MEAN Stack

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for MEAN Stack. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger, because MongoDB and Node.js both benefit from extra memory under load. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound port 80 from the networks your visitors use. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes approximately one minute after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud MEAN Stack Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=mean-stack-01}]'

On success, the command prints a JSON document. Note the instance ID, then retrieve the instance's public address once it is running with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from step 2. The SSH login user depends on the operating system of the AMI variant you launched. For MEAN Stack on Ubuntu 24.04, the user is ubuntu.

This is an example for the Ubuntu 24.04 variant.

ssh -i <your-key>.pem ubuntu@<instance-public-ip>

Once you have shell access, read the credentials file that first boot generated.

sudo cat /root/mean-credentials.txt

The file contains the per-instance MongoDB administrator user, the MongoDB application user, the database name and the Express app secret. Store the contents in a password manager and remove the file once you have recorded the values.

The sample application is served on port 80. Open a browser and visit the instance's public address.

http://<instance-public-ip>/

You see the SecureAnyCloud MEAN Stack starter page. It shows the four components of the stack, reports the health of the Express API, and lists the documents currently in the sample collection. The API inserts a welcome document automatically the first time it runs.

The starter page renders an Angular front end, served as static assets from /opt/mean/sac/public. The front end calls the Express API at /api/items, which reads from and writes to the sac.items collection in MongoDB. Every page load exercises the full Angular -> Express -> MongoDB round trip.

The starter page includes a form to add new items. Enter a name and an optional note, then choose Add.

The Angular front end issues an HTTP POST to /api/items, and nginx forwards the request to Express on 127.0.0.1:3000. Express inserts a document into MongoDB as the application MongoDB user, authenticated against the SecureAnyCloud database with SCRAM-SHA-256. The new item appears at the top of the list, which is ordered by creation time.

Delete items individually with the Delete button on each row. The front end issues DELETE /api/items/<id>, which Express routes to MongoDB.

The sample API is also reachable directly. From the EC2 instance, check its health.

curl -s http://127.0.0.1/api/health

This returns a small JSON document that confirms the API is up and that the Express app secret has been loaded from the environment file. The secretConfigured field should report true.

To list items, run the following.

curl -s http://127.0.0.1/api/items

To create an item from the command line, run the following.

curl -s -X POST http://127.0.0.1/api/items \
  -H 'Content-Type: application/json' \
  -d '{"name":"my first item","note":"created from the command line"}'

The MongoDB shell mongosh is preinstalled. Use it with the application credentials from /root/mean-credentials.txt.

APP_PASS=$(sudo grep '^mongo.app.password=' /root/mean-credentials.txt | cut -d= -f2-) mongosh "mongodb://sac:${APP_PASS}@127.0.0.1:27017/sac?authSource=sac"

Inside the shell, the items collection of the SecureAnyCloud database is the one that the sample API reads and writes.

use sac db.items.countDocuments({}) db.items.find().sort({createdAt: -1}).limit(5)

For administrative work, use the administrator credentials from the same file.

ADMIN_PASS=$(sudo grep '^mongo.admin.password=' /root/mean-credentials.txt | cut -d= -f2-) mongosh "mongodb://marketplaceAdmin:${ADMIN_PASS}@127.0.0.1:27017/?authSource=admin"

MongoDB listens on port 27017 on all interfaces by default, so only the AWS security group on the instance controls who can reach it. Open port 27017 in the security group only to the trusted networks that need direct database access.

The image is a starting point. Replace the sample at /opt/mean/sac with your own MEAN application.

The mean-app.service unit expects this layout:

• /opt/mean/sac/package.json declaring your Node.js dependencies and a main entry point.
• /opt/mean/sac/server.js (or whatever main points to) as the Node.js process that pm2-runtime launches.
• A static front end in /opt/mean/sac/public/ (the Angular build output) that Express serves.

The Express process reads the MongoDB connection string and the app secret from /etc/meanapp/sac.env. The keys are as follows.

NODE_ENV=production PORT=3000 MONGO_DB=sac MONGO_URI=mongodb://sac:<password>@127.0.0.1:27017/sac?authSource=sac APP_SECRET=<random>

To deploy your own application, run the following.

# Stop the sample
sudo systemctl stop mean-app.service
# Replace the code (as ubuntu, then chown for the runtime user)
sudo rm -rf /opt/mean/sac
sudo mkdir -p /opt/mean/sac
sudo chown meanapp:meanapp /opt/mean/sac
sudo -u meanapp git clone <your-repo-url> /opt/mean/sac
# Install dependencies as the runtime user cd /opt/mean/sac
sudo -u meanapp env HOME=/var/lib/meanapp npm install --omit=dev --no-fund --no-audit
# If your Angular front end needs building, build it once here:
#
sudo -u meanapp env HOME=/var/lib/meanapp npm run build
# and copy the build output into /opt/mean/sac/public/
# Restart the service
sudo systemctl restart mean-app.service

Your application now runs in place of the sample. The environment file, the MongoDB users, the nginx vhost and the systemd unit all continue to apply.

These systemd units make up the stack:

• mongod.service: MongoDB 7 Community, listening on 27017.
• mean-app.service: the Express API, run by pm2-runtime, on 127.0.0.1:3000.
• nginx.service: the reverse proxy, on port 80.
• mean-firstboot.service: a one-shot unit that rotates credentials on first boot.

Check the status of all services at once.

sudo systemctl is-active mongod.service mean-app.service nginx.service

Restart the Node.js application after a code or environment change.

sudo systemctl restart mean-app.service

Application stdout and stderr are written to /var/log/meanapp/stdout.log and /var/log/meanapp/stderr.log respectively. Tail them while you debug.

sudo tail -f /var/log/meanapp/stdout.log /var/log/meanapp/stderr.log

MongoDB logs go to /var/log/mongodb/mongod.log and nginx logs go to /var/log/nginx/.

The image ships with port 80 open and port 443 closed by default. To enable HTTPS, complete these steps:

• Open port 443 inbound in the EC2 security group on the instance.
• Point a DNS A record at the instance public IP and wait for propagation.
• Install certbot and request a certificate.

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot reads the existing nginx vhost, requests a certificate, writes a new HTTPS server block and reloads nginx. The redirect from port 80 to port 443 is optional, and certbot offers to add it.