FileRise 3.38.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick FileRise 3.38.0 on Ubuntu 24.04 as the software version, choose your Region, and select Launch through EC2.

Choose m5.large, your key pair, a security group as above, and a subnet. The AMI brings an 8 GiB root volume and a separate 20 GiB data volume that holds your files. Raise the data volume under Configure storage if you need more space. You can also grow it later (see Step 9).

With the AWS CLI, replace the values in angle brackets. This command sets the data volume to 100 GiB:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sdf,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=filerise}]'

Connect over SSH. On FileRise 3.38.0 on Ubuntu 24.04, the SSH user is ubuntu.

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot generates the certificate, creates the administrator and starts the site. This takes a few seconds:

systemctl is-active filerise-host filerise-firstboot php8.3-fpm nginx

active active active active

Only SSH (22) and nginx (80, 443) listen on the network. PHP talks to nginx over a local socket, and the two loopback entries are Ubuntu's local DNS resolver:

sudo ss -lntp | awk 'NR>1 {print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

The health helper checks that the site, PHP and the data volume answer:

sudo /usr/local/sbin/filerise-health

PRIMARY_HEALTH_OK https://ec2-203-0-113-10.compute-1.amazonaws.com/ (healthz 200, page 200, site config JSON)

If nginx is not running, first boot has not finished, or it failed. In the failed case, the site is never served. Check systemctl status filerise-host filerise-firstboot and journalctl -u filerise-firstboot.

sudo cat /root/filerise-credentials.txt

Only root can read the file. It holds the address and this instance's administrator sign-in:

# FileRise 3.38.0 - generated on first boot by filerise-firstboot.service
# This password is unique to this instance; none was baked into the image. Keep this file secret. FILERISE_URL=https://ec2-203-0-113-10.compute-1.amazonaws.com/ FILERISE_ADMIN_USER=admin FILERISE_ADMIN_PASSWORD=<FILERISE_ADMIN_PASSWORD> ...

You can confirm the sign-in from the instance itself. The helper checks these things:

• The redirect works.
• An anonymous visitor cannot list files.
• The first-run setup is closed.
• A wrong password and common defaults are refused.
• The password signs in through FileRise's own login and lists your files.

Run the helper:

sudo /usr/local/sbin/filerise-cred-roundtrip

OK https 301 + anonymous refused + setup closed + wrong/default passwords refused + admin signs in and lists the root folder

Open the FILERISE_URL address in your browser. The certificate is self-signed until you install your own (Step 8), so the browser asks you to accept it once. Compare the fingerprint that the browser shows with the one on the instance:

sudo openssl x509 -in /etc/nginx/ssl/filerise.crt -noout -fingerprint -sha256

Sign in as admin with the password from Step 4. A new instance always shows the sign-in page, never a setup form:

FileRise opens on your (empty) root folder. The upload area and the folder tree are on the left, and the file list is on the right:

Change the administrator password to one of your own whenever you like. In FileRise, open the User Panel and change it there. Or change it on the instance with the helper. Use 16 to 128 characters with no spaces. The helper reads the password from standard input, so it never appears in your shell history or the process list, and it updates the credentials file:

sudo filerise-set-password --stdin

Run sudo filerise-set-password without --stdin to generate a new random password instead. Sessions signed in with the old password are signed out. Other users are not affected.

Drag files or a whole folder onto the Upload Files/Folders area, or click Choose files. New creates folders and files.

Select files to move, copy, rename, tag, download as a zip or delete them. Deleted files go to the Recycle Bin in the folder tree, where an administrator can restore them.

Text files open in the built-in editor. Share creates a link for a file or folder, which you can protect with a password and an expiry.

As admin, open the Admin Panel from the user menu at the top right. Use Users & Access to add users and choose, folder by folder, what each user may view, upload, edit, delete or share. Users see only the folders they have been given:

Things to know:

• Refused names. FileRise refuses these names when you upload, create, rename or save: PHP files (.php, .phtml, .phar and similar), shell and other script files, .htaccess / .user.ini files, and names that start with a dot. Every other type uploads normally.
• Direct links. A FileRise download link pasted into a new browser tab's address bar is refused, because it carries no proof that it came from FileRise's page. Use the download action or a share link instead.
• WebDAV is off until an administrator enables it in the Admin Panel (Auth & WebDAV). It then answers at https://<your-host>/webdav.php/ with the FileRise user's name and password.
• FileRise Pro features are not available on this image. That covers the sections marked PRO in the Admin Panel and the Pro license and bundle install.

Your files are in /var/lib/filerise/uploads on the data volume, owned by the unprivileged filerise account that PHP runs as.

Users, passwords (bcrypt hashes) and folder permissions are in /var/lib/filerise/users. Tags, share links and FileRise's per-instance token key are in /var/lib/filerise/metadata. Only filerise can read these folders:

sudo ls -la /var/lib/filerise

total 40 drwxr-xr-x 7 root root 4096 Oct 30 19:15 . drwxr-xr-x 50 root root 4096 Oct 30 19:04 .. drwx------ 2 root root 16384 Oct 30 19:04 lost+found drwxr-x--- 2 filerise filerise 4096 Oct 30 19:38 metadata drwx------ 2 filerise filerise 4096 Oct 30 19:05 tmp drwxr-x--- 2 filerise filerise 4096 Oct 30 19:05 uploads drwx------ 2 filerise filerise 4096 Oct 30 19:38 users

To copy files in over SSH, write them as that account so that FileRise can manage them. For example:

sudo -u filerise cp /home/ubuntu/report.pdf /var/lib/filerise/uploads/

Point a DNS record at the instance. An Elastic IP keeps the address across stop and start. Then tell the instance its name.

The command creates a new self-signed certificate for that name. It updates the nginx host rule, the cross-site guard and the address in the credentials file, and it keeps the name across reboots:

sudo filerise-set-hostname files.example.com

To use a certificate from a public authority instead, replace /etc/nginx/ssl/filerise.crt (full chain) and /etc/nginx/ssl/filerise.key (mode 0600, owned by root) with your own. Then run sudo systemctl reload nginx. Running filerise-set-hostname again later replaces them with a new self-signed pair.

Every service is enabled, so FileRise returns after a reboot or a stop and start. Your files, users and passwords stay as they are. Unattended security upgrades keep the operating system, PHP and nginx patched:

systemctl is-enabled nginx php8.3-fpm unattended-upgrades

enabled enabled enabled

The data volume is mounted by its file system UUID. To grow it, enlarge the EBS volume in the EC2 console. Then extend the file system online:

sudo resize2fs $(findmnt -no SOURCE /var/lib/filerise)

To back up your files, users and share links, take an EBS snapshot of the data volume, or use AWS Backup on the instance. SecureAnyCloud publishes a new version of the image when a newer FileRise release is available.