bewCloud 4.21.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick bewCloud 4.21.0 on Ubuntu 24.04 as the software version, choose your Region, then choose Launch through EC2.

Choose m5.large, your key pair, a security group as above, and a subnet. Under Configure storage, the AMI brings two volumes: the 8 GiB root volume and the 20 GiB data volume for your files and database. Raise the data volume's size there if you expect to store more.

To launch with the AWS CLI, replace the values in angle brackets. The second mapping sets the data volume to 100 GiB:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sdf,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=bewcloud}]'

Version SSH user

bewCloud 4.21.0 on Ubuntu 24.04 ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot creates the database cluster on the data volume, generates the secrets and the administrator, then links the site. This takes well under a minute. Check that every service is active:

systemctl is-active bewcloud-firstboot bewcloud bewcloud-radicale postgresql@16-main nginx

active active active active active

Only SSH (22) and nginx (80, 443) listen on the network. Radicale (5232) listens on loopback. The other two are Ubuntu's local DNS resolver:

sudo ss -lntp | awk 'NR>1 {print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:5232 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

The data volume is mounted at /var/lib/bewcloud and holds the database cluster and your files:

findmnt -no SOURCE,SIZE,FSTYPE /var/lib/bewcloud;
sudo ls /var/lib/bewcloud

/dev/nvme1n1 19.5G ext4 files lost+found postgresql radicale

If nginx is not active, first boot has not finished or has failed. When first boot fails, the site is never published. Check systemctl status bewcloud-firstboot and journalctl -u bewcloud-firstboot.

sudo cat /root/bewcloud-credentials.txt

The file is readable by root only and holds the address and this instance's administrator:

# bewCloud - generated on THIS instance's first boot by bewcloud-firstboot.service. Unique to this instance; # nothing here was baked into the image. Sign in at bewcloud.url with this e-mail and password, then change the # password under Settings. To serve another name:
sudo bewcloud-set-hostname <name> bewcloud.url=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/ bewcloud.admin.email=admin@bewcloud.local bewcloud.admin.pass=<BEWCLOUD_ADMIN_PASSWORD>

The URL uses the instance's public DNS name from EC2 instance metadata. The certificate also names the public and private IP addresses, so https://<public-ip>/ works too. To serve bewCloud under your own DNS name, see Step 9.

You can prove the password works from the command line. bewCloud accepts HTTP Basic authentication on WebDAV. The correct password lists your files, and a wrong one is refused:

sudo bewcloud-verify.sh

bewcloud-verify: login 200; anonymous /files 302 + /dav 401; wrong password 302/401; per-instance admin 200/207; 256 KiB WebDAV round trip byte-identical; CardDAV via Radicale 207 BEWCLOUD_ROUNDTRIP_OK

Open the bewcloud.url in your browser. The certificate is self-signed, so your browser asks you to confirm it the first time. Alternatively, install your own certificate (Step 9).

bewCloud opens on its sign-in screen. There is no setup wizard, because your administrator already exists. Sign in with bewcloud.admin.email and bewcloud.admin.pass from Step 4.

After your first sign-in, change the password under Settings.

Files is the heart of bewCloud. Upload files and create folders from the web interface, browse and search them, and share a file or folder with a link. Every file is stored on the data volume, under /var/lib/bewcloud/files.

Point the bewCloud desktop and mobile apps, or any WebDAV client, at https://<your-host>/dav/ with the same email address and password. Compatible clients include Windows, macOS Finder, rclone and davfs2.

You can also test from the instance itself with curl. The password goes into a private curl config file, never onto the command line:

H=$(sudo sed -n 's#^bewcloud\.url=https://\([^/]*\)/$#\1#p' /root/bewcloud-credentials.txt)
E=$(sudo sed -n 's/^bewcloud\.admin\.email=//p' /root/bewcloud-credentials.txt);
P=$(sudo sed -n 's/^bewcloud\.admin\.pass=//p' /root/bewcloud-credentials.txt) ( umask 077; printf 'user = "%s:%s"\n' "$E" "$P" > ~/.bewcloud-curl ); unset P printf 'Hello from sac.\n' > /tmp/hello.txt curl -s -K ~/.bewcloud-curl --resolve "$H:443:127.0.0.1" --cacert /etc/ssl/bewcloud/bewcloud.crt -o /dev/null -w 'PUT hello.txt -> HTTP %{http_code}\n' -T /tmp/hello.txt "https://$H/dav/hello.txt" curl -s -K ~/.bewcloud-curl --resolve "$H:443:127.0.0.1" --cacert /etc/ssl/bewcloud/bewcloud.crt "https://$H/dav/hello.txt" rm -f ~/.bewcloud-curl /tmp/hello.txt

PUT hello.txt -> HTTP 201 Hello from sac.

An HTTP 201 (created) confirms the upload. Refresh the Files page and the file is there.

The header switches between the built-in apps: Dashboard, Files, Notes, Photos, News, Expenses, Contacts and Calendar.

The bundled Radicale server serves calendars and contacts through bewCloud. Phones and desktop clients sync them over CalDAV at https://<your-host>/caldav/ and CardDAV at https://<your-host>/carddav/, with the same email address and password.

The apps that appear, and their order, are set in /opt/bewcloud/app/bewcloud.config.ts (see the bewCloud FAQ). Apply a change with sudo systemctl restart bewcloud.

Sign ups are closed. To give someone else an account, open sign ups only for as long as you need:

1. Set allowSignups: true in /opt/bewcloud/app/bewcloud.config.ts.
2. Run sudo systemctl restart bewcloud.
3. Let them sign up at https://<your-host>/signup.
4. Set it back to false and restart bewCloud again.

Each user changes their own password under Settings, where they can also set a separate WebDAV/CalDAV password.

If you lose the administrator password, generate a new one. The new password is written to /root/bewcloud-credentials.txt, and the old one stops working at once:

sudo bewcloud-reset-admin-password

Point a DNS record at the instance. An Elastic IP keeps the address across stop and start. Then tell bewCloud its name. This mints a new self-signed certificate for that name, updates the nginx host rule and bewCloud's own address, and keeps the name across reboots:

sudo bewcloud-set-hostname cloud.example.com

To use a certificate from a public authority instead, replace /etc/ssl/bewcloud/bewcloud.crt (full chain) and /etc/ssl/bewcloud/bewcloud.key (mode 0600, owned by root) with your own. Then run sudo systemctl reload nginx. Running bewcloud-set-hostname again later replaces them with a new self-signed pair.

Every service is enabled, so bewCloud returns after a reboot or a stop and start. If the public address changes, the next boot re-issues the certificate and the address for the new name, unless you set your own name in Step 9.

Unattended security upgrades keep the operating system, PostgreSQL and nginx patched. Confirm that every service is enabled:

systemctl is-enabled bewcloud bewcloud-radicale bewcloud-set-host nginx postgresql unattended-upgrades

enabled enabled enabled enabled enabled enabled

Everything that matters is on the data volume: the PostgreSQL cluster, your files and your calendars and contacts. The simplest complete backup is an EBS snapshot of that volume, or AWS Backup on the instance.

For a file-level backup, dump the database and archive the files:

sudo -u postgres pg_dump bewcloud > bewcloud-backup.sql
sudo tar czf bewcloud-files-backup.tar.gz -C /var/lib/bewcloud files radicale

Keep /etc/bewcloud/bewcloud.env with the backup. It holds this instance's PASSWORD_SALT and application secrets, which the stored password hashes depend on.