Software Sushi documentation

Ready-to-run software on AWS

Guides for every Software Sushi product on AWS Marketplace. Each one is a hardened Amazon Machine Image that you launch in your own AWS account: your instance, your data, your keys.

How every product works

1. Subscribe to the product on AWS Marketplace. Most products include a free trial.
2. Launch an EC2 instance from the listing, with your own key pair, VPC and security group.
3. Follow the product's getting-started guide below to connect, finish setup and start using it.

Billing runs through your AWS account. You pay the product's hourly fee plus the usual EC2, EBS and data-transfer charges, and you can stop at any time by terminating the instance.

AI Agents

Self-hosted AI agents and agent runtimes on hardened Ubuntu.

• OpenClaw AI Agent

  Self-hosted OpenClaw AI agent on hardened Ubuntu. Connect Telegram, Slack or Discord with your own keys.

• Hermes AI Agent

  Nous Research's Hermes AI agent on hardened Ubuntu, chatting on Telegram with your own model key.

• Sushi OpenShell

  NVIDIA OpenShell on Graviton: policy-controlled Docker sandboxes behind a private mTLS gateway.

• OpenHands Core

  Self-hosted OpenHands Agent Canvas with Python, terminal and Git tools, plus optional private Telegram.

• Nanobot AI Agent

  Self-hosted nanobot agent with a password-protected web UI, workspace file tools and private Telegram.

• Agent Zero Core

  Focused Agent Zero workbench with file, Bash and Python tools, your own cloud model and private Telegram.

ML & Data

Machine learning and analytics that run in your own account.

• Sushi ML Studio

  No-code machine learning in your browser: upload a spreadsheet, train scikit-learn models, predict.

• DuckDB Analytics

  DuckDB CLI for fast local CSV and Parquet queries, with pinned extensions for reading your S3 data.

Networking & Security

Gateways, proxies, private access, DNS and secure file transfer.

• Caddy HTTPS Gateway

  Caddy reverse proxy, private by default, with a per-instance local CA and automatic HTTPS.

• HAProxy Community LTS

  HAProxy LTS HTTP load balancer with a password-protected stats page.

• WireGuard Private Access

  WireGuard endpoint with keys generated on first boot and UDP 51820 closed until you add peers.

• Unbound DNS Resolver

  Validating, caching DNS resolver that answers on loopback only until you open it up.

• OpenSSH SFTP Drop Box

  OpenSSH SFTP drop box: key-only users locked to their own folder, with no shell.

Observability

Monitoring, status pages, logs, telemetry and notifications.

• Uptime Kuma Monitoring

  Uptime monitoring with HTTP, TCP, DNS and ping checks behind a private HTTPS dashboard.

• Gatus Status Page

  Status page with HTTP, TCP and DNS checks, SQLite history and per-instance TLS.

• Fluent Bit Log Gateway

  Fluent Bit log gateway with HTTPS ingest, a bounded disk buffer and a local file output.

• Vector Log Pipeline

  Vector log pipeline with authenticated HTTPS and file ingest, VRL redaction and a disk buffer.

• OpenTelemetry Collector Gateway

  OpenTelemetry Collector OTLP gateway for traces, metrics and logs, with TLS and file export.

• Gotify Notification Server

  Private Gotify notification server with a REST API, web UI, live WebSocket stream and history.

Messaging & Data Services

Caches, brokers and connection poolers.

• Valkey Single-Node Cache

  Valkey single-node cache with loopback TLS, an ACL user, an LRU memory cap and no persistence.

• PgBouncer Connection Pooler

  PgBouncer PostgreSQL connection pooler with required client TLS and SCRAM authentication.

• NATS Core Broker

  NATS Core broker with loopback TLS, per-user subject permissions and the nats CLI.

• Mosquitto MQTT Broker

  Eclipse Mosquitto MQTT broker with loopback TLS, users, topic ACLs and persistence.

Automation & Backup

Infrastructure as code, configuration management, backup and transfer.

• OpenTofu Runner

  OpenTofu with a pinned offline AWS provider mirror for validate and plan. Nothing auto-applies.

• Ansible Core Runner

  ansible-core runner with pinned collections, a localhost inventory and a vault password.

• Restic Backup Worker

  restic backup worker: daily encrypted backups, a safe restore script and an optional S3 repository.

• Rclone Transfer Worker

  rclone transfer worker: a daily checksum copy that never deletes, with an optional S3 target.

Need help?

Write to info@softwaresushi.com with the product name, its version and your AWS Region. Every product page also lists where its upstream project keeps its own documentation.