chore(clickbench): remove hardcoded credentials and account-specific defaults from EC2 launch flow

- launch-ec2.sh: replace the fixed root serial-console password baked into
  user-data with a random per-launch password (openssl rand -hex 12),
  injected via placeholder substitution and printed to the operator. The
  serial console connection is key-authenticated via ec2-instance-connect,
  but the ttyS0 getty still needs a local password login, so password auth
  stays — just no longer checked into git.
- launch-ec2.sh: move AMI / subnet / security group / profile (+ new REGION,
  INSTANCE_TYPE, VOLUME_SIZE) into an env-overridable, clearly-labeled
  'Xata account defaults' block; pass --region to every aws call.
- launch-ec2.sh: the cloud-init SSH wait loop now fails loudly (exit 1 with
  inspect/teardown guidance) instead of printing 'Instance ready' after
  exhausting its 30 tries.
- Makefile: drop the personal EC2_KEY ?= ~/.ssh/tsg.pem default. EC2_KEY now
  derives from KEY_NAME (~/.ssh/$KEY_NAME.pem, the launch-ec2.sh convention)
  or must be passed explicitly; ssh/rsync targets abort with a clear error
  when neither is set. launch targets forward KEY_NAME to the script.
  AWS_PROFILE default labeled as a Xata account default.

Author: SferaDev

clickbench/Makefile

@@ -1,7 +1,7 @@
 # EC2 ClickBench benchmark workflow
 #
 # Lifecycle:
-#   make launch-ec2              # launch EC2 instance, prints export EC2=<ip>
+#   make launch-ec2 KEY_NAME=<key>  # launch EC2 instance, prints export EC2=<ip>
 #   make bench-full EC2=<ip>     # full ClickBench-equivalent run (install + load + queries)
 #   make bench EC2=<ip>          # queries-only against an already-loaded DB
 #   make bench-concurrent EC2=<ip> # only the concurrent-QPS test; merges into the latest results JSON
@@ -43,7 +43,18 @@
 #   make psql EC2=<ip>
 
 EC2 ?=
-EC2_KEY ?= ~/.ssh/tsg.pem
+# SSH key for the EC2 instance. No personal default — provide either:
+#   KEY_NAME=<ec2-key-pair>  -> uses ~/.ssh/<ec2-key-pair>.pem, same convention
+#                               as launch-ec2.sh
+#   EC2_KEY=<path-to-pem>    -> explicit path
+# Targets that don't ssh/rsync (launch-ec2, destroy-ec2, ...) work without it.
+KEY_NAME ?=
+ifneq ($(strip $(KEY_NAME)),)
+EC2_KEY ?= ~/.ssh/$(KEY_NAME).pem
+endif
+ifeq ($(origin EC2_KEY),undefined)
+EC2_KEY = $(error EC2_KEY is not set. Pass KEY_NAME=<your-ec2-key-pair> to use ~/.ssh/<key>.pem, or EC2_KEY=<path-to-pem> directly)
+endif
 EC2_USER ?= ubuntu
 PARQUET ?= 1
 EC2_SSH = ssh -i $(EC2_KEY) -o StrictHostKeyChecking=no $(EC2_USER)@$(EC2)
@@ -57,6 +68,7 @@ HISTORY_DIR = $(RESULTS_DIR)/history
 CLICKBENCH_DIR ?= $(CURDIR)/../../../ClickBench/pg_deltax
 CLICKBENCH_REPO ?= $(CLICKBENCH_DIR)/..
 
+# Xata account default (shared org infra) — override for other AWS accounts.
 AWS_PROFILE ?= management
 AWS_NAME = clickbench-pg-deltax
 REFERENCE_AWS_NAME = clickbench-pg-deltax-reference
@@ -65,8 +77,9 @@ REFERENCE_AWS_NAME = clickbench-pg-deltax-reference
 
 # Launch a new EC2 instance. Aborts if the name is already taken (never
 # terminates implicitly); requires KEY_NAME — see launch-ec2.sh.
+# Usage: make launch-ec2 KEY_NAME=<your-ec2-key-pair>
 launch-ec2:
-	@bash launch-ec2.sh
+	@KEY_NAME="$(KEY_NAME)" bash launch-ec2.sh
 
 # Terminate the EC2 instance
 destroy-ec2:
@@ -86,7 +99,7 @@ destroy-ec2:
 # Launch a separate EC2 instance for the vanilla-PG correctness reference run.
 # Uses a different Name tag so it doesn't clobber the bench EC2.
 launch-reference-ec2:
-	@bash launch-ec2.sh --name $(REFERENCE_AWS_NAME) --reference
+	@KEY_NAME="$(KEY_NAME)" bash launch-ec2.sh --name $(REFERENCE_AWS_NAME) --reference
 
