FreeScout

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for FreeScout. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger. The workload is PHP and MariaDB, and search and attachment handling benefit from memory. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and either create or select a security group. The group must allow inbound port 22 from your management network and inbound port 443 from the networks your agents use. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes a few seconds after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud FreeScout Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=freescout-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from step 2. The SSH login user depends on the operating system of the AMI variant you launched:

• AMI variant: FreeScout on Ubuntu 24.04
• SSH login user: ubuntu
• Connect with: ssh -i <path-to-key.pem> ubuntu@<public-ip>

Substitute your own key path and the instance's public IP address.

On first boot, the administrator sign-in details, the database credentials and the instance URL are written to a root-only file. List the entries it holds:

sudo grep -oE '^[a-z.]+=' /root/freescout-credentials.txt

Read the values with sudo cat /root/freescout-credentials.txt. The file contains live secrets, so treat it as sensitive. Copy the administrator email and password into your password manager, and do not paste the contents anywhere shared. Confirm that only root can read the file:

sudo stat -c '%n mode %a owner %U' /root/freescout-credentials.txt

Three systemd units serve FreeScout. Confirm that they are active:

systemctl is-active nginx php8.3-fpm mariadb

Each line returns active. Port 80 answers a plain HTTP liveness check that touches neither the application nor the database. This makes it a good target for a load balancer health check:

curl -s -m 15 -o /dev/null -w 'healthz HTTP %{http_code}\n' http://127.0.0.1/healthz

Confirm FreeScout itself answers on HTTPS (the -k flag accepts the per-instance self-signed certificate):

curl -sk -m 15 -o /dev/null -w 'sign-in page HTTP %{http_code}\n' https://127.0.0.1/login

Confirm the shipped FreeScout release:

sed -n "s/.*'version'[[:space:]]*=>[[:space:]]*'\([0-9][^']*\)'.*/FreeScout \1/p" /var/www/freescout/config/app.php | sed -n '1p'

The Laravel scheduler runs FreeScout's background jobs and polls your mailboxes for new mail. It runs every minute through a systemd timer:

systemctl is-active freescout-scheduler.timer

Only ports 22, 80 and 443 are reachable from outside. MariaDB is bound to the loopback interface, and no mail service listens:

ss -tlnH | awk '{print $4}' | sort -u

The database appears as 127.0.0.1:3306 and never on a routable address. No mail transfer agent is installed on this image, so nothing listens on ports 25, 465, 587, 143 or 993:

for p in postfix exim4 sendmail dovecot-core opensmtpd; do dpkg-query -W -f='${Package} ${Status}\n' "$p" 2>/dev/null || echo "$p: not installed" done

Browse to https://<public-ip>/. Because the image ships a self-signed certificate, your browser warns you on the first visit. Accept the warning to proceed (you replace the certificate in step 13). You land on the FreeScout sign-in page.

Sign in with the administrator email address and password from /root/freescout-credentials.txt. FreeScout signs in by email address, not by username. After you sign in, you land on the FreeScout dashboard, which prompts you to create your first mailbox.

The first-boot password is unique to your instance, but you should still set your own. Open the user menu at the top right and choose Your Profile. Set your real name and change the email address to your own. That address becomes your sign-in identity and receives your notifications.

Then use Password in the same area to set a password that you control. FreeScout stores agent passwords as bcrypt hashes.

A mailbox in FreeScout is a support address plus the conversations that arrive at it. Open Manage -> Mailboxes -> New Mailbox. Enter the support address customers will email (for example support@example.com) and a display name, choose which agents may use it, and save. FreeScout creates the Unassigned, Mine, Starred, Assigned, Closed and Spam folders for it.

The mailbox settings page controls the reply behavior for that address. You can set the outbound display name, the status a conversation moves to after you reply, the default assignee, and the email signature appended to replies:

FreeScout does not run a mail server. It fetches mail from a mailbox you already have, which is what turns inbound email into conversations. Open Manage -> Mailboxes -> your mailbox -> Connection Settings -> Fetching Emails (the page shown above), then:

• Set Protocol to IMAP and enter the Server, Port and Encryption your provider documents (commonly 993 with SSL, or 143 with StartTLS).
• Enter the mailbox Username and Password. For Google Workspace or Microsoft 365, use an app password or OAuth as your provider requires. Both are linked from that page.
• Leave IMAP Folders as INBOX unless you sort inbound mail into another folder.
• Save the settings, then use Check Connection to confirm FreeScout can log in.

The php8.3-imap extension that ships with this image makes fetching work. The scheduler timer already running on the instance polls the mailbox every minute, and new mail appears in the mailbox's Unassigned folder.

