Appwrite
Overview
Appwrite is an open source backend-as-a-service platform and a self-hosted Firebase alternative. It provides user authentication with many login methods, a database with per-document permissions, file storage, serverless functions, messaging and realtime subscriptions. Everything is available through REST, GraphQL and Realtime APIs and a web Console.
This SecureAnyCloud image installs Appwrite 1.9.0 as the official self-host Docker Compose stack and runs it as a systemd service, so a complete backend is online within minutes of launch.
What you get:
- Appwrite 1.9.0 (BSD-3-Clause), deployed from the official self-host Docker Compose stack and pinned so the image never silently upgrades at build time
- Docker Engine (Docker CE) and the Docker Compose plugin, installed from the official Docker package repository
- The Appwrite Compose stack: the
appwriteAPI container, the Console SPA, the realtime websocket service and the full set of worker containers (audits, webhooks, deletes, databases, builds, certificates, functions, mails, messaging, migrations, maintenance and scheduler, a headless browser and the OpenRuntimes executor), withappwrite-mongodbas the database andappwrite-redisfor the cache, queues and pub/sub - The bundled Traefik reverse proxy (
appwrite-traefik) publishing the Console and the API on port 80 (and 443) - All stateful data (the MongoDB database, the Redis data and every uploaded file and storage volume) on a dedicated 40 GiB data disk mounted at
/var/lib/appwrite, where Docker's data-root is relocated. The disk is independently resizable and re-provisioned on every VM - A per-VM Console root account (email and a generated password) created at first boot, with Console registration locked to that account
- Two systemd units:
appwrite.service(a oneshot wrapper arounddocker compose up -d) andappwrite-firstboot.service - 24/7 SecureAnyCloud support
Prerequisites
You need an active Azure subscription, an SSH key, and a VNet with a subnet.
Standard_B4ms (4 vCPU / 16 GB RAM) is the recommended size. It runs the roughly 25-container Appwrite stack comfortably.
Configure the NSG inbound rules to allow 22/tcp from your management CIDR for SSH. Allow 80/tcp from the CIDR that needs the Appwrite Console and API. Add 443/tcp if you enable HTTPS.
Connect over SSH
Connect to your VM as azureuser. Replace <vm-ip> with the public IP of your VM.
ssh azureuser@<vm-ip>Confirm the services are active
Run the following command on the VM.
sudo systemctl is-active docker.service appwrite.service docker --version docker compose versionThe output shows active twice, then the Docker Engine version and the Docker Compose v2 plugin version.
Confirm the Appwrite containers are running
List the running containers.
sudo docker ps --format "table {{.Names}}\t{{.Status}}"The core containers are appwrite, appwrite-traefik, appwrite-mongodb and appwrite-redis. They appear alongside the Appwrite worker containers, all in the Up / healthy state.
Confirm the data disk is mounted
All stateful Appwrite data lives on a dedicated data disk mounted at /var/lib/appwrite. Check the mount.
findmnt /var/lib/appwrite df -h /var/lib/appwritefindmnt shows the device backing /var/lib/appwrite. df confirms the 40 GiB volume.
Check the Appwrite health endpoint
Call the health endpoint. It is served without authentication through the bundled Traefik proxy on port 80 and returns the running version.
curl -s http://localhost/v1/health/versionA JSON document containing the Appwrite version confirms that the API is up.
Read the per-VM Console credentials
On first boot, the VM generates a unique Console root email and password and writes them to a root-only file. Console registration is locked to this root account, so it is the only login until you invite more users from the Console.
sudo cat /root/appwrite-credentials.txtThe file lists appwrite.url (where to sign in), appwrite.admin.email, appwrite.admin.pass and the appwrite.endpoint that you point the SDKs at. Store the password somewhere safe.
Sign in to the Appwrite Console
Browse to http://<vm-ip>/. Sign in with the appwrite.admin.email and appwrite.admin.pass values from Step 6. The bundled reverse proxy serves the Console and the API on port 80.
After you sign in, the projects overview opens. Create your first Appwrite project to start building.
Build your backend in the Console
Inside a project, model your data in the database with collections, attributes, indexes and per-document permissions. Manage users and teams in Auth, store and serve files in Storage, write serverless functions, and subscribe to realtime events.
Open the project settings and API keys view to retrieve the project id and create the API keys your applications use.
Connect the Appwrite SDKs
Point the Appwrite client and server SDKs at http://<vm-ip>/v1. Use the project id and an API key created in the Console. For example, with the Node.js server SDK:
const { Client } = require("node-appwrite"); const client = new Client() .setEndpoint("http://<vm-ip>/v1") .setProject("<your-project-id>") .setKey("<your-api-key>");The same endpoint serves the REST, GraphQL and Realtime APIs.
