From b372409ccf39246d8f9593d5fc25adaf93ad9d5e Mon Sep 17 00:00:00 2001
From: cruizba <carlos.ruizbal@gmail.com>
Date: Tue, 6 Oct 2026 16:00:49 +0200
Subject: [PATCH] openvidu-deployment: AWS - wait for the Elastic IP before
 deriving the domain

NewEIP was created with InstanceId, so the Elastic IP was attached only
after the instance existed, racing with the boot scripts: the domain could
be derived from whatever public IP the instance had at that moment (the
subnet's ephemeral one, or none), and with no public IP there was no
Internet access for apt-get, cfn-init or the installer either.

In the CE single node, Pro single node and Pro elastic templates, NewEIP is
now allocated on its own and attached by a separate NewEIPAssociation, so
its address is known up front. UserData waits up to 10 minutes for the
instance to have that address before doing anything else, and install.sh
reads public-ipv4 instead of public-hostname (empty in VPCs without DNS
hostnames).


Assisted-by: claude-code - Anthropic - Claude Opus 5.5
---
 .../aws/cf-openvidu-singlenode.yaml           |  89 +++++++-----
 .../pro/elastic/aws/cf-openvidu-elastic.yaml  | 135 ++++++++++--------
 .../aws/cf-openvidu-singlenode.yaml           |  89 +++++++-----
 3 files changed, 191 insertions(+), 122 deletions(-)

diff --git a/openvidu-deployment/community/singlenode/aws/cf-openvidu-singlenode.yaml b/openvidu-deployment/community/singlenode/aws/cf-openvidu-singlenode.yaml
index ca23d7a4a..d69c4b424 100644
--- a/openvidu-deployment/community/singlenode/aws/cf-openvidu-singlenode.yaml
+++ b/openvidu-deployment/community/singlenode/aws/cf-openvidu-singlenode.yaml
@@ -706,8 +706,7 @@ Resources:
 
                 # Configure Domain
                 if [[ "${DomainName}" == '' ]]; then
-                  PublicHostname=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-hostname)
-                  DOMAIN=$(echo "$PublicHostname" | cut -d'.' -f1 | sed 's/^ec2-//' | tr '-' '.')
+                  DOMAIN=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-ipv4)
                 else
                   DOMAIN=${DomainName}
                 fi
@@ -1100,49 +1099,68 @@ Resources:
         - Key: Name
           Value: !Ref 'AWS::StackName'
       UserData:
-        Fn::Base64: !Sub |
-          #!/bin/bash -x
-          set -eu -o pipefail
+        Fn::Base64: !Sub
+          - |
+            #!/bin/bash -x
+            set -eu -o pipefail
 
-          echo "DPkg::Lock::Timeout \"-1\";" > /etc/apt/apt.conf.d/99timeout
+            # Wait for the Elastic IP: CloudFormation associates it only after the instance
+            # is created, and until then the instance may have another public IP (or none,
+            # and no Internet access)
+            TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+            CURRENT_PUBLIC_IP=""
+            for _ in $(seq 1 120); do
+              CURRENT_PUBLIC_IP=$(curl -sf -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-ipv4 || true)
+              if [[ "$CURRENT_PUBLIC_IP" == "${ExpectedPublicIp}" ]]; then
+                break
+              fi
+              sleep 5
+            done
+            if [[ "$CURRENT_PUBLIC_IP" != "${ExpectedPublicIp}" ]]; then
+              echo "[OpenVidu] Elastic IP ${ExpectedPublicIp} not attached after 10 minutes"
+              exit 1
+            fi
 
-          apt-get update && apt-get install -y \
-                python3-pip \
-                ec2-instance-connect
+            echo "DPkg::Lock::Timeout \"-1\";" > /etc/apt/apt.conf.d/99timeout
 
-          CFN_BOOTSTRAP_VERSION=2.0-39
-          # Detect Ubuntu version and install cfn-bootstrap accordingly
-          UBUNTU_VERSION=$(lsb_release -rs | cut -d. -f1)
-          if [ "$UBUNTU_VERSION" -ge 24 ]; then
-            python3 -m pip install --break-system-packages https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
-          else
-            python3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
-          fi
+            apt-get update && apt-get install -y \
+                  python3-pip \
+                  ec2-instance-connect
 
