunk time and time again. No parsing tool is perfect, but the two I found to work best with the AWS Docs PDFs are Docling and PyMuPDF4LLM.

How does the file ingestion work?

1. Get the AWS Docs PDF file

   1. Uploaded by the user

   2. Downloaded by the app if a user submits online PDF location

2. Optimization

   1. Remove Table of Contents, Document revision and similar sections as they do not provide much value in terms of aiding the LLM response. But they do help in the next steps!

3. Parsing

   1. This is the most important part. PDF file is parsed and converted to Markdown. Takes the most time too.

4. Chunking

   1. Markdown shines here. Each document is chunked based on the heading levels in small, byte-sized pieces. This process will make each embedding more relevant and on point.

5. Generating Vectors

   1. The final part. This is where embeddings are created using Amazon Titan Text Embeddings V2 model and then stored in Qdrant Vector DB.

Why Amazon Titan Text Embeddings V2 model?

• With a maximum of 8192 input text tokens it can embed larger documents or text chunks without needing too much splitting (this can provide more contextual information)

• Flexible output dimensions (1024, 512, 256) allow fine-tuning the trade-off between embedding context and performance

• More than 100 supported languages in preview means you don’t really have to think about supporting multiple languages (but test the system always!)

• It makes things easier if you are already invested in the AWS ecosystem by being available in the Bedrock service as a first-party model

Subscribe now

How does the data retrieval work?

1. Embed user query

   1. Send user message to the embedding model

2. Search the Qdrant Vector DB

   1. Use the calculated vector to search Qdrant Collection

3. Return the content with metadata

   1. Remember that the documents are chunked based on the heading levels? Metadata contains heading levels and document title:

      

4. Send the results to the LLM

   1. The final step that provides precise and factual data which helps LLM to create a better response

You can use the search page to check the data retrieval:

Model Context Protocol (MCP) Servers

lumen also supports AWS MCP Servers, namely the Core and AWS Documentation ones.

Core MCP Server

MCP server that provides a starting point for using the following awslabs MCP servers - awslabs.cdk-mcp-server - awslabs.bedrock-kb-retrieval-mcp-server - awslabs.nova-canvas-mcp-server - awslabs.cost-analysis-mcp-server - awslabs.aws-documentation-mcp-server - awslabs.aws-diagram-mcp-server

- AWS MCP Servers Docs - Direct Link -

AWS Documentation MCP Server

Model Context Protocol (MCP) server for AWS Documentation

This MCP server provides tools to access AWS documentation, search for content, and get recommendations.

- AWS MCP Servers Docs - Direct Link -

I integrated these two AWS MCP Servers with the langchain-mcp-adapters. It converts the MCP Server tools into LangChain tools. As RAG system’s integration layer is LangChain this was a great tool for the job.

AWS MCP Servers supported chat has its own window so you can use and test RAG or MCP supported chat responses separately.

Both RAG-supported and MCP-supported chat windows have a Tool Activity drop-down component where you can see which tools were called and what were their responses.

You can also choose the Amazon Nova model you want to use in the chat. Session Info on the sidebar shows basic info about the chat (number of messages, tool calls and total tokens usage).

Amazon Nova Models

The backbone of lumen. I used:

• Amazon Nova Micro

• Amazon Nova Lite

• Amazon Nova Pro

Amazon Nova Micro

A text-only model optimized for very low latency and cost. Has plenty of context token space (128K). My usage of the Micro model in lumen:

• summarization

• simple tasks (listing quotas, basic info about services)

It is suprisingly good at tool calling and following the system prompt. Needless to say - it’s quite fast!

Amazon Nova Lite

This model can process text, images and videos. Has a larger context token space as well (300K)! My usage of the Lite model in lumen:

• cross-referencing multiple sources

• somewhat complex queries (how can service X take advantage of service Y, scenario-based questions)

Very solid at tool calling and following the system prompt. Slightly slower than Micro, but still fast.

Amazon Nova Pro

This one has all the benefits of the previous models but bumps things up a notch when it comes to the intelligence. Large context token space (300K) and is really good when it comes to the complex queries. My usage of the Pro model in lumen:

• when I need very detailed responses

• architecture-based questions (how to do X while having YZ in place, ideas to simplify, lower cost, speed up AWS infrastructure, etc.)

It is rock-solid at tool calling and following the system prompt. It is slower, but it’s worth it. In cases where I expect a very detailed response to a complex query I don’t really mind longer inference time.

I don’t know if this is the case but Nova models seem to be aligned very, very well with AWS Documentation.

Depending on the model-query combination, I didn’t really notice any hallucinations, even when links were included in the response.

It seems Amazon/AWS engineers carefully prepared relevant datasets, which is evident in the models’ performances. In any case - kudos to the team!

Final thoughts

So, building lumen turned out to be a great practical exercise. It definitely helps me dig through AWS docs and it provided real hands-on experience setting up the RAG pipeline, wiring up Qdrant, MCPs and properly testing out the different Amazon Nova models for the job.

Their performance, tool-calling ability and contextual understanding were a highlight.

Of course, there's always room for improvement (PDF parsing, looking at you), maybe refining the chunking strategy or even implementing a custom HTML parser down the line. But for now, lumen is working well as a proof-of-concept and is already a useful tool in my own workflow.

lumen is and will stay open source and MIT licensed.

EDIT 02. June 2025: Quick heads-up on the license: lumen kicked off with an MIT license but to properly mesh with some of the great open-source software lumen uses I'm now switching it over to the GNU Affero General Public License v3.0 (AGPL 3.0). It's just a necessary step to keep things solid and genuinely open for everyone.

