Kanboard 1.2.57

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Kanboard 1.2.57 on Ubuntu 24.04 as the software version, choose your Region, then choose Launch through EC2. Select m5.large (or larger for a big team), your key pair and a security group as described above.

To launch with the AWS CLI instead, run the following and replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=kanboard}]'

First boot creates the database and the certificate. It takes about a minute after the instance is running.

Connect over SSH as the ubuntu user (Kanboard 1.2.57 on Ubuntu 24.04):

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot creates the database, sets the administrator password and mints the certificate. nginx and Kanboard's cron start only after it finishes. Run:

systemctl is-active nginx php8.3-fpm kanboard-cron.timer
sudo test -f /var/lib/sac/data/kanboard-firstboot.done && echo FIRSTBOOT_DONE

All three services are active and the first-boot marker is present:

active active active FIRSTBOOT_DONE

Only SSH and nginx listen on network ports. Kanboard's database is a file, so there is no database listener. PHP-FPM uses a local socket. Check the listeners:

sudo ss -lntp | awk 'NR>1 && $4 !~ /^127\./ {split($6, p, "\""); print $4, p[2]}' | sort

0.0.0.0:22 sshd 0.0.0.0:443 nginx 0.0.0.0:80 nginx [::]:22 sshd [::]:443 nginx [::]:80 nginx

Read the credentials file as root with sudo. Only root can read it.

sudo cat /root/kanboard-credentials.txt

The file looks like this:

# Kanboard 1.2.57 - generated on first boot by kanboard-firstboot.service
# These credentials are unique to this instance; none was baked into the image. Keep this file secret. KANBOARD_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/ KANBOARD_ADMIN_USER=admin KANBOARD_ADMIN_PASSWORD=<KANBOARD_ADMIN_PASSWORD>
#
# Open KANBOARD_URL in a browser (self-signed certificate minted on this instance's first boot; port 80 redirects to # https) and sign in with the user name and password above. Then change the password (admin > My profile > Change # password) and set your e-mail address. The upstream default password (admin) does not work on this instance. # API: Settings > API shows this instance's own API token (user jsonrpc) and endpoint https://<host>/jsonrpc.php
# Data: /var/lib/kanboard/data (SQLite database db.sqlite, attachments). Configuration: /etc/kanboard/config.php
# Cron:
systemctl list-timers kanboard-cron.timer (runs php cli cronjob daily as kanboard)
# Change the name it serves as:
sudo kanboard-set-hostname <your-dns-name>
# User guide: https://secureanycloud.com/stacks/kanboard-1-2-57/

The URL uses the instance's public DNS name from the EC2 instance metadata. The certificate also names the public and private IP addresses, and nginx answers only to the names in the certificate.

The name is fixed at first boot. If you stop and start the instance without an Elastic IP and its public address changes, run sudo kanboard-set-hostname with the new name (Step 8). Better still, give the instance an Elastic IP or your own DNS name.

Open the KANBOARD_URL in your browser. The certificate is self-signed, so your browser asks you to confirm it the first time (or install your own, Step 8). Sign in with the user name admin and the password from Step 4.

Kanboard opens your dashboard. It shows the projects you belong to, with a count of tasks in each column, and the tasks and subtasks assigned to you. A new instance has no projects, so choose New project to create the first one.

Each project is a board. Drag cards between columns as work moves on. Use the menu at the top left of the board to edit the columns, swimlanes, categories, permissions and automatic actions.

Then open your account (the avatar at the top right, then My profile) and make these changes:

• Under Edit profile, set your own e-mail address. Kanboard sends notifications and password reset links to it.
• Under Change password, change the password.
• Under Two factor authentication, turn on two-factor sign-in.

Add a separate Kanboard user for each person instead of sharing the administrator account. Open the avatar menu at the top right, then Users management, then New user. Give each person access per project.

Kanboard e-mails notifications (new and changed tasks, comments, overdue tasks) to users who turn them on. Set your mail server under Settings (in the avatar menu at the top right), then Email settings. Until you do, Kanboard sends no e-mail.

The daily job runs from kanboard-cron.timer at about 08:00 UTC as the kanboard user. To see when it next runs, use:

systemctl list-timers kanboard-cron.timer --no-pager | head -3

Settings, then About shows the Kanboard, PHP and database versions, with links to download, upload and optimise the database.

Settings, then API shows this instance's own API token and the endpoint https://<host>/jsonrpc.php. Applications sign in to it as the user jsonrpc with that token. They can also sign in as a Kanboard user with that user's password or personal API token (My profile, then API). Requests without credentials are refused:

H=$(sudo grep '^KANBOARD_URL=' /root/kanboard-credentials.txt | cut -d= -f2- | sed -E 's#https://([^/]+)/#\1#')
curl -sk -o /dev/null -w 'API without credentials -> %{http_code}\n' --resolve "$H:443:127.0.0.1" \
  -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","method":"getVersion","id":1}' "https://$H/jsonrpc.php"

API without credentials -> 401

Kanboard connects out only to servers you configure: your mail server, webhook receivers (Settings, then Webhooks) and the pages behind external links you add to tasks. Webhooks and external links to private network addresses and to the instance metadata service are refused.

The plugin installer is off and the plugin directory is read-only. New Kanboard releases arrive as new versions of this listing.

Everything Kanboard stores is under /var/lib/kanboard/data: the SQLite database db.sqlite, task attachments and avatars. The configuration is /etc/kanboard/config.php. It holds no secret, because the API and webhook tokens live in the database. Both locations are on the root volume, so the simplest backup is an EBS snapshot of it.

