Pulse 6.5.0

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened Uptime Kuma, Gatus & Uptime and Status Pages AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for the full launch wizard. In Version, choose Pulse 6.5.0 on Ubuntu 24.04, then choose your Region.
• Pick an instance type and your key pair. m5.large is recommended, and the software charge is $0.04 per vCPU per hour.
• Set the security group. The listing's default group allows SSH (22), HTTP (80) and HTTPS (443). Restrict SSH to your own IP address, and restrict 80 and 443 to the people who need the dashboard.
• Choose your VPC and a subnet that gives the instance a public IP. Leave the metadata defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run these commands on your own workstation. They create a security group that allows SSH and the dashboard from your management address only, then launch the instance. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the VPC, subnet, key pair and CIDR with your own.

SG=$(aws ec2 create-security-group --group-name pulse \
  --description "Pulse" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 443 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 80 --cidr <your-mgmt-cidr>
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=pulse}]'

You do not need --metadata-options, because the AMI already requires IMDSv2.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot finishes within a minute of launch. It creates the HTTPS certificate and the admin password, then starts Pulse and nginx. Your login is in a file that only root can read:

sudo cat /root/pulse-credentials.txt

# Pulse - generated on first boot by pulse-firstboot.service
# These credentials are unique to this instance. Store them somewhere safe. PULSE_URL=https://ec2-18-212-195-121.compute-1.amazonaws.com/ PULSE_USERNAME=admin PULSE_PASSWORD=<PULSE_PASSWORD>
#
# Open PULSE_URL in a browser (self-signed certificate minted on this instance's first boot; port 80 redirects to # https) and sign in with the username and password above. Then add your Proxmox VE / Backup Server nodes (API # token), or install the Pulse agent on your Docker, Kubernetes or Linux hosts, from Settings. # Change the name it is served as:
sudo pulse-set-hostname <your-dns-name>
# Restrict 80/443 in the security group to the people who need the dashboard.
# Full deployment guide: https://secureanycloud.com/stacks/pulse-6-5-0/

PULSE_PASSWORD holds your instance's own password.

Check that the first boot service, Pulse and nginx are active, that Pulse runs as the unprivileged pulse user, and that its health endpoint reports healthy:

systemctl is-active pulse-firstboot.service pulse.service nginx.service ps -o user= -C pulse curl -sk https://localhost/api/health | jq -e '.status == "healthy"'

active active active pulse true

/api/health needs no login, so you can use it for a load balancer health check over HTTPS. Everything else needs a signed-in session.

List the ports that the instance listens on. These are the only ones.

sudo ss -Hltnu | awk '{print $1, $5}' | sort -u

tcp 0.0.0.0:22 tcp 0.0.0.0:443 tcp 0.0.0.0:80 tcp 127.0.0.1:7655 tcp 127.0.0.1:9091 tcp 127.0.0.53%lo:53 tcp 127.0.0.54:53 tcp [::]:22 tcp [::]:443 tcp [::]:80 udp 127.0.0.1:323 udp 127.0.0.53%lo:53 udp 127.0.0.54:53 udp 172.31.83.107%ens5:68 udp [::1]:323

Pulse (7655) and its Prometheus metrics endpoint (9091) listen on loopback only, and nginx publishes Pulse on 443. The loopback port 53 entries are Ubuntu's local stub resolver (systemd-resolved). Port 323 is chrony's local control socket, and port 68 is the DHCP client.

The binary is the reproducible SecureAnyCloud build of the 6.5.0 source. It is the only program in /opt/pulse/bin, and no agent binaries ship. Its record ships with the image:

sha256sum /opt/pulse/bin/pulse grep -E '^(source|binary|govulncheck) ' /usr/share/doc/pulse/BUILD-INFO.txt ls /opt/pulse/bin

c8255cc44aa5f26536fd9e829cd724678055dee0675bb253701d9f1e6ac2bbfb /opt/pulse/bin/pulse source https://github.com/rcourtman/Pulse/archive/refs/tags/v6.5.0.tar.gz source sha256 e5473d7d447825946154101220ad6e74f55eec0abb52dfe52cacfbe6fd500c58 (tag commit 38c981a397c7a37f469b619200b5035bfc60b328) binary sha256 c8255cc44aa5f26536fd9e829cd724678055dee0675bb253701d9f1e6ac2bbfb (reproducible) govulncheck v1.9.0 -mode=binary and source mode: 0 reachable vulnerabilities (DB updated: 2026-10-21 00:27:29 +0000 UTC) pulse

Browse to the PULSE_URL from Step 2, for example https://ec2-18-212-195-121.compute-1.amazonaws.com/. The certificate is self-signed, so your browser warns once. Accept it, or install your own certificate (Step 7). Pulse shows its sign-in page.