There are still some rough edges, so contributions to help smooth them out and build upon the concept are welcome!

You can find the source code and how-to-run instructions here: lumen

In case you must/want to use it or you want to remove your SSH port from the server and therefore public internet, I’ll show you how you can SSH into your instance without port 22, through a VPN. It’s all free and if you ask me - pretty cool!

What do you need?

1. A publicly accessible server (virtual or physical, doesn’t really matter)

If you don’t have an instance ready and would like to try this out, there are a lot of options, but notable free ones include: AWS Free Tier, Azure Free Tier, Oracle Free Tier

2. Cloudflare Account

   1. Zero Trust

   2. WARP Client

How does this work?

Let’s take a look at the following diagram:

• cloudflared - this is installed on the server and proxies the traffic through Cloudflare to the origin (your device in this case).

• Cloudflare Zero Trust - a security framework that allows you to set access rules to services that you want to protect. It ensures that devices are trustworthy before allowing access.

  • Cloudflare WARP is a part of Zero Trust. When WARP client is connected, it allows you to access services that you secured with Zero Trust.

    • You can download it from the Zero Trust portal by going to the: Settings → Downloads

After everything is in place, you will be able to connect to your machine using its private IP, but only while connected to the WARP client. Zero Trust will prevent access otherwise.

That being said, there is no more need for keeping port 22 open/accessible.

Note: While connected to the WARP client, you will be able to access everything on the machine even if your firewall/security group is preventing access as everything will be routed through cloudflared and Zero Trust. You can still allow access from the public internet by opening ports in your firewall/security group.

How to do it?

1. Create a tunnel in Cloudflare Zero Trust

1. Login to your Cloudflare account, or create one

2. Go to Zero Trust

3. Networks → Tunnels → Create a tunnel

4. Select Cloudflared → Next

5. Set a name

6. Select OS and architecture of your server

7. Copy and run the commands shown

   1. Wait until you see your tunnel is connected

8. Select Private Networks

9. CIDR

   1. Type in the private IP address of your server (or a range that includes your server private IP - /32 or lower)

      1. For example, if your server private IP was 10.0.2.3 - you’d need to write 10.0.2.3/32 or a range - e.g. 10.0.0.1/16 would work too

         1. What is CIDR?

   2. Description if you’d like

10. Save tunnel

Here are some images to help you out:

Note: For this setup, I am using Ubuntu 24.04 (LTS) x64 system.

One more thing - remember that you configured Cloudflare tunnel with a private network CIDR? Let’s now check split tunnel settings because, by default, WARP excludes traffic to/from IP address ranges reserved for private networks:

• 10.0.0.0/8 (10.0.0.0 - 10.255.255.255)

• 172.16.0.0/12 (172.16.0.0 - 172.31.255.255)

• 192.168.0.0/16 (192.168.0.0 - 192.168.255.255)

1. Go to Cloudflare Zero Trust portal

2. Settings → WARP Client → Device Settings

3. Select Default profile name

4. Edit → Scroll down → Split Tunnels

5. Check which option is selected → Manage

   1. If Exclude… is selected, find CIDR that includes your tunnel’s CIDR and delete it from the list

   2. If Include… is selected, add your tunnel’s CIDR to the list

Note: If you do have a service on your local network that is running on the same IP address as your (cloud) server, it will not be accessible anymore as traffic to that IP will now be routed through WARP client and Cloudflare Zero Trust.

2. Install and setup WARP client

1. Install WARP client

2. Once it is running, open settings

3. Go to Account tab

4. Login to Cloudflare Zero Trust

   1. When it prompts you on the team's name, if you don’t know it you can find it in the Zero Trust dashboard: Settings → Custom Pages → Team domain. Your team's name is the subdomain there.

      1. <team_name>.cloudflareaccess.com

3. Test it out

Check your server firewall/security group. Feel free to disable all incoming connections.

1. Open WARP client on your device

2. Connect

3. Open your shell/ssh connections manager app

4. Connect to your server via ssh protocol and public IP address

Not working. If it is working, disable your ssh port.

Now try the same with the private IP address. It will work if you set everything up.

That’s it!

Now, your machine is accessible only while connected to the WARP client, over the private IP address unless you allow a port to be accessible from the public internet.

You can also test it by running the nginx service on your machine, or anything else that needs an open port. Try accessing <server_private_ip>:<port> in your browser. You should be able to see your server’s nginx welcome page while connected to your Zero Trust (Cloudflare) account through WARP client.

Or try to ping your servers’ private IP from your device. You will see the packets transmitting. While your WARP client is in the connected state, your (cloud) server will be accessible as would any other server be on your local network.

This way, you can protect your server ports from public internet - for free! SSH Connection? Private DNS instance? Private Minecraft server to play with friends? A bit more work but easy enough to set up. Will probably try this out myself.

What is it?

AWS Nitro System is a collection of hardware and software components from AWS that are used for the virtualization of the EC2 servers. The Nitro System enables higher performance, availability and security than traditional virtualization.

What is virtualization?

Virtualization is a technology that you can use to create virtual representations of servers, storage, networks, and other physical machines. Virtual software mimics the functions of physical hardware to run multiple virtual machines simultaneously on a single physical machine - link.

The Nitro System is the underlying platform for a vast majority of EC2 instances. If you’d like to check which instances support the Nitro system - check this link.

It ensures the confidentiality, security and performance of the EC2 instances by moving most of the traditional virtualization functions to the dedicated hardware and firmware. This allows the core system to have more power for the actual workloads.

