Arc Time-Series Database 26.09.3

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Select Arc Time-Series Database 26.09.3 on Ubuntu 24.04 as the software version, pick your Region, and choose Launch through EC2.

Choose m5.large or larger, your key pair and the security group described above.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=arc}]'

You do not need --metadata-options, because the AMI already requires IMDSv2. The root file system grows to fill the volume on first boot.

The image runs Ubuntu 24.04 LTS, and the SSH user is ubuntu. Connect with the key pair you chose at launch:

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot takes under a minute. Once it finishes, Arc and its first-boot service report as active:

systemctl is-active arc arc-tsdb-firstboot

active active

Arc (port 8000) and SSH (port 22) are the only listeners on the network:

sudo ss -tlnH | awk '{print $4}' | sort -u

0.0.0.0:22 0.0.0.0:8000 127.0.0.53%lo:53 127.0.0.54:53 [::]:22

The two port 53 entries belong to the system DNS resolver.

Print the credentials file with the admin token line left out:

sudo grep -v '^ARC_ADMIN_TOKEN=' /root/arc-tsdb-credentials.txt

The file holds the URL Arc is served at, the host, the fingerprint of this instance's certificate and, on the line omitted above, the admin token:

# Arc Time-Series Database 26.09.3 (sac) on this instance. Every query, write and admin request needs the token:
# Authorization: Bearer <ARC_ADMIN_TOKEN>
# The token is unique to this instance. Create more (and narrower) tokens with the API, then keep this one safe.
# The certificate is self-signed for this instance: compare its SHA-256 fingerprint with ARC_TLS_SHA256, or pass
# --cacert /etc/arc/tls/arc.crt on this instance. ARC_URL=https://<public-ip>:8000 ARC_HOST=<public-ip> ARC_TLS_SHA256=<sha256-fingerprint> GUIDE=https://secureanycloud.com/stacks/arc-time-series-database-26-09-3/

Read the token with sudo cat /root/arc-tsdb-credentials.txt and store it in your secrets manager. The URL and a reminder are also printed when you log in over SSH.

Arc accepts the InfluxDB line protocol on /api/v1/write/line-protocol, with the database named in the x-arc-database header. It accepts SQL on /api/v1/query. Measurements are tables named <database>.<measurement>.

In this example, the token is written to a header file that only you can read, so it never appears on a command line. The certificate directory is readable only by root and Arc, so the first line copies the public certificate to your home directory for curl to trust:

sudo cat /etc/arc/tls/arc.crt > ~/arc.crt HDR="$(mktemp)"; chmod 600 "$HDR"
sudo sed -n 's/^ARC_ADMIN_TOKEN=\(.*\)$/Authorization: Bearer \1/p' /root/arc-tsdb-credentials.txt > "$HDR" arc() { curl -s --cacert ~/arc.crt -H "@$HDR" "$@"; } NOW="$(date +%s)" printf 'cpu,host=web1 usage=12.5 %s000000000\ncpu,host=web1 usage=17.5 %s000000000\ncpu,host=web2 usage=40 %s000000000\n' \
  "$((NOW - 120))" "$((NOW - 60))" "$NOW" | arc -o /dev/null -w '%{http_code}\n' -H 'x-arc-database: demo' --data-binary @- https://localhost:8000/api/v1/write/line-protocol arc -o /dev/null -w '%{http_code}\n' -X POST https://localhost:8000/api/v1/write/line-protocol/flush arc -H 'Content-Type: application/json' -d '{"sql":"SELECT host, count(*) AS points, avg(usage) AS avg_usage FROM demo.cpu GROUP BY host ORDER BY host"}' \
  https://localhost:8000/api/v1/query | jq -c '.data' rm -f "$HDR"

204 200 [["web1",2,15],["web2",1,40]]

Arc buffers writes for up to a second before it writes Parquet. The flush call (admin only) writes them at once. The files are under /var/lib/arc/data/demo/cpu/, where any tool that reads Parquet can open them.

From another machine, use https://<ARC_HOST>:8000 with the header Authorization: Bearer <token>. To trust the certificate, copy ~/arc.crt from the instance (--cacert for curl) or install your own certificate (Step 8).

