Frappe Builder 1.36.5

• Open the listing by SecureAnyCloud, choose View purchase options, then subscribe.
• Choose Continue to Configuration. Under Software version, choose Frappe Builder 1.36.5 on Ubuntu 24.04. Pick your Region, then choose Continue to Launch.
• Under Choose Action, select Launch through EC2.
• Set the instance type to m5.large (or larger) and choose your key pair. Use the seller's security group settings (ports 22, 80 and 443), and narrow port 22 to your management network. Keep the 30 GiB root volume.
• Launch the instance. First boot completes within two to three minutes of the instance reaching the running state.

Run these commands on your workstation. Replace <ami-id> with the AMI ID shown for the Frappe Builder 1.36.5 on Ubuntu 24.04 software version on the listing's launch page. Use your own VPC, subnet, key pair and address ranges.

aws ec2 create-security-group --group-name frappe-builder-sg \
  --description "Frappe Builder" --vpc-id <vpc-id>
aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port 22 --cidr <your-ip>/32
aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port 80 --cidr <visitors-cidr>
aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port 443 --cidr <visitors-cidr>
aws ec2 run-instances --image-id <ami-id> --instance-type m5.large \
  --key-name <key-name> --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> --associate-public-ip-address \
  --metadata-options HttpTokens=required \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=frappe-builder}]'
aws ec2 describe-instances --instance-ids <instance-id> \
  --query "Reservations[].Instances[].[PublicDnsName,PublicIpAddress]" --output text

ssh -i <key.pem> ubuntu@<public-dns>

The login user is ubuntu.

First boot writes your instance's credentials to a root-only file. Read it with:

sudo cat /root/frappe-builder-credentials.txt

The file looks like this. Your values differ:

builder.url=https://ec2-203-0-113-10.compute-1.amazonaws.com/builder builder.desk.url=https://ec2-203-0-113-10.compute-1.amazonaws.com/app builder.admin.login=Administrator builder.admin.pass=<generated-per-instance> mariadb.benchadmin.login=benchadmin mariadb.benchadmin.pass=<generated-per-instance>

The site address is taken from /etc/sac/frappe-builder-hostname if that file exists. Otherwise it comes from IMDSv2: the instance's public DNS name, else its public IPv4 address, else its private IPv4 address.

benchadmin is a per-instance MariaDB account on localhost for bench maintenance commands.

systemctl is-active mariadb redis-server supervisor nginx ls /var/lib/sac/data/frappe-builder-firstboot.done

All four services print active, and the first-boot marker exists. First boot runs once, so after a reboot its unit shows as skipped, which is expected.

Only 22, 80 and 443 listen on a public address. gunicorn (8000), MariaDB (3306), Redis (6379) and the loopback health listener (8088) are on localhost:

sudo ss -Hltn | awk '{print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:3306 127.0.0.1:6379 127.0.0.1:8000 127.0.0.1:8088 127.0.0.53%lo:53 127.0.0.54:53 [::1]:6379 [::]:22 [::]:443 [::]:80

The two :53 lines are Ubuntu's local DNS stub resolver.

The application processes all run as the unprivileged frappe user, and the realtime server listens on a UNIX socket that only nginx's group can reach:

ps -eo user=,args= | awk '/[g]unicorn|[s]ocketio\.js|[b]ench_helper/{print $1}' | sort | uniq -c sudo stat -c '%A %U %G %n' /run/frappe-socketio/socketio.sock

6 frappe srwxrwx--- frappe www-data /run/frappe-socketio/socketio.sock

The process supervisor is out of the application's reach. Its program list is a root-owned file, its control socket is root-only, and supervisorctl as the frappe user is refused:

sudo stat -c '%U:%G %a %F %n' /etc/supervisor/conf.d/frappe-bench.conf "$(readlink -f /var/run/supervisor.sock)"
sudo -u frappe supervisorctl status >/dev/null 2>&1 && echo "frappe can control supervisor" || echo "supervisorctl refused for frappe"

root:root 644 regular file /etc/supervisor/conf.d/frappe-bench.conf root:root 700 socket /run/supervisor.sock supervisorctl refused for frappe

The health endpoint answers pong, the HTTPS front end on the configured name answers 200, port 80 redirects to HTTPS, and the realtime (Socket.IO) handshake through nginx answers 200:

SITE=$(sudo cat /var/lib/sac/data/frappe-builder-current-hostname)
curl -s http://127.0.0.1:8088/api/method/ping; echo
curl -sk -o /dev/null -w "%{http_code}\n" --resolve "${SITE}:443:127.0.0.1" "https://${SITE}/login"
curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" --resolve "${SITE}:80:127.0.0.1" "http://${SITE}/"
curl -sk -o /dev/null -w "%{http_code}\n" --resolve "${SITE}:443:127.0.0.1" "https://${SITE}/socket.io/?EIO=4&transport=polling"