Sign in as admin with the password from Step 2. On a new instance, Pulse opens Settings > Infrastructure, where you add the systems to monitor (Step 5).

Port 80 only redirects to the HTTPS address:

curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' http://localhost/

301 https://ec2-18-212-195-121.compute-1.amazonaws.com/

You can also check the login from the command line. These requests go to nginx on the instance itself. The monitoring state needs a session, a wrong password is refused, and the instance's own password signs in and reads the state. The password is read from the credentials file and passed to curl on standard input, never on the command line. The block stops with an error if any answer is not the expected one.

H=$(sudo sed -n 's/^set $pulse_host "\(.*\)";$/\1/p' /etc/nginx/pulse-host.conf) PW() {
sudo sed -n 's/^PULSE_PASSWORD=//p' /root/pulse-credentials.txt; }
J=$(mktemp); trap 'rm -f "$J"' EXIT
U=$(curl -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w '%{http_code}' "https://$H/api/state")
W=$(printf '{"username":"admin","password":"not-the-password"}' | curl -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w '%{http_code}' \
  -H 'Content-Type: application/json' -H "Origin: https://$H" --data-binary @- "https://$H/api/login")
A=$(printf '{"username":"admin","password":"%s"}' "$(PW)" | curl -sk --resolve "$H:443:127.0.0.1" -c "$J" -o /dev/null -w '%{http_code}' \
  -H 'Content-Type: application/json' -H "Origin: https://$H" --data-binary @- "https://$H/api/login")
S=$(curl -sk --resolve "$H:443:127.0.0.1" -b "$J" -o /dev/null -w '%{http_code}' "https://$H/api/state")
echo "no session : $U";
echo "wrong password : $W";
echo "admin login : $A";
echo "with session : $S" [ "$U" = 401 ] && [ "$W" = 401 ] && [ "$A" = 200 ] && [ "$S" = 200 ]

no session : 401 wrong password : 401 admin login : 200 with session : 200

Pulse locks an account, and the address it is used from, for 15 minutes after 5 failed sign-ins. Avoid mistyping the password repeatedly.

The first-run setup is closed. An anonymous request to set up an account is refused, no setup token exists, and the account-recovery endpoint is refused through nginx. Pulse itself reports that authentication is required:

H=$(sudo sed -n 's/^set $pulse_host "\(.*\)";$/\1/p' /etc/nginx/pulse-host.conf)
QS=$(curl -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -H "Origin: https://$H" \
  --data '{"username":"someone","password":"Someone-Else-123"}' "https://$H/api/security/quick-setup")
BT=$(curl -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w '%{http_code}' -X POST -H "Origin: https://$H" "https://$H/api/security/validate-bootstrap-token")
RC=$(curl -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w '%{http_code}' -X POST -H "Origin: https://$H" --data '{"action":"disable_auth"}' "https://$H/api/security/recovery")
curl -sk --resolve "$H:443:127.0.0.1" "https://$H/api/security/status" | jq -c '{hasAuthentication, requiresAuth}' echo "anonymous setup : $QS"; echo "bootstrap token : $BT"; echo "remote recovery : $RC" [ "$QS" = 401 ] && [ "$BT" = 409 ] && [ "$RC" = 403 ]

{"hasAuthentication":true,"requiresAuth":true} anonymous setup : 401 bootstrap token : 409 remote recovery : 403

In Settings > Infrastructure, choose Add infrastructure. You can paste a hostname or URL and let Pulse detect the platform, install the Pulse agent on a host, or pick a source type. The source types are Proxmox VE, TrueNAS SCALE and Unraid. Under Show 5 more sources, you will find further types such as Proxmox Backup Server, Proxmox Mail Gateway and VMware vCenter (preview).

Pulse connects out from this instance, so it needs a network path to each system. Use a VPN, AWS Direct Connect, or systems that run in AWS.

Proxmox VE, Backup Server and Mail Gateway are monitored through their API. In the Proxmox VE form, enter a node name and the endpoint URL (for example https://<your-proxmox-host>:8006) and keep API Token (Recommended).

• Connect via API shows one command to run on the Proxmox VE server. The command creates the monitoring user pulse-monitor@pve with an API token and read-only permissions (PVEAuditor, guest agent access and backup visibility), and registers the node with Pulse. The Proxmox server must be able to reach this instance on port 443 for this to work.
• Manual Token Setup is the alternative when it cannot. Create the user and token yourself on the Proxmox node, then paste the token ID and secret into the form:

pveum user add pulse-monitor@pve pveum aclmod / -user pulse-monitor@pve -role PVEAuditor pveum user token add pulse-monitor@pve pulse --privsep 0

If your Proxmox node uses its default self-signed certificate, go to SSL settings and either turn off Verify SSL certificate or enter the node's certificate fingerprint. Pulse stores the token secret encrypted with your instance's own key.