Three main parts of the Nitro are:

1. Nitro Cards

2. Nitro Security Chip

3. Nitro Hypervisor

There are 2 additional parts of the system:

1. Nitro TPM

2. Nitro Enclaves

Let’s check how they are designed and what their responsibilities are within the Nitro System.

Nitro cards

EC2 server consists of 2 parts:

1. System board (bare-metal)

2. Nitro Cards

System boards have the CPU and memory.

Nitro Cards are a crucial component in the Nitro System. They function as separate components on the system boards. Some of the key characteristics and functions are:

1. System control and I/O Virtualization

Nitro cards provide overall system control and input/output virtualization independent of the system board. They have their CPU and memory. This separation enhances the performance of the core system.

2. Dedicated hardware and firmware

Nitro cards have their own SoC - System on Chip package which is developed in-house by the dedicated team within AWS - Annapurna Labs. Those SoCs need firmware to run - that firmware is created by the AWS dedicated teams too, meaning that the whole system is performance and security-optimized.

3. Specialized Nitro Cards for different I/O functions

There are specialized Nitro Cards too (with the same SoC and base firmware designs), specifically optimized for different workloads:

1. Nitro Cards for VPC - networking

2. Nitro Cards for EBS - storage

3. Nitro Cards for Local NVMe Storage

4. Hardware-Accelerated Encryption

Nitro cards use hardware offload engines for data encryption in networking and storage. This means that data and the traffic are encrypted without system performance impact. Secure key storage is integrated into the SoC.

Nitro Controller

Nitro Controller is the primary Nitro Card in the AWS Nitro System and with that - the hardware root of trust for the entire system. It manages various Nitro components and their interactions, including the loaded firmware.

What are the responsibilities of a Nitro Controller?

The Nitro Controller presents a set of strongly authenticated and encrypted APIs for system management.

On the left is an EC2 Control Plane - a set of services responsible for managing customer configuration (e.g. creating, modifying, deleting resources).

On the right is a Nitro Hypervisor. We’ll talk about it a bit later.

Nitro Security Chip

Please note that:

The nitro Controller and other Nitro Cards together operate as one domain in a Nitro System and the system main board with processors, where customer workloads are run.

The Nitro Security Chip is a critical component of the AWS Nitro System. It serves as a bridge between the Nitro Controller and the system board by extending the root hardware of trust (Nitro Controller chain of trust) and control over to the system main board.

The NSC (Nitro Security Chip) sits between the BMC (Baseboard Management Controller) and the main system CPU, on the high-speed PCI connection.

You probably guessed why - by being there, Nitro Security Chip is effectively acting as a firewall on production systems. Because it is controlled by the Nitro Controller, NSC can validate updates to the firmware or other programming of the non-volatile devices (ones that retain information even when the power is off), either on the system main board or the other Nitro Cards.

Secure Boot and Reset control

One of the most important things when it comes to the security of the system is BIOS integrity. It is the heart of the system in a way.

So, how does the NSC help here?

It controls the physical reset pins of the system main board, including the CPU and BMC.

This allows the Nitro Controller to complete its secure boot and verify the integrity of the BIOS, BMC and every other system firmware. Only after all checks are complete, NSC is instructed to release CPUs and BMC from being held in reset.

Note: Nitro Security Chip is playing a crucial role in the EC2 bare-metal mode too. There is no hypervisor as the EC2 instance system board is not shared, so NSC is making sure that the main system CPUs cannot update the firmware in bare-metal mode. But even when Nitro Hypervisor is present (shared system board), NSC has the same role. Just a different approach.

Nitro Hypervisor

Who is running and managing EC2 instances on shared hardware? Nitro Hypervisor - another part of the Nitro System that is purpose in-house built.

This system minimizes the possibility of vulnerabilities that could be exploited by attackers. It manages the allocation of resources (CPU, memory) and is controlled by the Nitro Controller.

Think of the AWS Nitro System as a busy office with specialized roles to ensure efficiency:

• Nitro Hypervisor: Like a specialized and efficient receptionist, its primary task is to allocate resources (meeting rooms and equipment) to different teams (virtual machines). It ensures security by maintaining strict boundaries between teams but does not handle tasks such as taking phone calls or managing schedules.

• Nitro Controller: Think of it as the office manager setting the policies and ensuring that the environment is efficiently operating. It sets the ground rules and policies for resource usage but also controls the coordination between the receptionist (Nitro Hypervisor) and other office functions, ensuring everything runs smoothly.

Let’s break down Nitro Hypervisor functions and characteristics:

1. Resource Management: Manages CPU and memory allocation as instructed by the Nitro Controller.

2. Hardware Device Assignment: Assigns GPUs to the VMs and manages error recovery.

3. Simple design, optimized security and performance: There is no networking stack, file system of any sort or any drivers. Meaning? It’s simple, secure and performant.

4. Storage: Firmware is stored on an encrypted storage device connected to the Nitro Controller. It is linked to the NC’s root of trust too, which means its integrity is validated.

5. Firmware updates: Live updates are possible. That means that Nitro Hypervisor firmware can be updated or even replaced without disruption to running instances!

6. Bare Metal instances: In this case, system management, I/O virtualization and monitoring are handled by the Nitro Cards directly. Nitro Hypervisor is an optional discrete component in this case.

7. Passive communication: Passive communication design principle means that during production operation, components of the system (any system) do not initiate outbound communication. Nitro Hypervisor follows this principle. Remember - there is no networking stack. It waits for commands from the Nitro Controller via a private channel over the PCIe interface.

