Alfresco Community Edition 26.2.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Alfresco Community Edition 26.2.0 on Ubuntu 24.04 as the software version, choose your Region, then choose Launch through EC2.

Choose m5.xlarge (or m5.large to evaluate), your key pair, a security group as described above, and a subnet. If you already know you will store more than a few GiB of documents, raise the root volume size under Configure storage.

Alternatively, launch with the AWS CLI. Replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.xlarge --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=alfresco}]'

Share is served under the instance's public DNS name. For a name that never changes, attach an Elastic IP or use your own DNS name (Step 9) before you give the address to your users.

Connect over SSH as the ubuntu user on Alfresco Community Edition 26.2.0 on Ubuntu 24.04:

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot generates the secrets, creates the database and the search cores, and starts Solr and the repository. On an m5.xlarge it takes about two minutes after the instance reports running. nginx starts last, so a browser cannot reach a half-configured stack.

Confirm that all four services are active:

systemctl is-active postgresql@16-main alfresco-search alfresco nginx

active active active active

Only SSH (22) and nginx (80, 443) listen on the network. Tomcat (8080), Solr (8983) and PostgreSQL (5432) are on localhost only. The two port 53 entries are Ubuntu's local DNS resolver:

sudo ss -lnt | awk 'NR>1 {print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:5432 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80 [::ffff:127.0.0.1]:8080 [::ffff:127.0.0.1]:8983

nginx refuses the internal endpoints and the RSS dashlet:

H=$(cat /etc/sac/alfresco-hostname) for p in /solr/ /alfresco/service/api/solr/aclchangesets /alfresco/s/prometheus \
  /share/service/components/dashlets/async-rssfeed; do printf '%-50s HTTP %s\n' "$p" "$(curl -s -o /dev/null -w '%{http_code}' \
  --cacert /etc/nginx/ssl/alfresco.crt --resolve "$H:443:127.0.0.1" "https://$H$p")" done

/solr/ HTTP 403 /alfresco/service/api/solr/aclchangesets HTTP 403 /alfresco/s/prometheus HTTP 403 /share/service/components/dashlets/async-rssfeed HTTP 403

If nginx is not active, first boot has not finished, or it failed and Alfresco stays closed. Check systemctl status alfresco-firstboot and journalctl -u alfresco-firstboot.

First boot writes the address, the administrator name and password, and the certificate fingerprint to /root/alfresco-credentials.txt, readable by root only:

sudo stat -c '%a %U:%G %n' /root/alfresco-credentials.txt
sudo grep -E '^(Share UI|Administrator|ALFRESCO_URL|ALFRESCO_API_URL|ALFRESCO_ADMIN_USER)' /root/alfresco-credentials.txt

600 root:root /root/alfresco-credentials.txt Share UI : https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/share/ Administrator : admin ALFRESCO_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/share/ ALFRESCO_API_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/alfresco/api/-default-/public/ ALFRESCO_ADMIN_USER=admin

The password is on the Password line, and repeated as ALFRESCO_ADMIN_PASSWORD= for scripts. It is unique to your instance and is not printed anywhere else, not even in the system log. Show it when you need it:

sudo grep '^ALFRESCO_ADMIN_PASSWORD=' /root/alfresco-credentials.txt | cut -d= -f2-

The upstream admin / admin account was never created. Both a request with it and a request with no credentials are refused:

H=$(cat /etc/sac/alfresco-hostname) API="https://$H/alfresco/api/-default-/public/alfresco/versions/1" curl -s -o /dev/null -w 'admin/admin -> HTTP %{http_code}\n' -u admin:admin \
  --cacert /etc/nginx/ssl/alfresco.crt --resolve "$H:443:127.0.0.1" "$API/people/-me-" curl -s -o /dev/null -w 'no credentials -> HTTP %{http_code}\n' \
  --cacert /etc/nginx/ssl/alfresco.crt --resolve "$H:443:127.0.0.1" "$API/people/-me-"

admin/admin -> HTTP 401 no credentials -> HTTP 401

Run the built-in self test. It signs in with your password over HTTPS, uploads a document, finds it by a word that appears only inside it, downloads it, compares the checksum and deletes it again:

sudo alfresco-roundtrip.sh

ROUNDTRIP_PASS node=c5473c63-a9eb-4f2b-873c-63a9ebaf2be4 sha256=f549f80994d54a4dfc6d52464776f06f1a892062d3ee0036823afc5213b24a98

Open https://<your-host>/share/, the Share UI address from Step 4. The bare https://<your-host>/ redirects there. Use the host name rather than the IP address, because Share checks that sign-in comes from the configured name.