Manage the stack
The appwrite.service systemd unit manages the whole stack. It wraps docker compose under /opt/appwrite.
sudo systemctl restart appwrite.service
sudo systemctl status appwrite.service --no-pagerTo read the logs of a specific container, run:
cd /opt/appwrite && sudo docker compose logs --tail 50 appwriteEnabling HTTPS on your own domain
The image serves plain HTTP on port 80 out of the box. To serve the Console and the API over HTTPS on your own domain, point an A record at the VM public IP.
Then set _APP_DOMAIN, _APP_CONSOLE_HOSTNAMES and _APP_OPTIONS_FORCE_HTTPS=enabled in /opt/appwrite/.env and restart appwrite.service. Appwrite's bundled Traefik then requests and renews a Let's Encrypt certificate automatically. Add 443/tcp to your NSG inbound rules.
First-boot security model
On the first boot of each VM, appwrite-firstboot.service runs once and:
- Rotates every per-VM secret in the stack: the API encryption key (
_APP_OPENSSL_KEY_V1), the OpenRuntimes executor secret, and the MongoDB and Redis passwords - Resolves the VM public IP through Azure IMDS and points the request-host allowlist (
_APP_DOMAIN/_APP_CONSOLE_HOSTNAMES) at it, so the Console and API are reachable by IP - Recreates the Compose stack on a fresh, empty database, then creates a fresh Console root account with a generated password and locks Console registration to it
- Writes the credentials to
/root/appwrite-credentials.txt(root-only, mode 0600)
The image ships with no shared or default secret and no preexisting login.
Support
24/7 technical support is included. Contact SecureAnyCloud at sales@secureanycloud.com for help with deployment, projects and API keys, authentication providers, the database and permissions model, storage, serverless functions, messaging, realtime, TLS and backups.
Appwrite is a trademark of Appwrite, Inc. MongoDB is a trademark of MongoDB, Inc. Redis is a trademark of Redis Ltd. All other product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.
Deploy on Azure
Launch Appwrite 1.9.0 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.
View this image
Need Help?
Our support team is available 24/7.
sales@secureanycloud.com
Overview
Appwrite is an open source backend-as-a-service platform and a self-hosted Firebase alternative. It provides user authentication with many login methods, a database with per-document permissions, file storage, serverless functions, messaging and realtime subscriptions. Everything is available through REST, GraphQL and Realtime APIs and a web Console.
This SecureAnyCloud image installs Appwrite as the official self-host Docker Compose stack and runs it as a systemd service, so a complete backend is online within minutes of launch.
What you get:
- Appwrite (BSD-3-Clause), deployed from the official self-host Docker Compose stack and pinned so the image never silently upgrades at build time
- Docker Engine (Docker CE) and the Docker Compose plugin, installed from the official Docker package repository
- The Appwrite Compose stack: the
appwriteAPI container, the Console SPA, the realtime websocket service and the full set of worker containers (audits, webhooks, deletes, databases, builds, certificates, functions, mails, messaging, migrations, maintenance and scheduler, a headless browser and the OpenRuntimes executor), withappwrite-mongodbas the database andappwrite-redisfor the cache, queues and pub/sub - The bundled Traefik reverse proxy (
appwrite-traefik) publishing the Console and the API on port 80 (and 443) - All stateful data (the MongoDB database, the Redis data and every uploaded file and storage volume) on a dedicated data volume mounted at
/var/lib/appwrite, where Docker's data-root is relocated. The volume is independently resizable - A per-instance Console root account (email and a generated password) created at first boot, with Console registration locked to that account
- Two systemd units:
appwrite.service(a oneshot wrapper arounddocker compose up -d) andappwrite-firstboot.service - 24/7 SecureAnyCloud support
Prerequisites
You need an Amazon Web Services account where you can launch EC2 instances, an EC2 key pair in the target Region, and a VPC with a subnet.
m5.xlarge (4 vCPU / 16 GiB RAM) is the recommended starting size. It runs the roughly 25-container Appwrite stack comfortably.
Configure the security group inbound rules to allow 22/tcp from your management CIDR for SSH. Allow 80/tcp from the CIDR that needs the Appwrite Console and API. Add 443/tcp if you enable HTTPS.
Launch the instance from the AWS Marketplace
Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Appwrite by SecureAnyCloud.
Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary. Pick m5.xlarge or larger and choose your EC2 key pair. Under Network settings, select a security group that allows inbound ports 22 and 80, as described above. Then select Launch instance.
First-boot initialisation rotates every secret and creates the Console root account. Allow a few minutes after the instance is running.
