Opengist 1.15.3

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Select Opengist 1.15.3 on Ubuntu 24.04 as the software version, pick your Region, and choose Launch through EC2.

Choose m5.large, your key pair, a security group as described above, and a subnet. A smaller instance works for a small team. The image comes with a second 20 GiB volume for Opengist's data, which you can make bigger at launch.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=opengist}]'

Connect to Opengist 1.15.3 on Ubuntu 24.04 as the SSH user ubuntu:

ssh -i <your-key.pem> ubuntu@<public-ip>

On first boot, the instance generates the certificate, the secret key and the administrator, and then starts Opengist and nginx. Confirm that it finished:

systemctl is-active opengist nginx opengist-firstboot
sudo test -f /var/lib/sac/data/opengist-firstboot.done && echo FIRSTBOOT_DONE

All three units are active and the first boot marker is present:

active active active FIRSTBOOT_DONE

Only SSH and nginx listen on the network. Opengist itself listens on 127.0.0.1 only, and there is no SSH git server. Check the listeners:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | grep -v '127.0.0.5' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort

0.0.0.0:22 users:(("sshd"),("systemd")) 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) 127.0.0.1:6157 users:(("opengist")) [::]:22 users:(("sshd"),("systemd")) [::]:443 users:(("nginx"),("nginx"),("nginx")) [::]:80 users:(("nginx"),("nginx"),("nginx"))

Read the credentials file. It is readable by root only and holds the URL, the administrator's user name and this instance's password:

sudo cat /var/lib/sac/data/opengist-credentials.txt

# Opengist 1.15.3 - generated on first boot by opengist-firstboot.service
# This administrator was created on THIS instance; no account was baked into the image. Opengist stores only a hash
# of the password. Keep this file secret and change the password after your first sign-in (Settings > Authentication). OPENGIST_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ OPENGIST_ADMIN_USER=admin OPENGIST_ADMIN_PASSWORD=<OPENGIST_ADMIN_PASSWORD>
#
# Open OPENGIST_URL in a browser (self-signed certificate minted on this instance's first boot; port 80 redirects to # https) and sign in. This instance ships LOCKED DOWN: open sign-up is off (add users in Admin panel > Users or with # invitations), login is required to view anything, anonymous gists are off and Gravatar is off. Each is a toggle in # Admin panel > Configuration. # Every gist is a Git repository: clone and push over HTTPS with your username and password or an access token. # The built-in SSH git server is switched off in this image. # Self-test:
sudo opengist-selftest
# Change the name it is served as:
sudo opengist-set-hostname <your-dns-name>
# User guide: https://secureanycloud.com/stacks/opengist-1-15-3/

The URL uses the instance's public DNS name from EC2 instance metadata. The certificate also names the public and private IP addresses, so https://<public-ip>/ works too.

To serve Opengist under your own DNS name, see Step 12.

Open the OPENGIST_URL in your browser. The certificate is self-signed, so your browser asks you to confirm it the first time. You can install your own certificate instead (Step 12).

Sign in as admin with the password from Step 4. There is no Register link, because sign-up is off.

Next, open your avatar menu, choose Settings, and change the password under Authentication to one that only you know.

Choose New. Give the gist a title and description, name the file, and type or paste the content. The file extension picks the syntax highlighting. Use Add file for more files, or drop files onto the upload area.

Choose Create public gist to create it. On this instance, "public" still means "visible to signed-in users". The arrow next to the button offers unlisted and private instead, and Expires removes the gist automatically after a time you choose.

The gist page shows each file with syntax highlighting. It has Raw, copy and download buttons, the revision history, and the Code menu with its clone address.

All gists lists every gist you can see, newest first. The search box at the top searches the contents of all of them.

The image includes a self-test. It checks HTTPS and confirms that anonymous visitors, sign-up and guessed passwords are refused. It then signs in, creates a gist, and reads it back over HTTPS and with a real git clone. Finally, it deletes the gist and checks the listening ports. Run it:

sudo opengist-selftest

SELFTEST-OK https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ : anonymous refused, sign-up refused, guessed passwords refused, admin signed in, gist round trip over HTTPS + git clone, listeners 22/80/443

Every gist's Code menu shows its clone address, https://<your-host>/<user>/<gist-id>, with no .git on the end. Git asks for your Opengist user name and password. For scripts and CI, create an access token under Settings > Access tokens and use it in place of the password.

