LavinMQ

Prerequisites

You need:

• An active AWS account and an EC2 key pair in your target region
• A subscription to the LavinMQ listing on AWS Marketplace
• A VPC and subnet, and a security group that allows inbound 22/tcp (SSH, from your admin network), 15672/tcp (the management UI, from your admin network) and 5672/tcp (AMQP, from the networks whose clients publish and consume)

Recommended instance type: m5.large (2 vCPU, 8 GB RAM) is a sensible starting point. LavinMQ is extremely lightweight, so a general-purpose instance handles high message throughput comfortably. Scale up only for very large workloads.

Ports: open 5672 and 15672 only to trusted networks. To avoid exposing them at all, keep them closed in the security group and reach the broker over an SSH tunnel, as shown at the end of this guide.

Connecting to your instance

Connect over SSH with your EC2 key pair. On Ubuntu 24.04 LTS, the default login user is ubuntu:

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

Replace <public-ip> with your instance's public IP, or its private IP if you connect over a VPN or bastion.

Retrieve your per-instance credentials

On first boot, the instance generates a unique SecureAnyCloud administrator password. It writes the password, together with the AMQP and management URLs, to a root-only file. Read the file:

sudo cat /root/lavinmq-credentials.txt

The file contains LAVINMQ_ADMIN_USER (always SecureAnyCloud), LAVINMQ_ADMIN_PASSWORD (unique to this instance), LAVINMQ_MGMT_URL and LAVINMQ_AMQP_URL. There is no guest login. It is deleted on first boot, so the SecureAnyCloud account is the only way in.

Verify the broker is running

Confirm that the container and systemd units are up:

systemctl is-active docker lavinmq
sudo docker ps --filter name=lavinmq --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}'

Query the broker's overview through the loopback management API, authenticating as the per-instance SecureAnyCloud administrator:

PASS=$(sudo grep '^LAVINMQ_ADMIN_PASSWORD=' /root/lavinmq-credentials.txt | cut -d= -f2-)
curl -s -u "sac:${PASS}" http://127.0.0.1:15672/api/overview | jq '{product: .product_version, node: .node, queue_totals: .queue_totals}'

Confirm the security model. An anonymous request is rejected, and the deleted guest account cannot authenticate:

echo "no-credentials -> $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:15672/api/whoami)"
echo "deleted guest -> $(curl -s -o /dev/null -w '%{http_code}' -u guest:guest http://127.0.0.1:15672/api/whoami)"

Both commands should print 401. Then confirm that the SecureAnyCloud administrator authenticates:

PASS=$(sudo grep '^LAVINMQ_ADMIN_PASSWORD=' /root/lavinmq-credentials.txt | cut -d= -f2-)
curl -s -u "sac:${PASS}" http://127.0.0.1:15672/api/whoami | jq '{name: .name, tags: .tags}'

The management UI

LavinMQ ships a built-in web management UI. Browse to port 15672 and sign in as SecureAnyCloud with the password from /root/lavinmq-credentials.txt:

http://<public-ip>:15672/

Open the Overview page for live queued-message, data-rate and message-rate graphs of the running broker. It also shows counts of connections, channels, consumers, exchanges and queues.

Open the Queues page to see every queue with its ready, unacknowledged and total message counts. From there you can create queues, publish test messages and inspect what is waiting for delivery.

Publish and consume a message

You can exercise the broker end to end from the instance itself, using the RabbitMQ-compatible management API. Declare a queue, publish a message to it through the default exchange, then consume the message back:

PASS=$(sudo grep '^LAVINMQ_ADMIN_PASSWORD=' /root/lavinmq-credentials.txt | cut -d= -f2-) M=http://127.0.0.1:15672 curl -s -u "sac:${PASS}" -H 'content-type: application/json' -X PUT \
  "$M/api/queues/%2F/demo.hello" -d '{"durable":true}' curl -s -u "sac:${PASS}" -H 'content-type: application/json' -X POST \
  "$M/api/exchanges/%2F/amq.default/publish" \
  -d '{"properties":{},"routing_key":"demo.hello","payload":"hello from sac","payload_encoding":"string"}' curl -s -u "sac:${PASS}" -H 'content-type: application/json' -X POST \
  "$M/api/queues/%2F/demo.hello/get" \
  -d '{"count":1,"ackmode":"ack_requeue_false","encoding":"auto"}' | jq '.[0].payload'

The last command prints "hello from sac", the message published a moment earlier, now consumed from the queue.

Connect an AMQP 0-9-1 client

Any AMQP 0-9-1 client library works. Point it at amqp://sac:<password>@<public-ip>:5672/. For example, with Python and pika:

import pika params = pika.URLParameters("amqp://sac:<password>@<public-ip>:5672/") conn = pika.BlockingConnection(params) ch = conn.channel() ch.queue_declare(queue="orders", durable=True) ch.basic_publish(exchange="", routing_key="orders", body="order #1001") print("published") conn.close()

Because LavinMQ implements AMQP 0-9-1, the same code runs unchanged against RabbitMQ. LavinMQ is a drop-in alternative.

Reach the broker over an SSH tunnel

If you keep ports 5672 and 15672 closed in your security group, forward them over SSH from your workstation:

ssh -i /path/to/your-key.pem -L 15672:127.0.0.1:15672 -L 5672:127.0.0.1:5672 ubuntu@<public-ip>

With the tunnel open, browse to http://127.0.0.1:15672/ for the management UI. Point AMQP clients at amqp://sac:<password>@127.0.0.1:5672/.

Managing the service

Manage LavinMQ with systemctl. It runs as a Docker container under lavinmq.service:

sudo systemctl status lavinmq --no-pager

• Restart the broker: sudo systemctl restart lavinmq
• Stop the broker: sudo systemctl stop lavinmq
• View broker logs: sudo docker logs lavinmq

The broker's data (definitions, queues and the message store) persists on the host at /data/lavinmq, bind-mounted into the container, so it survives restarts and reboots. The Compose file is at /opt/lavinmq/docker-compose.yml.

Enabling TLS

For production, terminate TLS in front of the broker. The simplest approach on AWS is to place a Network Load Balancer or Application Load Balancer in front of the instance, with an ACM certificate, forwarding to 15672 (management) and 5672 (AMQP).

Alternatively, run a reverse proxy (nginx or Caddy) on the instance for the management UI, and use AMQPS with LavinMQ's own TLS configuration. SecureAnyCloud support can help you set this up for your environment.

Security notes

• No guest account. The stock guest account is loopback-only in LavinMQ and is deleted entirely on first boot. The only account is the per-instance SecureAnyCloud administrator.
• Per-instance password. The SecureAnyCloud password is unique to each instance and stored in /root/lavinmq-credentials.txt (mode 0600, root only). You can rotate it from the management UI (Admin > Users) or the API.
• Limit port exposure. Open 5672 and 15672 only to the networks that need them. For anything beyond a trusted VPC, prefer an SSH tunnel or a load balancer with TLS.
• Use least-privilege users. Create dedicated users and virtual hosts for your applications rather than sharing the administrator credential.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat at sales@secureanycloud.com. We help with deployment, TLS termination, virtual hosts and user management, queue and exchange design, AMQP client integration, RabbitMQ migration, backups and scaling.

Deploy on AWS

Launch LavinMQ Message Broker with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com