PdfDing 1.15.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick PdfDing 1.15.0 on Ubuntu 24.04 as the software version, choose your Region, and select Launch through EC2.

Choose m5.large (or larger for many users), your key pair and a security group as described above. Give the root volume enough space for the PDFs that you plan to store.

To launch with the AWS CLI instead, run this command and replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=pdfding}]'

First boot takes under a minute. It generates the secret key, the certificate and the administrator password, creates the database, and checks the sign-in before nginx opens port 443.

Connect as the ubuntu user, the SSH user for PdfDing 1.15.0 on Ubuntu 24.04:

ssh -i <your-key.pem> ubuntu@<public-ip>

The message of the day shows where your login details are and lists the recovery commands.

Three systemd units run PdfDing: the network egress backstop, the PdfDing application server and nginx. Confirm that all three are active and check the listening sockets:

systemctl is-active pdfding-egress pdfding nginx
sudo ss -Htln | awk '{print $4}' | sort -u

active active active 0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:8000 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

PdfDing itself listens only on 127.0.0.1:8000, and nginx is the only service on ports 80 and 443.

First boot writes your login details to a file that only root can read. This command shows the file without the password line:

sudo grep -v '^ADMIN_PASSWORD=' /var/lib/sac/data/pdfding-credentials.txt

# PdfDing 1.15.0 - generated on this instance's first boot by pdfding-firstboot.service. # The administrator below is the only account and is unique to this instance; no default account exists. # PdfDing stores only a PBKDF2 hash of the password. Keep this file secret. PDFDING_URL=https://ec2-203-0-113-25.compute-1.amazonaws.com/ ADMIN_EMAIL=admin@pdfding.local # # Open PDFDING_URL in a browser (self-signed certificate minted on this first boot; port 80 redirects to https) and sign # in with the e-mail address and password above. Change both under Settings > Account once you are in. # Sign-up is closed: add users under Admin > Users. Lost access? sudo pdfding-reset-password # Change the name it is served as:
sudo pdfding-set-hostname <your-dns-name>
# User guide: https://secureanycloud.com/stacks/pdfding-1-15-0/

To read the password itself, run this command on the instance:

sudo grep '^ADMIN_PASSWORD=' /var/lib/sac/data/pdfding-credentials.txt

Open the PDFDING_URL address in your browser. The instance generates the certificate, so the browser shows a warning until you install a certificate that it trusts (Step 8).

Sign in with admin@pdfding.local and the password from Step 4. The page still shows the upstream "sign up" link, but sign-up is closed on this image. The sign-up page offers no form, so you cannot create an account from it.

After you sign in, open Settings > Account (the round avatar at the top right) and change the e-mail address and the password to your own.

Choose + at the top right to add a PDF. Give it a name and pick the file, or use bulk add for several files. The PDFs page lists your PDFs, newest first. Use the workspace and collection selectors on the left to organise them, and use tags, stars and the archive to find them again.

Open a PDF to read it in the pdf.js viewer. PdfDing remembers the page that you were on. The toolbar on the right has the editing tools: highlight, add text, draw and add images. Choose the save icon to write your annotations back into the stored PDF. The sidebar also lists highlights and comments under Annotations.

From a PDF's menu, choose Share. Give the share a name and, optionally, a password, a maximum number of views and a time after which PdfDing deletes it.

PdfDing creates a link and a QR code under Shared. Anyone with the link can open the PDF in the same patched viewer without an account, after entering the password if you set one.

Share links point at the name that the instance is served as, so set your own DNS name (Step 8) before you hand out links.

PdfDing accepts requests only for the one name that it is served as, which is the instance's public DNS name at first boot. Point a DNS record at the instance, then run:

sudo pdfding-set-hostname pdf.your-domain.example

The command pins the new name in the PdfDing allowed hosts and CSRF origins, writes a new self-signed certificate for it, and restarts the services.

To use a certificate that your browsers trust, replace /etc/ssl/pdfding/pdfding.crt and /etc/ssl/pdfding/pdfding.key with your own certificate and key, or with ones from your certificate authority. Then run sudo systemctl reload nginx.

