WunderGraph Cosmo Router

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Launch a Federated GraphQL Gateway in Minutes, Not Days

WunderGraph Cosmo Router is the open source, high performance GraphQL federation gateway built in Go. This AMI delivers it fully installed, security hardened, and operational immediately after boot, eliminating the manual setup, composition toolchain installation, and reverse proxy configuration that a do it yourself deployment requires.

Unlike managed federation services that require a SaaS control plane, cloud account, or graph token, this AMI runs standalone against a static execution config composed at build time. You get full infrastructure control with no external dependencies and no lock in to a SaaS dashboard.

## Why This Image Instead of Installing the Binary Yourself

• Hours of setup reduced to minutes: the router binary is checksum verified, installed under systemd, reverse proxied behind nginx, and serving federated queries before you finish reading the welcome notes
• Secure by default, not secure after configuration: a bare Cosmo Router install has no API gateway in front of it, while this image generates a unique per instance API key on first boot, binds the router to loopback only, and gates the query endpoint behind nginx
• Production patterns built in: systemd manages automatic restarts and clean logging, unattended security updates keep the operating system patched, and the shipped security group opens only the SSH and HTTP ports
• Composition tooling bundled: move from the demo supergraph to your own subgraphs by running the included wgc CLI to compose a new execution config and reloading the service

## Federated GraphQL Gateway

The router loads a static execution config and federates its subgraphs behind one endpoint, resolving a single client query across multiple services and joining their fields through federation entity keys. It is compatible with Apollo Federation v1 and v2 subgraphs. The image ships a small, self contained demo supergraph composed from two local Apollo Federation v2 subgraphs so the federated endpoint returns real joined data out of the box.

## Secure By Default

The federated GraphQL endpoint must never be an open, unauthenticated data gateway, so this image enforces that from first boot:

• nginx fronts the router on port 80 and gates the query endpoint with a per instance API key
• No default or baked key exists, a unique key is generated on each instance's first boot and written to a root only credentials file
• The health endpoint stays public for liveness checks while the query endpoint returns 401 without the correct key
• The router binds only to the loopback interface and is never directly reachable from the network
• The shipped security group opens only the SSH and HTTP ports

## Ready To Use

Connect over SSH and the gateway is already running. Read the welcome notes for the generated per instance API key and the reachable URL, confirm the health check, and send a federated query with your key. systemd manages the router and the demo subgraphs for automatic restarts and clean logging, and the operating system is fully patched at build time and continues to receive unattended security updates.

## cloudimg Support

24/7 technical support by email and live chat. Our engineers help with router deployment, composing your own subgraphs into the execution config with the bundled wgc CLI, configuring the API key gateway, TLS and reverse proxy setup, observability, and version upgrades.

## Use Cases

• Serving a federated GraphQL gateway that unifies many independent subgraphs behind one endpoint on infrastructure you control
• Running a self hosted Cosmo Router data plane without the SaaS control plane, cloud account, or graph token
• Giving a platform team a preconfigured, API key gated GraphQL federation gateway behind their own network controls and TLS

## Getting Started

1. Launch the AMI in your preferred AWS region

2. SSH into the instance and read the welcome notes for the per instance API key and reachable URL

3. Confirm the public health check returns 200 and send a federated query with your API key header

4. Recompose the execution config against your own subgraphs using the bundled wgc CLI and reload the router service