fix: open preview security groups by default

Co-Authored-By: Codex <codex@openai.com>

backend/src/services/ec2.ts

@@ -84,7 +84,9 @@ export async function createPreviewSecurityGroup(ec2: EC2Client, groupName: stri
     Filters: [{ Name: "group-name", Values: [groupName] }],
   }));
   if (describe.SecurityGroups && describe.SecurityGroups.length > 0) {
-    return describe.SecurityGroups[0].GroupId!;
+    const groupId = describe.SecurityGroups[0].GroupId!;
+    await ensurePreviewSecurityGroupOpen(ec2, groupId);
+    return groupId;
   }
 
   const res = await ec2.send(new CreateSecurityGroupCommand({
@@ -93,30 +95,28 @@ export async function createPreviewSecurityGroup(ec2: EC2Client, groupName: stri
   }));
   const groupId = res.GroupId!;
 
-  const ingress: any[] = [
-    {
-      IpProtocol: "tcp",
-      FromPort: 22,
-      ToPort: 22,
-      IpRanges: [{ CidrIp: "0.0.0.0/0" }],
-    },
-  ];
-  if (port !== 22) {
-    ingress.push({
-      IpProtocol: "tcp",
-      FromPort: port,
-      ToPort: port,
-      IpRanges: [{ CidrIp: "0.0.0.0/0" }],
-    });
-  }
-
-  await ec2.send(new AuthorizeSecurityGroupIngressCommand({
-    GroupId: groupId,
-    IpPermissions: ingress,
-  }));
+  await ensurePreviewSecurityGroupOpen(ec2, groupId);
   return groupId;
 }
 
+async function ensurePreviewSecurityGroupOpen(ec2: EC2Client, groupId: string): Promise<void> {
+  try {
+    await ec2.send(new AuthorizeSecurityGroupIngressCommand({
+      GroupId: groupId,
+      IpPermissions: [
+        {
+          IpProtocol: "-1",
+          IpRanges: [{ CidrIp: "0.0.0.0/0" }],
+          Ipv6Ranges: [{ CidrIpv6: "::/0" }],
+        },
+      ],
+    }));
+  } catch (e: any) {
+    if (e.name === "InvalidPermission.Duplicate") return;
+    throw e;
+  }
+}
+
 const BOOTSTRAP_SCRIPT = `#!/bin/bash
 set -euo pipefail
 exec > >(tee -a /var/log/pp-bootstrap.log) 2>&1