OrientDB 3.2.57

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened Neo4j & Graph and RDF Databases AMIs listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Choose Launch your software. In Version, choose OrientDB 3.2.57 on Ubuntu 24.04 - YYYY-MM-DD, then choose your Region.
• Instance type: choose m5.large (recommended).
• Key pair: choose your EC2 key pair.
• Security group: allow TCP 22 from your own address, and TCP 443 (and 80) from your clients.
• Launch the instance. First boot takes about a minute after the instance is reachable. During that time it generates this instance's certificate and passwords and creates the Demo database.

Option B: AWS CLI

Run this command on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the key pair, security group and subnet with your own.

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=orientdb}]'

The AMI already requires IMDSv2, so you do not need --metadata-options. The data volume is created from the AMI automatically.

ssh -i my-key-pair.pem ubuntu@<vm-ip>

The login banner shows the Studio and HTTP API URLs for this instance.

Confirm that OrientDB and nginx are running, that first boot has finished, and that the unauthenticated health endpoint answers over HTTPS.

systemctl is-active orientdb.service nginx.service test -f /var/lib/sac/data/orientdb-firstboot.done && echo first-boot-done curl -sk -o /dev/null -w 'healthz: HTTP %{http_code}\n' https://localhost/healthz

Both services report active, the first-boot marker is present and /healthz returns HTTP 200 (the nginx-served liveness check, which needs no login and returns nothing about OrientDB).

OrientDB itself listens on loopback only. nginx owns the public ports.

sudo ss -tlnp | grep -E ':(2424|2480|80|443) '

You see java on [::ffff:127.0.0.1]:2424 and [::ffff:127.0.0.1]:2480 (the loopback address) and nginx on ports 80 and 443.

The root password is unique to this instance and is written to a root-only file at first boot. Print only the field names, never the password itself.

sudo grep -oE '^[A-Z_]+=' /root/orientdb-credentials.txt

This lists ORIENTDB_HOST, ORIENTDB_STUDIO_URL, ORIENTDB_HTTP_API_URL, ORIENTDB_ROOT_USER (root), ORIENTDB_ROOT_PASSWORD (the per-instance password), ORIENTDB_DEMO_DATABASE (Demo) and ORIENTDB_BINARY_URL. Read the password itself with sudo sed -n 's/^ORIENTDB_ROOT_PASSWORD=//p' /root/orientdb-credentials.txt when you need it. Keep the password safe, because it belongs to the server administrator account. OrientDB stores only a salted PBKDF2 hash of it. The same password protects the HTTPS gateway, where nginx keeps a bcrypt hash.

Every path on port 443 except /healthz requires the login. An anonymous request and a wrong password are both rejected with 401, and so are the classic OrientDB defaults.

curl -sk -o /dev/null -w 'anonymous: HTTP %{http_code}\n' https://localhost/listDatabases
curl -sk -u 'root:wrong-password' -o /dev/null -w 'wrong password: HTTP %{http_code}\n' https://localhost/listDatabases
curl -sk -u 'admin:admin' -o /dev/null -w 'admin/admin: HTTP %{http_code}\n' https://localhost/listDatabases

With the per-instance password, the API answers 200 and lists the databases.

PW=$(sudo sed -n 's/^ORIENTDB_ROOT_PASSWORD=//p' /root/orientdb-credentials.txt)
curl -sk -u "root:$PW" -o /dev/null -w 'authenticated root: HTTP %{http_code}\n' https://localhost/listDatabases
curl -sk -u "root:$PW" https://localhost/listDatabases; echo

The list contains Demo. OrientDB checks the login again behind nginx, so OrientDB itself also refuses the defaults, including on the loopback port that bypasses nginx.

for c in admin:admin reader:reader writer:writer guest:guest; do printf '%-14s HTTP %s\n' "$c" "$(curl -s -u "$c" -o /dev/null -w '%{http_code}' -X POST --data-binary 'SELECT 1' http://127.0.0.1:2480/command/Demo/sql)" done

Every line shows HTTP 401. The Demo database has no database users at all, and the built-in guest account is suspended.

Open https://<public-dns>/studio/index.html in your browser. The certificate is self-signed and unique to this instance, so your browser warns once. For production, serve the instance under your own DNS name with a trusted certificate (Step 10). The browser then asks for the gateway login. Enter root and the per-instance password. Studio shows its sign-in page.

Choose the Demo database, sign in as root with the same password, and run a query in the Browse tab. The result grid shows the records.

The Graph tab draws vertices and their relationships. Run SELECT FROM Person with the play button. Studio draws the four people and the Knows edges between them. Click a vertex to show its properties.

The Schema tab lists the classes. These are the vertex class Person (extending V) and the edge class Knows (extending E) with their record counts. Further down, under Generic Classes, you see the schema-less document class Note.

Commands are POST /command/<database>/sql with the statement as the body. A two-hop MATCH pattern walks the Knows edges from Alice.

