AliasVault 0.31.1

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened Authentik, Vaultwarden & Identity, Secrets and PKI AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for the full launch wizard. In Version, choose AliasVault 0.31.1 on Ubuntu 24.04, then choose your Region.
• Pick an instance type and your key pair. m5.large is recommended. The software charge is $0.04 per vCPU per hour.
• Configure the security group. The listing's default group opens SSH (22), HTTPS (443) and SMTP (25). Restrict SSH to your own IP address. Keep 443 open to wherever you and your apps connect from. Keep 25 open to the internet only if you use email aliases, because other mail servers deliver to it. Otherwise, remove it.
• Choose your VPC and subnet, leave the metadata defaults (the image already requires IMDSv2), then choose Launch.

Port Why it is open

22 SSH for you, as ubuntu

443 The web vault, the API used by the browser extensions and mobile apps, and the admin panel

25 Incoming mail for your private email aliases (receive only; AliasVault never relays mail)

Option B: AWS CLI

Run these commands on your own workstation. They create a security group that allows SSH from your management address, HTTPS from your team's network and SMTP from anywhere, then launch the instance. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the VPC, subnet, key pair and CIDR ranges with your own:

SG=$(aws ec2 create-security-group --group-name aliasvault \
  --description "AliasVault password manager" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 443 --cidr 203.0.113.0/24
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 25 --cidr 0.0.0.0/0
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=aliasvault}]'

You do not need --metadata-options, because the AMI already requires IMDSv2. If you use email aliases or your own DNS name, associate an Elastic IP so the address survives a stop and start.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot finishes within a minute or two of launch. It does the following, in order:

• Sets the hostname that AliasVault is served as. This is the instance's public DNS name when it has one.
• Creates the TLS certificate for that hostname and generates the secrets.
• Creates an empty database and starts the six containers.
• Confirms that the admin login works, and writes /root/aliasvault-credentials.txt (mode 0600, root).
• Opens nginx.

The following output shows the entries in the credentials file. The password is not shown:

sudo grep -E '^ALIASVAULT_(URL|ADMIN_URL|ADMIN_USERNAME)=' /root/aliasvault-credentials.txt
sudo grep -oE '^[A-Z_]+=' /root/aliasvault-credentials.txt
sudo stat -c '%a %U:%G' /root/aliasvault-credentials.txt

ALIASVAULT_URL=https://ec2-44-207-6-221.compute-1.amazonaws.com/ ALIASVAULT_ADMIN_URL=https://ec2-44-207-6-221.compute-1.amazonaws.com/admin/ ALIASVAULT_ADMIN_USERNAME=admin ALIASVAULT_URL= ALIASVAULT_ADMIN_URL= ALIASVAULT_ADMIN_USERNAME= ALIASVAULT_ADMIN_PASSWORD= 600 root:root

Value What it is for

ALIASVAULT_URL The web vault of this instance

ALIASVAULT_ADMIN_URL The admin panel (users, invite links, email domains, logs)

ALIASVAULT_ADMIN_USERNAME Admin username (always admin)

ALIASVAULT_ADMIN_PASSWORD Admin password, generated on this instance

To read the password, run sudo cat /root/aliasvault-credentials.txt in your own session. Store the password in a password manager. The admin password opens the admin panel only. It is not a vault account.

Confirm that Docker, the metadata firewall rule, the first-boot units, AliasVault and nginx are active. Only sshd, nginx (443) and the mail server (25) listen beyond loopback. The web vault, API and admin panel listen on 127.0.0.1:3000 to 3002, and PostgreSQL's port is open only inside the private container network.