The certificate is self-signed, so your browser asks you to confirm it the first time. Before you accept it, compare the SHA-256 fingerprint your browser shows with the one on the instance, or install your own certificate (Step 9):

openssl x509 -in /etc/nginx/ssl/alfresco.crt -noout -subject -fingerprint -sha256

subject=CN = ec2-<public-ip-dashed>.compute-1.amazonaws.com, O = sac sha256 Fingerprint=<certificate fingerprint>

Sign in as admin with the password from Step 4:

The dashboard collects your sites, the activity in them, your tasks and the documents you worked on recently. Alfresco's sample site and its sample users are not installed on this image, so your instance starts with no sites.

To sign out, open the Administrator menu at the top right and choose Logout. In Share 26.2, signing out is a POST request made by that menu. A plain link to the sign-out address is answered with HTTP 405 and leaves you signed in.

Choose Sites in the toolbar to create a collaboration site, for example Sales. Each site has a document library where you upload, organise, version and share files.

Use the search box at the top right to search the content of documents, not only their names. A search for a word that appears only inside the text of quarterly-report.txt returns that file and shows the matching sentence with the word highlighted. The facets on the left narrow results by creator, file type, date and size.

Open a document to see its details, versions and actions: edit properties, upload a new version, permissions, workflows, move, copy and delete. For PDF files, Share's built-in viewer (pdf.js 5.4.54) draws the pages in your browser.

Full-text search works, but thumbnails and previews need the Alfresco Transform Service, which is not included. Office documents, images and other formats show a generic icon and a Download button instead of a preview, and the document library shows no thumbnails.

The PDF viewer runs no JavaScript embedded in a PDF. Share wires no scripting into it, and the image ships none of pdf.js's scripting files, so a PDF that tries to open a dialog or run code when opened does nothing. SecureAnyCloud checks this in Chrome on every build.

Applications reach the repository at https://<your-host>/alfresco/api/-default-/public/, the ALFRESCO_API_URL line of the credentials file.

The commands below run on the instance. They keep the password out of the command line and out of your shell history by writing it to a curl configuration file in memory, readable only by you. They pin the instance's certificate with --cacert. They upload a document, find it by a word that appears only inside it, download it, compare the checksums and delete it:

H=$(cat /etc/sac/alfresco-hostname)
CFG=$(mktemp -p /dev/shm alfresco-curl.XXXXXX)
sudo awk -F= '$1=="ALFRESCO_ADMIN_PASSWORD" {print "user = \"admin:" substr($0, index($0, "=") + 1) "\""}' \
  /root/alfresco-credentials.txt > "$CFG" alf() { curl -s --cacert /etc/nginx/ssl/alfresco.crt --resolve "$H:443:127.0.0.1" -K "$CFG" "$@"; } API="https://$H/alfresco/api/-default-/public/alfresco/versions/1" SEARCH="https://$H/alfresco/api/-default-/public/search/versions/1/search" WORD="budget$(od -An -N4 -tx1 /dev/urandom | tr -d ' \n')" printf 'Quarterly report\n\nThe %s division grew its revenue in Q3.\n' "$WORD" > /tmp/report.txt
NODE=$(alf -X POST "$API/nodes/-shared-/children" -F filedata=@/tmp/report.txt \
  -F name=report.txt -F nodeType=cm:content -F autoRename=true \
  | python3 -c 'import sys, json; print(json.load(sys.stdin)["entry"]["id"])')
echo "uploaded to Shared: $NODE" HITS=0 for i in $(seq 1 36); do
HITS=$(alf -X POST "$SEARCH" -H 'Content-Type: application/json' \
  -d "{\"query\":{\"language\":\"afts\",\"query\":\"TEXT:$WORD\"}}" \
  | python3 -c 'import sys, json; print(json.load(sys.stdin)["list"]["pagination"]["count"])') || HITS=0 [ "${HITS:-0}" -gt 0 ] && { echo "found by full-text search after about $((i * 5)) s"; break; } sleep 5 done alf "$API/nodes/$NODE/content" -o /tmp/report-downloaded.txt
A=$(sha256sum < /tmp/report.txt);
B=$(sha256sum < /tmp/report-downloaded.txt) [ "$A" = "$B" ] && echo "downloaded copy is byte identical" alf -o /dev/null -w 'deleted (not kept in the trashcan): HTTP %{http_code}\n' -X DELETE "$API/nodes/$NODE?permanent=true" rm -f "$CFG" /tmp/report.txt /tmp/report-downloaded.txt [ "${HITS:-0}" -gt 0 ] && [ "$A" = "$B" ]

uploaded to Shared: bfb03720-f4ac-4592-b037-20f4acb5924f found by full-text search after about 40 s downloaded copy is byte identical deleted (not kept in the trashcan): HTTP 204

Search is eventually consistent. Solr picks up new documents on a polling cycle and text extraction adds a step, so a new document is usually searchable within a minute, or longer just after a restart.

