Standing up Temporal on a single EC2 box: workers authenticated over mutual TLS with self-renewing certs, an SSO-protected dashboard and exactly one inbound port open.