Nitro TPM

This is another important part of the Nitro System and is utilized during the Secure Boot process.

Let’s check Nitro TPMs function:

1. Measurement and Verification: During system initialization, the TPM records measurements of the initial boot code. These measurements are then used to verify the integrity of the next stages of system firmware as they are loaded.

2. System Integrity: The TPM utilizes its embedded tamper-resistant cryptographic keys to generate digital signatures for the set of system measurements taken during the boot process. This digitally signed file serves as a reference point for future boots. Think of it as a boot history/archive.

3. Boot-Time Integrity Checks: Each time the system reboots, the TPM compares the newly generated system measurements against the signed file created during the initial secure boot. This comparison allows the system to detect any unauthorized changes or modifications to the system firmware.

4. Controlled Decryption: If the TPM verifies that no unauthorized changes have occurred, it enables the decryption of additional system data, allowing the boot process to proceed. But, if any mismatch is detected, this decryption process (including the Secure Boot) is halted and the system is taken offline, preventing it from hosting customer workloads.

It checks the integrity of the firmware. If something has been changed since the initial boot, without authorization, it is clear that something is wrong and the machine becomes unavailable.

Nitro Enclaves

Nitro Enclaves is a capability of the Nitro System that enables users to separate workloads into distinct components. They also allow the processing of data and highly trusted code running to which even the EC2 instance administrators do not have access to.

Nitro Enclaves characteristics:

1. Enhanced Isolation: Nitro Enclaves inherit the robust isolation specific to EC2 instances operating on the Nitro System. This means that there is a high level of security and protection for sensitive workloads.

2. Resource Allocation: Parent EC2 instance allocates a dedicated set of virtual CPUs (minimum one full core) and memory pages. These resources are isolated from the parent instance and dedicated to the enclave's operation.

3. Secure Communication: There is no IP networking capability, intentionally. This limits the attack surface and provides a secure communication model with the parent instance or other authorized systems/devices.

4. Persistence: Nitro Enclaves don’t have persistent storage, by design. This guarantees that sensitive data is not stored within the enclave's environment when it is deleted.

So, the primary objective of Nitro Enclaves is to provide an additional layer of isolation (and therefore security) to the Nitro System for (very) sensitive tasks. One of the key features is to specifically safeguard the Enclave against unauthorized access from users and software running on the ‘main’ EC2 instance.

Usage

You might ask - where is this useful?

1. Healthcare: Processing this highly-sensitive data securely - patient records, medical history, test results…

2. Financial services: Processing sensitive financial data - transactions, account information, financial analytics…

3. Machine learning: Running machine learning models on sensitive data without exposing the data to the host system or users.

4. Confidential collaboration: Enclaves enable multiple parties to collaborate on sensitive data without exposing it to each other or the underlying infrastructure. For example, imagine two companies, one has the data, other one has the ML model. They do not want to share their IP (intellectual property)/data. In that case, Nitro enclaves provide a way for them to collaborate while ensuring confidentiality for both parties.

So, there you have it – the AWS Nitro System in a nutshell. It’s a complex virtualization system that provides a high level of security, performance and efficiency.

Whether you’re handling (or planning to) sensitive data in healthcare, finance, or any other industry, Nitro System ensures your workloads are secure and running smoothly.

What will be used?

1. Nextcloud - free and open-source

2. Graviton EC2 t4g.small instance - up to 750 hours free per month, until 31. DEC 2026.

3. EBS - 30 GB included in the free tier

4. Elastic IP - 750 hours per month included in the free tier

5. S3 Storage - 5GB included in the free tier

6. IAM - free

7. A domain (or subdomain) - host on your own domain, or get a subdomain for free – noip, duckDNS or similar

8. Cloudflare (only if you have your own domain) - free

You can also try to do everything with t2.micro or t3.micro (available in Bahrain and Stockholm) EC2 instances. Everything is the same except for instance launch.

Graviton

As per documentation – AWS Graviton (ARM Processor) is a family of processors designed to deliver the best price performance for your cloud workloads running in Amazon Elastic Compute Cloud (Amazon EC2).

We will use t4g.small instance, which has:

• 2 GiB of Memory

• 2 vCPUs

Also, make sure you choose the right settings to avoid unintended charges to your account. Just follow along and you'll be good to go.

https://x.com/kaumnen/status/1783939334506258605

Create graviton EC2

Login to your AWS account. Head over to the EC2 console. Click Launch Instances.

Graviton EC2 t4g.small config

• Name: nextcloud-root (you can set this to your liking)

• AMI: Ubuntu Server 24.04 LTS (HVM), SSD Volume Type

• Architecture: 64-bit (Arm)

• Instance type: t4g.small

• Key pair: Proceed without a key pair

• Network (click Edit):

• New security group

• Open ports:

  • 22 - EC2 Instance Connect (consider restricting source IPs, more info below)

  • 80 - Initial HTTP Nextcloud setup (Source 0.0.0.0/0)

  • 443 - HTTPS Apache container (Source 0.0.0.0/0)

  • 8443 - SSL/TLS Nextcloud (Source 0.0.0.0/0)

• Storage: 1x 30GB gp3 (Nextcloud needs about 5GB of space for storage. Feel free to adjust this to your needs. 8GB is the minimum)

• Advanced settings:

  • Credit specification: Standard (take a look at the tweet above for more info)

You can restrict access for port 22. I will be using EC2 Instance Connect to connect to the instance directly from the AWS Console.