CMIS 1.1 is served at https://<your-host>/alfresco/api/-default-/public/cmis/versions/1.1/browser (browser binding) and .../versions/1.1/atom (AtomPub). Point a CMIS client, such as Apache Chemistry Workbench or a CMIS library, at either address with an Alfresco user name and password. To check CMIS from the instance:

H=$(cat /etc/sac/alfresco-hostname)
CFG=$(mktemp -p /dev/shm alfresco-curl.XXXXXX)
sudo awk -F= '$1=="ALFRESCO_ADMIN_PASSWORD" {print "user = \"admin:" substr($0, index($0, "=") + 1) "\""}' \
  /root/alfresco-credentials.txt > "$CFG" curl -s --cacert /etc/nginx/ssl/alfresco.crt --resolve "$H:443:127.0.0.1" -K "$CFG" \
  "https://$H/alfresco/api/-default-/public/cmis/versions/1.1/browser" \
  | python3 -c 'import sys, json; r = json.load(sys.stdin)["-default-"]; print(r["productName"], r["productVersion"], "| CMIS", r["cmisVersionSupported"], "| root folder", r["rootFolderUrl"].split("/public/")[1])' rm -f "$CFG"

Alfresco Community 26.2.0 (rec48a987-b1817) | CMIS 1.1 | root folder cmis/versions/1.1/browser/root

From another machine, use your own Alfresco user (Step 8) rather than the administrator, and connect over HTTPS to the instance's name.

Change the administrator password in Share. Open the Administrator menu, choose My Profile, then choose Change Password. Enter the password from Step 4 as the old password.

The credentials file still holds the first-boot password afterwards, and the built-in self test (alfresco-roundtrip.sh) reads it from there. Once you have stored the new password in your own password manager, remove the old one from the file:

sudo sed -i -e '/^Password /d' -e '/^ALFRESCO_ADMIN_PASSWORD=/d' /root/alfresco-credentials.txt

Create a named account for each person under Admin Tools, Users. Grant access per site (site members and roles) or per folder (Manage Permissions) rather than sharing the administrator account. Admin Tools also manages groups, categories, tags and the search facets.

Sample users. Upstream Alfresco loads a sample site ("Sample: Web Site Design Project") with two sample users, abeecher and mjackson, whose sample password is published with every installation. This image never creates them. The sample site loader is switched off (sample.site.disabled=true in alfresco-global.properties) before the repository first starts, and first boot checks that neither user nor the site exists.

Leave that setting as it is. If you ever import Alfresco's sample content yourself, delete both users or give them new passwords straight away.

Point a DNS record at the instance, then tell Alfresco its name. An Elastic IP keeps the address across stop and start.

The command below creates a new self-signed certificate for that name and pins nginx to it. It updates the host names Alfresco and Share use for links and for their cross-site checks, and updates the address lines of the credentials file. It then restarts Alfresco, which takes about two minutes:

sudo alfresco-set-hostname alfresco.example.com

The command prints the new certificate's fingerprint. The TLS certificate line of the credentials file keeps the first-boot fingerprint, so after a change always read the fingerprint from the certificate itself with the openssl x509 command in Step 5. The name is kept across reboots and stop and start.

Without your own name, the instance keeps serving the public DNS name it had at first boot. If a stop and start gives it a new public address (no Elastic IP), run sudo alfresco-set-hostname <new-public-dns-name> so that Share accepts sign-in on the new name.

To use a certificate from a public authority instead, set the name first. Then replace /etc/nginx/ssl/alfresco.crt (the full chain) and /etc/nginx/ssl/alfresco.key (mode 0600, owned by root) and reload nginx:

sudo install -m 0644 -o root -g root fullchain.pem /etc/nginx/ssl/alfresco.crt
sudo install -m 0600 -o root -g root privkey.pem /etc/nginx/ssl/alfresco.key
sudo nginx -t && sudo systemctl reload nginx

The commands in this guide (and alfresco-roundtrip.sh) pin the self-signed certificate with --cacert. With a certificate from a public authority, drop that option. Running alfresco-set-hostname again later replaces your certificate with a new self-signed pair.

