CodeIgniter 4.7.5

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick CodeIgniter 4.7.5 Host on Ubuntu 24.04 as the software version, choose your Region, and select Launch through EC2.

Choose m5.large, your key pair and a security group as described above. The AMI brings two volumes: an 8 GiB root volume and a 20 GiB application volume. You can make either larger at launch.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=codeigniter}]'

First boot finishes a few seconds after the instance is running. Creating the database and its account and running the application's migration takes about 3 seconds.

Connect with SSH as the ubuntu user, the default user for CodeIgniter 4.7.5 Host on Ubuntu 24.04:

ssh -i <your-key.pem> ubuntu@<public-ip>

On first boot the image creates the certificate, the admin password, the encryption key, and the database with its socket-authenticated account. It then runs the application's migration and starts nginx and PHP-FPM. Confirm that all four services are active and first boot is done:

systemctl is-active codeigniter-firstboot nginx php8.3-fpm mariadb
sudo test -f /var/lib/sac/data/codeigniter-firstboot.done && echo FIRSTBOOT_DONE

active active active active FIRSTBOOT_DONE

Only SSH and nginx listen on network ports, and nginx listens on 443 only. PHP-FPM (9000) and MariaDB (3306) listen on the loopback address:

sudo ss -Hltn | awk '{print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 127.0.0.1:3306 127.0.0.1:9000 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443

Read the credentials file with sudo. Only root can read it:

sudo cat /root/codeigniter-credentials.txt

The file looks like this:

# CodeIgniter 4.7.5 Host - generated on first boot by codeigniter-firstboot.service
# These credentials are unique to this instance; none was baked into the image. Keep this file secret. CI_APP_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/ CI_ADMIN_USER=admin CI_ADMIN_PASSWORD=<CI_ADMIN_PASSWORD> CI_DB_NAME=codeigniter CI_DB_USER=www-data CI_TLS_CERT=/etc/nginx/tls/codeigniter.crt CI_CERT_SHA256=04:51:85:89:...:13:0F:5A:2B:51:6C CI_APP_DIR=/srv/codeigniter/app
#
# nginx (HTTPS on 443, HTTP Basic auth) is the only public entry point. PHP-FPM (127.0.0.1:9000) and MariaDB
# (127.0.0.1:3306) listen on loopback only. /health is an unauthenticated probe answered by nginx.
# The application connects to MariaDB as the PHP-FPM user www-data over the local socket; MariaDB authenticates it
# by the socket peer (unix_socket), so there is no database password. On-box maintenance:
sudo mariadb
# The CodeIgniter encryption key is in /srv/codeigniter/app/.env.
# New admin password:
sudo codeigniter-rotate-password
# Change the name it serves as:
sudo codeigniter-set-hostname <your-dns-name>
# User guide: https://secureanycloud.com/stacks/codeigniter-4-7-5/

The URL uses the instance's public DNS name from the EC2 instance metadata. The certificate is generated on your instance and also names the public and private addresses. Inspect it with:

openssl x509 -noout -subject -ext subjectAltName -enddate -in /etc/nginx/tls/codeigniter.crt

subject=CN = ec2-32-197-202-84.compute-1.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-32-197-202-84.compute-1.amazonaws.com, IP Address:32.197.202.84, IP Address:172.31.84.216, IP Address:127.0.0.1, DNS:localhost notAfter=Jan 22 12:46:19 2029 GMT

Open CI_APP_URL in your browser and sign in as admin with CI_ADMIN_PASSWORD. The certificate is self-signed, so your browser asks you to confirm it the first time. You can install your own certificate in Step 9.

The sample application shows the CodeIgniter, PHP and MariaDB versions and a request counter. The counter is a row in a MariaDB table that a CodeIgniter migration created on first boot. Every request reads and writes it, so a number that goes up when you reload proves that the migration ran and the database round trip works.

The same facts are available as JSON for monitoring. From the instance itself, run the following. The password is passed to curl on standard input, never on the command line:

H=$(sudo sed -n 's#^CI_APP_URL=https://\(.*\)/$#\1#p' /root/codeigniter-credentials.txt) printf 'user = "admin:%s"\n' "$(sudo sed -n 's/^CI_ADMIN_PASSWORD=//p' /root/codeigniter-credentials.txt)" \
  | curl -s -K - --cacert /etc/nginx/tls/codeigniter.crt --resolve "$H:443:127.0.0.1" "https://$H/api/info" | jq .