If you want to restrict access to the port 22:

1. Go to this docs page – https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html#aws-ip-download

2. Click on the link for the ip-ranges json file

3. Search for EC2_INSTANCE_CONNECT

4. Find your region and CIDR IP. You can set that CIDR IP address as the source IP for port 22 in the security group.

5. As of now (25. APR 2024.) CIDR IP for the eu-central-1 (Frankfurt) region I will be using is: 3.120.181.40/29

You can leave everything else as default. Click Launch instance.

Update - Sept. 2024

You can use cipr - a CLI tool I created to find and filter CIDR ranges from various cloud providers. An example command for the CIDR needed in this case:

cipr aws --filter-service EC2_INSTANCE_CONNECT --filter-region eu-central-1

If you’d like to learn more about cipr - check the docs at: https://cipr.sh

Elastic IP and Domain (sub-domain) setup

Now that we have EC2 instance, we can first create an Elastic IP, and after that an A DNS record. Then we can proceed with EC2 setup. In the meantime, DNS records will be propagated.

A domain is required for Nextcloud. If you do not have a domain, you can buy one, or get a subdomain for free from services like duckdns.org, noip.com or others.

Let's start with Elastic IP.

1. Find Elastic IPs in the navigation panel on the left

2. Click Allocate Elastic IP address

3. Click Allocate

You can now select it, go to associate Elastic IP address, select your instance, Private IP address, and click Associate.

Okay. Now, we can create an A DNS record, and point a subdomain (or domain) to the nextcloud EC2 instance.

1. Copy your Elastic IP address

2. Create a DNS record:

3. Type: A

   • Name: nextcloud

   • This can be whatever you want. Your subdomain will look like: Name.domain.tld

     • In this case, your subdomain for Nextcloud would be: nextcloud.domain.tld

   • IPv4 address: Paste your Elastic IP address

   • TTL: Leave it at Auto

If you are using Cloudflare for your domain DNS management, set the Proxy status to DNS only!

Nextcloud installation

While your new DNS record is propagating, let's install Nextcloud on the Graviton EC2 instance.

Connect to the instance with the EC2 Instance Connect

1. Select your instance

2. Click Connect (top-right)

3. Select EC2 Instance Connect

4. Select Connect using EC2 Instance Connect

5. Make sure ubuntu is the username

6. Click Connect

Update/Upgrade system, just in case

Run this command:

sudo apt update && sudo apt upgrade

Install docker

Run this command:

curl -fsSL https://get.docker.com | sudo sh

Test docker installation

Run this command:

sudo docker run hello-world

Install Nextcloud

Run this command:

sudo docker run \
--init \
--sig-proxy=false \
--name nextcloud-aio-mastercontainer \
--restart always \
--publish 80:80 \
--publish 8080:8080 \
--publish 8443:8443 \
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
--volume /var/run/docker.sock:/var/run/docker.sock:ro \
nextcloud/all-in-one:latest

Nextcloud Setup

Output of the last docker command should give you something similar to this:

You can head to:

https://your_domain_that_points_to_this_server.tld:8443

because subdomain (or domain) is hopefully propagated. If browser is stuck loading, DNS records haven't been propagated yet, you need to wait until that happens. Or you can access your Nextcloud installation page at the Elastic IP, port 8080:

https://internal.ip.of.this.server:8080

You should land on a page like this:

1. Copy your Password, open Nextcloud AIO login and login

2. Type in the domain (or subdomain) you created record for previously

3. Click Submit domain

After that, the only thing that is left is the actual installation.

1. De-select everything except Imaginary, click Save changes

2. Select Install Nextcloud 29. Then click Download and start containers

Wait on the page until everything is started (should restart automagically when everything is ready)

Now that everything is set, click on Open your Nextcloud and login with the info provided to you by the installation page.

Okay, now that you are logged in, first let's change the admin password.

1. Profile icon (top-right)

2. Administration settings

3. Under Personal - Security

4. Change password

Enable server-side encryption

1. Click on your profile picture

2. Click on Apps

3. Click on Disabled apps and enable Default encryption module

While you are on that page, you can also enable External storage support. Or you can do that later on.

Now just enable Server-Side Encryption in the admin settings.

1. Profile picture

2. Administration settings

3. Under Administration - Security

4. Turn the slider next to the Enable server-side encryption on and click on Enable encryption

Configure S3 as an external storage

Unfortunately, the only supported option to do authN/authZ with the AWS S3 API is by using security credentials.

Let's first create an S3 bucket because we will need its ARN for a custom policy.

After that, you'll need to create a new user in the AWS Account, and security credentials after that.

S3 bucket creation

1. Go to the S3 console

2. Click on Create bucket

3. Bucket name: Whatever you want. Keep in mind that it has to be globally unique

4. Keep everything else as-is

5. Create a sbucket and note the bucket name

6. Copy the ARN

Using only common words in the S3 bucket name is a bad practice. Even if the bucket is private, you will be billed for every request, including those that result in 4xx errors (DELETE and CANCEL are free in both cases). This post discusses how even an empty AWS S3 bucket can lead to unexpected charges on your AWS bill.

IAM Policy creation

1. Go to the IAM Console

2. Click Policies

3. Click Create policy

4. Click on JSON

5. Paste this JSON

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowNextcloudToAccessS3Objects",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:CreateBucket"
            ],
            "Resource": [
                "arn:aws:s3:::s3-nextcloud-external-storage-test",
                "arn:aws:s3:::s3-nextcloud-external-storage-test/*"
            ]
        }
    ]
}

6. Update resource ARNs with your S3 bucket name

7. Click Next

8. Type in a policy name, I chose - nextcloud-root-s3-policy

9. Create policy

Your new IAM policy should look like this:

You can also use the AmazonS3FullAccess AWS Managed policy, but why would you give more permissions than needed to the S3 IAM User?

