Self-host on AWS

Deployment shape

The default AWS deployment creates one t3.small EC2 instance, a public IPv4 address, and 48 GiB of gp3 storage. AI-provider and external-tool charges are separate.

• An AWS account
• AWS CLI 2.32.0 or newer
• An SSH public key

Authenticate the AWS CLI

Sign in to the AWS account that will own the host. aws login opens a browser and creates a temporary session. Export that session into the current terminal, then verify the account and identity before deploying.

aws login
eval "$(aws configure export-credentials --format env)"
aws sts get-caller-identity
export AWS_REGION=us-east-1

Deploy

Lifecycle commands are Python modules inside the Kern checkout, so clone it and run them from that directory. generate_password prints the admin password and the SHA-256 digest the deploy command needs.

git clone https://github.com/infiloop2/kern.git
cd kern
python3 -m host.cli.generate_password
ssh-keygen -t ed25519

python3 -m host.cli.deploy \
  --provider aws \
  --agent-name my-kern \
  --admin-password-sha256 <sha256-from-generate-password> \
  --operator-ssh-public-key "$(cat ~/.ssh/id_ed25519.pub)"

Save the public_dns value from the deploy result. You need it to open the SSH tunnel.

Open Kern over SSH

ssh -i ~/.ssh/id_ed25519 -N -L 7443:127.0.0.1:7443 kern-operator@<public-dns>

Keep the tunnel running, open http://127.0.0.1:7443 ↗, and sign in with the admin password you saved. The AWS host keeps running when you close the tunnel.

Optional: add remote browser access

Follow Set up remote access to add a Cloudflare Tunnel and stable HTTPS hostname.

From deployment to a useful first run

1. 1
   Deploy in your AWS account

   Create the always-on host, open its SSH tunnel, then sign in to Kern on localhost.

2. 2
   Connect an agent

   Open Home → Integrations and connect the runtime you use.

3. 3
   Enable only the access you need

   Connect tools and network integrations for the task. Kern denies everything else.

4. 4
   Give the agent a real outcome

   Start a Chat with a bounded task, such as researching a question or improving a repository.

5. 5
   Inspect the boundary

   Review Network audit and Tool audit to see what was allowed, denied, or held for approval.

Set up credentials for future lifecycle commands

The first-run STS session expires. Later upgrade, recovery, reconfigure, start, and stop commands need credentials again. Create a dedicated kern-host-deploy IAM user that carries Kern's scoped iam_policy.json ↗, which limits resource changes to Kern-tagged infrastructure. That user's access key is the only credential you keep, and it cannot administer the rest of your account.

AWS_ACCOUNT_ID="$(aws sts get-caller-identity --query Account --output text)"

aws iam create-policy \
  --policy-name kern-host-deploy \
  --policy-document file://iam_policy.json

aws iam create-user --user-name kern-host-deploy

aws iam attach-user-policy \
  --user-name kern-host-deploy \
  --policy-arn "arn:aws:iam::$AWS_ACCOUNT_ID:policy/kern-host-deploy"

aws iam create-access-key --user-name kern-host-deploy

Store the returned key securely. Export AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and the same AWS_REGION before future lifecycle commands, and unset AWS_SESSION_TOKEN so the long-lived key is used.