{ "product": "sac CodeIgniter 4 Host", "codeigniterVersion": "4.7.5", "phpVersion": "8.3.6", "databaseServer": "10.11.14-MariaDB-0ubuntu0.24.04.1", "dbConnected": true, "environment": "production", "baseUrl": "https://ec2-32-197-202-84.compute-1.amazonaws.com/", "selfUrl": "https://ec2-32-197-202-84.compute-1.amazonaws.com/", "requestHost": "ec2-32-197-202-84.compute-1.amazonaws.com", "requestScheme": "https", "clientIp": "127.0.0.1", "requestsServed": 1 }

Without the password, nothing is reachable except the health probe, which load balancers and monitoring can use:

H=$(sudo sed -n 's#^CI_APP_URL=https://\(.*\)/$#\1#p' /root/codeigniter-credentials.txt)
curl -s -o /dev/null -w 'anonymous -> HTTP %{http_code}\n' --cacert /etc/nginx/tls/codeigniter.crt --resolve "$H:443:127.0.0.1" "https://$H/"
curl -s --cacert /etc/nginx/tls/codeigniter.crt --resolve "$H:443:127.0.0.1" "https://$H/health"

anonymous -> HTTP 401 ok

The application lives in /srv/codeigniter/app (a standard CodeIgniter 4 app starter layout), and nginx serves /srv/codeigniter/app/public. Add a controller and a route exactly as on any CodeIgniter install. The code is owned by root, so edit it with sudo:

sudo tee /srv/codeigniter/app/app/Controllers/Hello.php >/dev/null <<'PHP' <?php namespace App\Controllers; class Hello extends BaseController { public function index(): string { return 'Hello from my own CodeIgniter controller on ' . site_url('/'); } } PHP
sudo tee -a /srv/codeigniter/app/app/Config/Routes.php >/dev/null <<'PHP' $routes->get('hello', 'Hello::index'); PHP
sudo php -l /srv/codeigniter/app/app/Controllers/Hello.php
sudo php -l /srv/codeigniter/app/app/Config/Routes.php
sudo systemctl reload php8.3-fpm

No syntax errors detected in /srv/codeigniter/app/app/Controllers/Hello.php No syntax errors detected in /srv/codeigniter/app/app/Config/Routes.php

Use a quoted here-document (<<'PHP') so that $routes reaches the file literally. The php -l check catches a broken Routes.php before you reload.

Open https://<your-instance>/hello in your browser, or fetch it over HTTPS from the instance:

H=$(sudo sed -n 's#^CI_APP_URL=https://\(.*\)/$#\1#p' /root/codeigniter-credentials.txt) printf 'user = "admin:%s"\n' "$(sudo sed -n 's/^CI_ADMIN_PASSWORD=//p' /root/codeigniter-credentials.txt)" \
  | curl -s -K - --cacert /etc/nginx/tls/codeigniter.crt --resolve "$H:443:127.0.0.1" "https://$H/hello"; echo

Hello from my own CodeIgniter controller on https://ec2-32-197-202-84.compute-1.amazonaws.com/

Note that site_url() returns the configured https:// address. CodeIgniter builds every link from app.baseURL, never from the request.

Replace the sample with your own code in /srv/codeigniter/app. Keep the existing .env, which holds this instance's encryption key and database connection settings.

Run Composer as root, because the code is owned by root and read-only to PHP. Install without development packages, then reload PHP-FPM:

cd /srv/codeigniter/app
sudo COMPOSER_ALLOW_SUPERUSER=1 composer install --no-dev --optimize-autoloader --no-interaction sudo systemctl reload php8.3-fpm

Composer is part of the image. Check its version:

composer --version

Composer version 2.7.1 2024-02-09 15:26:28

Keep writable/ owned by www-data and everything else owned by root. Put your migrations in app/Database/Migrations/ and run them as the web user:

cd /srv/codeigniter/app && sudo -u www-data php spark migrate:status

CodeIgniter v4.7.5 Command Line Tool - Server Time: 2026-10-20 12:46:46 UTC+00:00 +-----------+-------------------+---------------------+---------+---------------------+-------+ | Namespace | Version | Filename | Group | Migrated On | Batch | +-----------+-------------------+---------------------+---------+---------------------+-------+ | App | 2026-01-01-000000 | CreateStackCounters | default | 2026-10-20 12:46:21 | 1 | +-----------+-------------------+---------------------+---------+---------------------+-------+

Apply new migrations with sudo -u www-data php spark migrate.

The application's database account is the PHP-FPM user www-data, and MariaDB authenticates it by the local socket (unix_socket). As a result, .env carries no database password and none exists on the instance:

sudo grep '^database' /srv/codeigniter/app/.env
sudo mariadb -t -e "SELECT CONCAT(user,'@',host) AS account, JSON_VALUE(Priv,'$.plugin') AS auth FROM mysql.global_priv WHERE user='www-data';"

database.default.hostname = localhost database.default.database = codeigniter database.default.username = www-data database.default.DBDriver = MySQLi +--------------------+-------------+ | account | auth | +--------------------+-------------+ | www-data@localhost | unix_socket | +--------------------+-------------+

hostname = localhost means the local socket. Only the www-data user can use that account. Any other user is refused, and the account cannot log in over TCP at all:

sudo -u www-data mariadb -t -e 'SELECT counter_key, hits FROM codeigniter.stack_counters;'
sudo mariadb -u www-data -e 'SELECT 1' 2>&1 || true

+-------------+------+ | counter_key | hits | +-------------+------+ | requests | 2 | +-------------+------+ ERROR 1698 (28000): Access denied for user 'www-data'@'localhost'

For maintenance, root reaches every database over the same socket with sudo mariadb. If your own application needs a password or a TCP account, create it with sudo mariadb and store the password outside the web root.

