PlantUML Server

• Open the listing in the AWS Marketplace and choose Continue to Subscribe, then Continue to Configuration and Continue to Launch.
• Select your instance type, VPC, subnet, key pair and a Security Group that allows inbound ports 22, 80 and 443.
• Launch the instance, then wait a minute or two for the first boot to generate the per-instance credential and certificate.

aws ec2 run-instances \
  --image-id <ami-id-from-listing> \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=plantuml-server}]'

PlantUML Server runs from a pinned container supervised by systemd, behind nginx. All three services should report active:

systemctl is-active docker plantuml nginx

active active active

The PlantUML container publishes only to the loopback interface on port 8080. Only nginx (ports 80 and 443) is exposed to the network:

sudo docker ps --format '{{.Image}} {{.Status}} {{.Ports}}'
sudo ss -Htlnp | awk '{print $4}' | sort -u

5b9968b8723e Up 8 minutes 127.0.0.1:8080->8080/tcp 0.0.0.0:443 0.0.0.0:80 127.0.0.1:8080

The renderer also runs with the INTERNET security profile, which hardens it against SSRF and local includes:

sudo docker inspect plantuml --format '{{range .Config.Env}}{{println .}}{{end}}' | grep SECURITY

PLANTUML_SECURITY_PROFILE=INTERNET

The appliance's container store and logs live on a dedicated EBS volume mounted at /var/lib/plantuml:

mountpoint /var/lib/plantuml && df -h /var/lib/plantuml | tail -1

At first boot, the image generates a unique HTTP Basic Auth password and writes it to /root/plantuml-server-credentials.txt, readable by root only:

sudo cat /root/plantuml-server-credentials.txt

PLANTUML_HTTP_USER=admin PLANTUML_BASIC_AUTH_PASSWORD=<PLANTUML_BASIC_AUTH_PASSWORD> PLANTUML_URL=https://<instance-public-ip>/ PLANTUML_HEALTHZ=https://<instance-public-ip>/healthz

The user name is admin. Keep this password safe, because it is unique to this instance.

An unauthenticated request is rejected, while the unauthenticated health endpoint stays available for load balancer probes:

curl -sk -o /dev/null -w 'unauthenticated: HTTP %{http_code}\n' https://localhost/
curl -sk -o /dev/null -w 'healthz: HTTP %{http_code}\n' https://localhost/healthz

unauthenticated: HTTP 401 healthz: HTTP 200

The stateless rendering API takes an encoded diagram in the URL and returns the image. The image includes a small helper, plantuml-encode, that produces the encoded form:

PW=$(sudo grep '^PLANTUML_BASIC_AUTH_PASSWORD=' /root/plantuml-server-credentials.txt | cut -d= -f2-)
ENC=$(printf '@startuml\nAlice -> Bob: Hello\nBob --> Alice: Hi\n@enduml' | /usr/local/bin/plantuml-encode)
curl -sk -o /dev/null -w 'SVG render: HTTP %{http_code}\n' -u "admin:$PW" "https://localhost/svg/$ENC"

SVG render: HTTP 200

Open https://<instance-public-ip>/ in your browser and accept the per-instance self-signed certificate. Sign in with the user name admin and the password from Step 6. Type PlantUML source on the left and the diagram renders live, with one-click export to PNG, SVG, ASCII or PDF.

PlantUML supports many diagram types. The bundled Graphviz engine lays out a class diagram:

Rendering is a stateless URL, so you can embed always-current diagrams anywhere by pointing at https://<instance>/svg/<encoded> or /png/<encoded>. The editor's address bar shows the encoded URL for the current diagram. Copy it into a wiki, README or documentation pipeline:

# Status and logs systemctl status plantuml nginx
sudo docker logs plantuml
# Restart the renderer or the proxy
sudo systemctl restart plantuml
sudo systemctl restart nginx

To rotate the web password, update /etc/nginx/.plantuml_htpasswd with sudo htpasswd -B /etc/nginx/.plantuml_htpasswd admin, then run sudo systemctl reload nginx.

• Restrict the Security Group to the addresses that need the editor and API, and keep SSH (22) limited to your admin network.
• Use your own domain and certificate. The per-instance certificate is self-signed. Terminate TLS at nginx with a certificate from your CA, or use AWS Certificate Manager through a load balancer.
• Keep the INTERNET (or stricter) security profile. It blocks local-file includes and internal-address fetches. Do not lower it below INTERNET.
• Do not expose the loopback port. The renderer must stay bound to 127.0.0.1:8080, and only nginx should face the network.
• Snapshot the data volume at /var/lib/plantuml with AWS Backup as part of your routine.
• Patch regularly with sudo apt update && sudo apt upgrade, and pull a newer pinned server image when you update.

PlantUML Server is licensed under the GPL-3.0 licence. This SecureAnyCloud image packages the upstream software with security hardening and a per-instance credential. The software charge on this listing is for SecureAnyCloud support services, in addition to standard AWS infrastructure costs.

Need Help?

SecureAnyCloud provides 24/7 technical support by email and live chat at sales@secureanycloud.com. Support covers deployment, reverse proxy and certificate setup, connecting the rendering API to your tools, renderer tuning, instance sizing, patching guidance and EBS volume management.

Deploy on AWS

Launch PlantUML Server - Secure Diagram-as-Code Rendering AMI by SecureAnyCloud with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com