Telegraf's InfluxDB output, Grafana's Arc data source and the Arc client libraries all take the URL and a token.

Only /health, /ready, /ready/write, /api/v1/auth/verify and Arc's aggregate /metrics counters answer without a token. Everything else, including SQL and writes, returns 401 without a valid token. Plain HTTP gets no answer at all:

for t in "" "Authorization: Bearer 0000000000000000000000000000000000000000000000000"; do curl -s -o /dev/null -w '%{http_code}\n' --cacert ~/arc.crt ${t:+-H "$t"} \
  -H 'Content-Type: application/json' -d '{"sql":"SELECT 1"}' https://localhost:8000/api/v1/query done curl -s --cacert ~/arc.crt https://localhost:8000/health | jq -r .status curl -s -o /dev/null http://127.0.0.1:8000/health || echo "plain HTTP refused (curl exit $?)"

401 401 ok plain HTTP refused (curl exit 52)

Neither Arc nor the first-boot service can reach the instance metadata service:

for u in arc arc-tsdb-firstboot; do printf '%s: ' "$u"; systemctl show -p IPAddressDeny --value "$u" | tr ' ' '\n' | grep -E '^169\.254\.' | paste -sd' ' done

arc: 169.254.169.254/32 arc-tsdb-firstboot: 169.254.169.254/32

To run the full self-test that the image build runs, use:

sudo arc-selftest

ARC_SELFTEST_OK

Keep the admin token for administration and give each application its own token with only the permissions it needs. Manage tokens with Arc's API (/api/v1/auth/tokens, admin token required). For example, create a write-only token for Telegraf:

curl -s --cacert ~/arc.crt -H "@$HDR" -H 'Content-Type: application/json' \
  -d '{"name":"telegraf","permissions":["write"]}' https://localhost:8000/api/v1/auth/tokens

The response shows the new token once, so store it in your secrets manager. Arc stores only a hash of each token.

To replace the admin token, create a new admin token and update ARC_ADMIN_TOKEN in /root/arc-tsdb-credentials.txt. Then delete the old token through the same API.

The certificate generated on first boot names the instance's addresses, localhost and its public DNS name.

To use a certificate from your own CA or from Let's Encrypt, replace /etc/arc/tls/arc.crt and /etc/arc/tls/arc.key. Keep owner root, group arc, key mode 0640 and directory mode 0750. Then restart Arc:

sudo systemctl restart arc

Clients can then trust the certificate without --cacert.

• Disk space: Parquet files live on the root volume under /var/lib/arc/data. Grow the EBS volume in the EC2 console, then extend the file system online with sudo growpart /dev/nvme0n1 1 && sudo resize2fs /dev/nvme0n1p1.
• Retention: Arc deletes old data per database with retention policies (/api/v1/retention). Compaction merges small Parquet files hourly and daily.
• Backups: Arc's backup API (/api/v1/backup) writes to /var/lib/arc/backups. Copy those files to Amazon S3, or take EBS snapshots of the volume.
• Amazon S3 storage: Arc can keep Parquet in S3 ([storage] backend = "s3" in /etc/arc/arc.toml). Instance metadata is blocked for Arc, so it cannot use the instance role. Put an access key for an IAM user limited to that bucket in the configuration, then restart Arc.

These are the components and where to find them on the instance:

• Arc 26.09.3 (DuckDB 1.5.5 built in): /usr/local/bin/arc, unit arc.service, user arc
• Configuration: /etc/arc/arc.toml
• Token database and Parquet data: /var/lib/arc/arc.db and /var/lib/arc/data
• TLS certificate and key: /etc/arc/tls/arc.crt and /etc/arc/tls/arc.key
• First boot and start guard: arc-tsdb-firstboot.service and /usr/local/sbin/arc-guard
• Self-test: /usr/local/sbin/arc-selftest
• Credentials: /root/arc-tsdb-credentials.txt (mode 0600)
• Licence and notices: /usr/share/doc/arc/

View the logs with sudo journalctl -u arc.

• Allow port 22 in the security group from your own networks only, and open port 8000 only to the applications and people that need Arc.
• Give each application its own token with the narrowest permissions, and keep the admin token for administration.
• Use your own DNS name and a certificate your clients trust (Step 8).
• Keep the operating system patched. Unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else.