From your workstation, run the commands below. Until you install a trusted certificate (Step 12), the first command tells Git to accept the instance's self-signed certificate for this address only:

git config --global http.https://<public-ip>/.sslVerify false
git clone https://<public-ip>/admin/<gist-id> my-gist cd my-gist echo "one more line" >> deploy.sh
git commit -am "Update from my laptop"
git push

To create a new gist from a local repository, push it to the special init address. Opengist creates the gist and prints its address:

cd my-new-snippet git push https://<public-ip>/init HEAD:main

remote: Your new gist has been created here: https://<public-ip>/admin/<gist-id>

Opengist's own SSH git server is switched off on this image, so use HTTPS. If you need git over SSH, see the Opengist documentation, and open only the port you configure, from your own networks.

Choose Admin in the sidebar to open the admin panel. Users lists the accounts. Invitations creates single-use sign-up links for people you want to add while open sign-up stays off. Configuration holds the switches that this image sets.

To read the same settings from Opengist's database, run:

sudo -u opengist sqlite3 -readonly /opt/opengist/opengist.db "SELECT key||' = '||value FROM admin_settings ORDER BY key;"

allow-gists-without-login = 0 disable-gravatar = 1 disable-login-form = 0 disable-signup = 1 require-login = 1

• To let anyone who can reach the instance register, switch off Disable signup. Do this only on a private network, because anyone who registers can create gists.
• To share individual gists with people who have no account, for example through a link in a ticket, switch on Allow individual gists without login. Listing and searching still need a login. To open everything to anonymous readers, switch off Require login as well.

OAuth and OpenID Connect sign-in are not configured, and nginx closes Opengist's /oauth/ routes so that an unconfigured provider cannot be used.

To enable a provider, register Opengist as an OAuth application with it, using the callback https://<your-host>/oauth/<provider>/callback. Add its keys to /etc/opengist/config.yml as the Opengist documentation describes. Then open the routes and restart:

sudo nano /etc/opengist/config.yml
# e.g. github.client-key / github.secret, or the oidc.* keys
sudo truncate -s 0 /etc/nginx/opengist-oauth.conf
sudo systemctl restart opengist && sudo systemctl reload nginx

Opengist's database, gist repositories, search index and sessions are on their own EBS volume, mounted at /opt/opengist by filesystem UUID. Check the mount:

findmnt -no SOURCE,FSTYPE,SIZE /opt/opengist

To grow the volume, increase its size in the EC2 console (Volumes > Modify volume). Then grow the filesystem online:

lsblk
sudo resize2fs "$(findmnt -no SOURCE /opt/opengist)" df -h /opt/opengist

To back up, take an EBS snapshot of the data volume, or use AWS Backup. For a consistent copy, stop Opengist while you start the snapshot. Run sudo systemctl stop opengist, start the snapshot, then run sudo systemctl start opengist.

Point a DNS name at the instance, then set it as the name that Opengist is served under. The command writes the name into the nginx configuration and Opengist's external URL, generates a new self-signed certificate for it, and restarts Opengist:

sudo opengist-set-hostname <your-domain>

To use a certificate from your own certificate authority, or one you obtained for the name, replace /etc/ssl/opengist/opengist.crt and /etc/ssl/opengist/opengist.key. Keep the key at mode 0600, owned by root. Then reload nginx with sudo systemctl reload nginx.

Running opengist-set-hostname again generates a new self-signed certificate, so install your own certificate after it.