systemctl is-active docker.service sac-docker-imds-deny.service aliasvault-firstboot.service aliasvault.service aliasvault-postboot.service nginx.service
sudo docker ps --format '{{.Names}} {{.Ports}}' | sort
sudo ss -Htlnp | awk '{print $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort -u curl -sk https://127.0.0.1/api/; echo

active active active active active active aliasvault-admin 127.0.0.1:3002->3002/tcp aliasvault-api 127.0.0.1:3001->3001/tcp aliasvault-client 80/tcp, 127.0.0.1:3000->3000/tcp aliasvault-postgres 5432/tcp aliasvault-smtp 0.0.0.0:25->25/tcp, [::]:25->25/tcp aliasvault-task-runner 0.0.0.0:22 users:(("sshd"),("systemd")) 0.0.0.0:25 users:(("docker-proxy")) 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) 127.0.0.1:3000 users:(("docker-proxy")) 127.0.0.1:3001 users:(("docker-proxy")) 127.0.0.1:3002 users:(("docker-proxy")) 127.0.0.53%lo:53 users:(("systemd-resolve")) 127.0.0.54:53 users:(("systemd-resolve")) [::]:22 users:(("sshd"),("systemd")) [::]:25 users:(("docker-proxy")) [::]:443 users:(("nginx"),("nginx"),("nginx")) OK

The /api/ endpoint answers OK only when the API can reach its database, so it works well as a load balancer health check.

These commands check the following behavior:

• A signed-out visit to the admin panel is sent to its sign-in page.
• A cross-origin POST is refused.
• An unknown Host header gets no answer.
• Nothing listens on plain HTTP.
• The API refuses to register an account without an invite.

The last command runs the image's own end-to-end check. It creates a registration invite in the database, reads it back through the API and deletes it. It also confirms that default and wrong admin passwords get no session, while this instance's password does:

H=$(sudo sed -n 's/^set \$app_host "\(.*\)";$/\1/p' /etc/nginx/aliasvault-host.conf) R=(--connect-to "$H:443:127.0.0.1:443") curl -sk "${R[@]}" -o /dev/null -w 'admin panel, signed out -> %{http_code} %{redirect_url}\n' "https://$H/admin/" curl -sk "${R[@]}" -o /dev/null -w 'cross-origin POST to the admin login -> %{http_code}\n' -X POST -H 'Origin: https://evil.example' --data 'x=1' "https://$H/admin/user/login" curl -sk -o /dev/null -w 'unknown Host -> %{http_code}\n' -H 'Host: evil.example' https://127.0.0.1/ || true curl -s -o /dev/null -w 'plain http on port 80 -> %{http_code}\n' http://127.0.0.1/ || true curl -sk "${R[@]}" -H 'Content-Type: application/json' -d '{"username":"newuser"}' "https://$H/api/v2/Auth/validate-username" | jq -c '{statusCode, code}'
sudo /usr/local/sbin/aliasvault-roundtrip.sh

admin panel, signed out -> 302 https://ec2-44-207-6-221.compute-1.amazonaws.com/admin/user/login?ReturnUrl=%2Fadmin%2F cross-origin POST to the admin login -> 403 unknown Host -> 000 plain http on port 80 -> 000 {"statusCode":400,"code":"PUBLIC_REGISTRATION_DISABLED"} OK round-trip https://ec2-44-207-6-221.compute-1.amazonaws.com/: web vault + API OK; unknown Host refused; registration closed; invite create->readback->delete OK; anonymous admin -> login; default/weak/wrong admin passwords refused; per-VM admin session Secure HttpOnly SameSite=Lax opens the panel

Browse to ALIASVAULT_ADMIN_URL (https://<public-dns-name>/admin/). The certificate is self-signed, so your browser warns once. Accept it for this host, or install your own certificate (Step 8). A default or guessed password is refused:

Sign in with admin and ALIASVAULT_ADMIN_PASSWORD. The dashboard shows recent users, the status of the mail server and the task runner, registrations and email statistics.

Turn on two-factor authentication for the admin account in Account Settings, as the banner suggests:

Registration is closed, so every vault account starts with an invite. In the admin panel, choose Users, then + Invite. Set how many accounts the link may create and for how many days it is valid, then choose Create invite. The link uses the configured hostname:

Open the link, or send it to the person you are inviting. The web vault asks for a username, then a master password. The master password encrypts the vault in your browser and is never sent to the server. Nobody, including the admin, can reset it for you, so keep it safe.

