Kinto 26.5.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Select Kinto 26.5.0 on Ubuntu 24.04 as the software version, choose your Region, and select Launch through EC2.

Choose m5.large, your key pair, a security group as described in Prerequisites, and a subnet.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=kinto}]'

For Kinto 26.5.0 on Ubuntu 24.04, the SSH user is ubuntu. Connect with your key pair:

ssh -i <your-key.pem> ubuntu@<public-ip>

On first boot, the instance creates the database, the administrator and the certificate. It then starts Kinto and opens the HTTPS port. This takes about half a minute. Check the services:

systemctl is-active postgresql@16-main kinto nginx

active active active

Only SSH (22) and nginx (80, 443) listen on the network. Kinto listens on 127.0.0.1:8888 for nginx only. PostgreSQL has no TCP port at all. The remaining loopback entries are Ubuntu's local DNS resolver. List the listening ports:

sudo ss -lntp | awk 'NR>1 {print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:8888 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

If nginx is not running, first boot has not finished or has failed. In that case the API is never served. Check systemctl status kinto-firstboot and sudo cat /var/log/sac/kinto-firstboot.log.

Read the credentials file. Only root can read it:

sudo cat /root/kinto-credentials.txt

The file contains the API URL, the administrator user and password, and the certificate fingerprint:

# Kinto 26.5.0 - per-instance credentials, generated on first boot (sac). Keep this file secret (0600 root).
# Sign in with HTTP Basic authentication. Change the password:
sudo kinto-set-admin-password admin ... KINTO_URL=https://ec2-203-0-113-10.compute-1.amazonaws.com/v1/ KINTO_ADMIN_USER=admin KINTO_ADMIN_PASSWORD=<KINTO_ADMIN_PASSWORD> KINTO_TLS_SHA256=AB:CD:...:EF

Run the built-in self-test. It checks the redirect, the host rules, an authenticated document round trip and every refusal: anonymous write, anonymous sign-up, a wrong password, admin:admin and a foreign CORS origin.

sudo /usr/local/sbin/kinto-verify.sh

KINTO_ROUNDTRIP_OK admin auth + document round trip + anonymous/wrong/default refusals + CORS + host checks

The root of the API is public and describes the server. On the instance, localhost is one of the certificate's names, so curl can verify the certificate instead of skipping the check:

curl -s --cacert /etc/ssl/kinto/kinto.crt https://localhost/v1/ | python3 -m json.tool | head -18

The response names the server's address, the Kinto version and the one plugin this image enables, accounts:

{ "project_name": "kinto", "project_version": "26.5.0", "http_api_version": "1.23", "project_docs": "https://kinto.readthedocs.io/", "url": "https://ec2-203-0-113-10.compute-1.amazonaws.com/v1/", "config": null, "settings": { "readonly": false, "batch_max_requests": 25, "explicit_permissions": true }, "capabilities": { "accounts": { "description": "Manage user accounts.",

From your own computer, first check that the certificate the instance presents matches the fingerprint in the credentials file. Then copy the certificate and use it with --cacert. Do not add it to your system's trust store:

openssl s_client -connect <public-ip>:443 -servername <public-dns-name> </dev/null 2>/dev/null \
  | openssl x509 -noout -fingerprint -sha256 scp -i <your-key.pem> ubuntu@<public-ip>:/etc/ssl/kinto/kinto.crt kinto.crt curl --cacert kinto.crt -u admin https://<public-dns-name>/v1/

curl -u admin prompts for the password, so the password does not end up in your shell history.