 # Terminate the reference EC2 instance.
 destroy-reference-ec2:

clickbench/launch-ec2.sh

@@ -1,16 +1,25 @@
 #!/bin/bash
 set -euo pipefail
 
+INSTANCE_TYPE=${INSTANCE_TYPE:-c6a.4xlarge}
+VOLUME_SIZE=${VOLUME_SIZE:-500}
+
+# --- Xata account defaults ---------------------------------------------------
+# Shared org infrastructure in the Xata management account (us-east-1). These
+# are resource identifiers, not secrets, but they are account-specific:
+# override them via env when launching in a different AWS account/region, e.g.
+#   PROFILE=myprofile REGION=eu-west-1 AMI=ami-... SUBNET=subnet-... SG=sg-... ./launch-ec2.sh
 PROFILE=${PROFILE:-management}
-INSTANCE_TYPE=c6a.4xlarge
-AMI=ami-04eaa218f1349d88b
+REGION=${REGION:-us-east-1}
+AMI=${AMI:-ami-04eaa218f1349d88b}   # Ubuntu amd64 image used by the bench boxes
+SUBNET=${SUBNET:-subnet-228cc17d}
+SG=${SG:-sg-add473b4}
+# -----------------------------------------------------------------------------
+
 # Personal key pair: no generic default exists, so it must be provided.
 #   KEY_NAME=<your-ec2-key-pair> [KEY_FILE=~/.ssh/<key>.pem] ./launch-ec2.sh
 KEY_NAME=${KEY_NAME:-}
 KEY_FILE=${KEY_FILE:-~/.ssh/${KEY_NAME}.pem}
-SUBNET=subnet-228cc17d
-SG=sg-add473b4
-VOLUME_SIZE=500
 # Track whether the name was given explicitly (env or --name): teardown
 # refuses to run against the implicit default name.
 NAME_EXPLICIT=false
@@ -70,15 +79,15 @@ fi
 # multiple people run benches in this account in parallel (e.g. tsg's
 # long-lived clickbench/rtabench/jsonbench boxes). Launching requires a
 # free name; explicit teardown requires --terminate-only.
-EXISTING=$(aws ec2 describe-instances --profile "$PROFILE" \
+EXISTING=$(aws ec2 describe-instances --profile "$PROFILE" --region "$REGION" \
   --filters "Name=tag:Name,Values=$NAME" "Name=instance-state-name,Values=running,stopped,pending" \
   --query 'Reservations[*].Instances[*].InstanceId' --output text)
 
 if $TERMINATE_ONLY; then
   if [ -n "$EXISTING" ]; then
     echo "Terminating instance(s) named '$NAME': $EXISTING"
-    aws ec2 terminate-instances --profile "$PROFILE" --instance-ids $EXISTING --output text
-    aws ec2 wait instance-terminated --profile "$PROFILE" --instance-ids $EXISTING
+    aws ec2 terminate-instances --profile "$PROFILE" --region "$REGION" --instance-ids $EXISTING --output text
+    aws ec2 wait instance-terminated --profile "$PROFILE" --region "$REGION" --instance-ids $EXISTING
     echo "Terminated."
   else
     echo "No instance named '$NAME' to terminate."
@@ -97,15 +106,26 @@ fi
 # Enable serial console access (idempotent, account-level setting; only
 # needed for the launch flow's serial-console fallback)
 echo "Ensuring serial console access is enabled..."
-aws ec2 enable-serial-console-access --profile "$PROFILE" --region us-east-1 >/dev/null 2>&1 || true
+aws ec2 enable-serial-console-access --profile "$PROFILE" --region "$REGION" >/dev/null 2>&1 || true
+
+# Root password for the serial-console emergency login. The serial-console
+# *connection* is authenticated by pushing an SSH key via ec2-instance-connect
+# (see the hint at the end of this script), but the getty on ttyS0 still
+# presents a normal login prompt, which requires a local password — so password
+# auth can't be dropped from this flow entirely. Instead of a fixed password
+# checked into git, generate a random one per launch and print it at the end.
+# It only grants access through the serial console, which itself requires AWS
+# credentials; it is not stored anywhere besides the instance's /etc/shadow.
+SERIAL_PW=$(openssl rand -hex 12)
 
 # User-data script: OOM diagnostics + serial console access
 USER_DATA=$(cat <<'USERDATA'
 #!/bin/bash
 set -x
 
-# Set root password for serial console login
-echo 'root:Cb3nch!s3rial#2026' | chpasswd
+# Set root password for serial console login (substituted at launch time;
+# random per launch, printed by launch-ec2.sh)
+echo 'root:__SERIAL_PW__' | chpasswd
 