Docker, Podman, Kubernetes and Linux, macOS, Windows or Unraid hosts are monitored by the Pulse agent. Choose Install Pulse Agent and run the installer command that Pulse shows on that host. The installer comes from this instance, with its upstream OpenSSH signature (/opt/pulse/scripts/install.sh.sshsig). The agent binary is the official signed 6.5.0 release, which Pulse fetches from GitHub for you.

Agents connect to Pulse on port 443 at the PULSE_PUBLIC_URL (Step 7), so allow 443 from those hosts in the security group. Install your own certificate (Step 7) before you install agents, so that they can trust it.

You can check this chain from the instance itself. The installer that Pulse serves carries upstream's OpenSSH signature in an X-Signature-SSHSIG header. The installer and the agent verify it against the signing key pinned in the script, using the same ssh-keygen -Y verify check that they run. The agent binary that Pulse fetches for a host arrives with a matching checksum and both of upstream's signatures:

H=$(sudo sed -n 's/^set $pulse_host "\(.*\)";$/\1/p' /etc/nginx/pulse-host.conf)
T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
KEY=$(sed -n 's/^PINNED_INSTALLER_SSH_PUBLIC_KEY="\(ssh-ed25519 [A-Za-z0-9+/=]*\)[ "].*/\1/p' /opt/pulse/scripts/install.sh) printf 'pulse-installer %s\n' "$KEY" > "$T/allowed_signers" curl -sk --resolve "$H:443:127.0.0.1" -D "$T/h" -o "$T/install.sh" "https://$H/install.sh" tr -d '\r' < "$T/h" | sed -n 's/^[Xx]-[Ss]ignature-[Ss][Ss][Hh][Ss][Ii][Gg]: //p' | base64 -d > "$T/install.sh.sshsig" ssh-keygen -Y verify -f "$T/allowed_signers" -I pulse-installer -n pulse-install -s "$T/install.sh.sshsig" < "$T/install.sh" && V=ok curl -sk --resolve "$H:443:127.0.0.1" -D "$T/a" -o "$T/agent" "https://$H/download/pulse-agent?arch=linux-amd64"
CS=$(tr -d '\r' < "$T/a" | sed -n 's/^[Xx]-[Cc]hecksum-[Ss]ha256: //p') [ "$CS" = "$(sha256sum "$T/agent" | cut -d' ' -f1)" ] && echo "agent download: checksum matches"
SIGS=$(tr -d '\r' < "$T/a" | grep -ioE '^x-signature-(ed25519|sshsig)' | tr 'A-Z' 'a-z' | sort)
echo "$SIGS" [ "${V:-}" = ok ] && [ "$CS" = "$(sha256sum "$T/agent" | cut -d' ' -f1)" ] && [ "$(echo "$SIGS" | wc -l)" = 2 ]

Good "pulse-install" signature for pulse-installer with ED25519 key SHA256:WjzDnbyb4fF3hPGRE1ZLtYcXzLimGpJq6Ou4opquTV0 agent download: checksum matches x-signature-ed25519 x-signature-sshsig

Alerts and notifications: set alert thresholds under Alerts. Email, webhook and Apprise destinations are in the alert settings. Webhooks to private addresses are blocked unless you allow them.

Everything in the dashboard comes from Pulse's REST API. With a session, or an API token from Settings > API Access, you can read it from scripts. On a new instance no systems are configured, so the node list is empty and there are no alerts:

H=$(sudo sed -n 's/^set $pulse_host "\(.*\)";$/\1/p' /etc/nginx/pulse-host.conf) PW() {
sudo sed -n 's/^PULSE_PASSWORD=//p' /root/pulse-credentials.txt; }
J=$(mktemp); trap 'rm -f "$J"' EXIT printf '{"username":"admin","password":"%s"}' "$(PW)" | curl -sk --resolve "$H:443:127.0.0.1" -c "$J" -o /dev/null \
  -H 'Content-Type: application/json' -H "Origin: https://$H" --data-binary @- "https://$H/api/login" curl -sk --resolve "$H:443:127.0.0.1" -b "$J" "https://$H/api/config/nodes" | jq -c '{configured_nodes: length}' curl -sk --resolve "$H:443:127.0.0.1" -b "$J" "https://$H/api/state" | jq -e -c '{active_alerts: (.activeAlerts | length)}' curl -sk --resolve "$H:443:127.0.0.1" -b "$J" "https://$H/api/version" | jq -e -c '{version}'

