Apache Jena Fuseki

Confirm the services are active and the unauthenticated health and ping endpoints respond:

sudo systemctl is-active fuseki.service nginx.service curl -s -o /dev/null -w 'health: HTTP %{http_code}\n' http://127.0.0.1/health printf 'ping: '; curl -s 'http://127.0.0.1/$/ping'; echo

fuseki.service and nginx.service report active, /health returns HTTP 200 (the nginx-served liveness check), and /$/ping returns a timestamp (Fuseki's own anonymous liveness endpoint).

The admin password is unique to this VM and is written to a root-only file at first boot:

sudo cat /root/fuseki-credentials.txt

This prints FUSEKI_ADMIN_USER (admin), FUSEKI_ADMIN_PASSWORD (the per-VM password), and the FUSEKI_URL. Keep this password safe, because it unlocks the admin UI and dataset management.

The server-management endpoints under /$/ are protected by Apache Shiro. Read the password into a shell variable first, then confirm that authentication is enforced. Run these commands from your SSH session. If you copy a single line, replace <FUSEKI_ADMIN_PASSWORD> with the value from Step 5:

• Without auth or with a wrong password, the datasets endpoint is rejected: curl -s -o /dev/null -w '%{http_code}\n' -u admin:wrong 'http://127.0.0.1/$/datasets' returns 401.

• With the per-VM password it returns the datasets JSON: curl -s -u admin:<FUSEKI_ADMIN_PASSWORD> 'http://127.0.0.1/$/datasets' returns 200 and lists the TDB2-backed /ds dataset.

Confirm the Fuseki version, that the /ds TDB2 dataset lives on the dedicated Azure data disk, and run an anonymous SPARQL SELECT that counts the triples in /ds:

df -h /var/lib/fuseki | awk 'NR==1 || /fuseki/'
sudo ls -1 /var/lib/fuseki/databases/ds/ | head curl -s -G 'http://127.0.0.1/ds/query' \
  --data-urlencode 'query=SELECT (COUNT(*) AS ?n) WHERE { ?s ?p ?o }' \
  -H 'Accept: application/sparql-results+json'

The data disk is mounted at /var/lib/fuseki, the TDB2 database files (Data-0001, tdb.lock) back the /ds dataset, and the SPARQL query returns the current triple count.

Open http://<vm-ip>/ in a browser. The Fuseki dashboard lists your datasets. The bundled /ds dataset is shown with query, add data, edit, and info actions. When prompted, sign in as admin with the per-VM password from Step 5.

Click query on the /ds dataset to open the SPARQL query editor (YASGUI). Paste a SELECT and run it with the play button. The example below lists every resource that has an rdfs:label:

PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#> SELECT ?s ?label WHERE { ?s rdfs:label ?label } ORDER BY ?label

The results table renders below the editor with the matching rows and the query timing.

Click add data on the /ds dataset to open the upload page. Choose one or more RDF files (Turtle, RDF/XML, TriG, N-Triples, JSON-LD), optionally name a target graph, and click upload all to load them into the dataset. You can also load data over HTTP with the SPARQL Graph Store Protocol at http://<vm-ip>/ds/data.

Click info on the /ds dataset to see the available services (the SPARQL Query, Update, and Graph Store Protocol endpoints), per-endpoint request statistics, and the dataset size (use count triples in all graphs to tally the graphs).

You can insert data programmatically with SPARQL Update against http://<vm-ip>/ds/update. The update endpoint is part of the dataset service. Send an INSERT DATA request with Content-Type: application/sparql-update, then read it back with a SELECT against http://<vm-ip>/ds/query. For example, posting INSERT DATA { <http://example.org/a> <http://www.w3.org/2000/01/rdf-schema#label> "Example" } adds one triple, and a SELECT * WHERE { ?s ?p ?o } returns it.

Create additional datasets from the dashboard's manage tab, then new dataset. Choose a name and a dataset type: Persistent (TDB2) for durable storage on the data disk, or In-memory for scratch data. Persistent datasets are written under /var/lib/fuseki/databases/. You can also drop a .ttl assembler file into /var/lib/fuseki/configuration/ and restart the service:

sudo systemctl restart fuseki.service

Fuseki's heap is set in /etc/fuseki.env (JVM_ARGS=-Xms512m -Xmx1024m by default). For larger graphs increase the maximum heap and restart:

sudo sed -i 's/-Xmx1024m/-Xmx2048m/' /etc/fuseki.env
sudo systemctl restart fuseki.service

Fuseki logs to the systemd journal. Tail the service logs and check the listening socket:

sudo journalctl -u fuseki.service --no-pager | tail -30 sudo ss -tln | grep -E ':80 |:3030 '

The Shiro auth configuration is at /var/lib/fuseki/shiro.ini; the dataset assembler files are in /var/lib/fuseki/configuration/. If a query fails with a 500, check the journal for the underlying SPARQL parse or TDB2 error.

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for Apache Jena Fuseki. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. Fuseki is a JVM workload, so size the instance for your dataset and query concurrency.

Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and either create or select a security group. The group must open port 22 from your management network and port 80 for the web UI. Leave the root volume at the default size or larger, and keep the attached data volume that holds the triplestore.

Select Launch instance. First-boot initialisation takes approximately one minute after the instance state becomes Running and the status checks pass.

The following block launches an instance from the SecureAnyCloud Apache Jena Fuseki Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=jena-fuseki}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Connect over SSH using your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i <key-name>.pem ubuntu@<public-ip>

The Fuseki administrator password is unique to your instance and was generated on first boot. Read it as root:

sudo cat /root/apache-jena-fuseki-credentials.txt

The file lists the web UI URL, the administrator user (admin) and the generated password, and the SPARQL endpoints for the pre-created ds dataset. It is mode 0600 and owned by root, so only the root user can read it.

Fuseki and nginx run as systemd services. Confirm both are active:

systemctl is-active fuseki.service nginx.service

Fuseki listens on port 3030 and nginx proxies port 80 to it. Confirm the health endpoint answers (this endpoint is public and is ideal for load-balancer health checks):

curl -fsS 'http://127.0.0.1:3030/$/ping'

Browse to http://<public-ip>/ to open the Fuseki web UI. The datasets page lists the pre-created ds dataset with buttons to query, add data, edit and view info.

Open the query tab to run SPARQL against your dataset using the built-in editor.

The info tab lists the dataset endpoints and shows live per-endpoint request statistics.

Administrative functions, such as the manage page where you create, back up and remove datasets, require the administrator credentials from Step 4.

SPARQL query and read endpoints are open by default so applications can read without credentials. Count the triples in the ds dataset:

curl -s 'http://127.0.0.1:3030/ds/sparql' --data-urlencode 'query=SELECT (COUNT(*) AS ?count) WHERE { ?s ?p ?o }' -H 'Accept: application/sparql-results+json'

You can point any SPARQL client or your application at http://<public-ip>/ds/query (or the equivalent http://<public-ip>/ds/sparql).

SPARQL Update and the other write endpoints require authentication. The following block reads the per-instance administrator password from the credentials file and inserts a triple into the ds dataset. It then reads the triple back with a public query:

PASS=$(sudo grep '^fuseki.admin.pass=' /root/apache-jena-fuseki-credentials.txt | cut -d= -f2-)
curl -s -u "admin:${PASS}" -H 'Content-Type: application/sparql-update' \
  --data 'INSERT DATA { <urn:sac:example> <http://www.w3.org/2000/01/rdf-schema#label> "Hello from sac" }' \
  'http://127.0.0.1:3030/ds/update'
curl -s 'http://127.0.0.1:3030/ds/query' \
  --data-urlencode 'query=SELECT ?label WHERE { <urn:sac:example> <http://www.w3.org/2000/01/rdf-schema#label> ?label }' \
  -H 'Accept: application/sparql-results+json'

You can also load an RDF file (Turtle, N-Triples, RDF/XML, JSON-LD and more) through the add data tab in the UI, or with the Graph Store Protocol endpoint http://<public-ip>/ds/data using the same administrator credentials.

Confirm that an anonymous write is correctly rejected (secure by default):

curl -s -o /dev/null -w '%{http_code}\n' -H 'Content-Type: application/sparql-update' \
  --data 'INSERT DATA { <urn:x> <urn:p> "y" }' 'http://127.0.0.1:3030/ds/update'

This returns 401, confirming that dataset writes require authentication.

The triplestore lives on a dedicated EBS data volume mounted at /var/lib/fuseki, separate from the operating system disk, so you can resize it independently for capacity and IOPS. Confirm the mount and its contents:

findmnt /var/lib/fuseki ls /var/lib/fuseki

The configuration/ directory holds the ds.ttl dataset definition, databases/ holds the persistent TDB2 store, and shiro.ini holds the security policy.

The Shiro policy is at /var/lib/fuseki/shiro.ini. By default the SPARQL query and read endpoints are open and the admin plus write endpoints require the admin user. To require authentication for reads as well, change the final /** = anon rule and add a rule for the query endpoints, then restart Fuseki:

sudo systemctl restart fuseki.service for i in $(seq 1 60); do curl -fsS -o /dev/null 'http://127.0.0.1:3030/$/ping' && break; sleep 1; done echo "Fuseki restarted and ready"

To change the password of the admin user, edit the admin line under [users] in shiro.ini (keep the file mode 0640 and owner fuseki) and restart the service. To serve the UI over HTTPS, terminate TLS at the nginx reverse proxy with your own certificate.

Use the admin API to trigger a backup of the ds dataset. Backups are written under /var/lib/fuseki/backups:

PASS=$(sudo grep '^fuseki.admin.pass=' /root/apache-jena-fuseki-credentials.txt | cut -d= -f2-)
curl -s -u "admin:${PASS}" -X POST 'http://127.0.0.1:3030/$/backup/ds'

You can also back up and restore datasets from the manage page in the UI.