AWS image reference (archived)

Release binding: v0.1.0-enterprise-ready · AMI ami-010806d4d3445660e · 2026-05-19 · Region us-east-1 · Minimum instance g5.2xlarge

Archived technical reference — no current marketplace purchase path

HX-SDP is currently available only through a Private Appliance or scoped pilot. This page retains the dated AWS image configuration and runtime procedures; it does not establish a currently available AWS Marketplace listing, image access, or entitlement. Use these procedures only if HolonomiX supplies this image and configuration within your agreed deployment scope.

1. Current access

Contact HolonomiX to agree a Private Appliance or scoped pilot and obtain the authorized release bundle. Start with Deploy: Private Appliance. The former marketplace subscription instructions have been withdrawn.

The remaining sections describe the release binding above. Confirm image access, infrastructure, and licensing against the package supplied for your pilot before using them.

2. Launch through the console

1. For an authorized image matching this reference, open the EC2 launch workflow.
2. Choose instance type: g5.2xlarge (minimum enterprise).
3. Configure storage: root volume 100 GiB gp3, encrypted with the KMS key arn:aws:kms:us-east-1:487916112059:key/e1d9cc91-4aa3-4e1d-9cf3-d6b110694a80.
4. Configure network: place the instance in a private subnet with NAT (or a public subnet if direct access is needed) and assign a security group per section 4.
5. Under Advanced Details: set metadata version to V2 only (IMDSv2) with HttpTokens = required and a metadata response hop limit of 1.
6. Launch the instance.

3. Launch through the CLI

aws ec2 run-instances \
  --image-id ami-010806d4d3445660e \
  --instance-type g5.2xlarge \
  --key-name <YOUR_KEY_PAIR> \
  --security-group-ids <SG_ID> \
  --subnet-id <SUBNET_ID> \
  --block-device-mappings '[{
    "DeviceName": "/dev/sda1",
    "Ebs": {
      "VolumeSize": 100,
      "VolumeType": "gp3",
      "Encrypted": true,
      "KmsKeyId": "arn:aws:kms:us-east-1:487916112059:key/e1d9cc91-4aa3-4e1d-9cf3-d6b110694a80"
    }
  }]' \
  --metadata-options '{
    "HttpTokens": "required",
    "HttpPutResponseHopLimit": 1,
    "HttpEndpoint": "enabled"
  }' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=hx-sdp-prod}]'

4. Security group

Rule	Protocol	Port	Source	Purpose
Inbound	TCP	8443	Your CIDR	hx-gate API and console
Outbound	All	All	0.0.0.0/0	Package updates (optional)

Do not expose any other ports. The engine and Redis listen on loopback only and are not reachable from the network.

5. First boot

On first boot, cloud-init performs the following with no user action required:

1. Generates a per-instance ML-DSA-65 signing keypair.
2. Generates bootstrap admin credentials.
3. Verifies the signed manifest against the embedded public key (fail-closed).
4. Verifies the license token when a Marketplace entitlement is bound.
5. Starts services in order: redis, then hx-engine, then hx-gate.

Boot completes in approximately 60 to 90 seconds on g5.2xlarge.

6. Capture API keys

ssh -i <YOUR_KEY>.pem ubuntu@<INSTANCE_IP>
sudo cat /opt/hx-sdp/secrets/bootstrap-admin.json

{
  "tenant": "admin",
  "api_key": "<GENERATED_KEY>",
  "role": "admin"
}

Store these credentials securely. They are the only copy.

7. Verify health

curl -sk https://<INSTANCE_IP>:8443/health \
  -H "Authorization: Bearer <API_KEY>"

Expected response:

{
  "status": "healthy",
  "engine": "ok",
  "redis": "ok",
  "gpu": "ok",
  "manifest": "verified"
}

Check Prometheus metrics:

curl -sk https://<INSTANCE_IP>:8443/metrics \
  -H "Authorization: Bearer <API_KEY>"

8. Replace the TLS certificate

The AMI ships with a self-signed TLS certificate. Replace it for production:

sudo cp /path/to/your/fullchain.pem /opt/hx-sdp/tls/server.crt
sudo cp /path/to/your/privkey.pem /opt/hx-sdp/tls/server.key
sudo chown hx-gate:hx-gate /opt/hx-sdp/tls/server.*
sudo chmod 600 /opt/hx-sdp/tls/server.key
sudo systemctl restart hx-gate

9. Smoke test: ingest

curl -sk -X PUT https://<INSTANCE_IP>:8443/v1/put \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "key": "test-doc-001",
    "namespace": "default",
    "data_b64": "<base64-encoded .npy array>",
    "metadata": {"source": "smoke-test"}
  }'

Expected: a success response with the Oracle verdict and a receipt.

10. Smoke test: query

curl -sk -X POST https://<INSTANCE_IP>:8443/v1/query/vector \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "namespace": "default",
    "data_b64": "<base64-encoded .npy array>",
    "k": 5
  }'

Expected: 200 OK with a results array.

Important notes

• IMDSv2 is enforced. The AMI does not function correctly with IMDSv1.
• KMS grant required. The launching IAM principal must have kms:CreateGrant on the CMK for the encrypted AMI to boot. See Known Boundaries.
• GPU required. The engine preflight refuses to start on instances without a compatible NVIDIA GPU.
• g5.2xlarge is the minimum enterprise instance. Smaller GPU instances are not validated.