Read this before you rely on outbound replies. A new EC2 instance cannot send email directly. AWS throttles outbound port 25 on new accounts and instances by default. A fresh instance also has no reverse DNS record and no sending reputation, so mail it sends directly is very likely to be rejected or filed as spam. This image therefore ships no mail transfer agent and makes no attempt to deliver mail itself.

Configure an authenticated relay instead. Open Manage -> Mailboxes -> your mailbox -> Connection Settings -> Sending Emails.

Choose SMTP as the method, then enter the host, port (587 with StartTLS, or 465 with SSL), username and password of your relay. Amazon SES is the natural choice on AWS. Verify your sending domain in SES, create SMTP credentials, and enter the regional SES SMTP endpoint here. Any authenticated provider works equally well.

The PHP mail() and Sendmail methods offered on that page require a local mail transfer agent, which this image deliberately does not install. Leave them unselected. Save the settings and use Send Test to confirm delivery before you go live.

The mailbox view is the shared inbox. Each row is a conversation that shows the customer, the subject and preview, the conversation number and how long it has been waiting. The folder list on the left separates what nobody has picked up (Unassigned) from what is yours (Mine), starred, assigned, closed and spam.

Open a conversation to work it. You get the customer's message thread, the assignee and status controls at the top, and the customer's profile on the right:

Use Reply to answer the customer and Note for a comment that only your team sees. Use the person control to assign the conversation to an agent, and the status control to move it between Active, Pending and Closed. Saved replies, tags and custom folders are available from the same view once you configure them.

Add the rest of your team under Manage -> Users -> New User. Give each person their own account with the User role for agents or the Admin role for administrators. Then grant them access to the mailboxes they should see from the mailbox's Permissions page. Each agent signs in with their own email address and password.

The Manage -> Settings area sets the instance-wide behavior. It covers the company name, conversation numbering, which actions non-admin users may perform, the default language, the timezone, and what customers see in outbound email.

FreeScout builds links and assets from APP_URL, and its trusted-hosts protection rejects any request whose Host header it does not recognize. On first boot, both are set to the instance's own address, so browsing by IP works out of the box.

To serve FreeScout on your own name instead, point a DNS record at the instance, then edit /var/www/freescout/.env as root. Set APP_URL to https://support.your-domain.com and add that hostname to the comma-separated APP_TRUSTED_HOSTS list. Apply the change with sudo -u www-data php /var/www/freescout/artisan freescout:clear-cache.

A missing trusted-hosts entry is the usual cause of a 403 Untrusted Host response after a domain change.

The image serves HTTPS with a per-instance self-signed certificate, so traffic is encrypted out of the box. For production, replace it with a trusted certificate for your own domain. Complete step 14 first so that DNS resolves to the instance.

The commands below are illustrative. They involve a domain you own and interactive prompts, so run them yourself and substitute your own hostname.

Install Certbot and the nginx plugin, then request a certificate. Certbot edits the nginx site in place and reloads nginx:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx

sudo certbot --nginx -d support.your-domain.com

Certbot installs a renewal timer, so the certificate renews automatically. To keep the shipped nginx site as it is, place your own certificate and key at /etc/nginx/ssl/freescout.crt and /etc/nginx/ssl/freescout.key (key mode 0600) and reload nginx.

The application and database tiers are on dedicated EBS volumes, and you can resize each one independently:

df -h /var/lib/mysql /var/www

/var/lib/mysql holds the MariaDB data directory and /var/www holds the FreeScout code tree, Laravel storage and conversation attachments. Both are recorded in /etc/fstab by filesystem UUID, so the layout reproduces on every instance launched from this image:

grep -E ' /var/(www|lib/mysql) ' /etc/fstab

To grow a tier, modify the EBS volume in the EC2 console and then extend the filesystem with sudo resize2fs <device>.

Back up both tiers: the FreeScout database in MariaDB and the application storage tree that holds conversation attachments. Take a consistent database dump as root over the local socket:

sudo mysqldump --single-transaction --quick freescout | gzip > /tmp/freescout-db-$(date +%F).sql.gz && ls -la /tmp/freescout-db-*.sql.gz

Take EBS snapshots of both data volumes for point-in-time recovery, and snapshot before any FreeScout version upgrade. Keep the operating system patched with sudo apt-get update && sudo apt-get -y upgrade.

FreeScout writes its application log inside the storage tree. Look there first if a background job or a mailbox fetch misbehaves:

sudo ls -1 /var/www/freescout/storage/logs/ 2>/dev/null; echo '(FreeScout log directory listed)'