Manyfold 0.154.1

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened SRS Streaming Media Server & Media Servers AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for the full launch wizard. In Version, choose Manyfold 0.154.1 on Ubuntu 24.04, then choose your Region.
• Pick an instance type (m5.large recommended) and your key pair. The 10 GiB data volume is part of the image. Make it larger in the storage settings if your model collection needs the room.
• Set the security group. The listing's default group opens SSH (22), HTTP (80) and HTTPS (443). Restrict SSH to your own IP address and restrict 80 and 443 to the networks your users work from. Never open 3214, 5432 or 6379.
• Choose your VPC and subnet and leave the metadata defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the VPC, subnet, key pair and CIDRs with your own.

SG=$(aws ec2 create-security-group --group-name manyfold \
  --description "Manyfold" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 443 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 80 --cidr <your-mgmt-cidr>
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=manyfold}]'

You do not need --metadata-options, because the AMI already requires IMDSv2. Associate an Elastic IP if you want the address to survive a stop and start.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot takes one to two minutes after the instance starts. It takes a little longer on the very first start, while EC2 reads the container images from their snapshot.

First boot sets the name that Manyfold is served as (the instance's public DNS name when it has one) and creates the TLS certificate and this instance's secrets. It then starts PostgreSQL, Valkey and Manyfold, creates the administrator and opens nginx.

The login is in a root-only file. The following commands show the address, the user names and the field names without printing any password:

sudo grep -E '^manyfold\.(url|admin\.user|admin\.email|db\.name|db\.user)=' /root/manyfold-credentials.txt
sudo grep -oE '^[a-z.]+=' /root/manyfold-credentials.txt
sudo stat -c '%a %U:%G %n' /root/manyfold-credentials.txt

manyfold.url=https://ec2-54-174-222-146.compute-1.amazonaws.com/ manyfold.admin.email=admin@localhost.localdomain manyfold.admin.user=admin manyfold.db.name=manyfold manyfold.db.user=manyfold manyfold.url= manyfold.admin.email= manyfold.admin.pass= manyfold.admin.user= manyfold.db.name= manyfold.db.user= manyfold.db.pass= manyfold.valkey.pass= 600 root:root /root/manyfold-credentials.txt

The credentials file holds these values:

• manyfold.url: the address of this instance's Manyfold web interface
• manyfold.admin.email and manyfold.admin.pass: the administrator's sign-in. Manyfold signs in by e-mail address, so use admin@localhost.localdomain until you change it
• manyfold.admin.user: the administrator's account name (admin)
• manyfold.db.user and manyfold.db.pass: Manyfold's PostgreSQL account (manyfold), for backups and database administration
• manyfold.valkey.pass: the password of the Valkey job queue, used by Manyfold's background workers

To read the passwords, run sudo cat /root/manyfold-credentials.txt in your own session. Store them in your password manager.

These commands confirm the following:

• The first-boot unit has finished.
• Docker, the metadata block, the Manyfold stack and nginx are active.
• Exactly three containers run, from the pinned images.
• The only public listening sockets are sshd and nginx on ports 22, 80 and 443.
• Manyfold's port 3214 is on 127.0.0.1 only, and PostgreSQL and Valkey have no host port at all.

systemctl is-active manyfold-firstboot docker sac-docker-imds-deny manyfold nginx
sudo ss -Htlnp | awk '{print $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort -u sudo docker ps --format '{{.Names}} {{.Image}} {{.Ports}}'
sudo docker image ls --digests --format '{{.Repository}}:{{.Tag}} {{.Digest}}'

active active active active active 0.0.0.0:22 users:(("sshd"),("systemd")) 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) 127.0.0.1:3214 users:(("docker-proxy")) 127.0.0.53%lo:53 users:(("systemd-resolve")) 127.0.0.54:53 users:(("systemd-resolve")) [::]:22 users:(("sshd"),("systemd")) [::]:443 users:(("nginx"),("nginx"),("nginx")) [::]:80 users:(("nginx"),("nginx"),("nginx")) manyfold manyfold3d/manyfold 127.0.0.1:3214->3214/tcp manyfold-valkey valkey/valkey 6379/tcp manyfold-postgres postgres 5432/tcp postgres:17.11-alpine3.24 sha256:4717f90960a225c2d1c5dac50508c401230f693ff626e06e84e6db0a68ded508 manyfold3d/manyfold:0.154.1 sha256:050e8dde3f59fe0aca5e294b5f3697550c6344d12e2a1bcd8219b7134c97286b valkey/valkey:8.1.11-alpine3.24 sha256:ac81eb0a7b37e054000af8fdd5e6c3eb17249caa71eba79c003a145e518415e5

These commands confirm the following:

• Signed-out requests for the library, settings, account, import and job-queue pages are all sent to the sign-in page.
• The sign-up page redirects away.
• The health check answers.
• Plain HTTP redirects to HTTPS.
• An unknown Host header gets no answer.
• TLS 1.1 is not offered.