After you select Create Account, the vault opens. It is empty and ready for your first login or an import from KeePass, Bitwarden, Chrome or Firefox:

The new account is now in the database, and the invite has been used up:

sudo docker exec aliasvault-postgres psql -U aliasvault -d aliasvault -tAc 'SELECT "UserName" FROM "AliasVaultUsers"'
sudo docker exec aliasvault-postgres psql -U aliasvault -d aliasvault -tAc 'SELECT "UseCount", "MaxUses" FROM "RegistrationInvites" ORDER BY "CreatedAt" DESC LIMIT 1'

demouser 1|1

To use the vault from the browser extensions or the iOS and Android apps, choose Self-hosted in the app and enter ALIASVAULT_URL. The apps check the certificate, so install a certificate that your devices trust first (Step 8).

AliasVault's mail server listens on port 25 and accepts mail only for the domains you list. With no domain set, it accepts nothing. It offers STARTTLS with this instance's certificate and announces the configured hostname. Check the mail server:

H=$(sudo sed -n 's/^set \$app_host "\(.*\)";$/\1/p' /etc/nginx/aliasvault-host.conf) timeout 10 bash -c 'exec 3<>/dev/tcp/127.0.0.1/25; head -n1 <&3; printf "QUIT\r\n" >&3' openssl s_client -starttls smtp -connect 127.0.0.1:25 -servername "$H" </dev/null 2>/dev/null | openssl x509 -noout -subject sudo grep -E '^(PRIVATE_EMAIL_DOMAINS|SMTP_ADVERTISED_HOSTNAME|SMTP_TLS_ENABLED|PUBLIC_REGISTRATION_ENABLED)=' /opt/aliasvault/.env

220 ec2-44-207-6-221.compute-1.amazonaws.com v11.1.0.0 ESMTP ready subject=CN = ec2-44-207-6-221.compute-1.amazonaws.com, O = sac PRIVATE_EMAIL_DOMAINS= SMTP_ADVERTISED_HOSTNAME=ec2-44-207-6-221.compute-1.amazonaws.com SMTP_TLS_ENABLED=true PUBLIC_REGISTRATION_ENABLED=false

To receive mail for alias.example.com:

• Give the instance an Elastic IP and a DNS name, for example mail.example.com, and set the name with aliasvault-set-hostname (Step 8).
• Create an MX record for alias.example.com that points at mail.example.com.
• Add the domain to /opt/aliasvault/.env and restart AliasVault:

sudo sed -i 's/^PRIVATE_EMAIL_DOMAINS=.*/PRIVATE_EMAIL_DOMAINS=alias.example.com/' /opt/aliasvault/.env
sudo systemctl restart aliasvault

New aliases can then use @alias.example.com. Mail sent to them appears under Emails in the vault, stored encrypted with the receiving user's key.

AWS accepts inbound mail on port 25 without any request. AliasVault never sends mail, so the outbound port 25 limit does not affect it.

Point a DNS record at the instance. An Elastic IP keeps the address stable. Then tell AliasVault the name.

The helper re-issues the self-signed certificate for the name, for both HTTPS and STARTTLS. It updates nginx's accepted names and the admin panel's cross-origin guard, and it sets the mail server's name. It records the name in /etc/sac/aliasvault-hostname, which persists across reboots, and updates the credentials file:

sudo aliasvault-set-hostname vault.example.com

aliasvault-set-hostname: AliasVault is served at https://vault.example.com/

Until you set a name, the instance follows its own public DNS name. If the instance comes back from a stop and start with a new address, boot updates the certificate and names.

The mobile apps and browser extensions need a certificate they trust. To use a certificate from your own CA or from Let's Encrypt, follow these steps:

• Set the name with aliasvault-set-hostname first, so the automatic refresh leaves your certificate alone.
• Replace /etc/ssl/aliasvault/aliasvault.crt and /etc/ssl/aliasvault/aliasvault.key. Keep the key at mode 0600, owned by root.
• For STARTTLS, put the certificate and key together in /opt/aliasvault/certificates/smtp/aliasvault.pem (mode 0600).
• Run sudo systemctl reload nginx and sudo systemctl restart aliasvault.

