changedetection.io 0.60.10

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened Actual Budget & Self-Hosted Personal Apps AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for the full launch wizard. In Version, choose changedetection.io 0.60.10 on Ubuntu 24.04, then choose your Region.
• Pick an instance type (m5.large recommended; the software charge is $0.04 per vCPU per hour) and your key pair.
• Set the security group. The listing's default group opens SSH (22), HTTP (80) and HTTPS (443). Restrict SSH to your own IP address, and restrict 80 and 443 to the networks you work from.
• Choose your VPC and subnet, keep the metadata defaults (the image already requires IMDSv2), then choose Launch.

Option B: AWS CLI

Run these commands on your own workstation. They create a security group that allows SSH from your management address and HTTPS from your own network, then launch the instance. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the VPC, subnet, key pair and CIDR ranges with your own:

SG=$(aws ec2 create-security-group --group-name changedetection \
  --description "changedetection.io" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 443 --cidr 203.0.113.0/24
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 80 --cidr 203.0.113.0/24
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=changedetection}]'

You do not need --metadata-options or --block-device-mappings: the AMI already requires IMDSv2 and brings its 20 GiB data volume. To keep the address across a stop and start, associate an Elastic IP.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot finishes within a minute or two of launch. It sets the hostname that changedetection.io is served as (the instance's public DNS name when it has one) and creates the TLS certificate for it. It then generates the login password, lets changedetection.io create its datastore, and proves that the password and the API key work.

Last, it writes /root/changedetection-credentials.txt (mode 0600, root) and opens nginx. These are the entries in that file (the secrets are not shown here):

sudo grep -E '^CHANGEDETECTION_URL=' /root/changedetection-credentials.txt
sudo grep -oE '^[A-Z_]+=' /root/changedetection-credentials.txt
sudo stat -c '%a %U:%G' /root/changedetection-credentials.txt

CHANGEDETECTION_URL=https://ec2-3-83-154-156.compute-1.amazonaws.com/ CHANGEDETECTION_URL= CHANGEDETECTION_PASSWORD= <set-at-first-boot>= 600 root:root

• CHANGEDETECTION_URL: the address of this instance's changedetection.io
• CHANGEDETECTION_PASSWORD: the login password, generated on this instance (changedetection.io has no username)
• CHANGEDETECTION_API_KEY: the REST API key, created on this instance (send it as the x-api-key header)

To read the values, run sudo cat /root/changedetection-credentials.txt in your own session, and store them in your password manager.

Check that Docker, the metadata firewall rule, changedetection.io and nginx are active. Only sshd and nginx listen beyond loopback. changedetection.io is on 127.0.0.1:5000, and its data is on the separate EBS volume.

systemctl is-active docker.service sac-docker-imds-deny.service changedetection.service nginx.service
sudo docker ps --format '{{.Names}} {{.Image}} {{.Ports}}' | sed -E 's/@sha256:[0-9a-f]+//'
sudo ss -Htlnp | awk '{print $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort -u findmnt -no SOURCE,FSTYPE,SIZE /var/lib/changedetection curl -sk https://127.0.0.1/healthz

active active active active changedetection ghcr.io/dgtlmoon/changedetection.io:0.60.10 127.0.0.1:5000->5000/tcp 0.0.0.0:22 users:(("sshd"),("systemd")) 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) 127.0.0.1:5000 users:(("docker-proxy")) 127.0.0.53%lo:53 users:(("systemd-resolve")) 127.0.0.54:53 users:(("systemd-resolve")) [::]:22 users:(("sshd"),("systemd")) [::]:443 users:(("nginx"),("nginx"),("nginx")) [::]:80 users:(("nginx"),("nginx"),("nginx")) /dev/nvme1n1 ext4 19.5G ok

/healthz is answered by nginx itself and reveals nothing, so you can safely use it as a load balancer health check.

A signed-out visit to the watch list is redirected to the sign-in page. The REST API refuses requests without the key or with a wrong one. A cross-origin POST is refused, an unknown Host header gets no answer, and plain HTTP redirects to HTTPS.

