Blaze FHIR Server 1.11.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Blaze FHIR Server 1.11.0 on Ubuntu 24.04 as the software version and select your Region. Then choose Launch through EC2. Choose m5.large, your key pair and a security group as above.

First boot gives Blaze a quarter of the instance memory as JVM heap and another quarter as RocksDB block cache. A larger instance therefore serves larger data sets without any change. Step 9 shows how to adjust both.

With the AWS CLI, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=blaze}]'

Version SSH user

Blaze FHIR Server 1.11.0 on Ubuntu 24.04 ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot takes about a minute. It creates the certificate and the password, sizes the memory settings, and starts Blaze against its empty store. Only then does nginx start. After that, every unit is active and the Blaze container is up, published on loopback only:

systemctl is-active docker blaze nginx blaze-firstboot
sudo docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'

active active active active NAMES STATUS PORTS blaze Up 2 minutes 127.0.0.1:8080->8080/tcp

The image runs exactly one container image, pinned by digest:

sudo docker image ls --digests --format '{{.Repository}}@{{.Digest}}'

samply/blaze@sha256:1a60d9ca0d579d8296b65ae3c24fea838730e4267e39aa7676ebf945140be3cb

sudo /usr/local/sbin/blaze-port-check.sh

off-box TCP exactly [22 80 443]; Blaze on loopback 8080 BLAZE_PORTS_OK

This is the complete network surface of a new instance: SSH, the HTTPS front door and the HTTP redirect. Blaze itself listens on loopback only.

First boot writes this instance's FHIR base URL, the user name and its password to a root-only file:

sudo cat /root/blaze-credentials.txt

# Blaze FHIR Server 1.11.0 on Ubuntu 24.04 (sac)
# Generated on this instance's first boot. These credentials are unique to THIS instance. BLAZE_URL=https://<public-dns-name>/ BLAZE_FHIR_BASE=https://<public-dns-name>/fhir BLAZE_USERNAME=admin BLAZE_PASSWORD=<BLAZE_PASSWORD> ...

None of these values exists in the image. The password and the certificate are created on your instance's first boot. The host name is your instance's public DNS name (or its IP address when it has none). Step 8 shows how to use your own.

Without the password every FHIR request is refused by nginx before it reaches Blaze, and port 80 only redirects to HTTPS on your configured host name:

curl -sk -o /dev/null -w 'no password: %{http_code}\n' https://127.0.0.1/fhir/metadata
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' http://127.0.0.1/fhir/metadata

no password: 401 port 80: 301 -> https://<public-dns-name>/fhir/metadata

The commands on this page read the password from your credentials file and hand it to curl as a configuration file on its standard input (-K -). The password therefore never appears on a command line or in your shell history. Define this small helper in your SSH session:

blaze_auth() {
sudo sed -n 's/^BLAZE_PASSWORD=\(.*\)/user = "admin:\1"/p' /root/blaze-credentials.txt; } blaze_auth | curl -sk -K - -H 'Accept: application/fhir+json' https://127.0.0.1/fhir/metadata \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d["resourceType"], d["software"]["name"], d["software"]["version"], "FHIR", d["fhirVersion"]); print(d["implementation"]["url"])'

CapabilityStatement Blaze 1.11.0 FHIR 4.0.1 https://<public-dns-name>/fhir

The CapabilityStatement lists every resource type, interaction and search parameter the server supports. From your own workstation the same request is curl -k -u admin https://<public-dns-name>/fhir/metadata, which prompts for the password.

Create a Patient. Blaze assigns the id and the version:

blaze_auth() {
sudo sed -n 's/^BLAZE_PASSWORD=\(.*\)/user = "admin:\1"/p' /root/blaze-credentials.txt; } blaze_auth | curl -sk -K - -X POST -H 'Content-Type: application/fhir+json' -H 'Prefer: return=representation' \
  --data '{"resourceType":"Patient","identifier":[{"system":"urn:example:mrn","value":"MRN-0001"}],"name":[{"family":"Lovelace","given":["Ada"]}],"gender":"female","birthDate":"1815-12-10"}' \
  https://127.0.0.1/fhir/Patient \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d["resourceType"], d["id"], "version", d["meta"]["versionId"], d["name"][0]["family"])'