Create a bucket and a collection, add a record, then read it back. Replace <KINTO_ADMIN_PASSWORD> with the password from Step 4, as follows:

K="curl -s --cacert /etc/ssl/kinto/kinto.crt -u admin:<KINTO_ADMIN_PASSWORD>" $K -o /dev/null -w 'bucket %{http_code}\n' -X PUT https://localhost/v1/buckets/demo $K -o /dev/null -w 'collection %{http_code}\n' -X PUT https://localhost/v1/buckets/demo/collections/notes $K -H 'Content-Type: application/json' -X POST https://localhost/v1/buckets/demo/collections/notes/records \
  -d '{"data": {"title": "hello kinto", "done": false}}' | python3 -m json.tool $K https://localhost/v1/buckets/demo/collections/notes/records | python3 -m json.tool

bucket 201 collection 201 { "data": { "title": "hello kinto", "done": false, "id": "2b0b4a6c-...", "last_modified": 1793400000000 }, "permissions": { "write": [ "account:admin" ] } }

Clients that synchronise ask only for what changed since their last sync, for example ?_since=<last_modified>. See the Kinto API documentation for filtering, sorting, pagination, groups and permissions.

To remove the demo data, run:

curl -s --cacert /etc/ssl/kinto/kinto.crt -u admin:<KINTO_ADMIN_PASSWORD> -o /dev/null -w '%{http_code}\n' -X DELETE https://localhost/v1/buckets/demo

Anonymous visitors can read the public server description and nothing else. They cannot write, create an account or read your records. Try it:

curl -s --cacert /etc/ssl/kinto/kinto.crt -o /dev/null -w 'anonymous write %{http_code}\n' -X PUT https://localhost/v1/buckets/anon
curl -s --cacert /etc/ssl/kinto/kinto.crt -o /dev/null -w 'anonymous sign up %{http_code}\n' -H 'Content-Type: application/json' \
  -X PUT https://localhost/v1/accounts/intruder -d '{"data": {"password": "intruder-password"}}'
curl -s --cacert /etc/ssl/kinto/kinto.crt -o /dev/null -w 'admin:admin %{http_code}\n' -u admin:admin https://localhost/v1/buckets

anonymous write 401 anonymous sign up 401 admin:admin 401

The rules are in /etc/kinto/kinto.ini. Every *_principals setting lists account:admin only.

To let your own users sign up, add system.Everyone to kinto.account_create_principals. Each new account can then write only what it is given permission on. Restart Kinto with sudo systemctl restart kinto.

Point a DNS record at the instance. An Elastic IP keeps the address across stop and start. Then tell the instance its name.

The command below creates a new self-signed certificate for that name. It updates the nginx host rule, Kinto's kinto.http_host and CORS origins, and the address and fingerprint in the credentials file. The name is kept across reboots.

sudo kinto-set-hostname kinto.example.com

To use a certificate from a public authority instead, replace /etc/ssl/kinto/kinto.crt (full chain) and /etc/ssl/kinto/kinto.key (mode 0600, owned by root) with your own. Then run sudo systemctl reload nginx. Running kinto-set-hostname again later replaces them with a new self-signed pair.

If a browser application on another origin calls the API, add that origin (space-separated) to kinto.cors_origins in /etc/kinto/kinto.ini. For example, kinto.cors_origins = https://kinto.example.com https://app.example.com. Then run sudo systemctl restart kinto. kinto-set-hostname keeps the origins you add.

Change the administrator password. The command reads it from the terminal or standard input, never the command line, and the old password stops working at once. Afterwards, update or remove the password line in the credentials file.

sudo kinto-set-admin-password admin

Every service is enabled, so Kinto returns after a reboot or a stop and start with your data intact. Unattended security upgrades keep the operating system, PostgreSQL and nginx patched. Confirm that the services are enabled:

systemctl is-enabled kinto nginx unattended-upgrades

enabled enabled enabled

Your data lives in PostgreSQL in /var/lib/postgresql/16/main on the root volume. Back it up with a dump, or with an EBS snapshot or AWS Backup of the instance:

sudo -u postgres pg_dump -Fc kinto > kinto-$(date +%F).dump

PostgreSQL has no network listener. If another host must reach it, add listen_addresses and a pg_hba.conf rule with a password role yourself, and open the port only to that host.

SecureAnyCloud publishes a new version of the image when a newer Kinto release is available.