feat: migrate EC2 userdata + RegionMap from Amazon Linux 2 to AL2023

[alexzhangs]

Why

Amazon Linux 2 reaches end of support on 2026-06-30. Existing stacks keep running (security-update cliff, not an outage cliff), but new deployments should land on AL2023.

What

• RegionMap — regenerated for all 17 regions with the latest AL2023 kernel-default AMIs (al2023-ami-2023.12.20260608.0-kernel-6.1), x86_64 + arm64 in every region. Generated with the AL2023-updated cfn/vpn/ami logic (feat(cfn/vpn/ami): fetch AL2023 AMIs instead of Amazon Linux 2 xsh-lib/aws#14); same key order/indentation, so the x-file-inject anchors contract is intact.
• userdata:
  • yum install -y docker from the AL2023 core repos (amazon-linux-extras is AL2-only and gone).
  • IMDSv2 token-based metadata curls — AL2023 AMIs default to IMDSv2-required, so the previous bare curls would return 401 and silently empty public_ip/private_ip.
  • yum install -y aws-cfn-bootstrap — update was a silent no-op when the helper scripts aren't preinstalled, leaving the cfn-signal EXIT trap broken.
  • EnableL2TP: replaced the host install of openswan/xl2tpd from EPEL (not available on AL2023, also missing from SPAL) with the containerized server alexzhangs/xl2tpd-libreswan (libreswan + xl2tpd + bundled chap-manager, env-configured) — the new standalone image repo that supersedes aws-ec2-xl2tpd, mirroring the aws-ec2-shadowsocks-libev → shadowsocks-libev-v2ray relationship. ⚠️ Depends on the xl2tpd-libreswan image being published to DockerHub first (repo needs DOCKERHUB_USERNAME var + DOCKERHUB_TOKEN secret, then a release to trigger ci-docker).
• README — AL2023 is the recommended AMI; documented that AL2/AL2018 support ends with the pre-AL2023 revisions.

Not included / follow-ups

• A live stack deploy test on AL2023 (vpn-2026-3 sandbox is occupied until 2026-06-18; existing nodes were just rebuilt on the 2026-05-26 AL2 AMI, so no urgency).
• Heads-up: security: scope SNS topic policies + least-privilege the SSN subscriber Lambda #17/security: parameterize hub admin SG (22/80/443) via AdminAllowedCidr #18/security: wire VpcPeerRequesterAccountIds through to the peer-acceptor stack #19 also touch stack.json; whichever merges last may need a trivial rebase.

🤖 Generated with Claude Code