-          cfn-init --region ${AWS::Region} --stack ${AWS::StackId} --resource OpenviduServer
+            CFN_BOOTSTRAP_VERSION=2.0-39
+            # Detect Ubuntu version and install cfn-bootstrap accordingly
+            UBUNTU_VERSION=$(lsb_release -rs | cut -d. -f1)
+            if [ "$UBUNTU_VERSION" -ge 24 ]; then
+              python3 -m pip install --break-system-packages https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
+            else
+              python3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
+            fi
 
-          export HOME="/root"
+            cfn-init --region ${AWS::Region} --stack ${AWS::StackId} --resource OpenviduServer
 
-          # Install OpenVidu
-          /usr/local/bin/install.sh || { echo "[OpenVidu] error installing OpenVidu"; exit 1; }
+            export HOME="/root"
 
-          # Config S3 bucket
-          /usr/local/bin/config_s3.sh || { echo "[OpenVidu] error configuring S3 bucket"; exit 1; }
+            # Install OpenVidu
+            /usr/local/bin/install.sh || { echo "[OpenVidu] error installing OpenVidu"; exit 1; }
 
-          # Start OpenVidu
-          systemctl start openvidu || { echo "[OpenVidu] error starting OpenVidu"; exit 1; }
+            # Config S3 bucket
+            /usr/local/bin/config_s3.sh || { echo "[OpenVidu] error configuring S3 bucket"; exit 1; }
 
-          # Update shared secret
-          /usr/local/bin/after_install.sh || { echo "[OpenVidu] error updating shared secret"; exit 1; }
+            # Start OpenVidu
+            systemctl start openvidu || { echo "[OpenVidu] error starting OpenVidu"; exit 1; }
 
-          # Launch on reboot
-          echo "@reboot /usr/local/bin/restart.sh" | crontab
+            # Update shared secret
+            /usr/local/bin/after_install.sh || { echo "[OpenVidu] error updating shared secret"; exit 1; }
 
-          # Wait for the app
-          /usr/local/bin/check_app_ready.sh
+            # Launch on reboot
+            echo "@reboot /usr/local/bin/restart.sh" | crontab
 
-          # sending the finish call
-          cfn-signal -e $? --stack ${AWS::StackId} --resource WaitCondition --region ${AWS::Region}
+            # Wait for the app
+            /usr/local/bin/check_app_ready.sh
+
+            # sending the finish call
+            cfn-signal -e $? --stack ${AWS::StackId} --resource WaitCondition --region ${AWS::Region}
+          - ExpectedPublicIp: !If [PublicElasticIPPresent, !Ref PublicElasticIP, !Ref NewEIP]
 
       BlockDeviceMappings:
         - DeviceName: /dev/sda1
@@ -1161,8 +1179,13 @@ Resources:
   NewEIP:
     Type: 'AWS::EC2::EIP'
     Condition: PublicElasticIPAbsent
+
+  NewEIPAssociation:
+    Type: 'AWS::EC2::EIPAssociation'
+    Condition: PublicElasticIPAbsent
     Properties:
       InstanceId: !Ref OpenviduServer
+      AllocationId: !GetAtt NewEIP.AllocationId
 
   IMDSv2LaunchTemplate:
     Type: AWS::EC2::LaunchTemplate
diff --git a/openvidu-deployment/pro/elastic/aws/cf-openvidu-elastic.yaml b/openvidu-deployment/pro/elastic/aws/cf-openvidu-elastic.yaml
index 8f79301d8..7c27e14e2 100644
--- a/openvidu-deployment/pro/elastic/aws/cf-openvidu-elastic.yaml
+++ b/openvidu-deployment/pro/elastic/aws/cf-openvidu-elastic.yaml
@@ -1410,8 +1410,13 @@ Resources:
   NewEIP:
     Type: 'AWS::EC2::EIP'
     Condition: PublicElasticIPAbsent
+
+  NewEIPAssociation:
+    Type: 'AWS::EC2::EIPAssociation'
+    Condition: PublicElasticIPAbsent
     Properties:
       InstanceId: !Ref OpenViduMasterNode
+      AllocationId: !GetAtt NewEIP.AllocationId
 
   IMDSv2LaunchTemplateMasterNode:
     Type: AWS::EC2::LaunchTemplate
@@ -1469,8 +1474,7 @@ Resources:
 