 # Enable root login on serial console
 mkdir -p /etc/systemd/system/serial-getty@ttyS0.service.d
@@ -142,10 +162,13 @@ sed -i 's/GRUB_CMDLINE_LINUX_DEFAULT=.*/GRUB_CMDLINE_LINUX_DEFAULT="console=tty0
 update-grub 2>/dev/null || true
 USERDATA
 )
+# Inject the per-launch serial-console password (heredoc is quoted, so this is
+# the only substitution that happens in the user-data).
+USER_DATA=${USER_DATA//__SERIAL_PW__/$SERIAL_PW}
 
 # Launch new instance
 echo "Launching $INSTANCE_TYPE instance..."
-INSTANCE_ID=$(aws ec2 run-instances --profile "$PROFILE" \
+INSTANCE_ID=$(aws ec2 run-instances --profile "$PROFILE" --region "$REGION" \
   --image-id "$AMI" \
   --instance-type "$INSTANCE_TYPE" \
   --key-name "$KEY_NAME" \
@@ -158,26 +181,42 @@ INSTANCE_ID=$(aws ec2 run-instances --profile "$PROFILE" \
 
 echo "Instance ID: $INSTANCE_ID"
 echo "Waiting for instance to be running..."
-aws ec2 wait instance-running --profile "$PROFILE" --instance-ids "$INSTANCE_ID"
+aws ec2 wait instance-running --profile "$PROFILE" --region "$REGION" --instance-ids "$INSTANCE_ID"
 
-IP=$(aws ec2 describe-instances --profile "$PROFILE" \
+IP=$(aws ec2 describe-instances --profile "$PROFILE" --region "$REGION" \
   --instance-ids "$INSTANCE_ID" \
   --query 'Reservations[0].Instances[0].PublicIpAddress' --output text)
 
-echo "Instance ready: $IP"
+echo "Instance running: $IP"
 echo ""
 echo "  ssh -i $KEY_FILE ubuntu@$IP"
 echo ""
 
-# Wait for user-data to complete (cloud-init)
+# Wait for user-data to complete (cloud-init). Fail loudly if we never get
+# through — a half-initialized box must not be reported as ready.
 echo "Waiting for cloud-init to finish..."
+CLOUD_INIT_OK=false
 for i in $(seq 1 30); do
   if ssh -i "$KEY_FILE" -o StrictHostKeyChecking=no -o ConnectTimeout=5 "ubuntu@$IP" "cloud-init status --wait" 2>/dev/null; then
+    CLOUD_INIT_OK=true
     break
   fi
   sleep 5
 done
 
+if ! $CLOUD_INIT_OK; then
+  echo "" >&2
+  echo "ERROR: could not confirm cloud-init completion on $IP after 30 attempts." >&2
+  echo "The instance ($INSTANCE_ID) is still running — it was NOT terminated." >&2
+  echo "Inspect it:" >&2
+  echo "  ssh -i $KEY_FILE ubuntu@$IP" >&2
+  echo "  ssh -i $KEY_FILE ubuntu@$IP 'cloud-init status --long'" >&2
+  echo "Or tear it down:" >&2
+  echo "  $0 --terminate-only --name $NAME" >&2
+  echo "Serial-console root password for this launch: $SERIAL_PW" >&2
+  exit 1
+fi
+
 echo ""
 echo "Instance ready. Next steps:"
 echo ""
@@ -193,6 +232,6 @@ else
 fi
 echo ""
 echo "Serial console (if SSH is down):"
-echo "  aws ec2-instance-connect send-serial-console-ssh-public-key --profile $PROFILE --instance-id $INSTANCE_ID --serial-port 0 --ssh-public-key file://${KEY_FILE%.pem}.pub --region us-east-1"
-echo "  ssh -i $KEY_FILE $INSTANCE_ID.port0@serial-console.ec2-instance-connect.us-east-1.aws"
-echo "  Login: root / Cb3nch!s3rial#2026"
+echo "  aws ec2-instance-connect send-serial-console-ssh-public-key --profile $PROFILE --instance-id $INSTANCE_ID --serial-port 0 --ssh-public-key file://${KEY_FILE%.pem}.pub --region $REGION"
+echo "  ssh -i $KEY_FILE $INSTANCE_ID.port0@serial-console.ec2-instance-connect.$REGION.aws"
+echo "  Login: root / $SERIAL_PW   (random, generated for this launch only — note it down if you may need the serial console)"