IAM User creation

1. Click Users in the IAM Console

2. Click Create user

3. Type in a user name that you like

4. Leave Provide user access to the AWS Management Console - unchecked

5. Click Attach policies directly

6. From Filter by Type choose Customer managed and choose your policy

7. Or you can type in the search field the name of the custom IAM Policy that you just created

8. Search and select your IAM policy (in my case that is nextcloud-root-s3-policy) and create your user

Now create security credentials.

1. Click on a user you just created

2. Select tab Security credentials

3. In the Access keys - click Create access key

4. Select Other, read all the bullet points

5. Create key. And keep them somewhere secure!

Nextcloud external storage setup

Go back to the Nextcloud console and get the S3 integration done.

For External storage to work, External storage support app needs to be enabled. If you did not enable it before, do it now. It is required.

After app for external storage is enabled, do the following:

1. Open Administration settings

2. Under Administration – External Storage

3. Under the Authentication drop-down menu, select Access key

4. You can leave Hostname, Port, Storage Class empty, as well as Enable Path Style and Legacy (v2) authentication unselected

5. Click on the submit button on the far right

6. If you see a green symbol on the left, all good!

Note that if you leave Region field empty, eu-west-1 (Ireland) will be selected by default.

Now, when you return to the Files page, you will see the S3 folder there.

Open it, try to upload something.

Let's now check if we can see the file in the S3 bucket.

Perfect. But what would happen if you:

1. Selected that file in the S3 bucket

2. Click Open from the menu above

It didn't open. You do have enough permissions to see the file. Why did it not open?

Because of the server-side encryption in Ghost! When you upload a file to your Nextcloud instance, it is first encrypted and then saved.

Subscribe now

Bonus

If you are using Cloudflare, you can benefit from the free DDoS protection, and other useful features. But your website DNS record needs to be proxied. You can take a look at the gallery below to check your setup.

Before proxy is turned on in the DNS Records management panel, you need to make sure that requests to the Nextcloud bypass Cache and Rocket Loader.

How to configure a Cloudflare Cache Rule

1. Login to your Cloudflare account

2. Select your domain

3. Select Caching in the left menu

4. Cache rules

5. Create rule

6. Write your Rule name

7. Field: Hostname

8. Operator: equals

9. Value: a sub-domain (or domain) where you access your Nextcloud

10. Cache eligibility: Bypass cache

11. Leave everything else as-is

12. Deploy rule

How to disable Rocker Loader

1. Select Rules in the left menu

2. Configuration rules

3. Create rule

4. Field: Hostname

5. Operator: equals

6. Value: a sub-domain (or domain) where you access your Nextcloud

7. Scroll down

8. Click on + Add next to the Rocket loader

9. Leave it turned off

10. Deploy rule

Now you can use Cloudflare Trace, to check if you set the rules correctly.

1. Go to the root of your Cloudflare account

2. Click Trace in the left menu

3. Begin Trace

4. Type in your url (with the protocol - https://)

5. HTTP Method: GET

6. Leave everything else as-is

7. Send Trace and check if the trace result is showing 2 rules you just created

If it looks similar, good to go! If you haven't already – you can check your Nextcloud instance now.

Easy way to check if your website is actually going through the Cloudflare proxy and bypassing the cache is:

1. Open dev tools in the browser

2. Network tab

3. Refresh the page

4. Select the first request

   1. This one will be named dashboard/ probably (or your subdomain/domain)

5. Select the Headers tab and check the Response Headers:

   1. Cf-Cache-Status:

      1. DYNAMIC - NOT cached, going through the proxy

      2. HIT - IS cached, going through the proxy

That's it! If you're looking to further refine and enhance your Nextcloud setup, consider the following suggestions:

1. Create a folder for temporary files (e.g. 30 days temporary storage) and utilize S3 Lifecycle Policies to delete files from that folder only

   1. A notification mechanism which will email you a reminder about file deletion. SNS? SES? Lambda? S3 Event Notifications? EventBridge?

2. Set S3 object (file) replication to another region

   1. S3 standard storage provides 99.999999999% durability and 99.99% availability of objects over a given year. But it's always good to have additional safety for important files.

Don’t fully rely on AI. Seems simple right? However, when you are doing some easy/repetitive stuff, you might fall under influence of just ‘tabbing’.

What was the ‘bug’ anyway?

I was making a Twitter bot in NodeJS. Get some data from Reddit, and post it on Twitter bot account.

First off, I need a library, to simplify things about auth and whatever. A’ight, done.

npm install, make file structure, git init.

Here comes the fun part. I’m writing a constructor for a Twitter client. It needs 4 elements:

• API key

• API secret

• Access token

• Access secret

Okay, fair enough.

Constructing the constructor

First one, it’s okay. TAB.

Seems good, TAB!

Awesome. GitHub Copilot is great!

It’s so easy. TAB and there we go. Constructor finished!

Testing

Let’s try to get a simple ‘Hello World!’ tweet out there.

401, Unauthorized.

Umm, what? Let’s go to the .env file, let’s check if the naming is correct. Copy, paste.

Check.

401, Unauthorized.

Okay, let’s check for Twitter stuff. Check permissions, regenerate keys.

Check.