                 # Configure Domain and other parameters
                 if [[ "${DomainName}" == '' ]]; then
-                  PublicHostname=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-hostname)
-                  DOMAIN=$(echo "$PublicHostname" | cut -d'.' -f1 | sed 's/^ec2-//' | tr '-' '.')
+                  DOMAIN=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-ipv4)
                 else
                   DOMAIN=${DomainName}
                 fi
@@ -1940,56 +1944,64 @@ Resources:
         - Key: Name
           Value: !Sub ${AWS::StackName} - OpenVidu Elastic - Master Node
       UserData:
-        Fn::Base64: !Sub |
-          #!/bin/bash
-          set -eu -o pipefail
+        Fn::Base64: !Sub
+          - |
+            #!/bin/bash
+            set -eu -o pipefail
 
-          echo "DPkg::Lock::Timeout \"-1\";" > /etc/apt/apt.conf.d/99timeout
-
-          apt-get update && apt-get install -y \
-                python3-pip \
-                ec2-instance-connect
-
-          CFN_BOOTSTRAP_VERSION=2.0-39
-          # Detect Ubuntu version and install cfn-bootstrap accordingly
-          UBUNTU_VERSION=$(lsb_release -rs | cut -d. -f1)
-          if [ "$UBUNTU_VERSION" -ge 24 ]; then
-            python3 -m pip install --break-system-packages https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
-          else
-            python3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
-          fi
-
-          cfn-init --region ${AWS::Region} --stack ${AWS::StackId} --resource OpenViduMasterNode
-
-          export HOME="/root"
-
-          # Install OpenVidu
-          /usr/local/bin/install.sh || { echo "[OpenVidu] error installing OpenVidu"; exit 1; }
-
-          # Config S3 bucket
-          /usr/local/bin/config_s3.sh || { echo "[OpenVidu] error configuring S3 bucket"; exit 1; }
-
-          # Start OpenVidu
-          systemctl start openvidu || { echo "[OpenVidu] error starting OpenVidu"; exit 1; }
-
-          # Update shared secret
-          /usr/local/bin/after_install.sh || { echo "[OpenVidu] error updating shared secret"; exit 1; }
-
-          # Launch on reboot
-          echo "@reboot /usr/local/bin/restart.sh &> /var/log/openvidu-restart.log" | crontab
-
-          # Local readiness gate: wait up to 300s for Caddy health, restart once if it does not converge
-          OPENVIDU_READY=false
-          for i in $(seq 1 60); do
-            if curl -fsS http://127.0.0.1:7880/health/caddy >/dev/null 2>&1; then
-              OPENVIDU_READY=true
-              break
+            # Wait for the Elastic IP: CloudFormation associates it only after the instance
+            # is created, and until then the instance may have another public IP (or none,
+            # and no Internet access)
+            TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+            CURRENT_PUBLIC_IP=""
+            for _ in $(seq 1 120); do
+              CURRENT_PUBLIC_IP=$(curl -sf -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-ipv4 || true)
+              if [[ "$CURRENT_PUBLIC_IP" == "${ExpectedPublicIp}" ]]; then
+                break
+              fi
+              sleep 5
+            done
+            if [[ "$CURRENT_PUBLIC_IP" != "${ExpectedPublicIp}" ]]; then
+              echo "[OpenVidu] Elastic IP ${ExpectedPublicIp} not attached after 10 minutes"
+              exit 1
             fi
-            sleep 5
-          done
-          if [ "$OPENVIDU_READY" != "true" ]; then
-            echo "[OpenVidu] not healthy after 300s, restarting once"
-            systemctl restart openvidu || true
+
+            echo "DPkg::Lock::Timeout \"-1\";" > /etc/apt/apt.conf.d/99timeout
+
+            apt-get update && apt-get install -y \
+                  python3-pip \
+                  ec2-instance-connect
+
+            CFN_BOOTSTRAP_VERSION=2.0-39
+            # Detect Ubuntu version and install cfn-bootstrap accordingly
+            UBUNTU_VERSION=$(lsb_release -rs | cut -d. -f1)
+            if [ "$UBUNTU_VERSION" -ge 24 ]; then
+              python3 -m pip install --break-system-packages https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
+            else
+              python3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
+            fi
+
+            cfn-init --region ${AWS::Region} --stack ${AWS::StackId} --resource OpenViduMasterNode
+
+            export HOME="/root"
+
+            # Install OpenVidu
+            /usr/local/bin/install.sh || { echo "[OpenVidu] error installing OpenVidu"; exit 1; }
+
+            # Config S3 bucket
+            /usr/local/bin/config_s3.sh || { echo "[OpenVidu] error configuring S3 bucket"; exit 1; }
+
+            # Start OpenVidu
+            systemctl start openvidu || { echo "[OpenVidu] error starting OpenVidu"; exit 1; }
+
+            # Update shared secret
+            /usr/local/bin/after_install.sh || { echo "[OpenVidu] error updating shared secret"; exit 1; }
+
+            # Launch on reboot
+            echo "@reboot /usr/local/bin/restart.sh &> /var/log/openvidu-restart.log" | crontab
+
+            # Local readiness gate: wait up to 300s for Caddy health, restart once if it does not converge
+            OPENVIDU_READY=false
             for i in $(seq 1 60); do
               if curl -fsS http://127.0.0.1:7880/health/caddy >/dev/null 2>&1; then
                 OPENVIDU_READY=true
@@ -1997,14 +2009,25 @@ Resources:
               fi
               sleep 5
             done
-          fi
+            if [ "$OPENVIDU_READY" != "true" ]; then
+              echo "[OpenVidu] not healthy after 300s, restarting once"
+              systemctl restart openvidu || true
+              for i in $(seq 1 60); do
+                if curl -fsS http://127.0.0.1:7880/health/caddy >/dev/null 2>&1; then
+                  OPENVIDU_READY=true
+                  break
+                fi
+                sleep 5
+              done
+            fi
 
