Payload CMS

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Payload CMS. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.large or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that opens port 22 from your management network and port 80 for the admin panel and the API. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialisation takes a short time after the instance state becomes Running and the status checks pass. It generates the application secret and the admin user, then starts the service.

The following command launches an instance from the SecureAnyCloud Payload CMS Marketplace AMI into an existing subnet and security group. Replace the values as follows:

• <ami-id>: the AMI ID shown on the Marketplace listing
• <key-name>: your EC2 key pair name
• <subnet-id>: your subnet ID
• <security-group-id>: a security group that opens ports 22 and 80 as described above

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=payload-cms}]'

Wait for the instance to reach the Running state and pass its status checks. Then note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Connect over SSH using your key pair and the login user for your operating system variant. For Ubuntu 24.04, the login user is ubuntu.

ssh -i <key-name>.pem ubuntu@<public-ip>

The admin password is unique to your instance and was generated on first boot. Read it as root:

sudo cat /root/payload-cms-credentials.txt

The file lists the admin panel URL, the admin email (admin@sac.local) and the generated password. Store the password somewhere safe.

nginx serves the Payload admin panel on port 80 at the /admin path. In a browser, go to:

http://<instance-public-ip>/admin

Sign in with the email admin@sac.local and the password from the credentials file. You land on the dashboard, which lists the collections defined in your Payload config.

Open a collection from the sidebar or the dashboard to see its list view, where you browse, search, filter and manage entries. Every collection you define in code automatically gets a list view, an editor, access control and a typed API.

Select an entry to open the field-based document editor, where you edit the fields defined for that collection. The same editor powers your own collections once you add them to the Payload config.

Over SSH, confirm that the Payload service and the nginx proxy are active and that the ports are listening:

sudo systemctl is-active payload nginx
sudo ss -tlnp | grep -E ':(80|3000) '

Both services report active. Payload listens on 127.0.0.1:3000 (loopback only), and nginx listens on port 80.

Payload exposes a fully typed REST and GraphQL content API on the same port 80, under the /api path. Obtain a session token by posting your admin credentials to the login endpoint. From the instance, call the API over loopback:

PASS=$(sudo grep '^payload.admin.pass=' /root/payload-cms-credentials.txt | cut -d= -f2-)
curl -s -H 'Content-Type: application/json' \
  --data "{\"email\":\"admin@sac.local\",\"password\":\"${PASS}\"}" \
  http://127.0.0.1/api/users/login | head -c 400; echo

The response contains a session token and the authenticated user. From outside the instance, send the same request to http://<instance-public-ip>/api/users/login.

List the documents in a collection with a GET to /api/<collection-slug>, for example the users collection:

curl -s http://127.0.0.1/api/users?limit=1 | head -c 400; echo

The GraphQL endpoint is at /api/graphql, and the GraphQL Playground is at /api/graphql-playground. Generate API keys and manage access control from the admin panel.

Payload is code-first. You define collections and globals in TypeScript in /opt/payload/src, and Payload generates the admin panel, the typed API and the database schema for you.

The configuration entry point is /opt/payload/src/payload.config.ts, and the collection definitions live under /opt/payload/src/collections. View the current config:

sudo sed -n '1,40p' /opt/payload/src/payload.config.ts

After you change the config or add a collection, generate a new database migration and rebuild the production bundle as the payload user, then restart the service. SQLite requires migrations to apply schema changes in production:

cd /opt/payload
sudo -u payload env HOME=/opt/payload NODE_ENV=production npx payload migrate:create my_change
sudo -u payload env HOME=/opt/payload NODE_ENV=production npx payload migrate
sudo -u payload env HOME=/opt/payload NODE_ENV=production npm run build
sudo systemctl restart payload

See the Payload documentation at https://payloadcms.com/docs for the full configuration, field type and access control reference.

The content store lives on a dedicated EBS volume mounted at /var/lib/payload. This keeps the SQLite database and your uploaded media off the operating system disk and lets you resize or snapshot the volume independently. Confirm the mount and the database location:

df -h /var/lib/payload
sudo ls -la /var/lib/payload

The listing shows payload.db and the media directory on the mounted volume. To grow the content store, expand the EBS volume in the AWS console. Then grow the filesystem on the instance with sudo resize2fs on the underlying device.

nginx serves the admin panel and API over plain HTTP on port 80. For production use, place them behind TLS.

Obtain a certificate for your domain, for example a managed certificate on an Application Load Balancer in front of the instance, or Certbot installed on the instance. Then configure nginx to listen on 443 with your certificate and proxy to 127.0.0.1:3000, exactly as the bundled site does for port 80.

Restrict the security group so that ports 80 and 443 are reachable only from the networks that need the admin panel and the API. When you serve Payload over a public domain, set the serverURL in your Payload config to the HTTPS URL and rebuild.

Back up the content store by snapshotting the /var/lib/payload EBS volume. The snapshot captures the SQLite database and all uploaded media. For an application-level backup, you can also copy the database file off the instance, for example sudo cp /var/lib/payload/payload.db /path/to/backup/payload.db.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. Payload and nginx start automatically on boot.