The last command is the image's own round-trip check. It signs in with this instance's administrator over https://<your-name>/. It proves that a wrong password is refused and that the database and job-queue passwords work.

H=$(sudo sed -nE 's#^manyfold\.url=https://([^/]+)/?.*#\1#p' /root/manyfold-credentials.txt) for p in / /settings /users/edit /imports/new /admin/sidekiq; do printf '%-16s %s\n' "$p" "$(curl -sk -o /dev/null -w '%{http_code}' --connect-to ::127.0.0.1: "https://$H$p")" done curl -sk -D - -o /dev/null --connect-to ::127.0.0.1: "https://$H/settings" | grep -i '^location' printf 'sign-up page %s\n' "$(curl -sk -o /dev/null -w '%{http_code}' --connect-to ::127.0.0.1: "https://$H/users/sign_up")" printf '/health %s\n' "$(curl -sk -o /dev/null -w '%{http_code}' --connect-to ::127.0.0.1: "https://$H/health")" curl -s -D - -o /dev/null --connect-to ::127.0.0.1: "http://$H/" | grep -iE '^(HTTP|location)' curl -sk -o /dev/null -w 'unknown Host %{http_code}\n' -H 'Host: evil.example' https://127.0.0.1/ || true curl -sk -o /dev/null -w 'TLS 1.1 %{http_code}\n' --tls-max 1.1 --connect-to ::127.0.0.1: "https://$H/" || true
sudo manyfold-selftest

/ 302 /settings 302 /users/edit 302 /imports/new 302 /admin/sidekiq 302 location: https://ec2-54-174-222-146.compute-1.amazonaws.com/users/sign_in sign-up page 302 /health 200 HTTP/1.1 301 Moved Permanently Location: https://ec2-54-174-222-146.compute-1.amazonaws.com/ unknown Host 000 TLS 1.1 000 round-trip OK https://ec2-54-174-222-146.compute-1.amazonaws.com/: 5 protected routes redirect anonymous visitors to sign-in; sign-up closed; wrong admin password 422; admin signed in over 443 (303), /settings 200, account page shows admin@localhost.localdomain; PostgreSQL password authenticates, a wrong one refused; Valkey password PONG, anonymous NOAUTH

The option --connect-to ::127.0.0.1: sends each request to this instance while keeping the real host name in the request, exactly as a browser would send it. The status 000 means the server closed the connection without an answer.

Browse to manyfold.url (https://<public-dns-name>/). The certificate is self-signed, so your browser warns once. Accept it for this host, or install your own certificate (Step 8).

Sign in with the e-mail address admin@localhost.localdomain and the manyfold.admin.pass value from the credentials file.

On your first visit, Manyfold offers a short tour of its main features. Close it or step through it. Then open the gear icon (Site Settings) and choose Manage Accounts.

The image creates one account, admin, with the member and administrator roles. Open it with View to change its e-mail address to your own. Use New account to add an account for each person who should see the library. Because registration is closed, nobody can create an account for themselves.

The image creates one library, Models, at /libraries inside the container. That path is /var/lib/manyfold/libraries on the data volume. There are two ways to fill the library:

• In the browser: choose Add content, then Upload models. Drop your model files (or a zip of them) on the page. Large files upload in small chunks, so the 16 MB request limit does not apply to them.
• From the instance: copy a folder per model into the library and give it to the manyfold user. Then choose Scan, then Scan for new files in the web interface. Replace the source path with your own.

sudo cp -r ~/my-models/* /var/lib/manyfold/libraries/
sudo chown -R manyfold:manyfold /var/lib/manyfold/libraries

Manyfold turns each folder into a model. Its background workers then render a preview of every file and analyse the meshes. The Models page shows the collection with its previews.

Open a model to see its files, load any of them into the 3D viewer, and download them. You can also tag the model and file it under a creator or a collection. New models are shared with your signed-in local users by default. The padlock icon on each model changes who can see it.

The home page searches the whole library and lists recent activity.

Importing a model from a web page (Add content, then Import URL) needs outbound internet access from the instance. For most sites, it also needs that site's API key, which you add under Site Settings, then Integrations. Imports can never reach the instance metadata service.