For a copy of the database alone, use Download the database on Settings, then About. It downloads a gzip-compressed SQLite file.

To take a consistent copy from the command line while Kanboard is running, install the SQLite tool and let the kanboard user make the copy. Do not open the database as root: a file that root creates next to it would lock Kanboard out.

sudo apt-get install -y sqlite3
sudo -u kanboard sqlite3 /var/lib/kanboard/data/db.sqlite ".backup '/var/lib/kanboard/tmp/kanboard-backup.sqlite'"
sudo mv /var/lib/kanboard/tmp/kanboard-backup.sqlite <backup-dir>/kanboard-$(date +%F).sqlite
sudo tar -C / --exclude='db.sqlite*' -czf <backup-dir>/kanboard-files-$(date +%F).tar.gz var/lib/kanboard/data etc/kanboard

The database holds every password hash and the API tokens, so protect the copy as carefully as the instance.

To give Kanboard more room, enlarge the root volume in the EC2 console (Volumes, then Modify). Ubuntu grows the file system on the next boot.

Point a DNS record at the instance (an Elastic IP keeps the address stable), then set the name Kanboard is served as. The command below mints a new self-signed certificate for the name and points nginx and Kanboard's application URL (used in every e-mailed link) at it. It also updates the URL in /root/kanboard-credentials.txt and keeps the name across reboots:

sudo kanboard-set-hostname <your-domain>

To use a certificate from a public or internal certificate authority instead, such as one issued by Let's Encrypt for <your-domain>, copy it over the generated pair and reload nginx. Running kanboard-set-hostname again replaces it with a self-signed certificate.

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/kanboard.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/kanboard.key
sudo nginx -t && sudo systemctl reload nginx

nginx runs PHP only for Kanboard's two entry points. The configuration, the database, Kanboard's diagnostic and command-line scripts, the code and libraries, and trick addresses answer 404. Plain HTTP redirects to HTTPS, and a request for a name the instance does not serve gets no answer at all.

The sign-in redirect (302) is Kanboard sending you to its sign-in page. /jsonrpc.php answers a browser's GET with a JSON error. Run:

H=$(sudo grep '^KANBOARD_URL=' /root/kanboard-credentials.txt | cut -d= -f2- | sed -E 's#https://([^/]+)/#\1#') for p in / /index.php /jsonrpc.php /config.php /data/db.sqlite /healthcheck.php /cli /app/common.php /vendor/autoload.php /index.php/x //index.php /.git/config; do curl -sk -o /dev/null -w "%{http_code} $p\n" --resolve "$H:443:127.0.0.1" "https://$H$p" done curl -s -o /dev/null -w 'http:// -> %{http_code}\n' --resolve "$H:80:127.0.0.1" "http://$H/" curl -sk -o /dev/null -w 'unknown host name -> %{http_code}\n' --resolve "other.example:443:127.0.0.1" "https://other.example/" || true

302 / 302 /index.php 200 /jsonrpc.php 404 /config.php 404 /data/db.sqlite 404 /healthcheck.php 404 /cli 404 /app/common.php 404 /vendor/autoload.php 404 /index.php/x 404 //index.php 404 /.git/config http:// -> 301 unknown host name -> 000

Every service runs with the instance metadata service blocked. Confirm it:

for u in nginx php8.3-fpm kanboard-cron kanboard-firstboot; do echo "$u $(systemctl show -p IPAddressDeny --value $u)"; done

nginx 168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128 php8.3-fpm 168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128 kanboard-cron 168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128 kanboard-firstboot 168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128

The code is owned by root, PHP runs as kanboard, and only kanboard can open the data directory. Confirm it:

stat -c '%U:%G %a %n' /var/www/kanboard /var/www/kanboard/index.php /etc/kanboard /var/lib/kanboard
sudo stat -c '%U:%G %a %n' /etc/kanboard/config.php /var/lib/kanboard/data

root:root 755 /var/www/kanboard root:root 644 /var/www/kanboard/index.php root:kanboard 750 /etc/kanboard root:kanboard 750 /var/lib/kanboard root:kanboard 640 /etc/kanboard/config.php kanboard:kanboard 700 /var/lib/kanboard/data

Operating system security updates install automatically. Run sudo apt-get update && sudo apt-get upgrade to apply everything else. nginx and PHP-FPM restart cleanly and Kanboard keeps all of its data.

New Kanboard releases arrive as new versions of this listing, and support can help you move your data to one.

Key locations on the instance:

• Kanboard: /var/www/kanboard (owned by root, read-only to PHP)
• Configuration: /etc/kanboard/config.php (root:kanboard, mode 0640)
• Database, attachments and avatars: /var/lib/kanboard/data (db.sqlite; uploads under files/)
• nginx site: /etc/nginx/sites-available/sac-kanboard
• Certificate and key: /etc/nginx/ssl/kanboard.crt, /etc/nginx/ssl/kanboard.key
• Cron: kanboard-cron.timer and kanboard-cron.service
• Helper: /usr/local/sbin/kanboard-set-hostname
• Credentials: /root/kanboard-credentials.txt (mode 0600)
• Source and changes: /usr/share/doc/kanboard/SOURCE.txt

• Allow port 22 from your admin network only, and ports 80 and 443 only from the networks your team works from.
• Use your own DNS name and a certificate your users' browsers trust (Step 8).
• Change the administrator password and e-mail address as soon as you sign in, turn on two-factor authentication, and give each person their own user (Step 5).
• Treat the API token under Settings, then API as a password. Anyone who holds it can act on every project.
• Keep the operating system patched, and snapshot the root volume regularly.