The last line uses this instance's own API key and shows the version and an empty watch list:

H=$(sudo sed -n 's/^set \$app_host "\(.*\)";$/\1/p' /etc/nginx/changedetection-host.conf) R=(--resolve "$H:443:127.0.0.1")
K=$(sudo grep '^CHANGEDETECTION_API_KEY=' /root/changedetection-credentials.txt | cut -d= -f2-) api() { curl -sk "${R[@]}" -H @<(printf 'x-api-key: %s\n' "$K") "$@"; } curl -sk "${R[@]}" -o /dev/null -w 'watch list, signed out -> %{http_code}\n' "https://$H/" curl -sk "${R[@]}" -o /dev/null -w 'API, no key -> %{http_code}\n' "https://$H/api/v1/watch" curl -sk "${R[@]}" -o /dev/null -w 'API, wrong key -> %{http_code}\n' -H 'x-api-key: not-the-real-key' "https://$H/api/v1/watch" curl -sk "${R[@]}" -o /dev/null -w 'cross-origin POST -> %{http_code}\n' -X POST -H 'Origin: https://evil.example' -d 'password=x' "https://$H/login" curl -sk -o /dev/null -w 'unknown Host -> %{http_code}\n' -H 'Host: evil.example' https://127.0.0.1/ || true curl -s -o /dev/null -w 'http -> %{http_code}\n' -H "Host: $H" http://127.0.0.1/ api "https://$H/api/v1/systeminfo" | jq -c '{version, watch_count, tag_count}'

watch list, signed out -> 302 API, no key -> 403 API, wrong key -> 403 cross-origin POST -> 403 unknown Host -> 000 http -> 301 {"version":"0.60.10","watch_count":0,"tag_count":0}

The API key reaches curl through a header file on a file descriptor (-H @<(...)), so it never appears on a command line or in your shell history.

Browse to CHANGEDETECTION_URL (https://<public-dns-name>/). The certificate is self-signed, so your browser warns once. Accept it for this host, or install your own certificate (Step 8).

changedetection.io has a single password and no username. Enter CHANGEDETECTION_PASSWORD:

A new instance has no watches, no tags and no notification targets.

Paste a URL into Web page URL and choose Watch, or use the REST API. These commands add three watches with the default check interval and list them once their first check has run:

H=$(sudo sed -n 's/^set \$app_host "\(.*\)";$/\1/p' /etc/nginx/changedetection-host.conf) R=(--resolve "$H:443:127.0.0.1")
K=$(sudo grep '^CHANGEDETECTION_API_KEY=' /root/changedetection-credentials.txt | cut -d= -f2-) api() { curl -sk "${R[@]}" -H @<(printf 'x-api-key: %s\n' "$K") "$@"; } for site in https://secureanycloud.com/ https://changedetection.io/CHANGELOG.txt https://www.debian.org/News/; do jq -nc --arg u "$site" '{url:$u}' | api -H 'Content-Type: application/json' \
  --data-binary @- "https://$H/api/v1/watch" | jq -e '.uuid' >/dev/null && echo "watching $site" done sleep 60 api "https://$H/api/v1/watch" | jq -r 'to_entries[] | "\(.value.url) checked=\(.value.last_checked > 0) error=\(.value.last_error)"' | sort

watching https://secureanycloud.com/ watching https://changedetection.io/CHANGELOG.txt watching https://www.debian.org/News/ https://changedetection.io/CHANGELOG.txt checked=true error=false https://secureanycloud.com/ checked=true error=false https://www.debian.org/News/ checked=true error=false

The watch list shows each page's title, when it was last checked and when it last changed:

Preview shows the text of the latest snapshot. Once a page changes, History highlights what was added and removed between any two snapshots:

changedetection.io fetches from this instance, so a watch reaches whatever the instance can reach on the public internet. Private, link-local and carrier-grade NAT addresses, including the instance metadata service, are refused by design.

These checks confirm the following:

• A watch pointed at the instance metadata service is refused by changedetection.io's URL filter (and is then deleted).
• The certificate was made for this instance on first boot.
• Container traffic to the metadata service is dropped, and nginx, Docker and the changedetection unit are denied it as well.
• The container runs as an unprivileged user with no capabilities.
• The password file and datastore are closed to other users.