401, Unauthorized.

Now comes the part where I tried to debug code, try a different library that supports Twitter’s V2 API. No success.

Debugging

Google, google, google. Try this, try that. Progress: NULL

I go for a walk, hoping for an ‘Aha!’ moment.

No luck. Back to work! Open Postman. Input parameters. Check headers, check body.

Send.

It worked!

Hmm, what could it be? Open postman, copy the curl request. Paste it in Notepad++.

I previously turned on debug mode in my code, copied the curl request from there too. Paste it in Notepad++.

Double-click one. Check.

Double-click another one. Check.

Another one. Check.

…

One is missing. How’s that possible??

Now I went to the library docs.

Do you know what I did? Doesn’t make sense, but let’s try. Better than nothing.

Search for a method to input custom headers.

Nope. I did google (a lot) previously, about errors, and whatnot, but either there was no answer, or it was a typo in the .env file.

‘Aha!’ Moment

Maybe… It’s the wrong naming of the constructor fields. So I check. Now I rely on IntelliSense and typing fields.

Seems good.

Keep on.

Okay. Onto the last one.

Wait, what? Wasn’t it accessToken..? My literal reaction was: NO WAY! Are you kidding me?! 😂

GitHub Copilot:

IntelliSense:

…

Keep going!

These are my .02 cents. Don’t let code completion AI tools rule your work. I’m sure there is a lot of funny stories like this. But we all make mistakes. Embrace them as learning opportunities.

I don’t blame GHC for this. I blame myself. But whatever. At least I got some experience. There is always space for improvement.

Fun one for sure.

Bad programmers worry about the code. Good programmers worry about data structures and their relationships. — Linus Torvalds

What are they? Which ones exist? Pros and cons of each one?
If this is looking hmm to you, well all of us were in that phase. But don’t worry! I will try to explain all of those questions in this introductory blog post. You got it!

What are Data Structures?

In computer science, a data structure is a data organization, management, and storage format that enables efficient access and modification.

So essentially, the data structure is a way to efficiently manipulate and organize data.

We are using data structures every day! For example:

• In Microsoft Word, undo and redo operations? — Stacks!

• Social networks feeds? — Linked list or Hash table!

• Storing an image? — Arrays!

• Go back functionality in browsers? — Stacks!

• Friend list, connections, who is a friend with who? — Graph!

• etc.

Data structures are everywhere!

They are the backbone of every good and quality software and software engineer!

Which Data Structures exist?

I will cover the following Data Structures.

Array

In computer science, an array data structure, or simply an array, is a data structure consisting of a collection of elements (values or variables), each identified by at least one array index or key.

Linear array or one-dimensional array is the simplest type of data structure. Arrays are present everywhere! Basically, it is just a continuous stream of cells.

Array pros:

• They are quick! If you know the exact number, that data is retrieved almost instantly.

Array cons:

• Arrays have to be continuous. Before, it was quite common to run into memory problems as they grow in size. Memory management is nowadays a lot more automated/secure (Python, JavaScript), but you still have to keep in mind this, in order to either write or troubleshoot code well (C, C++).

We can find the Array data structure here:

• Sorted leaderboards

• 2D arrays, matrices, are used in image processing and manipulation

Linked List

A linked list is a linear collection of data elements whose order is not given by their physical placement in memory. Instead, each element points to the next.

A linked list is not continuous, or at least it doesn't have to be.

It consists of a collection of nodes. Basically, each node contains data and a pointer to the next node in the sequence. The last node contains a pointer to nothing (it has a value of Null/None).

The first and last nodes are known as HEAD and TAIL ones.

Linked List pros:

• You can easily add or delete a node. All you need is to change the pointer, as each node is aware only of the node next to it (or node before it, if it’s double-linked)

Linked List cons:

• They can be slow because, in order to find a node, you have to (in the worst case, TAIL has the data you are looking for) traverse the whole Linked List.

We can find the Linked List data structure here:

• Previous web pages in browsers

• Switching music in music players

• Turns in mobile games

Hash Table

Hash Table is a data structure which stores data in an associative manner. In a hash table, data is stored in an array format, where each data value has its own unique index value. Access of data becomes very fast if we know the index of the desired data.

So essentially, it uses arrays as an underlying data structure. Hash Table functions in a key-value manner. It has a function, which computes an index (hash node). That index is used for data (value) to be stored.

Hash Table pros:

• As per the nature of Hash Table functioning, they are fast when it comes to the addition or retrieval of data

Hash Table cons:

• The hash function can cause a collision! There are workarounds, but you need to keep in mind that two different inputs can cause the same output, which could make a problem in memory and potential data loss.

off-topic: Recently, there was a collision problem in Apple’s security system. Read more about it here.

We can find the Hash Table data structure here:

• Databases, passwords

• Searching in web-browsers

• Files on devices, filename, and file path

Stack and Queue

Stack is a container of objects that are inserted and removed according to the last-in first-out (LIFO) principle.

You can think of a stack as a pile of plates. You clean them, and the last one you place on top, you will use it first. So, last-in -> first-out.

Queue is a container of objects (a linear collection) that are inserted and removed according to the first-in first-out (FIFO) principle.

You can abstract queue as people waiting to buy something in store. The first one who came will be the first one who will get to buy and go. So, first-in -> first-out.

Stack and Queue pros:

• They are efficient in addition or removal of data

Stack and Queue cons:

• They don't have many use cases. That doesn't mean you shouldn't learn them!