Inspect the two mounts that hold your application and database:

findmnt -no SOURCE,TARGET,FSTYPE,SIZE,OPTIONS /srv/codeigniter
findmnt -no SOURCE,TARGET,FSTYPE /var/lib/mysql

/dev/nvme1n1 /srv/codeigniter ext4 19.5G rw,nosuid,nodev,relatime /dev/nvme1n1[/mysql] /var/lib/mysql ext4

/srv/codeigniter is the application volume. /var/lib/mysql is a bind mount of /srv/codeigniter/mysql, so the database files live on the same volume while MariaDB keeps its standard path.

To grow the volume, resize it in EC2 and then run sudo resize2fs /dev/nvme1n1.

Point a DNS name at the instance. An Elastic IP keeps the address stable. Then tell the instance to serve that name. This issues a new self-signed certificate for it, pins nginx to it and sets CodeIgniter's app.baseURL:

sudo codeigniter-set-hostname <your-domain>

To use a certificate from a public CA, replace /etc/nginx/tls/codeigniter.crt and /etc/nginx/tls/codeigniter.key, keeping the key 0600 root. Then run sudo systemctl reload nginx.

Requests for any other host name are dropped, and allowedHostnames stays empty. CodeIgniter therefore never builds a link from the Host a client sends.

Send a request with a host name the instance does not serve. The connection is closed without an answer:

curl -sk -o /dev/null -w 'forged Host -> HTTP %{http_code} (000 = connection closed)\n' -H 'Host: evil.example' https://127.0.0.1/health || true

forged Host -> HTTP 000 (000 = connection closed)

Forged forwarding headers change nothing. The application still builds its URLs from the configured name and sees the real client address:

H=$(sudo sed -n 's#^CI_APP_URL=https://\(.*\)/$#\1#p' /root/codeigniter-credentials.txt) printf 'user = "admin:%s"\n' "$(sudo sed -n 's/^CI_ADMIN_PASSWORD=//p' /root/codeigniter-credentials.txt)" \
  | curl -s -K - --cacert /etc/nginx/tls/codeigniter.crt --resolve "$H:443:127.0.0.1" \
  -H 'X-Forwarded-Host: evil.example' -H 'X-Forwarded-For: 203.0.113.9' "https://$H/api/info" | jq '{selfUrl, requestHost, clientIp}'

{ "selfUrl": "https://ec2-32-197-202-84.compute-1.amazonaws.com/", "requestHost": "ec2-32-197-202-84.compute-1.amazonaws.com", "clientIp": "127.0.0.1" }

Only the front controller runs. The configuration and writable/ are not on the web, and there is no port 80 listener:

H=$(sudo sed -n 's#^CI_APP_URL=https://\(.*\)/$#\1#p' /root/codeigniter-credentials.txt) for p in /.env /writable/ /app/Config/App.php /vendor/autoload.php; do printf 'user = "admin:%s"\n' "$(sudo sed -n 's/^CI_ADMIN_PASSWORD=//p' /root/codeigniter-credentials.txt)" \
  | curl -s -o /dev/null -w "GET $p -> HTTP %{http_code}\n" -K - --cacert /etc/nginx/tls/codeigniter.crt --resolve "$H:443:127.0.0.1" "https://$H$p" done curl -s -o /dev/null -m 5 http://127.0.0.1/; echo "port 80 -> curl exit $? (7 = nothing listening)"

GET /.env -> HTTP 404 GET /writable/ -> HTTP 404 GET /app/Config/App.php -> HTTP 404 GET /vendor/autoload.php -> HTTP 404 port 80 -> curl exit 7 (7 = nothing listening)

The web stack is blocked from the instance metadata service. Your own shell is not:

systemctl show -p IPAddressDeny nginx php8.3-fpm mariadb codeigniter-firstboot

IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32

The image also ships the credential check that the build runs: sudo /usr/local/sbin/codeigniter-credential-round-trip.sh.

Run the rotate command to set a new admin password:

sudo codeigniter-rotate-password

This writes a new random password for admin as a bcrypt hash, never on a command line. It records the password in /root/codeigniter-credentials.txt and reloads nginx.

To serve the application publicly without the password prompt, for example once your app has its own login, delete the two lines in /etc/nginx/codeigniter-auth.conf and run sudo systemctl reload nginx.

List the pinned component versions and the licence of each Composer package:

grep -E '^PINNED_' /opt/sac/codeigniter-versions.txt cd /srv/codeigniter/app && php -r '$l=json_decode(file_get_contents("composer.lock"),true); foreach($l["packages"] as $p) printf("%-26s %-8s %s\n",$p["name"],$p["version"],implode(",",(array)$p["license"]));'

PINNED_CODEIGNITER=4.7.5 PINNED_PHP=8.3.6 PINNED_MARIADB=10.11.14-MariaDB-0ubuntu0.24.04.1 PINNED_COMPOSER=2.7.1 codeigniter4/framework v4.7.5 MIT laminas/laminas-escaper 2.18.0 BSD-3-Clause psr/log 3.0.2 MIT