{"configured_nodes":0} {"active_alerts":0} {"version":"6.5.0"}

The certificate was created on your instance's first boot for the instance's public DNS name, public IP, private IP and localhost. The key, Pulse's configuration and encryption key, and the credentials file are readable only by their owners. The configuration holds the password only as a bcrypt hash.

sudo openssl x509 -in /etc/ssl/pulse/pulse.crt -noout -subject -dates -ext subjectAltName
sudo stat -c '%a %U:%G %n' /etc/ssl/pulse/pulse.key /etc/ssl/pulse/pulse.crt /etc/pulse/.env /etc/pulse/.encryption.key /root/pulse-credentials.txt
sudo sed -E -n "s/^(PULSE_AUTH_USER=.*)/\1/p; s/^(PULSE_AUTH_PASS=')(.{7}).*/\1\2.../p" /etc/pulse/.env cat /etc/sac/pulse-host.env

subject=CN = ec2-18-212-195-121.compute-1.amazonaws.com, O = sac notBefore=Oct 21 17:40:29 2026 GMT notAfter=Jan 23 17:40:29 2029 GMT X509v3 Subject Alternative Name: DNS:ec2-18-212-195-121.compute-1.amazonaws.com, IP Address:18.212.195.121, IP Address:172.31.83.107, IP Address:127.0.0.1, DNS:localhost 600 root:root /etc/ssl/pulse/pulse.key 644 root:root /etc/ssl/pulse/pulse.crt 600 pulse:pulse /etc/pulse/.env 600 pulse:pulse /etc/pulse/.encryption.key 600 root:root /root/pulse-credentials.txt PULSE_AUTH_USER='admin' PULSE_AUTH_PASS='$2y$12$... PULSE_PUBLIC_URL=https://ec2-18-212-195-121.compute-1.amazonaws.com/ ALLOWED_ORIGINS=https://ec2-18-212-195-121.compute-1.amazonaws.com,https://18.212.195.121,https://172.31.83.107,https://127.0.0.1,https://localhost

PULSE_PUBLIC_URL is the address that Pulse puts in agent install commands and notification links. To serve Pulse under your own DNS name, for example pulse.example.com pointed at this instance, run the helper. The helper records the name and creates a new self-signed certificate for it. It also updates nginx and Pulse's public URL, restarts Pulse and rewrites the URL in the credentials file.

sudo pulse-set-hostname pulse.example.com

If the instance's public address changes after a stop and start, run the helper again so that the certificate names the new address too. To use a certificate from your own certificate authority, replace /etc/ssl/pulse/pulse.key (keep it 0600 root) and /etc/ssl/pulse/pulse.crt, then run sudo systemctl reload nginx.

Pulse's environment turns off outbound telemetry and network discovery, binds Pulse to loopback, and trusts forwarded headers from the local nginx only. A marker file turns off the update check. Pulse's log confirms this, including that no paid-plan licence can be activated on this build:

systemctl show -p Environment pulse.service | tr ' ' '\n' | grep -E '^(BIND_ADDRESS|PULSE_TELEMETRY|PULSE_TRUSTED_PROXY_CIDRS|DISCOVERY_ENABLED)='
sudo journalctl -u pulse.service -o cat --no-pager | grep -oE '"message":"(Outbound usage telemetry is disabled|discovery service disabled by configuration|no license public key configured)' | sort -u head -1 /opt/pulse/BUILD_FROM_SOURCE

BIND_ADDRESS=127.0.0.1 PULSE_TRUSTED_PROXY_CIDRS=127.0.0.1/32 PULSE_TELEMETRY=false DISCOVERY_ENABLED=false "message":"Outbound usage telemetry is disabled "message":"discovery service disabled by configuration "message":"no license public key configured sac source build of Pulse v6.5.0 (see /usr/share/doc/pulse/BUILD-INFO.txt).

pulse.service and nginx.service carry a systemd IPAddressDeny rule for the instance metadata addresses, so no Proxmox address, webhook or AI provider URL entered in Pulse can reach the metadata service. Each entry is a single address, so the Amazon Time Sync Service at 169.254.169.123 keeps working, as chrony shows. Pulse also runs with no capabilities.

systemctl show -p IPAddressDeny pulse.service nginx.service chronyc -n sources | grep 169.254 grep CapEff /proc/$(systemctl show -p MainPID --value pulse.service)/status

IPAddressDeny=168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128 IPAddressDeny=168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128 ^* 169.254.169.123 3 4 377 16 +17us[ +19us] +/- 614us CapEff: 0000000000000000