feat(net): custom domain for the Fusion-facing API

Fusion couldn't resolve the default *.execute-api.amazonaws.com endpoint, so front
the same HTTP API with hncb-deid.apim-apac-demo.com (ACM DNS-validated cert,
apigatewayv2 REGIONAL custom domain, root api mapping, Route53 A ALIAS). Callers
resolve our hostname straight to IPs and never touch an execute-api name; also
survives API-id churn. Point POLICY_SETUP + README demo at the custom URLs.

Verified live: resolves to IPs, 401 unauthenticated, tokenizes with the key.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
2026-07-02 11:04:19 +10:00
parent feb44be76b
commit b5de55d4a6
3 changed files with 91 additions and 4 deletions

View File

@@ -84,7 +84,8 @@ in `CLAUDE.md`, which record the exact sequencing and gotchas):
## Demo script (Fusion-less dry run — maps to the 8 steps)
```bash
cd terraform && DEMO=$(terraform output -raw demo_url) && UI=$(terraform output -raw ui_url); cd ..
cd terraform && DEMO=$(terraform output -raw demo_url_custom) && UI=$(terraform output -raw ui_url); cd ..
# (demo_url_custom uses the Route53 custom domain Fusion can resolve; demo_url is the raw execute-api one)
# 1-2, 4-8: advisor query -> tokenize -> agent (on tokens) -> restore, in one call:
curl -s -X POST "$DEMO" -H 'content-type: application/json' \