Deploy a Web App

This guide walks through deploying a three-tier web application using Kyku. The same config works across AWS, GCP, and Hetzner.

Architecture

Internet → LoadBalancer (port 80/443) → Web VM (port 8080)
                                              ↓
                                     Database (port 5432, private subnet)

Config

import { Vpc, Vm, SecurityGroup, LoadBalancer, Database } from '@kykucloud/types';

const vpc = new Vpc({
  id: 'vpc-app',
  name: 'app-vpc',
  cidr: '10.0.0.0/16',
  region: 'us-east',
  distributeAcrossAzs: 2,
});

// Public-facing web SG
const webSg = new SecurityGroup({
  id: 'sg-web',
  name: 'web-sg',
  ingress: [
    { protocol: 'tcp', fromPort: 80, toPort: 80, sources: ['0.0.0.0/0'] },
    { protocol: 'tcp', fromPort: 443, toPort: 443, sources: ['0.0.0.0/0'] },
  ],
});

// Internal DB SG
const dbSg = new SecurityGroup({
  id: 'sg-db',
  name: 'db-sg',
  ingress: [
    { protocol: 'tcp', fromPort: 5432, toPort: 5432, sources: [webSg] },
  ],
});

const webServer = new Vm({
  id: 'vm-web-1',
  name: 'web-server-1',
  instanceType: 'small',
  image: 'ubuntu-24.04',
  network: vpc,
  securityGroups: [webSg],
  userData: `#!/bin/bash
apt-get update
apt-get install -y nginx
systemctl enable nginx
systemctl start nginx`,
});

const db = new Database({
  id: 'db-main',
  name: 'app-db',
  engine: 'postgresql',
  version: '16',
  instanceType: 'small',
  storage: 20,
  username: 'appuser',
  vpc: vpc,
  securityGroups: [dbSg],
});

const lb = new LoadBalancer({
  id: 'lb-web',
  name: 'web-lb',
  lbType: 'application',
  vpc: vpc,
  listeners: [{
    port: 80,
    protocol: 'http',
    targets: [{ vm: webServer, port: 80 }],
  }],
});

export default { provider: 'aws', resources: [vpc, webSg, dbSg, webServer, db, lb] };

Switching Providers

Change the provider and optionally override regions:

export default { provider: 'gcp', resources: [...] };
// Or multi-provider
export default {
  providers: {
    aws: { region: 'us-east-1' },
    gcp: { region: 'us-central1' },
  },
  resources: [...],
};

Deploy

# Preview
kyku plan

# Apply
kyku apply --auto-approve

# Check outputs
kyku output

# Clean up
kyku destroy --auto-approve

What Kyku Does Automatically

• Subnets: distributeAcrossAzs: 2 creates 2 public + 2 private subnets
• SG references: sources: [webSg] auto-resolves to the correct security group ID
• Dependencies: DAG ensures VPC → SGs → VM/DB → LB order
• DB credentials: Auto-generates password, encrypted in state
• LB targets: Auto-configures target group and health checks