Amazon Web Services

Create one EC2 instance with persistent EBS storage and a stable public address, then install the recommended Caddy stack.

For AWS concepts and the current console flow, use the EC2 getting started guide.

Create the instance

1. Open the EC2 console and choose Launch instance.
2. Select a current Ubuntu LTS or Debian image.
3. Choose an instance meeting the Bearicorn starting requirements.
4. Use at least 30 GB of EBS-backed root storage.
5. Create or select an SSH key pair, or configure EC2 Instance Connect.

Exact image names, instance availability, and prices vary by region. Review the estimate in AWS before launching.

Configure the security group

Allow only the required inbound traffic:

Protocol	Port	Source
SSH	22	Your trusted public IP or network
HTTP	80	0.0.0.0/0 and ::/0 when using IPv6
HTTPS	443	0.0.0.0/0 and ::/0 when using IPv6

AWS recommends restricting SSH to the addresses that need access. Its security-group examples document the public HTTP/HTTPS rules.

Do not add inbound rules for PostgreSQL 5432 or the internal application port 8080.

Keep the public address stable

Associate an Elastic IP with the instance before creating DNS records. An auto-assigned public IPv4 address is released when an instance is stopped and started; an Elastic IP remains associated. AWS documents this behavior and current charges in EC2 IP addressing.

WARNING

AWS charges for public IPv4 addresses, including Elastic IPs. Release addresses you no longer use.

Configure DNS and connect

Create an A record at Route 53 or your DNS provider that points the hub hostname to the Elastic IP.

Connect using the method shown for the selected AMI on the EC2 Connect page. Default usernames differ by image, so use the value AWS displays rather than guessing.

Install Bearicorn

1. Install Docker on Debian or Ubuntu.
2. Follow the quick start.
3. Set CADDY_SITE_ADDRESS to the DNS hostname, not the EC2 public hostname or raw IP.

Before inviting users, create a logical PostgreSQL backup. EBS snapshots are useful as an additional recovery layer but do not replace a tested database backup.