Your model library, the PostgreSQL database and the Valkey job queue live on the 10 GiB data volume. The volume is mounted by its filesystem UUID.

findmnt -n -o SOURCE,FSTYPE,SIZE,TARGET /var/lib/manyfold
sudo ls /var/lib/manyfold grep ' /var/lib/manyfold ' /etc/fstab | sed -E 's/UUID=[0-9a-f-]+/UUID=<uuid>/'

/dev/nvme1n1 ext4 9.7G /var/lib/manyfold libraries lost+found postgres valkey UUID=<uuid> /var/lib/manyfold ext4 defaults,nofail 0 2

To grow the library's space, enlarge the volume in the EC2 console (Volumes, Modify volume). Then run sudo resize2fs on the device that findmnt shows. To back up the library, snapshot the volume (see Maintenance, below).

Point a DNS record (for example models.example.com) at the instance's public or Elastic IP address. Then tell the image to serve that name.

The command creates a new self-signed certificate for the name and pins nginx, the cross-site guard and Manyfold to it. It also updates manyfold.url in the credentials file and keeps the name across reboots.

sudo manyfold-set-hostname models.example.com

For a trusted certificate, obtain one for that name. For example, use certbot's certonly mode with its own temporary web server, or get one from your organisation's CA. Copy the certificate chain and key over /etc/ssl/manyfold/manyfold.crt and /etc/ssl/manyfold/manyfold.key (key mode 0600, root). Then run sudo systemctl reload nginx.

These commands confirm the following:

• The DOCKER-USER rules drop the metadata addresses (IPv4 and IPv6) and keep other containers off the Manyfold network.
• No container gets an answer from instance metadata, while the Manyfold container still reaches the internet. The 200 is that positive control.
• The PostgreSQL and Valkey ports answer nothing on the host.
• The services carry IPAddressDeny.
• SSH runs with the SecureAnyCloud pins.

sudo iptables -S DOCKER-USER
sudo ip6tables -S DOCKER-USER
sudo docker exec manyfold ruby -rnet/http -e 'puts "manyfold -> internet: " + Net::HTTP.get_response(URI("http://checkip.amazonaws.com/")).code' for c in manyfold manyfold-postgres manyfold-valkey; do
sudo docker exec "$c" sh -c 'wget -q -T 5 -O /dev/null http://169.254.169.254/latest/meta-data/ 2>/dev/null && echo answered || echo blocked' | sed "s/^/$c -> IMDS: /" done for p in 5432 6379; do curl -s -m 5 -o /dev/null -w "host -> 127.0.0.1:$p: %{http_code}\n" "telnet://127.0.0.1:$p" || true done systemctl show -p IPAddressDeny docker manyfold nginx
sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|kbdinteractiveauthentication|x11forwarding) '

-N DOCKER-USER -A DOCKER-USER ! -i br-manyfold -o br-manyfold -m conntrack --ctstate NEW -j DROP -A DOCKER-USER -d 168.63.129.16/32 -j DROP -A DOCKER-USER -d 169.254.169.254/32 -j DROP -N DOCKER-USER -A DOCKER-USER -o br-manyfold -j DROP -A DOCKER-USER -d fd00:ec2::254/128 -j DROP manyfold -> internet: 200 manyfold -> IMDS: blocked manyfold-postgres -> IMDS: blocked manyfold-valkey -> IMDS: blocked host -> 127.0.0.1:5432: 000 host -> 127.0.0.1:6379: 000 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 permitrootlogin no passwordauthentication no kbdinteractiveauthentication no x11forwarding no

Manyfold is licensed under the GNU Affero General Public License version 3. Section 13 requires that anyone using the program over a network is offered the corresponding source of the running version. The instance carries that source, so you need no network access to get it.

head -12 /usr/share/doc/manyfold/SOURCE-OFFER.txt cd /usr/share/manyfold/source && sha256sum -c manyfold-0.154.1-source.tar.gz.sha256

Manyfold 0.154.1 - AGPL-3.0 offer of corresponding source ================================================================ This appliance runs Manyfold 0.154.1 from the official upstream container image, unmodified: manyfold3d/manyfold@sha256:050e8dde3f59fe0aca5e294b5f3697550c6344d12e2a1bcd8219b7134c97286b (multi-arch index sha256:32308a8370452af6bc93f749fc4fa037de8d77075b9c3f0e423efe5dfef1d192, tag 0.154.1) Manyfold is free software licensed under the GNU Affero General Public License, version 3 (AGPL-3.0). Under section 13, every user who interacts with this program over a network is offered the complete corresponding source of the version that is running. manyfold-0.154.1-source.tar.gz: OK

SecureAnyCloud makes no changes to Manyfold itself. The image adds only the Docker Compose project, the systemd units, the nginx configuration and the first-boot setup.