Run:

H=$(sudo sed -n 's/^set \$app_host "\(.*\)";$/\1/p' /etc/nginx/changedetection-host.conf) R=(--resolve "$H:443:127.0.0.1")
K=$(sudo grep '^CHANGEDETECTION_API_KEY=' /root/changedetection-credentials.txt | cut -d= -f2-) api() { curl -sk "${R[@]}" -H @<(printf 'x-api-key: %s\n' "$K") "$@"; }
U=$(jq -nc '{url:"http://169.254.169.254/latest/meta-data/"}' | api -H 'Content-Type: application/json' --data-binary @- "https://$H/api/v1/watch" | jq -r .uuid) api -o /dev/null "https://$H/api/v1/watch/$U?recheck=1"; sleep 20 api "https://$H/api/v1/watch/$U" | jq -r '.last_error' | cut -c1-110 api -o /dev/null -w 'metadata watch deleted -> %{http_code}\n' -X DELETE "https://$H/api/v1/watch/$U" openssl s_client -connect 127.0.0.1:443 -servername "$H" </dev/null 2>/dev/null | openssl x509 -noout -subject -enddate sudo iptables -S DOCKER-USER | grep DROP systemctl show -p IPAddressDeny --value nginx.service docker.service changedetection.service
sudo docker inspect --format '{{.Name}} user={{.Config.User}} cap_drop={{.HostConfig.CapDrop}} no_new_privs={{.HostConfig.SecurityOpt}}' changedetection
sudo stat -c '%a %U:%G %n' /opt/changedetection/secrets/admin_password /var/lib/changedetection

Exception: Fetch blocked: 'http://169.254.169.254/latest/meta-data/' resolves to a private/reserved IP address metadata watch deleted -> 204 subject=CN = ec2-3-83-154-156.compute-1.amazonaws.com, O = sac notAfter=Feb 9 09:30:43 2029 GMT -A DOCKER-USER -d 168.63.129.16/32 -j DROP -A DOCKER-USER -d 169.254.169.254/32 -j DROP 168.63.129.16/32 169.254.169.254/32 168.63.129.16/32 169.254.169.254/32 168.63.129.16/32 169.254.169.254/32 /changedetection user=10001:10001 cap_drop=[ALL] no_new_privs=[no-new-privileges:true] 600 root:root /opt/changedetection/secrets/admin_password 700 UNKNOWN:UNKNOWN /var/lib/changedetection

The datastore belongs to uid 10001, the container's user, which has no account on the host (hence UNKNOWN).

Point a DNS record at the instance (an Elastic IP keeps the address stable), then tell changedetection.io the name. The helper re-issues the self-signed certificate for the name and updates nginx's accepted names and the cross-origin guard. It also records the name in /etc/sac/changedetection-hostname (kept across reboots) and updates CHANGEDETECTION_URL:

sudo changedetection-set-hostname watch.example.com

changedetection-set-hostname: changedetection.io is served at https://watch.example.com/

Until you set a name, the instance follows its own public DNS name. If it comes back from a stop and start with a new address, the certificate and nginx names are updated at boot.

To use a certificate from your own CA or from Let's Encrypt instead, replace /etc/ssl/changedetection/changedetection.crt and /etc/ssl/changedetection/changedetection.key (keep the key mode 0600, owner root). Set the name with changedetection-set-hostname first, so the automatic refresh leaves your certificate alone. Then run sudo systemctl reload nginx.

Open Settings to change the default check interval, global filters, fetching options and time zone, and to add notification targets. Settings > Notifications (and each watch's Edit > Notifications) take Apprise URLs, for example mailtos://user:password@smtp.example.com, slack://TokenA/TokenB/TokenC/#channel or json://hooks.example.com/changes.

Click Send test notification to check the target straight away. The full list of services is in the Apprise documentation.

Keep the password. The Remove password button would leave the instance open to anyone who can reach it. This image refuses to start changedetection.io without a password. After a restart, the service stays down until you run sudo changedetection-reset-password (see Troubleshooting).

changedetection.io's Settings page only offers Remove password while a password is set, so change the password from the shell instead, without ever opening the instance. Put the new password (at least 20 characters) into the root-only first-boot password file and re-seed it. changedetection-reset-password stores it as changedetection.io's salted hash and restarts the service:

sudo nano /opt/changedetection/secrets/admin_password
sudo changedetection-reset-password

Keep the file at mode 0600, owner root. To issue a new API key, use Settings > API > Regenerate API key and keep API access switched on. Then update /root/changedetection-credentials.txt with sudo nano, or delete that file, so it does not hold stale secrets.