ERPNext

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for ERPNext. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.large or larger. ERPNext runs several services (the web workers, background workers, the socket.io server, Redis and MariaDB) and benefits from the extra memory. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that opens port 22 from your management network and port 80 for the desk. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes a short time after the instance state becomes Running and the status checks pass. During this time, the per-instance Administrator password is generated and applied, and the production stack starts.

This command launches an instance from the SecureAnyCloud ERPNext Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=erpnext}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find it in the EC2 console or with aws ec2 describe-instances.

Connect over SSH using your key pair and the login user for your operating system variant. For Ubuntu 22.04, the SSH login user is ubuntu.

ssh -i <key-name>.pem ubuntu@<public-ip>

The ERPNext Administrator password is unique to your instance and was generated on first boot. Read it as root:

sudo cat /root/erpnext-aws-credentials.txt

The file lists the desk URL, the Administrator login (Administrator) and the generated password. Keep this password somewhere safe.

nginx serves the desk on port 80, in front of the gunicorn web workers. In a browser, open:

http://<instance-public-ip>/

Sign in as Administrator with the password from the credentials file. On first sign-in, ERPNext launches the setup wizard. Choose your language and region, create your company and chart of accounts, and add your first users.

Over SSH, confirm that the database, Redis, the supervisor process group and the nginx proxy are active and that the application answers:

sudo systemctl is-active mariadb redis-server supervisor nginx curl -s -o /dev/null -w 'ping HTTP %{http_code}\n' 'http://127.0.0.1/api/method/ping'

All four services report active, and the Frappe API answers 200 on /api/method/ping. To see the individual Frappe processes that supervisor manages, run:

sudo supervisorctl status

These processes are the gunicorn web workers, the background workers, the realtime socket.io server and the bench Redis instances.

MariaDB, Redis and the application workers all listen on loopback only and are never exposed publicly. Only nginx on port 80 is reachable from outside the instance.

After the setup wizard, you land on the desk home with the module workspaces. Each workspace lists the masters, transactions and reports for its area:

• Accounting for your chart of accounts, journal entries, sales and purchase invoices and financial reports
• Stock for items, warehouses and stock entries
• Selling and Buying for the order-to-cash and procure-to-pay cycles
• Manufacturing for bills of materials and work orders
• CRM for leads and opportunities
• Projects, HR and Support for the remaining suites

Every record in ERPNext is a Frappe DocType rendered through a consistent list and form interface. Open any list, for example Items or Sales Invoices, to filter, sort, bulk edit and export records. Select + Add to create a new document.

Every ERPNext operation is also available programmatically through the Frappe REST API on the same port 80. Authenticate by posting your credentials to /api/method/login, which returns a session cookie. Then call the resource endpoints.

This example logs in and fetches the list of companies. Replace <public-ip> with your instance address and <new-password> with your Administrator password:

curl -s -c /tmp/erpnext-cookies.txt \
  --data-urlencode 'usr=Administrator' \
  --data-urlencode 'pwd=<new-password>' \
  'http://<public-ip>/api/method/login'
curl -s -b /tmp/erpnext-cookies.txt \
  'http://<public-ip>/api/resource/Company'

For server-to-server integrations, generate an API key and secret for a user under the user's settings in the desk. Send them in an Authorization: token <key>:<secret> header instead of using the cookie flow. Treat API keys like passwords, and scope each integration to the minimum role it needs.

Manage ERPNext through the Frappe bench command line as the frappe user. The bench lives at /home/frappe/frappe-bench, and the site name is stored in /var/lib/sac/config/sac-erpnext-site. To run a bench command, switch to the bench directory as the frappe user. For example, print the installed app versions:

sudo -u frappe -H bash -lc 'cd /home/frappe/frappe-bench && bench version'

Common operations include:

• bench --site <site> set-admin-password <new-password> to change the Administrator password
• bench --site <site> backup to take a database and files backup
• bench --site <site> clear-cache after configuration changes

The value to substitute for <site> is the site name in /var/lib/sac/config/sac-erpnext-site.

The ERPNext database lives on a dedicated EBS volume mounted at /var/lib/mysql. This keeps the database off the operating system disk and lets you resize or snapshot it independently. Confirm the mount with:

df -h /var/lib/mysql

To grow the database store, expand the EBS volume in the AWS console. Then grow the filesystem on the instance with sudo resize2fs on the underlying device. Because the database is on its own volume, you can snapshot it for backup, or detach it and reattach it to a replacement instance.

nginx serves the desk over plain HTTP on port 80. For production use, place it behind a custom domain and TLS. First boot pins the site host name to your instance public IP, so the desk is reachable immediately. To use a domain name, set the site host name to your domain as the frappe user. Replace <your-domain> with your domain:

sudo -u frappe -H bash -lc 'cd /home/frappe/frappe-bench && bench --site $(cat /var/lib/sac/config/sac-erpnext-site) set-config host_name "https://<your-domain>"'

Point the domain's DNS A record at the instance public IP. To terminate TLS, choose one of two options. Place the instance behind an Application Load Balancer with a managed certificate. Or install Certbot on the instance and configure nginx to listen on 443 with your certificate, proxying to the Frappe upstreams exactly as the bundled site does for port 80.

Restrict the security group so that ports 80 and 443 are reachable only from the networks that need the desk.

Back up ERPNext by snapshotting the /var/lib/mysql EBS volume, which captures the entire database. Also keep a copy of the site directory under /home/frappe/frappe-bench/sites, which holds the site configuration and the uploaded files.

You can also take a logical backup with the bench backup command. It writes a database dump and a files archive into the site's private/backups directory:

sudo -u frappe -H bash -lc 'cd /home/frappe/frappe-bench && bench --site $(cat /var/lib/sac/config/sac-erpnext-site) backup --with-files'

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. MariaDB, Redis, supervisor and nginx start automatically on boot, and the Administrator password is preserved across reboots.

Take a backup, then upgrade ERPNext and the Frappe framework with the bench update workflow. See the Frappe documentation for the upgrade procedure that matches your version.