Cloudreve 4.19.1

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Cloudreve 4.19.1 on Ubuntu 24.04 as the software version, choose your Region, and select Launch through EC2.

Choose m5.large, your key pair, a security group as described above, and a subnet. The AMI has an 8 GiB root volume, and uploaded files are stored on it (/var/lib/cloudreve/data). Raise the root volume under Configure storage to fit the files you plan to keep, or add an S3 storage policy later (Step 8).

To launch with the AWS CLI instead, replace the values in angle brackets. This command sets the root volume to 100 GiB:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=cloudreve}]'

Connect over SSH as the ubuntu user. Software version and SSH user:

Cloudreve 4.19.1 on Ubuntu 24.04: ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot generates the certificate, the configuration, the database and the administrator, then publishes the site. This takes about ten seconds. Confirm that all three services are active:

systemctl is-active cloudreve-firstboot cloudreve nginx

active active active

List the listening ports. Only SSH (22) and nginx (80, 443) listen on the network. Cloudreve (5212) listens on loopback, and the two port 53 entries are Ubuntu's local DNS resolver:

sudo ss -lntp | awk 'NR>1 {print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:5212 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

Query the health endpoint, which needs no sign-in, to see the Cloudreve version:

curl -sk https://127.0.0.1/api/v4/site/ping | python3 -c 'import json,sys; print(json.load(sys.stdin)["data"])'

4.19.1

If nginx serves nothing, first boot has not finished or has failed. When first boot fails, the site is never published. Check systemctl status cloudreve-firstboot and journalctl -u cloudreve-firstboot.

Read the credentials file as root:

sudo cat /root/cloudreve-credentials.txt

Only root can read the file. It holds the site address and this instance's administrator sign-in:

# Cloudreve on Ubuntu 24.04 (sac AWS Marketplace image) - this instance's administrator sign-in. # Generated on this instance at first boot; unique to it and not known to sac or the Cloudreve project. ... CLOUDREVE_URL=https://ec2-203-0-113-10.compute-1.amazonaws.com/ cloudreve.admin.email=admin@cloudreve.local cloudreve.admin.password=<CLOUDREVE_ADMIN_PASSWORD>

Optionally, confirm the sign-in from the instance itself. The helper signs in through nginx and checks that a wrong password and a new registration are refused. It then prints CLOUDREVE_ROUNDTRIP_OK:

sudo /usr/local/sbin/cloudreve-verify.sh | tail -1

CLOUDREVE_ROUNDTRIP_OK

The certificate is self-signed until you install your own (Step 9). Before you accept it in the browser, compare its SHA-256 fingerprint with the one the browser shows:

sudo openssl x509 -in /etc/ssl/cloudreve/cloudreve.crt -noout -fingerprint -sha256

sha256 Fingerprint=3F:A1:...:7C

Open the CLOUDREVE_URL address in your browser. Accept the certificate once, after comparing the fingerprint. Enter the e-mail address admin@cloudreve.local, choose Next, then enter the password from Step 4.

Change the administrator password now. Open Settings (the gear icon at the top right), then Password and security, and set a password of your own. You can also add a passkey or two-factor authentication there.

The password in /root/cloudreve-credentials.txt stops working once you change it. Delete the file after you have stored the new password safely. nginx allows two sign-in attempts a second per address, with a short burst, so a script hammering the sign-in page is slowed down with HTTP 429.

Open My Files, which is your drive. Use New to upload files or folders, or to create folders. You can also drag files onto the page. Large files are uploaded in chunks, so uploads of many gigabytes work through the browser.

Right-click a file or folder, or use its menu, and choose Share. Cloudreve creates a link that you can protect with a password and an expiry. Your links are listed under Shared by me.

Anyone with the link can download without an account. Download links that Cloudreve hands out carry a signature and expire, and they always use your instance's configured address.

Open Connect & Mount and choose Create new account to make a WebDAV account. You can limit it to one folder and make it read-only.

Cloudreve shows the WebDAV address (https://<your-host>/dav), the account name and a generated password. Use them in your file manager, a sync tool such as rclone, or a mobile app.

Open Dashboard in the left bar to reach the administration pages:

• Users: create an account for each person. Self-registration is off on this image. To let people sign up themselves, switch registration on under Settings, and consider enabling e-mail activation and a captcha there too.
• Groups: set quotas and permissions. New users join the User group (1 GB quota, sharing on). The Admin group has 1 TB. Raise the quotas to suit your disk.
• Storage Policy: the default policy stores files on the instance under /var/lib/cloudreve/data/uploads. Add an S3-compatible policy (Amazon S3, MinIO, Cloudflare R2 and others) to keep files in object storage instead, and assign it to a group.

Some administration entries carry a Pro badge. They belong to Cloudreve Pro, a separate commercial edition from the Cloudreve project that is not part of this image. Choosing them only shows information about it. The Summary page also shows the project's announcement board, which your browser loads from GitHub.

Remote Download fetches a URL or a torrent into your drive. It needs a separate downloader service that this image does not include, so it is not available out of the box.

Point a DNS record at the instance. An Elastic IP keeps the address across stop and start. Then tell the instance its name with the command below.

The command creates a new self-signed certificate for that name. It updates the nginx host rule, the cross-site guard, the address Cloudreve uses in its links and the address in the credentials file. It also keeps the name across reboots.

sudo cloudreve-set-hostname files.example.com

To use a certificate from a public authority instead, replace /etc/ssl/cloudreve/cloudreve.crt (full chain) and /etc/ssl/cloudreve/cloudreve.key (mode 0600, owned by root) with your own. Then run sudo systemctl reload nginx.

Running cloudreve-set-hostname again later replaces your certificate with a new self-signed pair.

Every service is enabled, so Cloudreve returns after a reboot or a stop and start. If the public address changes, the next boot re-issues the certificate and the address for the new name, unless you set your own name in Step 9. Unattended security upgrades keep the operating system and nginx patched. Confirm that the units are enabled:

systemctl is-enabled cloudreve cloudreve-set-host nginx unattended-upgrades

enabled enabled enabled enabled

Cloudreve itself is a single program, /opt/cloudreve/cloudreve, built by SecureAnyCloud from the 4.19.1 source. The file /usr/share/doc/sac/cloudreve/BUILD-PROVENANCE.txt records how. SecureAnyCloud publishes a new version of this image for new Cloudreve releases.

To move to a newer release yourself, read the release notes first, because a new release may migrate the database. Back up (Step 11), then replace the program with the new release from the Cloudreve releases page (the linux_amd64 archive). Finally, run sudo systemctl restart cloudreve.

Everything Cloudreve keeps is under /var/lib/cloudreve/data (the SQLite database cloudreve.db and the uploaded files), plus its configuration at /etc/cloudreve/conf.ini. Keep the database and the files together, because the database holds the file index and the encryption key for any files you store encrypted.

An EBS snapshot of the root volume, or AWS Backup on the instance, captures everything. For a file-level copy, stop Cloudreve briefly:

sudo systemctl stop cloudreve
sudo tar czf cloudreve-backup.tar.gz -C / var/lib/cloudreve/data etc/cloudreve/conf.ini
sudo systemctl start cloudreve

Back up files kept in an S3 storage policy with your bucket.