-          # Disable errexit so cfn-signal always runs and reports readiness via $? (fast-fail instead of a PT20M timeout)
-          set +e
-          [ "$OPENVIDU_READY" = "true" ]
+            # Disable errexit so cfn-signal always runs and reports readiness via $? (fast-fail instead of a PT20M timeout)
+            set +e
+            [ "$OPENVIDU_READY" = "true" ]
 
-          # sending the finish call
-          cfn-signal -e $? --stack ${AWS::StackId} --resource WaitCondition --region ${AWS::Region}
+            # sending the finish call
+            cfn-signal -e $? --stack ${AWS::StackId} --resource WaitCondition --region ${AWS::Region}
+          - ExpectedPublicIp: !If [PublicElasticIPPresent, !Ref PublicElasticIP, !Ref NewEIP]
 
       BlockDeviceMappings:
         - DeviceName: /dev/sda1
diff --git a/openvidu-deployment/pro/singlenode/aws/cf-openvidu-singlenode.yaml b/openvidu-deployment/pro/singlenode/aws/cf-openvidu-singlenode.yaml
index ff4f2cc2f..77ec2489c 100644
--- a/openvidu-deployment/pro/singlenode/aws/cf-openvidu-singlenode.yaml
+++ b/openvidu-deployment/pro/singlenode/aws/cf-openvidu-singlenode.yaml
@@ -808,8 +808,7 @@ Resources:
 
                 # Configure Domain
                 if [[ "${DomainName}" == '' ]]; then
-                  PublicHostname=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-hostname)
-                  DOMAIN=$(echo "$PublicHostname" | cut -d'.' -f1 | sed 's/^ec2-//' | tr '-' '.')
+                  DOMAIN=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-ipv4)
                 else
                   DOMAIN=${DomainName}
                 fi
@@ -1217,49 +1216,68 @@ Resources:
         - Key: Name
           Value: !Ref 'AWS::StackName'
       UserData:
-        Fn::Base64: !Sub |
-          #!/bin/bash -x
-          set -eu -o pipefail
+        Fn::Base64: !Sub
+          - |
+            #!/bin/bash -x
+            set -eu -o pipefail
 
-          echo "DPkg::Lock::Timeout \"-1\";" > /etc/apt/apt.conf.d/99timeout
+            # Wait for the Elastic IP: CloudFormation associates it only after the instance
+            # is created, and until then the instance may have another public IP (or none,
+            # and no Internet access)
+            TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+            CURRENT_PUBLIC_IP=""
+            for _ in $(seq 1 120); do
+              CURRENT_PUBLIC_IP=$(curl -sf -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-ipv4 || true)
+              if [[ "$CURRENT_PUBLIC_IP" == "${ExpectedPublicIp}" ]]; then
+                break
+              fi
+              sleep 5
+            done
+            if [[ "$CURRENT_PUBLIC_IP" != "${ExpectedPublicIp}" ]]; then
+              echo "[OpenVidu] Elastic IP ${ExpectedPublicIp} not attached after 10 minutes"
+              exit 1
+            fi
 
