Ironically after all that setup, I decided to give Linode with k8s a try [3] :-) (due to aws' high costs of egress and NAT gws / IPv4 tax on AWS, and the fact that some apps that I want to run are easier to deploy with helm).
More notes:
* I did try ECS and Fargate, which are nice, but also come with associated costs and a bunch of complexity. At that point, I rather spend time directly with k8s, which should make my localhost parity way higher, and hosting somewhere more affordable.
* I tried both Pulumi and Terraform. I have mixed feelings about them. I ended up using CDK because it _felt_ like the nicer development experience (except when CloudFormation fails and it kind of hides the reason why, sigh ... fishing for logs on CloudWatch is such a drag!).
* I tried to add some NACL rules since I ended up running the thing on a public VPC. I couldn't make it work but at that time I had already decided to host elsewhere so I left it like that :-). I did succeed on adding support for AWS WAF. Sadly, the cdk currently doesn't have high level support for WAF so it was not as nice to setup.
--
1: https://github.com/Wowu/docker-rollout
2: https://news.ycombinator.com/item?id=34690947
3: https://medium.com/@elliotgraebert/comparing-the-top-eight-m...