Bludit Flat-File CMS 3.22.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Bludit Flat-File CMS 3.22.0 on Ubuntu 24.04 as the software version, choose your Region, then choose Launch through EC2.

Choose m5.large, your key pair and a security group as described above. Bludit is light, so a smaller instance is fine for a small site. Keep the second EBS volume in the launch settings, because it is where your site lives.

Alternatively, launch with the AWS CLI. Replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=bludit}]'

Connect to Bludit Flat-File CMS 3.22.0 on Ubuntu 24.04 over SSH as the ubuntu user:

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot takes a few seconds. After it finishes, nginx, PHP and the first-boot unit are active:

systemctl is-active nginx php8.3-fpm bludit-firstboot

active active active

nginx serves ports 80 and 443. PHP listens on a local socket only, so the only open ports are 22, 80 and 443:

sudo ss -tlnp | awk 'NR==1 || /nginx|sshd|php/' | awk '{print $1, $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g'

State Local Peer LISTEN 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) LISTEN 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) LISTEN 0.0.0.0:22 users:(("sshd"),("systemd")) LISTEN [::]:443 users:(("nginx"),("nginx"),("nginx")) LISTEN [::]:80 users:(("nginx"),("nginx"),("nginx")) LISTEN [::]:22 users:(("sshd"),("systemd"))

grep -oE "BLUDIT_VERSION', +'[0-9.]+'" /var/www/bludit/bl-kernel/boot/init.php php -v | head -1

BLUDIT_VERSION', '3.22.0' PHP 8.3.6 (cli) (built: Oct 19 2026 15:16:58) (NTS)

The credentials file holds the address the site is served as (your instance's public DNS name by default), the admin panel address, the user, and the password generated on this instance. Show it:

sudo cat /root/bludit-credentials.txt

BLUDIT_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ BLUDIT_ADMIN_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/admin/ BLUDIT_ADMIN_USER=admin BLUDIT_ADMIN_PASSWORD=<24 letters and digits>

To show the address lines without the password, run:

sudo grep -E '^BLUDIT_(URL|ADMIN_URL|ADMIN_USER)=' /root/bludit-credentials.txt

BLUDIT_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ BLUDIT_ADMIN_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/admin/ BLUDIT_ADMIN_USER=admin

Open BLUDIT_URL in your browser. The certificate is self-signed and generated on your instance, so accept the browser warning once, or install your own certificate (Step 10). Bludit's starter site opens with its example pages.

The example pages tell you to sign in with the password you set during installation. On this image, that is the BLUDIT_ADMIN_PASSWORD from Step 4. Open BLUDIT_ADMIN_URL and sign in as admin.

The dashboard shows your published pages, drafts and scheduled posts, the visits counter and Bludit's notifications, with the admin menu on the left.

Choose New content. Give the page a title and write the body in the editor. The toolbar adds headings, lists, tables, links, images and embedded media.

Use Options for the page type, category, tags, cover image and URL. Choose Save to publish the page, or use the status switch to keep it as a draft or schedule it.

Settings > General sets the site title, slogan, description and footer. The other tabs cover the URL (Advanced), SEO, social links, image sizes, language and the logo.

Users adds editors and authors. Themes changes the look. Plugins switches on extras such as a contact form, a sitemap or the REST API.

Leave Settings > Advanced > URL as it is. If you change the host name with bludit-set-hostname (Step 10), that command sets the URL for you.

Everything Bludit stores (pages, uploads, settings, users and plugin data) is on its own EBS volume. Inspect it:

df -h /var/lib/bludit-content | awk 'NR==1 || /bludit/'
sudo ls /var/lib/bludit-content /var/lib/bludit-content/databases

Filesystem Size Used Avail Use% Mounted on /dev/nvme0n1 20G 176K 19G 1% /var/lib/bludit-content /var/lib/bludit-content: databases lost+found pages tmp uploads workspaces /var/lib/bludit-content/databases: categories.php pages.php plugins security.php site.php syslog.php tags.php users.php

Back it up with an EBS snapshot of that volume, or copy the folder (sudo tar -C /var/lib -czf bludit-content.tar.gz bludit-content).

To grow it, enlarge the volume in EC2 and run sudo resize2fs on its device.

Port 80 sends browsers to HTTPS, and the health endpoint answers for load balancer checks. The installer, Bludit's databases and its internal PHP files are not reachable:

H=$(sudo grep '^BLUDIT_URL=' /root/bludit-credentials.txt | sed -E 's#^BLUDIT_URL=https://([^/]+)/.*#\1#')
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/admin/"
curl -sk --resolve "$H:443:127.0.0.1" "https://$H/healthz" for p in /install.php '/install.php?demo=true' /bl-content/databases/users.php /bl-kernel/boot/init.php; do
curl -sk -o /dev/null -w "$p: %{http_code}\n" --resolve "$H:443:127.0.0.1" "https://$H$p" done
curl -s -o /dev/null -w 'unknown host name: %{http_code}\n' -H 'Host: example.com' http://127.0.0.1/ || true

port 80: 301 -> https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/admin/ ok /install.php: 404 /install.php?demo=true: 404 /bl-content/databases/users.php: 404 /bl-kernel/boot/init.php: 404 unknown host name: 000

The code 000 means nginx closed the connection without an answer.