{"message":"pong"} 200 301 https://ec2-203-0-113-10.compute-1.amazonaws.com/ 200

A request for any other host name is dropped (nginx closes the connection, so curl prints 000):

curl -sk -o /dev/null -w "%{http_code}\n" --resolve "evil.example:443:127.0.0.1" "https://evil.example/login" || true

Nothing is published on a new instance. The site's home page is the sign-in page, and the editor's content API refuses an anonymous visitor:

SITE=$(sudo cat /var/lib/sac/data/frappe-builder-current-hostname)
curl -sk -o /dev/null -w "home: %{http_code}\n" --resolve "${SITE}:443:127.0.0.1" "https://${SITE}/"
curl -sk -o /dev/null -w "page list: %{http_code}\n" --resolve "${SITE}:443:127.0.0.1" "https://${SITE}/api/resource/Builder%20Page"

home: 200 page list: 403

The application cannot reach the instance metadata service. This check runs the same request from inside supervisor.service (gunicorn, the workers and the realtime server) as the frappe user, and from your shell. The first prints 000 (blocked) and the second prints 200:

CG=$(systemctl show -p ControlGroup --value supervisor.service)
sudo bash -c "echo \$\$ > /sys/fs/cgroup${CG}/cgroup.procs; exec setpriv --reuid=frappe --regid=frappe --init-groups curl -s -m 5 -o /dev/null -w '%{http_code}\n' -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token" curl -s -m 5 -o /dev/null -w '%{http_code}\n' -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token

The site certificate is self-signed and unique to your instance, so your browser warns you the first time you open the site. Before you continue past the warning, compare the certificate's SHA-256 fingerprint in the browser with the one on the instance. To see the fingerprint in the browser, click the padlock or warning icon, then view the certificate. To print the fingerprint on the instance, run:

sudo openssl x509 -in /etc/ssl/frappe-builder/frappe-builder.crt -noout -fingerprint -sha256

Continue only if the two fingerprints match. Do not add this certificate to your computer's trusted certificates. For everyday use, install a certificate from a public certificate authority (Step 10).

• Open the builder.url address from Step 4 in a browser. Plain http:// redirects to HTTPS.
• Sign in as Administrator with the builder.admin.pass value. Common default passwords (admin, password123, changeme, frappe, builder and the like) are rejected. Change the password after your first sign-in, from the Frappe desk at /app.

Open /builder to reach Builder's All Pages dashboard. Filter pages by title or route, sort them, switch between grid, list and tree views, and group pages into folders. Settings holds the site-wide Builder settings.

A new instance has no pages yet (the screenshot shows one demo page). Use New to start a page from a blank canvas or from a template.

To let other people edit pages, add them as users in the Frappe desk (/app/user) with the Website Manager role. Sign-up is off, so nobody creates their own account.

Opening a page puts you in the visual editor. The canvas in the middle shows the page as it will look. The left rail carries the block tree, the component library, assets and page scripts. The right rail shows the properties of the selected block: layout (stack or grid, direction, gap, alignment), typography, spacing, colors and borders. Switch breakpoints at the top to check the page on tablet and mobile widths.

Save blocks you reuse as components and drop them into any other page, so a header, footer or call to action is maintained in one place. Images you add are uploaded to the site's public files. PNG and JPEG uploads are converted to WebP when Builder Settings > Auto convert images to WebP is on.

Give the page a route in its page settings (the gear icon in the top bar), then choose Publish in the top right. The page title bar shows Draft until you publish. Builder serves the page at that route on this same host, so https://<your-site>/<your-route> is live for anonymous visitors at once.

Unpublish takes the page off the site again. A page you have not published is never served.

Only the pages you publish, and the images on them, are public. The editor, the desk and Builder's APIs still require a signed-in user with the Website Manager role.

Frappe builds absolute links (sitemaps, canonical URLs, emails) from the site's host_name, which this image sets from configuration. To serve the site on your own DNS name, point a DNS record (for example in Amazon Route 53) at the instance's public IP (an Elastic IP keeps it stable), then run this command on the instance:

sudo frappe-builder-set-hostname www.example.com

The helper writes the name to /etc/sac/frappe-builder-hostname and issues a new self-signed certificate for it. It rewrites the site host_name, the nginx server_name and the cross-site guard, updates the credentials file, and restarts the application and nginx.

The site certificate is /etc/ssl/frappe-builder/frappe-builder.crt and its key is /etc/ssl/frappe-builder/frappe-builder.key (mode 600, root). To use Let's Encrypt, first set your DNS name and open port 80 to the internet, then run:

sudo apt-get install -y certbot
sudo certbot certonly --standalone -d www.example.com \
  --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx" \
  --deploy-hook "install -m 644 \$RENEWED_LINEAGE/fullchain.pem /etc/ssl/frappe-builder/frappe-builder.crt && install -m 600 \$RENEWED_LINEAGE/privkey.pem /etc/ssl/frappe-builder/frappe-builder.key"