Run these requests to confirm that the instance refuses what it should:

H=$(sudo sed -n 's#^OPENGIST_URL=https://\([^/]*\)/#\1#p' /var/lib/sac/data/opengist-credentials.txt) c() { curl -sk --resolve "$H:443:127.0.0.1" --resolve "$H:80:127.0.0.1" -o /dev/null "$@"; } c -w 'port 80: %{http_code} -> %{redirect_url}\n' "http://$H/" c -w 'API without a token: %{http_code}\n' "https://$H/api/gists" c -w 'gist list without login: %{http_code} -> %{redirect_url}\n' "https://$H/-/all" c -w 'cross-site logout link: %{http_code}\n' -H 'Sec-Fetch-Site: cross-site' "https://$H/-/logout" c -w 'cross-origin form post: %{http_code}\n' -X POST -H 'Origin: https://evil.example' "https://$H/-/login" c -w 'OAuth sign-in routes: %{http_code}\n' "https://$H/oauth/github" curl -s -o /dev/null -w 'unknown host name: %{http_code} (connection closed)\n' -H 'Host: other.example' http://127.0.0.1/ || true

port 80: 301 -> https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ API without a token: 401 gist list without login: 302 -> https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/-/login cross-site logout link: 403 cross-origin form post: 403 OAuth sign-in routes: 404 unknown host name: 000 (connection closed)

Opengist and nginx cannot reach the instance metadata service. Confirm it:

for u in opengist nginx; do echo "$u denies: $(systemctl show -p IPAddressDeny --value $u | tr ' ' '\n' | sort | xargs)"; done

opengist denies: 168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128 nginx denies: 168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128

Items and their locations:

Opengist binary /usr/local/bin/opengist

Configuration /etc/opengist/config.yml (root:opengist, mode 0640)

Data (database, repositories, index, sessions) /opt/opengist (its own EBS volume)

Service units opengist.service, nginx.service, opengist-firstboot.service

nginx site /etc/nginx/sites-available/sac-opengist

Certificate and key /etc/ssl/opengist/

First-boot script /usr/local/sbin/opengist-firstboot.sh

Host name helper /usr/local/sbin/opengist-set-hostname

Self-test /usr/local/sbin/opengist-selftest

Credentials /var/lib/sac/data/opengist-credentials.txt (mode 0600)

/usr/local/bin/opengist version command -v go || echo "no Go toolchain" nginx -v 2>&1 git --version sed -n '1,3p' /usr/share/doc/sac-opengist/BUILD-INFO.txt

Opengist v1.15.3 no Go toolchain nginx version: nginx/1.24.0 (Ubuntu) git version 2.43.0 opengist 1.15.3 (tag v1.15.3, commit 2acf3dae87f9c3d536e0a870787941bbd06d0b46), AGPL-3.0 - the OFFICIAL release binary https://github.com/thomiceli/opengist/releases/download/v1.15.3/opengist1.15.3-linux-amd64.tar.gz tarball sha256 fb843f3dab89164c7b3a96018d8ea7a97ab3dc90fea05a45770719d23ddf836a (= GitHub's asset digest); binary sha256 008e12ecc149ffd5a18afa894e89fcf7483da4f74b8391d6cb6b69a738a68737

/usr/share/doc/sac-opengist/BUILD-INFO.txt records the release archive and binary checksums, the Go version and modules the release was built with, and the govulncheck result. govulncheck-opengist-binary.txt holds the full report.

SecureAnyCloud made these changes to the operating system:

• SSH accepts keys only, with no passwords and no root login, and the root account has no password.
• The firmware metadata refresh timer (fwupd-refresh) is masked, because EC2 has no updatable firmware.
• The golden image's boot-time updater and the SSM user's passwordless sudo are removed.
• Unattended security upgrades are on.

• Allow ports 22, 80 and 443 in the security group from your own networks only.
• Change the administrator password after your first sign-in (Step 5), keep the credentials file secret, and give each person their own account (Step 9).
• Use your own DNS name and a certificate your clients trust (Step 12).
• Gists can hold sensitive snippets. Keep Require login on unless the instance is for public sharing, and prefer private gists for anything that is not meant to be shared.
• govulncheck lists advisories for three modules that Opengist's build includes but whose vulnerable packages it never uses, so no vulnerable code is reachable. They are GO-2026-6866 and GO-2026-6860 (the golang.org/x/net/html package, fixed in x/net 0.62.0) and GO-2026-5932 (the golang.org/x/crypto/openpgp package, which is unmaintained, with no fixed version). SecureAnyCloud rechecks this at each Opengist release.
• Keep the operating system patched. Unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else.