Ghost

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Ghost Publishing Platform. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Choose an instance type of m5.large or larger, which gives Node.js and MySQL room to work. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from your visitors' networks. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes about one minute after the instance state becomes Running and the status checks pass.

Run the command below to launch an instance from the SecureAnyCloud Ghost Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22, 80 and 443.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=ghost-01}]'

On success the command prints a JSON document. Note the instance ID. When the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the instance's public IP address. The login user depends on the AMI variant you launched. For the Ghost 6 on Ubuntu 24.04 AMI, the SSH login user is ubuntu.

The first-boot service runs before the SSH daemon is ready, so the credentials file is already in place when you first log in.

ssh <login-user>@<public-ip>
sudo cat /root/ghost-credentials.txt

The plain text file lists the Ghost admin URL, the administrator email (sac-admin@<public-ip>), the administrator password, and the MySQL database name, user and password. Copy these values to a password manager or encrypted vault. Do not commit them to source control.

From the same SSH session, confirm that the deployment is healthy:

curl -fsS -o /dev/null -w 'Ghost front page HTTP %{http_code}\n' http://127.0.0.1/

A Ghost front page HTTP 200 response confirms that the full stack (nginx, Node.js with Ghost, and MySQL) is serving requests.

Open a browser and go to http://<public-ip>/ghost/. Ghost shows the admin sign-in form.

Enter the administrator email and password from /root/ghost-credentials.txt, then select Sign in. The public site is at http://<public-ip>/.

After you sign in, Ghost opens the admin dashboard, the home of all editorial and configuration work. The left-hand menu lists every management area:

• Posts and Pages for content
• Tags for organising posts
• Members for your audience
• Site (Design, Navigation, Code injection) for theme work
• Settings for global configuration

The dashboard shows traffic, recent posts and member activity. Use Settings to configure outbound mail, members, integrations and the site title.

For a production deployment, replace the administrator password generated on first boot and set a real administrator email. This makes sure password recovery and system notifications reach you.

Select your avatar at the bottom left of the admin and choose Your profile. Update the email address at the top, then scroll down and use Change password to set a new password. Select Save.

Ghost organises content as posts, pages and tags. Open Posts and select New post. Give the post a title, write the body in the editor and add tags from the right-hand sidebar. Select Publish at the top right to schedule the post or publish it immediately.

The editor supports rich text, images, embeds, code blocks, bookmark cards, galleries and HTML cards out of the box. Once published, the post appears on the public site at http://<public-ip>/.

Browse to http://<public-ip>/ to see the public Ghost site. Ghost ships with the Source theme by default, a clean, fast theme that suits blogs, newsletters and editorial publications.

To switch themes, go to Settings, then Design, then Change theme. There you can upload any Ghost-compatible theme zip or pick one from the marketplace built into Ghost.

Ghost uses Mailgun to send newsletters and member emails. It uses a separate SMTP provider for transactional mail such as welcome and password-reset messages. For newsletters, open Settings, then Email newsletter.

The documentation at https://ghost.org/docs/config/mail/ covers both Mailgun and the transactional mail config block in /var/www/ghost/config.production.json. To configure transactional mail, edit that file:

sudo nano /var/www/ghost/config.production.json

Set the mail object to use your SMTP provider (common choices are Amazon SES, SendGrid, Postmark and Mailgun), then restart Ghost:

sudo systemctl restart ghost_sac.service

For any production Ghost deployment, serve the site over HTTPS so that session cookies and authentication tokens cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

These commands assume a DNS record already points your fully qualified domain name at the instance's public IP address.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d ghost.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

When certbot finishes, set the Ghost url field in /var/www/ghost/config.production.json to your HTTPS URL and restart Ghost:

sudo sed -i 's#"url": "http://[^"]*"#"url": "https://ghost.your-domain.example"#' /var/www/ghost/config.production.json
sudo systemctl restart ghost_sac.service

Back up two data sources together: the MySQL database, and the site files in /var/www/ghost (the Ghost code tree, themes and uploaded content under content/).

sudo mysqldump --single-transaction ghost_prod > /var/backups/ghost-db-$(date +%F).sql
sudo tar --acls --xattrs -czf /var/backups/ghost-files-$(date +%F).tgz -C /var/www ghost

Copy both files to an Amazon S3 bucket or another object store.

Ubuntu's unattended-upgrades is enabled by default, so security patches for the kernel and packages apply automatically. To update Ghost itself, use Ghost-CLI:

sudo -u ghost HOME=/tmp bash -c "cd /var/www/ghost && ghost update"

Ghost-CLI downloads the new version, migrates the schema and restarts the process in one command.

For larger deployments, move Ghost off the single-instance layout:

• Move MySQL to Amazon RDS for MySQL and update database.connection in /var/www/ghost/config.production.json
• Put the Ghost web tier behind an Application Load Balancer and scale horizontally with an Auto Scaling group, with the content/ directory on Amazon EFS shared storage
• Serve static assets and uploaded media through Amazon CloudFront
• Use Amazon SES for transactional and bulk mail through Ghost's SMTP configuration

The official Ghost documentation at https://ghost.org/docs/ covers each of these.