• The RSS feed dashlet is disabled. nginx answers every address containing rssfeed with HTTP 403, because Share's feed web script fetches any feed-url from the server without authentication. Anyone who could reach Share could make the instance fetch addresses inside your network. Alfresco's metadata-service block still applies, but other addresses in your VPC would be reachable. If you need the dashlet and accept that, restrict the security group to trusted networks first. Then delete the line if ($uri ~* "rssfeed") { return 403; } from /etc/nginx/sites-available/sac-alfresco, and run sudo nginx -t && sudo systemctl reload nginx.
• Search and metrics endpoints. /solr, the repository's api/solr tracking API and /prometheus are refused with 403 by nginx. Solr itself listens on localhost only and authenticates the repository with the per-instance shared secret.
• No sample site or sample users. Upstream's "Sample: Web Site Design Project" site and its sample users abeecher and mjackson are never created (Step 8).
• Previews and thumbnails are off because the Transform Service is not included (Step 6). Text is extracted for full-text search inside the repository itself.
• ActiveMQ, FTP, CIFS, NFS, IMAP, inbound e-mail, guest sign-in and the metrics endpoint are off. Outbound e-mail is not configured; to send notifications, set mail.host, mail.port, mail.username, mail.password and mail.from.default in /opt/alfresco/tomcat/shared/classes/alfresco-global.properties and restart alfresco.
• Host name. Alfresco's own links and Share's cross-site checks use the configured name (Step 9), never the Host header a client sends.

Every service is enabled and starts in order after a reboot or a stop and start:

systemctl is-enabled postgresql alfresco-search alfresco nginx unattended-upgrades

enabled enabled enabled enabled enabled

Restart the repository and Share with sudo systemctl restart alfresco. Share answers again after about a minute. Restart Solr with sudo systemctl restart alfresco-search.

The readiness probe answers 200 when the repository is up:

curl -s -o /dev/null -w 'repository ready probe: HTTP %{http_code}\n' \
  http://127.0.0.1:8080/alfresco/api/-default-/public/alfresco/versions/1/probes/-ready-

repository ready probe: HTTP 200

When Tomcat stops Share, it logs a block of SEVERE ... checkThreadLocalMapForLeaks lines. These are normal for Share on Tomcat and do not mean the restart failed.

Data and configuration live in these locations:

• Content store (the files): /var/lib/alfresco/alf_data
• Repository database: PostgreSQL 16 database alfresco, cluster 16/main, /var/lib/postgresql/16/main
• Metadata encryption keystore: /etc/alfresco/keystore
• Search index: /var/lib/alfresco/solr-data (Solr home /var/lib/alfresco/solrhome)
• Repository configuration: /opt/alfresco/tomcat/shared/classes/alfresco-global.properties
• Java heap sizes: /etc/alfresco/alfresco.env, /etc/alfresco/alfresco-search.env
• Logs: /var/log/alfresco/tomcat/alfresco.log, share.log, catalina.*.log; /var/log/alfresco/solr; journalctl -u alfresco
• nginx site: /etc/nginx/sites-available/sac-alfresco
• Build information: /usr/share/doc/alfresco-community-edition/ (versions, checksums, licences)

Backups. The database and the content store are a matched pair. A backup of one without the other does not restore. Back up the keystore with them, because encrypted properties in the database cannot be read without it. The search index can be rebuilt from the repository, so backing it up is optional.

The simplest complete backup is an EBS snapshot (or AWS Backup) of the root volume taken with Alfresco stopped:

sudo systemctl stop alfresco alfresco-search
# take the EBS snapshot or AWS Backup job here
sudo systemctl start alfresco-search alfresco

For a file-level backup, stop Alfresco, dump the database and archive the content store and keystore together, then start it again:

sudo install -d -m 0700 /var/backups/alfresco
sudo systemctl stop alfresco alfresco-search
sudo -u postgres pg_dump -Fc alfresco | sudo tee /var/backups/alfresco/db.dump > /dev/null
sudo tar -C / -czf /var/backups/alfresco/files.tar.gz var/lib/alfresco/alf_data etc/alfresco \
  opt/alfresco/tomcat/shared/classes/alfresco-global.properties
sudo systemctl start alfresco-search alfresco

To restore onto a fresh instance of this AMI, stop Alfresco and restore the database with sudo -u postgres pg_restore --clean --if-exists -d alfresco db.dump. Extract the archive over /, then start Alfresco again. The search index rebuilds itself from the repository.

Copy both files off the instance, for example to Amazon S3. They contain your documents and the instance's secrets, so keep them private.

To grow the storage, increase the root volume in the EC2 console (or with aws ec2 modify-volume). Ubuntu grows the file system on the next boot, or straight away with sudo growpart /dev/nvme0n1 1 && sudo resize2fs /dev/nvme0n1p1.