We can find the Stack data structure here:

• Undo operation

• Syntaxes in programming languages

• Virtual Machines

• Browser history

• Call logs, e-mails, gallery, notifications

We can find the Queue data structure here:

• Operating system, job scheduling

• Sending e-mail, it’s queued and sent in blocks

• Server responding to request

• Uploading and downloading files

Graphs and Trees

Tree and graph come under the category of non-linear data structures where tree offers a very useful way of representing a relationship between the nodes in a hierarchical structure and graph follows a network model.

How to differentiate them?

Tree data structure has to be connected, and can not have loops.

Graphs data structures don't have such restrictions.

They are both hierarchical data structures. You can abstract that as a business, with CEO being on top with his associates beneath, then the people below him, who have their own associates, and so on.

Each node is aware of the next node (kind of like a linked list). It contains data and the pointer to the next one.

Graphs and Trees pros:

• They provide a quick addition of data, as well as searching e.g. binary search.

Graphs and Trees cons:

• Modifying data can be tricky sometimes, as you don't have all node indexes at once and you maybe have to traverse them.

We can find the Graph data structure here:

• Facebook Graph API

• Dijkstra algorithm which finds the smallest path between two nodes, used in maps for example

• Facebook, Instagram, social media networking

We can find the Tree data structure here:

• XML parser

• Domain Name Server — DNS

• File explorer of any device

• Posting questions on Quora, Reddit, etc.

Conclusion

These data structures will give you a good foundation for algorithms.

But don’t forget: You will become an expert at them only if you start applying them!

It can be frustrating from time to time, but solving those problems will give you an experience, something you can not learn.

Why should you sign your commits?

First off, let’s see what is git’s default behavior.

Git’s default behavior

By default, git commits have two properties:

• user. email — this email is also used so that GitHub can link commits with your account and show you those shiny green squares :)

• user.name — this is the name that will be shown in a commit info

Git doesn’t verify the info you put into those properties, it just assumes they are right until you set commit signing.

What does ↑ this ↑ mean?

Someone else can set those parameters as yours, and git will just push it remotely (there are certain repo settings you can set, but I’m talking about default behavior), without any checks.

It will show like you committed, with a picture and your email, but you didn’t! So, basically, anyone can set their user.email or user.name to yours, and it will look like you made the commit.

How to prove it is really you?

You can utilize software called GPG (GNU Privacy Guard). It allows you to create public-private key pairs, and encrypt/sign the data.

It is important to understand public-private key pairs.

What are public-private keys in terms of encryption?

The public key is a public one (wow). No, seriously, you can share this key with everyone. It’s mainly used by someone else, so they can encrypt the message, and send it to you. Then, you decode and read it with your private key.

The private key is a private one (another one). It’s like a password. Noone, except you, should ever be able to get it. It’s used to decrypt data, and leaking/exposing it would present a fatal flaw.

How to Sign Commits in Git(Hub)

Prerequisites

• Git, or GitHub Desktop

• GPG utility

You can verify if GPG is already installed by running the following command in the terminal:

• gpg — version

Generating a new GPG key

1. Download and install GPG command-line tools for your operating system.

2. Open terminal.

3. Generate a generate an RSA key pair with the following command:

• gpg --full-generate-key

4. Select what kind of key you want.

• We will use RSA key pair, default one, so you can just press Enter to advance.

5. What keysize do you want?

• Although you can use stronger, 4096 is good, press Enter.

6. Key is valid for?

• I will just press Enter which will select default (0 — doesn’t expire)

7. Then, input your information.

• NOTE: When asked for an email, make sure to input the primary email for your GitHub account! You can also use your no-reply GitHub provided an email address, if you have your privacy settings on.

8. Now you need to set a secure passphrase.

• NOTE: You can also just press OK with blank fields, but it is recommended to use a password for your encryption! Keep in mind that you will have to type in a passphrase at each commit (it has some time window, but you get the idea)

Copying generated key

1. Use the following command to list the long-form of GPG keys

• gpg --list-secret-keys --keyid-format LONG

2. Copy the long form of your key ID, from the list.

• Find the long form of your key after >4096R/<

3. Show your public key with the following command:

• gpg --armor --export 42653CC58CD62E74

• NOTE: Use your own key after --export part

4. Copy your GPG key, beginning with:

• -----BEGIN PGP PUBLIC KEY BLOCK -----

And ending with:

• -----END PGP PUBLIC KEY BLOCK -----

Adding your key to GitHub

1. Go to your settings

2. In the settings sidebar, go to SSH and GPG keys

3. Click on New GPG key

4. In the ‘Key’ field, paste copied public key

5. Finish with clicking on Add GPG key and confirm your password (GitHub account password, not the passphrase)

NOTE: Check if the Key ID on GitHub is the same one as the Key ID you copied earlier:

If it’s not, you did something wrong. If you need help, don’t hesitate to comment down below!

Configuring Git on your local machine

We will modify the .gitconfig file, so this will work for any instance for Git on your windows machine.

The global scope will suffice in this case, navigate and open the .gitconfig file with any editor (I am using Notepad++).

• NOTE: If you don't see the .gitconfig file, you probably have to enable showing hidden files on Windows (I am using Windows 11):

1. Add Key ID from before:

2. Add the GPG section which will point to gpg binary you used for generating a key:

• NOTE: I had problems with only ‘gpg’ or single back-slashes. The method from the picture should work on every Windows 11 machine.

3. Add commit section which will tell git to sign every commit:

That’s it! Now you are able to push signed commits!

Vigilant Mode

If you want to go further, this option will mark every commit you didn't sign as Unverified.