These read-only checks show HTTPS, the redirect, the dropped unknown host names, the refused encoded paths, the pdf.js version that the instance serves, the metadata block and the application's network deny list:

H=$(sudo head -n1 /etc/pdfding/served-host); echo "served as: $H" curl -sk -o /dev/null -w 'https %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/accountlogin/" curl -s -o /dev/null -w 'http %{http_code}\n' --resolve "$H:80:127.0.0.1" "http://$H/" curl -sk -o /dev/null -w 'unknown host %{http_code}\n' --resolve "other.example:443:127.0.0.1" https://other.example/ || true curl -sk -o /dev/null -w 'encoded path %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/static/%2e%2e/x" || true curl -sk --resolve "$H:443:127.0.0.1" "https://$H/static/pdfjs/build/pdf.mjs" | grep -m1 -o 'pdfjsVersion = [0-9.]*' curl -s -o /dev/null -w 'IMDSv1 %{http_code}\n' http://169.254.169.254/latest/meta-data/ || true systemctl show -p IPAddressDeny pdfding | cut -c1-120

served as: ec2-203-0-113-25.compute-1.amazonaws.com https 200 http 301 unknown host 000 encoded path 400 pdfjsVersion = 6.2.108 IMDSv1 401 IPAddressDeny=240.0.0.0/4 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 ::/0 172.16.0.0/12 168.63.129.16/32 224.0.0.0/4 169.254.0.0

The status 000 means that nginx closed the connection without answering a request for a name that the instance does not serve. The status 401 means that the instance metadata service requires IMDSv2 tokens. The deny list is the static part of the egress backstop, and the instance adds your VPC's own address ranges at every boot.

The built-in self-test signs in over HTTPS with the administrator account and checks the version and the viewer:

sudo pdfding-selftest 2>&1 | tail -1

round-trip OK: admin@pdfding.local signed in over https://ec2-203-0-113-25.compute-1.amazonaws.com/ (wrong password refused), the app reports v1.15.0 and serves pdf.js 6.2.108, anonymous sent to /accountlogin/, sign-out ended the session

Add users under Admin > Users in the administrator's avatar menu. If you lose the administrator password, or lock the account out with failed sign-ins or a lost second factor, reset it from SSH:

sudo pdfding-reset-password
# new random password for admin@pdfding.local
sudo pdfding-reset-password someone@example.com
# or for another account (re-created if it was deleted)

The command writes the new password to /var/lib/sac/data/pdfding-credentials.txt and never prints it.

You set optional features in /etc/pdfding/pdfding.env: an SMTP relay for password-reset e-mails, OpenID Connect sign-in and the default theme. Without an SMTP relay, those e-mails go to the service journal (sudo journalctl -u pdfding). The image pins the security settings, and PdfDing does not read them from this file:

sudo sed -n '1,6p' /etc/pdfding/pdfding.env

# PdfDing optional settings (sac). Read by pdfding.service at start:
sudo systemctl restart pdfding
# Security settings (SECRET_KEY, DEBUG, ALLOWED_HOSTS/CSRF, cookies, the database) are pinned by
# /opt/pdfding/app/core/settings/sac.py and are NOT read from here.
# Sign-up stays closed unless you set this to FALSE (the administrator creates accounts under Admin > Users). DISABLE_USER_SIGNUP=TRUE
# DEFAULT_THEME=system (light | dark | system)

Edit the file with sudo nano /etc/pdfding/pdfding.env, then run sudo systemctl restart pdfding.

The database, the uploaded PDFs and the per-instance secret key live under /var/lib/pdfding. List the directory:

sudo ls -la /var/lib/pdfding ls /usr/share/doc/pdfding

total 8 drwxr-x--- 5 root pdfding 120 Nov 9 22:43 . drwxr-xr-x 49 root root 4096 Nov 9 22:41 .. drwx------ 2 pdfding pdfding 40 Nov 9 22:43 consume drwx------ 2 pdfding pdfding 80 Nov 9 22:59 db drwx------ 3 pdfding pdfding 60 Nov 9 22:50 media -rw-r----- 1 root pdfding 81 Nov 9 22:43 secret_key CHANGELOG.md LICENSE LICENSE.pdfjs README.md SECURITY-NOTES.txt SECURITY.md SHA256SUMS SOURCE-OFFER.txt THIRD-PARTY-NOTICES.txt package-lock.json pdfjs-licenses poetry.lock

To back up everything, snapshot the instance's EBS volume. Alternatively, copy /var/lib/pdfding to other storage on a schedule. For a consistent copy, stop PdfDing first with sudo systemctl stop pdfding, copy the directory, and start PdfDing again with sudo systemctl start pdfding.

Keep backups private. They hold every stored PDF and the secret key that signs sessions and share links.

• Allow port 22 in the security group from your own networks only, and allow ports 443 and 80 only to the people who use PdfDing.
• Set your DNS name and a trusted certificate before you share links (Step 8).
• Change the administrator's e-mail address and password after the first sign-in, and turn on a second factor under Settings > Account.
• Use share passwords, view limits and expiry times for anything sensitive, and delete shares that you no longer need under Shared.
• Keep the operating system patched. Unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else.