These commands confirm the following:

• First boot made the certificate for this instance.
• Every container's traffic to the instance metadata service is dropped. nginx, Docker and AliasVault's own unit are denied access as well.
• The containers drop their capabilities.
• The secret files are readable only by root. The database password is also readable by the PostgreSQL user (70).

The last line sends a request to the metadata service from inside the API container:

H=$(sudo sed -n 's/^set \$app_host "\(.*\)";$/\1/p' /etc/nginx/aliasvault-host.conf)
openssl s_client -connect 127.0.0.1:443 -servername "$H" </dev/null 2>/dev/null | openssl x509 -noout -subject -enddate sudo iptables -S DOCKER-USER | grep DROP systemctl show -p IPAddressDeny --value nginx.service docker.service aliasvault.service
sudo docker inspect --format '{{.Name}} user={{.Config.User}} cap_drop={{.HostConfig.CapDrop}} cap_add={{.HostConfig.CapAdd}}' aliasvault-postgres aliasvault-client aliasvault-api aliasvault-admin aliasvault-smtp aliasvault-task-runner
sudo ls -ln /opt/aliasvault/secrets/ out=$(sudo docker exec aliasvault-api wget -q -T 5 -O - http://169.254.169.254/latest/meta-data/ 2>&1); echo "$out"; [[ "$out" == *"timed out"* ]]

subject=CN = ec2-44-207-6-221.compute-1.amazonaws.com, O = sac notAfter=Jan 22 08:53:39 2029 GMT -A DOCKER-USER -d 168.63.129.16/32 -j DROP -A DOCKER-USER -d 169.254.169.254/32 -j DROP 169.254.169.254/32 168.63.129.16/32 169.254.169.254/32 168.63.129.16/32 169.254.169.254/32 168.63.129.16/32 /aliasvault-postgres user=70:70 cap_drop=[ALL] cap_add=[] /aliasvault-client user= cap_drop=[ALL] cap_add=[CAP_CHOWN CAP_SETGID CAP_SETUID] /aliasvault-api user= cap_drop=[ALL] cap_add=[] /aliasvault-admin user= cap_drop=[ALL] cap_add=[] /aliasvault-smtp user= cap_drop=[ALL] cap_add=[] /aliasvault-task-runner user= cap_drop=[ALL] cap_add=[] total 20 -rw------- 1 0 0 64 Oct 20 08:53 abuse_metrics_salt -rw------- 1 0 0 105 Oct 20 08:53 admin_password_hash -rw------- 1 0 0 41 Oct 20 08:53 data_protection_cert_pass -rw------- 1 0 0 45 Oct 20 08:53 jwt_key -rw-r----- 1 0 70 33 Oct 20 08:53 postgres_password wget: download timed out

To allow the admin panel only from your own networks, edit /etc/nginx/aliasvault-admin-allow.conf, which ships with allow all;, and reload nginx. The admin password is still required:

allow 203.0.113.0/24; deny all;

sudo nginx -t && sudo systemctl reload nginx

• Open registration (for a public service). Set PUBLIC_REGISTRATION_ENABLED=true in /opt/aliasvault/.env and run sudo systemctl restart aliasvault. Anyone who can reach port 443 can then create an account. AliasVault limits registrations per address per day.
• New admin password. Run sudo aliasvault-reset-admin-password. It generates a password, installs its hash, and restarts the admin panel, which also clears admin two-factor authentication and any lockout. It then confirms the new login and writes the password to /root/aliasvault-credentials.txt.
• Settings. Settings such as the support email shown to users (SUPPORT_EMAIL) and the upload limit (MAX_UPLOAD_SIZE_MB) are in /opt/aliasvault/.env. That file holds settings only and must stay mode 0600. AliasVault refuses to start if a secret is placed in it. Server settings such as registration limits and log retention are in the admin panel under Server settings.