Patient DIKZ3OG7UZOMNONF version 7 Lovelace

Search for it by its identifier. The fullUrl of every entry is built from your configured host name:

blaze_auth() {
sudo sed -n 's/^BLAZE_PASSWORD=\(.*\)/user = "admin:\1"/p' /root/blaze-credentials.txt; } blaze_auth | curl -sk -K - -H 'Accept: application/fhir+json' 'https://127.0.0.1/fhir/Patient?identifier=urn:example:mrn|MRN-0001' \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print("total:", d["total"]); [print(e["fullUrl"]) for e in d.get("entry", [])]'

total: 1 https://<public-dns-name>/fhir/Patient/DIKZ3OG7UZOMNONF

To load data in bulk, POST a FHIR transaction or batch Bundle to https://<public-dns-name>/fhir.

The Blaze project's separate command-line tool blazectl (github.com/samply/blazectl, not installed on the image) uploads directories of bundles, counts resources and downloads search results from your workstation. Point it at your FHIR base URL with your admin password.

Create a DNS record for your instance (for example fhir.example.com), then serve Blaze under that name. The helper creates a new certificate for it and pins nginx and the cross-origin guard to it. It also sets Blaze's base URL and restarts Blaze:

sudo blaze-set-hostname fhir.example.com

The name is remembered in /etc/sac/blaze-hostname. To use a certificate from your own certificate authority, replace /etc/ssl/blaze/blaze.crt and /etc/ssl/blaze/blaze.key (keep the key 0600 root). Then run sudo systemctl reload nginx.

The RocksDB store is on its own EBS volume:

findmnt -n -o SOURCE,SIZE,FSTYPE /var/lib/blaze
sudo ls -l /var/lib/blaze cat /etc/blaze-sac/blaze-tuning.env

/dev/nvme1n1 19.5G ext4 total 20 drwxr-xr-x 2 blaze blaze 4096 Oct 20 15:11 admin-index drwxr-xr-x 2 blaze blaze 4096 Oct 20 15:11 admin-transaction drwxr-xr-x 2 blaze blaze 4096 Oct 20 15:11 index drwxr-xr-x 2 blaze blaze 4096 Oct 20 15:11 resource drwxr-xr-x 2 blaze blaze 4096 Oct 20 15:11 transaction
# Rendered by first boot from this instance memory (7816 MiB) (sac). Edit and `sudo systemctl restart blaze`. JAVA_TOOL_OPTIONS=-Xmx1954m DB_BLOCK_CACHE_SIZE=1954

• Grow the store. Enlarge the volume in the EC2 console, then run sudo resize2fs on the device shown by findmnt. Snapshot the volume to back up your data. Stop Blaze (sudo systemctl stop blaze) first for a consistent snapshot.
• Memory. Edit /etc/blaze-sac/blaze-tuning.env (JVM heap and RocksDB block cache in MiB) and run sudo systemctl restart blaze. You can add other Blaze settings from its documentation to the same file.
• Password. sudo blaze-set-password creates a new random password and updates /root/blaze-credentials.txt. sudo blaze-set-password --stdin reads a password you choose (12 or more characters) from standard input. nginx picks it up on the next request.

Blaze can be configured to call other services, such as an OpenID Connect provider or an external terminology server. The image drops any container traffic to the instance metadata service in Docker's DOCKER-USER firewall chain. Docker, Blaze's unit and nginx are also denied it by systemd:

sudo iptables -S DOCKER-USER
sudo docker exec blaze curl -s -m 5 -o /dev/null -w 'metadata from inside the container: %{http_code}\n' http://169.254.169.254/latest/meta-data/ || true

-N DOCKER-USER -A DOCKER-USER -d 168.63.129.16/32 -j DROP -A DOCKER-USER -d 169.254.169.254/32 -j DROP metadata from inside the container: 000

000 means the connection never completed. The instance itself still uses IMDSv2 normally (first boot reads its host name from it).

• Ubuntu and Docker receive security updates automatically through unattended-upgrades.
• Blaze is the pinned 1.11.0 container. SecureAnyCloud publishes a new version of this listing when a new Blaze release is needed. To move an existing instance to it, snapshot the data volume, launch the new version, and attach the volume (or restore its snapshot) at /var/lib/blaze.