ArcadeDB 26.10.2

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened Neo4j & Graph and RDF Databases AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Choose Launch your software. In Version, choose ArcadeDB 26.10.2 on Ubuntu 24.04 - YYYY-MM-DD and select your Region.
• Instance type: m5.large is recommended.
• Key pair: choose your EC2 key pair.
• Security group: allow TCP 22 from your own address and TCP 443 (and 80) from your clients.
• Launch the instance. First boot takes about a minute after the instance is reachable. During that time it generates this instance's certificate and root password and creates the Demo database.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and replace the key pair, security group and subnet with your own:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=arcadedb}]'

The AMI already requires IMDSv2, so you do not need --metadata-options. The data volume is created from the AMI automatically.

Connect over SSH:

ssh -i my-key-pair.pem ubuntu@<vm-ip>

The login banner shows the Studio and HTTP API URLs for this instance.

Confirm that ArcadeDB and nginx are running, first boot has finished, and the unauthenticated health endpoint answers over HTTPS:

systemctl is-active arcadedb.service nginx.service test -f /var/lib/sac/data/arcadedb-firstboot.done && echo first-boot-done curl -sk -o /dev/null -w 'healthz: HTTP %{http_code}\n' https://localhost/healthz

Both services report active, the first-boot marker is present and /healthz returns HTTP 200 (the nginx-served liveness check, which needs no login).

The server itself listens on loopback only, and nginx owns the public ports. List the listening ports:

sudo ss -tlnp | grep -E ':(2480|80|443) '

You see java on [::ffff:127.0.0.1]:2480 (the loopback address) and nginx on ports 80 and 443.

The root password is unique to this instance and is written to a root-only file at first boot. Print only the field names, never the password itself:

sudo grep -oE '^[A-Z_]+=' /root/arcadedb-credentials.txt

This lists ARCADEDB_HOST, ARCADEDB_STUDIO_URL, ARCADEDB_HTTP_API_URL, ARCADEDB_ROOT_USER (root), ARCADEDB_ROOT_PASSWORD (the per-instance password) and ARCADEDB_DEMO_DATABASE (Demo). Read the password itself with sudo sed -n 's/^ARCADEDB_ROOT_PASSWORD=//p' /root/arcadedb-credentials.txt when you need it, and keep it safe because it is the database administrator account. ArcadeDB stores only a salted PBKDF2 hash of it in /var/lib/arcadedb/config/server-users.jsonl.

Every API call requires the login. An anonymous request is rejected with 401, and a wrong password is refused too (ArcadeDB answers 403). Try both:

curl -sk -o /dev/null -w 'anonymous: HTTP %{http_code}\n' https://localhost/api/v1/databases
curl -sk -u 'root:wrong-password' -o /dev/null -w 'wrong password: HTTP %{http_code}\n' https://localhost/api/v1/databases

With the per-instance password, the API answers 200 and lists the databases:

PW=$(sudo sed -n 's/^ARCADEDB_ROOT_PASSWORD=//p' /root/arcadedb-credentials.txt)
curl -sk -u "root:$PW" -o /dev/null -w 'authenticated root: HTTP %{http_code}\n' https://localhost/api/v1/databases
curl -sk -u "root:$PW" https://localhost/api/v1/databases; echo

The list contains Demo. ArcadeDB also protects every account against password guessing: after five failed logins within 30 seconds the user name is locked for the rest of that 30-second window, even for the right password.

Open https://<public-dns>/ in your browser. The certificate is self-signed and unique to this instance, so your browser warns once. To serve the instance under your own DNS name with a trusted certificate, see Step 9. Studio shows its sign-in page.

Sign in as root with the per-instance password. Studio connects to the Demo database, and its Database Info panel shows the schema: Person vertices and Knows edges. Type a query in the editor, choose the language (SQL, SQL Script, openCypher, Gremlin, GraphQL, MongoDB and more) and press Run. The Table view shows the records.

Switch to the Graph view to explore vertices and their relationships visually. An openCypher query there returns the three people and the Knows edges between them.

The Server view reports the running version (v.26.10.2) and live CPU, memory, disk and transaction metrics. The Security view manages users, groups and API tokens.

The same queries run over the HTTP API. Send commands as POST /api/v1/command/<database> with a JSON body naming the language:

PW=$(sudo sed -n 's/^ARCADEDB_ROOT_PASSWORD=//p' /root/arcadedb-credentials.txt)
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/command/Demo \
  -d '{"language":"sql","command":"SELECT name, role FROM Person ORDER BY name"}'; echo
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/command/Demo \
  -d '{"language":"cypher","command":"MATCH (p:Person)-[:Knows]->(f:Person) RETURN p.name AS person, f.name AS knows"}'; echo

The first call returns Alice, Bob and Carol with their roles. The second returns the three Knows relationships. The same graph can be traversed with Gremlin (g.V().hasLabel('Person').out('Knows').values('name'), language gremlin).

Create your own database and write to it:

PW=$(sudo sed -n 's/^ARCADEDB_ROOT_PASSWORD=//p' /root/arcadedb-credentials.txt)
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/server \
  -d '{"command":"create database Inventory"}'; echo
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/command/Inventory \
  -d '{"language":"sql","command":"CREATE DOCUMENT TYPE Item"}'; echo
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/command/Inventory \
  -d '{"language":"sql","command":"INSERT INTO Item SET sku = '\''A-100'\'', qty = 5"}'; echo
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/command/Inventory \
  -d '{"language":"sql","command":"SELECT sku, qty FROM Item"}'; echo

The last call returns the A-100 item you inserted. Remove the example with {"command":"drop database Inventory"} on the same /api/v1/server endpoint.

For application traffic, create a dedicated user with only the permissions it needs in Studio's Security view instead of using root.

Component Path

ArcadeDB install (read-only, root-owned) /opt/arcadedb

Server settings /etc/default/arcadedb

Server root (data volume) /var/lib/arcadedb

Databases /var/lib/arcadedb/databases

Users, groups, server configuration /var/lib/arcadedb/config

Server logs /var/lib/arcadedb/log and journalctl -u arcadedb

Backups /var/lib/arcadedb/backups

Files IMPORT DATABASE may read /var/lib/arcadedb/imports

Credentials file /root/arcadedb-credentials.txt (mode 0600)

Per-instance certificate /etc/ssl/arcadedb/

nginx site /etc/nginx/sites-available/sac-arcadedb

The data volume is mounted by filesystem UUID:

findmnt /var/lib/arcadedb df -h /var/lib/arcadedb

To change a server setting (for example the heap in ARCADEDB_OPTS_MEMORY), edit /etc/default/arcadedb and run sudo systemctl restart arcadedb.service. Keep -Darcadedb.server.httpIncomingHost=127.0.0.1 so the server stays on loopback behind nginx.

Point a DNS record at the instance, then regenerate the certificate and pin the served hostname:

sudo arcadedb-set-hostname arcadedb.example.com

This issues a new self-signed certificate for that name and makes nginx answer only for it. Replace the certificate with your own CA- or ACM-issued certificate. For a public, browser-trusted certificate, terminate TLS at an Application Load Balancer or CloudFront in front of the instance, and keep the security group's 443 open only to that front.