To launch from the AWS CLI instead, run:
aws ec2 run-instances \
--image-id <ami-id> \
--instance-type m5.xlarge \
--key-name <key-name> \
--subnet-id <subnet-id> \
--security-group-ids <security-group-id> \
--tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=appwrite-01}]'Connect over SSH
The SSH login user depends on the operating system of the AMI variant you launched. For Appwrite on Ubuntu 24.04, the login user is ubuntu. Replace <instance-ip> with the public IP of your instance.
ssh -i <path-to-key>.pem ubuntu@<instance-ip>Confirm the services are active
Run the following command on the instance.
sudo systemctl is-active docker.service appwrite.service docker --version docker compose versionThe output shows active twice, then the Docker Engine version and the Docker Compose v2 plugin version.
Confirm the Appwrite containers are running
List the running containers.
sudo docker ps --format "table {{.Names}}\t{{.Status}}"The core containers are appwrite, appwrite-traefik, appwrite-mongodb and appwrite-redis. They appear alongside the Appwrite worker containers, all in the Up / healthy state.
Confirm the data volume is mounted
All stateful Appwrite data lives on a dedicated data volume mounted at /var/lib/appwrite. Check the mount.
findmnt /var/lib/appwrite df -h /var/lib/appwritefindmnt shows the device backing /var/lib/appwrite. df confirms the dedicated volume.
Check the Appwrite health endpoint
Call the health endpoint. It is served without authentication through the bundled reverse proxy on port 80 and returns the running version.
curl -s http://localhost/v1/health/versionA JSON document containing the Appwrite version confirms that the API is up.
Read the per-instance Console credentials
On first boot, the instance generates a unique Console root email and password and writes them to a root-only file. Console registration is locked to this root account, so it is the only login until you invite more users from the Console.
sudo cat /root/appwrite-credentials.txtThe file lists appwrite.url (where to sign in), appwrite.admin.email, appwrite.admin.pass and the appwrite.endpoint that you point the SDKs at. Store the password somewhere safe.
Sign in to the Appwrite Console
Browse to http://<instance-ip>/. Sign in with the appwrite.admin.email and appwrite.admin.pass values from Step 7. The bundled reverse proxy serves the Console and the API on port 80.
After you sign in, the projects overview opens. Create your first Appwrite project to start building.
Build your backend in the Console
Inside a project, model your data in the database with collections, attributes, indexes and per-document permissions. Manage users and teams in Auth, store and serve files in Storage, write serverless functions, and subscribe to realtime events.
Open the project settings and API keys view to retrieve the project id and create the API keys your applications use.
Connect the Appwrite SDKs
Point the Appwrite client and server SDKs at http://<instance-ip>/v1. Use the project id and an API key created in the Console. For example, with the Node.js server SDK:
const { Client } = require("node-appwrite"); const client = new Client() .setEndpoint("http://<instance-ip>/v1") .setProject("<your-project-id>") .setKey("<your-api-key>");The same endpoint serves the REST, GraphQL and Realtime APIs.
Manage the stack
The appwrite.service systemd unit manages the whole stack. It wraps docker compose under /opt/appwrite.
sudo systemctl restart appwrite.service
sudo systemctl status appwrite.service --no-pagerTo read the logs of a specific container, run:
cd /opt/appwrite && sudo docker compose logs --tail 50 appwriteEnabling HTTPS on your own domain
The image serves plain HTTP on port 80 out of the box. To serve the Console and the API over HTTPS on your own domain, point an A record at the instance public IP.
Then set _APP_DOMAIN, _APP_CONSOLE_HOSTNAMES and _APP_OPTIONS_FORCE_HTTPS=enabled in /opt/appwrite/.env and restart appwrite.service. Appwrite's bundled Traefik then requests and renews a Let's Encrypt certificate automatically. Add 443/tcp to your security group inbound rules.
First-boot security model
On the first boot of each instance, appwrite-firstboot.service runs once and:
- Rotates every per-instance secret in the stack: the API encryption key (
_APP_OPENSSL_KEY_V1), the OpenRuntimes executor secret, and the MongoDB and Redis passwords - Resolves the instance public IP through the EC2 Instance Metadata Service (IMDSv2) and points the request-host allowlist (
_APP_DOMAIN/_APP_CONSOLE_HOSTNAMES) at it, so the Console and API are reachable by IP - Recreates the Compose stack on a fresh, empty database, then creates a fresh Console root account with a generated password and locks Console registration to it
- Writes the credentials to
/root/appwrite-credentials.txt(root-only, mode 0600)
The image ships with no shared or default secret and no preexisting login.
Support
24/7 technical support is included. Contact SecureAnyCloud at sales@secureanycloud.com for help with deployment, projects and API keys, authentication providers, the database and permissions model, storage, serverless functions, messaging, realtime, TLS and backups.
Appwrite is a trademark of Appwrite, Inc. MongoDB is a trademark of MongoDB, Inc. Redis is a trademark of Redis Ltd. All other product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.
Deploy on AWS
Launch Appwrite on AWS with 24/7 support from SecureAnyCloud.
View on Marketplace
Need Help?
Our support team is available 24/7.
sales@secureanycloud.com