Bludit has exactly one user, its site URL is the configured host, and the login lockout is on (ten failures, five minutes):

sudo -u www-data php /usr/local/lib/sac/bludit/bludit-admin.php summary

users=admin:admin url=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com minutesBlocked=5 numberFailuresAllowed=10 blackList=0

Only root can read the credentials file, only the web server can read the user database, and root owns the code:

sudo stat -c '%a %U:%G %n' /root/bludit-credentials.txt /var/lib/bludit-content/databases/users.php /var/www/bludit/index.php

600 root:root /root/bludit-credentials.txt 640 www-data:www-data /var/lib/bludit-content/databases/users.php 644 root:root /var/www/bludit/index.php

The certificate was generated on this instance and names its own addresses:

H=$(sudo grep '^BLUDIT_URL=' /root/bludit-credentials.txt | sed -E 's#^BLUDIT_URL=https://([^/]+)/.*#\1#')
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

nginx and PHP cannot reach the instance metadata service. PHP cannot run shell commands and is confined to Bludit's folders. nginx hands PHP the configured host name and the real client address from the connection, never values a client sends:

systemctl show nginx -p IPAddressDeny
systemctl show php8.3-fpm -p IPAddressDeny php-fpm8.3 -i 2>/dev/null | grep -E '^(open_basedir|disable_functions|expose_php) ' | cut -d' ' -f1-3 grep -E 'fastcgi_param (HTTP_HOST|HTTP_X_FORWARDED_FOR|HTTP_X_REAL_IP)' /etc/nginx/sites-available/sac-bludit

IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 disable_functions => exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec expose_php => Off open_basedir => /var/www/bludit/:/var/lib/bludit-content/:/var/lib/php/sessions/:/tmp/ fastcgi_param HTTP_HOST $bludit_host; fastcgi_param HTTP_X_FORWARDED_FOR $remote_addr; fastcgi_param HTTP_X_REAL_IP $remote_addr;

If you lock yourself out with ten wrong passwords, wait five minutes or clear the block list:

sudo bludit-reset-lockout

Point a DNS record at the instance, then set the name Bludit is served as. The command below mints a new self-signed certificate for the name. It updates nginx, Bludit's site URL (links, RSS and sitemap) and the URLs in /root/bludit-credentials.txt, and it keeps the name across reboots:

sudo bludit-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx. Running bludit-set-hostname again replaces it with a self-signed certificate.

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/bludit.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/bludit.key
sudo nginx -t && sudo systemctl reload nginx

Once browsers trust the certificate, you can also add an HSTS header (add_header Strict-Transport-Security "max-age=31536000" always;) to the HTTPS server in /etc/nginx/sites-available/sac-bludit.

The image does not send one. Browsers ignore HSTS from a site whose certificate they do not trust, so it only takes effect with a trusted certificate.

bludit-set-password gives the admin user a new random password, with a new salt and API token, and records it in /root/bludit-credentials.txt. Run it without arguments, or pass your own password (24 to 64 letters and digits) on stdin.

You can also change the password of any user in the admin panel under Users.

sudo bludit-set-password printf '%s\n' '<your-new-password>' | sudo bludit-set-password --stdin

To move to a newer Bludit release later, snapshot the instance and download the release zip from bludit.com or GitHub. Replace index.php and the bl-kernel, bl-languages, bl-plugins and bl-themes folders under /var/www/bludit, and keep them owned by root.

Your site is untouched, because it lives on the content volume. Do not copy the release's install.php into the web root. The image ships the version named in the listing.

• Bludit code (root-owned): /var/www/bludit
• Content (pages, uploads, settings, users): /var/lib/bludit-content (own EBS volume; /var/www/bludit/bl-content points to it)
• nginx site: /etc/nginx/sites-available/sac-bludit
• PHP settings: /etc/php/8.3/fpm/conf.d/99-sac-bludit.ini
• Certificate and key: /etc/nginx/ssl/
• First boot script: /usr/local/sbin/bludit-firstboot.sh
• Helpers: /usr/local/sbin/bludit-set-hostname, /usr/local/sbin/bludit-set-password, /usr/local/sbin/bludit-reset-lockout
• Credentials: /root/bludit-credentials.txt (mode 0600)

• Allow port 22 in the security group from your own networks only.
• Keep the admin password secret, and rotate it if it may have been shared (Step 11). Give other people their own Editor or Author accounts instead of sharing admin.
• Use your own DNS name and a certificate your browsers trust (Step 10).
• Keep the operating system patched. Unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else.
• Snapshot the content volume regularly (Step 8).