PW=$(sudo sed -n 's/^ORIENTDB_ROOT_PASSWORD=//p' /root/orientdb-credentials.txt)
curl -sk -u "root:$PW" -X POST https://localhost/command/Demo/sql \
  --data-binary "MATCH {class: Person, as: a, where: (name = 'Alice')}.out('Knows'){as: b}.out('Knows'){as: c} RETURN a.name AS a, b.name AS b, c.name AS c" \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["result"])'

It returns Alice, who knows Bob, who knows Carol. The same graph answers graph functions inside ordinary SQL. The document side answers queries on nested fields that exist on no schema.

PW=$(sudo sed -n 's/^ORIENTDB_ROOT_PASSWORD=//p' /root/orientdb-credentials.txt)
curl -sk -u "root:$PW" -X POST https://localhost/command/Demo/sql \
  --data-binary "SELECT name, out('Knows').name AS knows FROM Person ORDER BY name" \
  | python3 -c 'import json,sys; [print(r["name"], "->", r["knows"]) for r in json.load(sys.stdin)["result"]]'
curl -sk -u "root:$PW" -X POST https://localhost/command/Demo/sql \
  --data-binary "SELECT title, meta.author AS author, tags FROM Note WHERE meta.priority = 1" \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["result"])'

The first query prints who each person knows. The second returns the Release plan note written by Alice.

Create your own database and write to it.

PW=$(sudo sed -n 's/^ORIENTDB_ROOT_PASSWORD=//p' /root/orientdb-credentials.txt)
curl -sk -u "root:$PW" -o /dev/null -w 'create database: HTTP %{http_code}\n' -X POST https://localhost/database/Inventory/plocal
curl -sk -u "root:$PW" -o /dev/null -X POST https://localhost/command/Inventory/sql --data-binary "CREATE CLASS Item"
curl -sk -u "root:$PW" -o /dev/null -X POST https://localhost/command/Inventory/sql --data-binary "INSERT INTO Item SET sku = 'A-100', qty = 5"
curl -sk -u "root:$PW" -X POST https://localhost/command/Inventory/sql --data-binary "SELECT sku, qty FROM Item" \
  | python3 -c 'import json,sys; print(json.load(sys.stdin)["result"])'
curl -sk -u "root:$PW" -o /dev/null -w 'drop database: HTTP %{http_code}\n' -X DELETE https://localhost/database/Inventory

The SELECT returns the A-100 item, and the example database is dropped again.

A new database has no users of its own. Create the users your applications need with CREATE USER <name> IDENTIFIED BY '<password>' ROLE reader (or writer). Never create a database with the security.createDefaultUsers option, because it adds the published admin/admin, reader/reader and writer/writer users.

Drivers and the OrientDB console connect to the binary port 2424 on loopback. Connect from the instance itself, or from your workstation through an SSH tunnel (ssh -L 2424:127.0.0.1:2424 ubuntu@<vm-ip>). The console reads its commands from a file, which keeps the password off the command line.

PW=$(sudo sed -n 's/^ORIENTDB_ROOT_PASSWORD=//p' /root/orientdb-credentials.txt)
T=$(mktemp -d); chmod 700 "$T" printf 'connect remote:127.0.0.1:2424/Demo root %s\nselect name, city from Person order by name\n' "$PW" > "$T/demo.osql" HOME="$T" /opt/orientdb/bin/console.sh "$T/demo.osql" 2>&1 | grep -E '^\||item\(s\) found' rm -rf "$T"

The console prints the four people and 4 item(s) found. The nginx gateway accepts only root. Database users you create sign in over the binary protocol or the loopback HTTP port 2480, for example through the same SSH tunnel. To let another user through the gateway too, add it to /etc/nginx/orientdb.htpasswd with sudo htpasswd -B /etc/nginx/orientdb.htpasswd <user>, using the same password it has in OrientDB.

These components use the following paths:

• OrientDB install (read-only, root-owned): /opt/orientdb
• Server configuration: /opt/orientdb/config/orientdb-server-config.xml and /opt/orientdb/config/security.json
• JVM and memory settings: /etc/default/orientdb
• Data volume: /var/lib/orientdb
• Databases (including the OSystem server-user database): /var/lib/orientdb/databases
• Server log: /var/lib/orientdb/log and journalctl -u orientdb
• Credentials file: /root/orientdb-credentials.txt (mode 0600)
• Per-instance certificate: /etc/ssl/orientdb/
• Gateway login (bcrypt): /etc/nginx/orientdb.htpasswd
• nginx site: /etc/nginx/sites-available/sac-orientdb

The data volume is mounted by filesystem UUID.

findmnt /var/lib/orientdb df -h /var/lib/orientdb

To change the heap (ORIENTDB_OPTS_MEMORY), edit /etc/default/orientdb and run sudo systemctl restart orientdb.service. Keep the listeners in orientdb-server-config.xml on 127.0.0.1 so OrientDB stays behind nginx.

Back up a database with the console's backup database command, or stop the service and copy /var/lib/orientdb/databases.

Point a DNS record at the instance, then regenerate the certificate and pin the served hostname.

sudo orientdb-set-hostname orientdb.example.com

This issues a new self-signed certificate for that name and makes nginx answer only for it. For production, replace the certificate with your own CA- or ACM-issued certificate. For a public, browser-trusted certificate, terminate TLS at an Application Load Balancer or CloudFront in front of the instance. Keep the security group's port 443 open only to that front end.