-          apt-get update && apt-get install -y \
-                python3-pip \
-                ec2-instance-connect
+            echo "DPkg::Lock::Timeout \"-1\";" > /etc/apt/apt.conf.d/99timeout
 
-          CFN_BOOTSTRAP_VERSION=2.0-39
-          # Detect Ubuntu version and install cfn-bootstrap accordingly
-          UBUNTU_VERSION=$(lsb_release -rs | cut -d. -f1)
-          if [ "$UBUNTU_VERSION" -ge 24 ]; then
-            python3 -m pip install --break-system-packages https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
-          else
-            python3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
-          fi
+            apt-get update && apt-get install -y \
+                  python3-pip \
+                  ec2-instance-connect
 
-          cfn-init --region ${AWS::Region} --stack ${AWS::StackId} --resource OpenviduServer
+            CFN_BOOTSTRAP_VERSION=2.0-39
+            # Detect Ubuntu version and install cfn-bootstrap accordingly
+            UBUNTU_VERSION=$(lsb_release -rs | cut -d. -f1)
+            if [ "$UBUNTU_VERSION" -ge 24 ]; then
+              python3 -m pip install --break-system-packages https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
+            else
+              python3 -m pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-${!CFN_BOOTSTRAP_VERSION}.tar.gz
+            fi
 
-          export HOME="/root"
+            cfn-init --region ${AWS::Region} --stack ${AWS::StackId} --resource OpenviduServer
 
-          # Install OpenVidu
-          /usr/local/bin/install.sh || { echo "[OpenVidu] error installing OpenVidu"; exit 1; }
+            export HOME="/root"
 
-          # Config S3 bucket
-          /usr/local/bin/config_s3.sh || { echo "[OpenVidu] error configuring S3 bucket"; exit 1; }
+            # Install OpenVidu
+            /usr/local/bin/install.sh || { echo "[OpenVidu] error installing OpenVidu"; exit 1; }
 
-          # Start OpenVidu
-          systemctl start openvidu || { echo "[OpenVidu] error starting OpenVidu"; exit 1; }
+            # Config S3 bucket
+            /usr/local/bin/config_s3.sh || { echo "[OpenVidu] error configuring S3 bucket"; exit 1; }
 
-          # Update shared secret
-          /usr/local/bin/after_install.sh || { echo "[OpenVidu] error updating shared secret"; exit 1; }
+            # Start OpenVidu
+            systemctl start openvidu || { echo "[OpenVidu] error starting OpenVidu"; exit 1; }
 
-          # Launch on reboot
-          echo "@reboot /usr/local/bin/restart.sh" | crontab
+            # Update shared secret
+            /usr/local/bin/after_install.sh || { echo "[OpenVidu] error updating shared secret"; exit 1; }
 
-          # Wait for the app
-          /usr/local/bin/check_app_ready.sh
+            # Launch on reboot
+            echo "@reboot /usr/local/bin/restart.sh" | crontab
 
-          # sending the finish call
-          cfn-signal -e $? --stack ${AWS::StackId} --resource WaitCondition --region ${AWS::Region}
+            # Wait for the app
+            /usr/local/bin/check_app_ready.sh
+
+            # sending the finish call
+            cfn-signal -e $? --stack ${AWS::StackId} --resource WaitCondition --region ${AWS::Region}
+          - ExpectedPublicIp: !If [PublicElasticIPPresent, !Ref PublicElasticIP, !Ref NewEIP]
 
       BlockDeviceMappings:
         - DeviceName: /dev/sda1
@@ -1278,8 +1296,13 @@ Resources:
   NewEIP:
     Type: 'AWS::EC2::EIP'
     Condition: PublicElasticIPAbsent
+
+  NewEIPAssociation:
+    Type: 'AWS::EC2::EIPAssociation'
+    Condition: PublicElasticIPAbsent
     Properties:
       InstanceId: !Ref OpenviduServer
+      AllocationId: !GetAtt NewEIP.AllocationId
 
   IMDSv2LaunchTemplate:
     Type: AWS::EC2::LaunchTemplate